From 86c9e5ccc87ca7ef477cee20b48049b9632078c9 Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Tue, 22 Aug 2023 14:39:53 +0200 Subject: [PATCH] net/wireguard - remove wg-quick dependency and drop go support (#3556) net/wireguard - removing wg-quick and go support. This commits adds the following: * Remove wireguard-go support and cleanup some go specific code as it's not being used anymore anyway * Service control handler similar to OpenVPN, which offers control per instance/interface and keeps track of changed interfaces (configure only restarts the changed ones). * Add some basic logging for the service handling and a view to inspect it. * Configuration logs are being flushed to the correct log automatically as mwexecf() sends errors to syslog (which in this scope sends to wireguard) * Reimplement https://github.com/WireGuard/wireguard-tools/tree/master/contrib/reresolve-dns using Python in reresolve-dns.py * Enforce wireguard-tools rc script to be disabled when still installed, this should prevent bootup issues * Move 'interface' calculated field to model for easy reusability * Change plugin maintainer --------- Co-authored-by: Franco Fichtner --- net/wireguard/Makefile | 7 +- net/wireguard/pkg-descr | 11 ++ .../src/etc/inc/plugins.inc.d/wireguard.inc | 46 ++--- .../src/etc/rc.syshook.d/start/50-wireguard | 4 +- .../Wireguard/Api/ClientController.php | 7 +- .../Wireguard/Api/ServerController.php | 11 +- .../Wireguard/Api/ServiceController.php | 24 ++- .../Wireguard/FieldTypes/ServerField.php | 58 ++++++ .../models/OPNsense/Wireguard/Menu/Menu.xml | 5 +- .../app/models/OPNsense/Wireguard/Server.xml | 2 +- .../app/views/OPNsense/Wireguard/general.volt | 173 ++++++++--------- .../scripts/OPNsense/Wireguard/post.sh | 11 -- .../OPNsense/Wireguard/resolve-dns.bash | 45 ----- .../scripts/OPNsense/Wireguard/setup.sh | 4 - .../{OPNsense => }/Wireguard/genkey.sh | 0 .../scripts/Wireguard/reresolve-dns.py | 61 ++++++ .../scripts/Wireguard/wg-service-control.php | 180 ++++++++++++++++++ .../conf/actions.d/actions_wireguard.conf | 29 +-- .../OPNsense/Syslog/local/wireguard.conf | 6 + .../templates/OPNsense/Wireguard/wireguard | 15 +- .../OPNsense/Wireguard/wireguard-server.conf | 27 ++- 21 files changed, 484 insertions(+), 242 deletions(-) create mode 100644 net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/FieldTypes/ServerField.php delete mode 100755 net/wireguard/src/opnsense/scripts/OPNsense/Wireguard/post.sh delete mode 100755 net/wireguard/src/opnsense/scripts/OPNsense/Wireguard/resolve-dns.bash delete mode 100755 net/wireguard/src/opnsense/scripts/OPNsense/Wireguard/setup.sh rename net/wireguard/src/opnsense/scripts/{OPNsense => }/Wireguard/genkey.sh (100%) create mode 100755 net/wireguard/src/opnsense/scripts/Wireguard/reresolve-dns.py create mode 100755 net/wireguard/src/opnsense/scripts/Wireguard/wg-service-control.php create mode 100644 net/wireguard/src/opnsense/service/templates/OPNsense/Syslog/local/wireguard.conf diff --git a/net/wireguard/Makefile b/net/wireguard/Makefile index 9d7d9cf08..29b00aa7c 100644 --- a/net/wireguard/Makefile +++ b/net/wireguard/Makefile @@ -1,9 +1,8 @@ PLUGIN_NAME= wireguard -PLUGIN_VERSION= 1.13 -PLUGIN_REVISION= 7 +PLUGIN_VERSION= 2.0.d PLUGIN_COMMENT= WireGuard VPN service kernel implementation -PLUGIN_DEPENDS= wireguard-kmod wireguard-tools +PLUGIN_DEPENDS= wireguard-kmod PLUGIN_CONFLICTS= wireguard-go -PLUGIN_MAINTAINER= m.muenz@gmail.com +PLUGIN_MAINTAINER= ad@opnsense.org .include "../../Mk/plugins.mk" diff --git a/net/wireguard/pkg-descr b/net/wireguard/pkg-descr index 5d84964c9..8a590fa7e 100644 --- a/net/wireguard/pkg-descr +++ b/net/wireguard/pkg-descr @@ -16,6 +16,17 @@ WWW: https://www.wireguard.com/ Changelog --------- +2.0 + +* Remove wireguard-go support and cleanup some go specific code as it's not being used anymore anyway +* Service control handler similar to OpenVPN, which offers control per instance/interface and keeps track of changed interfaces (configure only restarts the changed ones). +* Add some basic logging for the service handling and a view to inspect it. +* Configuration logs are being flushed to the correct log automatically as mwexecf() sends errors to syslog (which in this scope sends to wireguard) +* Reimplement https://github.com/WireGuard/wireguard-tools/tree/master/contrib/reresolve-dns using Python in reresolve-dns.py +* Enforce wireguard-tools rc script to be disabled when still installed, this should prevent bootup issues +* Move 'interface' calculated field to model for easy reusability +* Change plugin maintainer + 1.13 * Reworked widget and assorted cleanups (contributed by Patrik Kernstock) diff --git a/net/wireguard/src/etc/inc/plugins.inc.d/wireguard.inc b/net/wireguard/src/etc/inc/plugins.inc.d/wireguard.inc index cc1e49ee8..aed267382 100644 --- a/net/wireguard/src/etc/inc/plugins.inc.d/wireguard.inc +++ b/net/wireguard/src/etc/inc/plugins.inc.d/wireguard.inc @@ -1,6 +1,7 @@ * All rights reserved. * @@ -28,8 +29,7 @@ function wireguard_enabled() { - $model = new \OPNsense\Wireguard\General(); - return (string)$model->enabled == '1'; + return (string)(new \OPNsense\Wireguard\General())->enabled == '1'; } function wireguard_services() @@ -40,26 +40,32 @@ function wireguard_services() return $services; } - $service = [ - 'description' => gettext('WireGuard VPN'), - 'configd' => [ - 'restart' => ['wireguard restart'], - 'start' => ['wireguard start'], - 'stop' => ['wireguard stop'], - ], - 'name' => 'wireguard-go', - ]; - - if (file_exists('/boot/modules/if_wg.ko') || file_exists('/boot/kernel/if_wg.ko')) { - $service['name'] = 'wireguard'; - $service['nocheck'] = true; + foreach ((new OPNsense\Wireguard\Server())->servers->server->iterateItems() as $key => $node) { + if (!empty((string)$node->enabled)) { + $services[] = [ + 'description' => "Wireguard " . htmlspecialchars($node->name), + 'configd' => [ + 'start' => ["wireguard start {$key}"], + 'restart' => ["wireguard restart {$key}"], + 'stop' => ["wireguard stop {$key}"], + ], + 'nocheck' => true, /* no daemon to check */ + 'id' => $key, + 'name' => "wireguard" + ]; + } } - $services[] = $service; - return $services; } +function wireguard_syslog() +{ + return [ + 'wireguard' => ['facility' => ['wireguard']] + ]; +} + function wireguard_interfaces() { $interfaces = []; @@ -87,11 +93,7 @@ function wireguard_xmlrpc_sync() $result['id'] = 'wireguard'; $result['section'] = 'OPNsense.wireguard'; $result['description'] = gettext('WireGuard'); - $result['services'] = ['wireguard-go']; - - if (file_exists('/boot/modules/if_wg.ko') || file_exists('/boot/kernel/if_wg.ko')) { - $result['services'] = ['wireguard']; - } + $result['services'] = ['wireguard']; return [$result]; } diff --git a/net/wireguard/src/etc/rc.syshook.d/start/50-wireguard b/net/wireguard/src/etc/rc.syshook.d/start/50-wireguard index 78ab22804..826ba71cd 100755 --- a/net/wireguard/src/etc/rc.syshook.d/start/50-wireguard +++ b/net/wireguard/src/etc/rc.syshook.d/start/50-wireguard @@ -1,4 +1,2 @@ #!/bin/sh - -# start again to fix problems with failed name resolution (no need to restart) -configctl -dq wireguard start +configctl -dq wireguard configure diff --git a/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php b/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php index ae7d84660..f8a758561 100644 --- a/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php +++ b/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php @@ -1,6 +1,7 @@ * * All rights reserved. @@ -39,12 +40,14 @@ class ClientController extends ApiMutableModelControllerBase public function searchClientAction() { - return $this->searchBase('clients.client', array("enabled", "name", "pubkey", "tunneladdress", "serveraddress", "serverport")); + return $this->searchBase( + 'clients.client', + ["enabled", "name", "pubkey", "tunneladdress", "serveraddress", "serverport"] + ); } public function getClientAction($uuid = null) { - $this->sessionClose(); return $this->getBase('client', 'clients.client', $uuid); } diff --git a/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php b/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php index 5bf57767a..416eb73be 100644 --- a/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php +++ b/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php @@ -1,6 +1,7 @@ * All rights reserved. * @@ -38,17 +39,15 @@ class ServerController extends ApiMutableModelControllerBase public function searchServerAction() { - $search = $this->searchBase('servers.server', array("enabled", "instance", "peers", "name", "networks", "pubkey", "port", "tunneladdress")); - // prepend "wg" to all instance IDs to use as interface name - foreach ($search["rows"] as $key => $server) { - $search["rows"][$key]["interface"] = "wg" . $server["instance"]; - } + $search = $this->searchBase( + 'servers.server', + ["enabled", "instance", "peers", "name", "networks", "pubkey", "port", "tunneladdress", 'interface'] + ); return $search; } public function getServerAction($uuid = null) { - $this->sessionClose(); return $this->getBase('server', 'servers.server', $uuid); } diff --git a/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php b/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php index 627911beb..f71b3d047 100644 --- a/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php +++ b/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php @@ -1,6 +1,7 @@ * All rights reserved. * @@ -52,14 +53,30 @@ class ServiceController extends ApiMutableServiceControllerBase return true; } + /** + * @return array + */ + public function reconfigureAction() + { + if (!$this->request->isPost()) { + return ['result' => 'failed']; + } + + $this->sessionClose(); + $backend = new Backend(); + $backend->configdRun('template reload ' . escapeshellarg(static::$internalServiceTemplate)); + $backend->configdpRun('wireguard configure'); + + return ['result' => 'ok']; + } + /** * show wireguard config * @return array */ public function showconfAction() { - $backend = new Backend(); - $response = $backend->configdRun("wireguard showconf"); + $response = (new Backend())->configdRun("wireguard showconf"); return array("response" => $response); } @@ -69,8 +86,7 @@ class ServiceController extends ApiMutableServiceControllerBase */ public function showhandshakeAction() { - $backend = new Backend(); - $response = $backend->configdRun("wireguard showhandshake"); + $response = (new Backend())->configdRun("wireguard showhandshake"); return array("response" => $response); } } diff --git a/net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/FieldTypes/ServerField.php b/net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/FieldTypes/ServerField.php new file mode 100644 index 000000000..a327af5fb --- /dev/null +++ b/net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/FieldTypes/ServerField.php @@ -0,0 +1,58 @@ +internalChildnodes as $node) { + if (!$node->getInternalIsVirtual()) { + $files = [ + 'cnfFilename' => "/usr/local/etc/wireguard/wg{$node->instance}.conf", + 'statFilename' => "/usr/local/etc/wireguard/wg{$node->instance}.stat", + 'interface' => "wg{$node->instance}", + ]; + foreach ($files as $name => $payload) { + $new_item = new TextField(); + $new_item->setInternalIsVirtual(); + $new_item->setValue($payload); + $node->addChildNode($name, $new_item); + } + } + } + return parent::actionPostLoadingEvent(); + } +} diff --git a/net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml b/net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml index a2934e1b0..8494a617f 100644 --- a/net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml +++ b/net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml @@ -1,5 +1,8 @@ - + + + + diff --git a/net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml b/net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml index 476091d23..af7164665 100644 --- a/net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml +++ b/net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml @@ -4,7 +4,7 @@ 0.0.4 - + 1 Y diff --git a/net/wireguard/src/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt b/net/wireguard/src/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt index 8b0accd2d..93a9897c4 100644 --- a/net/wireguard/src/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt +++ b/net/wireguard/src/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt @@ -1,5 +1,5 @@ {# - # OPNsense (c) 2014-2018 by Deciso B.V. + # OPNsense (c) 2014-2023 by Deciso B.V. # OPNsense (c) 2018 Michael Muenz # All rights reserved. # @@ -25,6 +25,66 @@ # POSSIBILITY OF SUCH DAMAGE. #} +