From f5411260300b9da351f4b29389e2806e8f06cf9f Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Mon, 21 Aug 2023 10:28:50 +0200 Subject: [PATCH] net/wireguard-go: make a copy in preparation for kmod improvements The Go variant will be phased out in 24.1, but for 23.7.x it is retained as such. The kmod variant will be improved and rewritten to not require wg-quick so it might eventually move into the core. --- README.md | 3 +- net/wireguard-go/Makefile | 10 + net/wireguard-go/pkg-descr | 78 +++++++ .../src/etc/inc/plugins.inc.d/wireguard.inc | 102 +++++++++ .../src/etc/rc.syshook.d/start/50-wireguard | 4 + .../Wireguard/Api/ClientController.php | 70 ++++++ .../Wireguard/Api/GeneralController.php | 138 ++++++++++++ .../Wireguard/Api/ServerController.php | 108 ++++++++++ .../Wireguard/Api/ServiceController.php | 76 +++++++ .../OPNsense/Wireguard/GeneralController.php | 40 ++++ .../forms/dialogEditWireguardClient.xml | 52 +++++ .../forms/dialogEditWireguardServer.xml | 82 ++++++++ .../OPNsense/Wireguard/forms/general.xml | 8 + .../app/models/OPNsense/Wireguard/ACL/ACL.xml | 9 + .../app/models/OPNsense/Wireguard/Client.php | 31 +++ .../app/models/OPNsense/Wireguard/Client.xml | 47 +++++ .../app/models/OPNsense/Wireguard/General.php | 35 +++ .../app/models/OPNsense/Wireguard/General.xml | 11 + .../models/OPNsense/Wireguard/Menu/Menu.xml | 5 + .../app/models/OPNsense/Wireguard/Server.php | 31 +++ .../app/models/OPNsense/Wireguard/Server.xml | 77 +++++++ .../app/views/OPNsense/Wireguard/general.volt | 199 ++++++++++++++++++ .../scripts/OPNsense/Wireguard/genkey.sh | 55 +++++ .../scripts/OPNsense/Wireguard/post.sh | 11 + .../OPNsense/Wireguard/resolve-dns.bash | 45 ++++ .../scripts/OPNsense/Wireguard/setup.sh | 4 + .../conf/actions.d/actions_wireguard.conf | 43 ++++ .../templates/OPNsense/Wireguard/+TARGETS | 2 + .../templates/OPNsense/Wireguard/wireguard | 15 ++ .../OPNsense/Wireguard/wireguard-server.conf | 53 +++++ .../src/www/widgets/include/wireguard.inc | 4 + .../www/widgets/widgets/wireguard.widget.php | 120 +++++++++++ net/wireguard/Makefile | 12 +- 33 files changed, 1570 insertions(+), 10 deletions(-) create mode 100644 net/wireguard-go/Makefile create mode 100644 net/wireguard-go/pkg-descr create mode 100644 net/wireguard-go/src/etc/inc/plugins.inc.d/wireguard.inc create mode 100755 net/wireguard-go/src/etc/rc.syshook.d/start/50-wireguard create mode 100644 net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php create mode 100644 net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/GeneralController.php create mode 100644 net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php create mode 100644 net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php create mode 100644 net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/GeneralController.php create mode 100644 net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardClient.xml create mode 100644 net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardServer.xml create mode 100644 net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/general.xml create mode 100644 net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/ACL/ACL.xml create mode 100644 net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.php create mode 100644 net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.xml create mode 100644 net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.php create mode 100644 net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.xml create mode 100644 net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml create mode 100644 net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.php create mode 100644 net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml create mode 100644 net/wireguard-go/src/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt create mode 100755 net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/genkey.sh create mode 100755 net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/post.sh create mode 100755 net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/resolve-dns.bash create mode 100755 net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/setup.sh create mode 100644 net/wireguard-go/src/opnsense/service/conf/actions.d/actions_wireguard.conf create mode 100644 net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/+TARGETS create mode 100644 net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard create mode 100644 net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard-server.conf create mode 100644 net/wireguard-go/src/www/widgets/include/wireguard.inc create mode 100644 net/wireguard-go/src/www/widgets/widgets/wireguard.widget.php diff --git a/README.md b/README.md index 4ae696eba..0abae3c9f 100644 --- a/README.md +++ b/README.md @@ -66,7 +66,8 @@ net/tayga -- Tayga NAT64 net/udpbroadcastrelay -- Control ubpbroadcastrelay processes net/upnp -- Universal Plug and Play Service net/vnstat -- Network traffic monitor -net/wireguard -- WireGuard VPN service +net/wireguard -- WireGuard VPN service kernel implementation +net/wireguard-go -- WireGuard VPN service Go implementation (pending removal) net/wol -- Wake on LAN Service net/zerotier -- Virtual Networks That Just Work net-mgmt/collectd -- Collect system and application performance metrics periodically diff --git a/net/wireguard-go/Makefile b/net/wireguard-go/Makefile new file mode 100644 index 000000000..4215a2f19 --- /dev/null +++ b/net/wireguard-go/Makefile @@ -0,0 +1,10 @@ +PLUGIN_NAME= wireguard-go +PLUGIN_VERSION= 1.13 +PLUGIN_REVISION= 7 +PLUGIN_COMMENT= WireGuard VPN service Go implementation +PLUGIN_CONFLICTS= wireguard +PLUGIN_OBSOLETE= yes +PLUGIN_DEPENDS= wireguard-go wireguard-tools +PLUGIN_MAINTAINER= m.muenz@gmail.com + +.include "../../Mk/plugins.mk" diff --git a/net/wireguard-go/pkg-descr b/net/wireguard-go/pkg-descr new file mode 100644 index 000000000..5d84964c9 --- /dev/null +++ b/net/wireguard-go/pkg-descr @@ -0,0 +1,78 @@ +WireGuard® is an extremely simple yet fast and modern VPN +that utilizes state-of-the-art cryptography. It aims to be +faster, simpler, leaner, and more useful than IPSec, while +avoiding the massive headache. It intends to be considerably +more performant than OpenVPN. WireGuard is designed as a +general purpose VPN for running on embedded interfaces and +super computers alike, fit for many different circumstances. +Initially released for the Linux kernel, it is now +cross-platform and widely deployable. It is currently under +heavy development, but already it might be regarded as the +most secure, easiest to use, and simplest VPN solution in +the industry. + +WWW: https://www.wireguard.com/ + +Changelog +--------- + +1.13 + +* Reworked widget and assorted cleanups (contributed by Patrik Kernstock) +* Improve widget public key overlapping (contributed by Victor Haggqvist) + +1.12 + +* Adjust validation for naming local instance and endpoints + +1.11 + +* Add script for renewal of Wireguard DNS-based entries for stale connections (#2956) +* Trim whitespace around new public and private keys in config (#2982) + +1.10 + +* Remove instance limit + +1.9 + +* Rename interface label in filter rules (#2577) + +1.8 + +* Empty port in Endpoint is allowed + +1.7 + +* Make tunnel address (wg interface address) optional + +1.6 + +* Move DNS setting to advanced +* Make listen port optional + +1.5 + +* Allow synchronization of config + +1.4 + +* Add IPv6 gateway support (contributed by Alexander Korinek) + +1.3 + +* Client/peer name validation to use HostnameField + +1.2 + +* Dashboard widget (contributed by D. Domig) + +1.1 + +* Allow adding interface route for PBR + +1.0 + +* Support for most features like S2S, Roadwarrior +* DNS, MTU, PSK +* Allow to disable setting routes for PBR diff --git a/net/wireguard-go/src/etc/inc/plugins.inc.d/wireguard.inc b/net/wireguard-go/src/etc/inc/plugins.inc.d/wireguard.inc new file mode 100644 index 000000000..cc1e49ee8 --- /dev/null +++ b/net/wireguard-go/src/etc/inc/plugins.inc.d/wireguard.inc @@ -0,0 +1,102 @@ + + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +function wireguard_enabled() +{ + $model = new \OPNsense\Wireguard\General(); + return (string)$model->enabled == '1'; +} + +function wireguard_services() +{ + $services = []; + + if (!wireguard_enabled()) { + return $services; + } + + $service = [ + 'description' => gettext('WireGuard VPN'), + 'configd' => [ + 'restart' => ['wireguard restart'], + 'start' => ['wireguard start'], + 'stop' => ['wireguard stop'], + ], + 'name' => 'wireguard-go', + ]; + + if (file_exists('/boot/modules/if_wg.ko') || file_exists('/boot/kernel/if_wg.ko')) { + $service['name'] = 'wireguard'; + $service['nocheck'] = true; + } + + $services[] = $service; + + return $services; +} + +function wireguard_interfaces() +{ + $interfaces = []; + + if (!wireguard_enabled()) { + return $interfaces; + } + + $interfaces['wireguard'] = [ + 'descr' => gettext('WireGuard (Group)'), + 'if' => 'wireguard', + 'virtual' => true, + 'enable' => true, + 'type' => 'group', + 'networks' => [], + ]; + + return $interfaces; +} + +function wireguard_xmlrpc_sync() +{ + $result = []; + + $result['id'] = 'wireguard'; + $result['section'] = 'OPNsense.wireguard'; + $result['description'] = gettext('WireGuard'); + $result['services'] = ['wireguard-go']; + + if (file_exists('/boot/modules/if_wg.ko') || file_exists('/boot/kernel/if_wg.ko')) { + $result['services'] = ['wireguard']; + } + + return [$result]; +} + +function wireguard_devices() +{ + return [['pattern' => '^wg', 'volatile' => true]]; +} diff --git a/net/wireguard-go/src/etc/rc.syshook.d/start/50-wireguard b/net/wireguard-go/src/etc/rc.syshook.d/start/50-wireguard new file mode 100755 index 000000000..78ab22804 --- /dev/null +++ b/net/wireguard-go/src/etc/rc.syshook.d/start/50-wireguard @@ -0,0 +1,4 @@ +#!/bin/sh + +# start again to fix problems with failed name resolution (no need to restart) +configctl -dq wireguard start diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php new file mode 100644 index 000000000..ae7d84660 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php @@ -0,0 +1,70 @@ + + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + * + */ + +namespace OPNsense\Wireguard\Api; + +use OPNsense\Base\ApiMutableModelControllerBase; + +class ClientController extends ApiMutableModelControllerBase +{ + protected static $internalModelName = 'client'; + protected static $internalModelClass = '\OPNsense\Wireguard\Client'; + + public function searchClientAction() + { + return $this->searchBase('clients.client', array("enabled", "name", "pubkey", "tunneladdress", "serveraddress", "serverport")); + } + + public function getClientAction($uuid = null) + { + $this->sessionClose(); + return $this->getBase('client', 'clients.client', $uuid); + } + + public function addClientAction() + { + return $this->addBase('client', 'clients.client'); + } + + public function delClientAction($uuid) + { + return $this->delBase('clients.client', $uuid); + } + + public function setClientAction($uuid) + { + return $this->setBase('client', 'clients.client', $uuid); + } + + public function toggleClientAction($uuid) + { + return $this->toggleBase('clients.client', $uuid); + } +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/GeneralController.php b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/GeneralController.php new file mode 100644 index 000000000..1aca5548d --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/GeneralController.php @@ -0,0 +1,138 @@ + + * Copyright (C) 2022 Patrik Kernstock + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + * + */ + +namespace OPNsense\Wireguard\Api; + +use OPNsense\Base\ApiMutableModelControllerBase; +use OPNsense\Core\Config; +use OPNsense\Core\Backend; + +class GeneralController extends ApiMutableModelControllerBase +{ + protected static $internalModelClass = '\OPNsense\Wireguard\General'; + protected static $internalModelName = 'general'; + + public function getStatusAction() + { + // get wireguard configuration + $config = Config::getInstance()->object(); + $config = $config->OPNsense->wireguard; + + // craft peers array + $peers = []; + $peers_uuid_pubkey = []; + // enabled, name, pubkey + foreach ($config->client->clients->client as $client) { + $peerUuid = (string)$client->attributes()['uuid']; + $peers_uuid_pubkey[$peerUuid] = (string) $client->pubkey; + $peers[$peerUuid] = [ + "name" => (string) $client->name, + "enabled" => (int) $client->enabled, + "publicKey" => (string) $client->pubkey, + ]; + } + + // prepare and initialize the server array + $status = []; + $peer_pubkey_reference = []; + foreach ($config->server->servers->server as $server) { + if ($server->enabled != "1") { + continue; + } + + // build basic server array + $interface = "wg" . $server->instance; + $status[$interface] = [ + "instance" => (int) $server->instance, + "interface" => (string) $interface, + "enabled" => (int) $server->enabled, + "name" => (string) $server->name, + "peers" => [], + ]; + + // parse and add peers with initial values to array + if (strlen($server->peers) > 0) { + // there is at least one peer defined + $serverPeers = explode(",", (string) $server->peers); + // iteriate over each peer uuid + foreach ($serverPeers as $peerUuid) { + // skipping removed peer that is still referenced in server + if (!isset($peers[$peerUuid])) { + continue; + } + // remember interface and pubkey <> peer-uuid reference for referencing handshake logic below + $peer_pubkey_reference[$interface][$peers_uuid_pubkey[$peerUuid]] = $peerUuid; + // merge peer info and initial values for handshake data + $status[$interface]["peers"][$peerUuid] = array_merge( + $peers[$peerUuid], + [ + "lastHandshake" => "0000-00-00 00:00:00+00:00", + ] + ); + } + } + } + + // Get latest handshakes by running CLI command locally + $data = (new Backend())->configdRun("wireguard showhandshake"); + + // parse and set handshake to status datastructure + $data = trim($data); + if (strlen($data) !== 0) { + $wgHandshakes = explode("\n", $data); + foreach ($wgHandshakes as $handshake) { + $item = explode("\t", trim($handshake)); + + // set interface name and publickey + $interface = trim($item[0]); + $pubkey = trim($item[1]); + + // calculate handshake time based on local timezone + $epoch = $item[2]; + if ($epoch > 0) { + $dt = new \DateTime("@$epoch"); + $dt->setTimezone(new \DateTimeZone(date_default_timezone_get())); + $latest = $dt->format("Y-m-d H:i:sP"); + + // set handshake + $peerUuid = $peer_pubkey_reference[$interface][$pubkey]; + if (!empty($peerUuid)) { + $status[$interface]["peers"][$peerUuid]["lastHandshake"] = $latest; + } + } + } + } + + return [ + "items" => $status + ]; + } +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php new file mode 100644 index 000000000..5bf57767a --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php @@ -0,0 +1,108 @@ + + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +namespace OPNsense\Wireguard\Api; + +use OPNsense\Base\ApiMutableModelControllerBase; +use OPNsense\Core\Backend; + +class ServerController extends ApiMutableModelControllerBase +{ + protected static $internalModelName = 'server'; + protected static $internalModelClass = '\OPNsense\Wireguard\Server'; + + public function searchServerAction() + { + $search = $this->searchBase('servers.server', array("enabled", "instance", "peers", "name", "networks", "pubkey", "port", "tunneladdress")); + // prepend "wg" to all instance IDs to use as interface name + foreach ($search["rows"] as $key => $server) { + $search["rows"][$key]["interface"] = "wg" . $server["instance"]; + } + return $search; + } + + public function getServerAction($uuid = null) + { + $this->sessionClose(); + return $this->getBase('server', 'servers.server', $uuid); + } + + public function addServerAction($uuid = null) + { + if ($this->request->isPost() && $this->request->hasPost("server")) { + if ($uuid != null) { + $node = $this->getModel()->getNodeByReference('servers.server.' . $uuid); + } else { + $node = $this->getModel()->servers->server->Add(); + } + $node->setNodes($this->request->getPost("server")); + if (empty((string)$node->pubkey) && empty((string)$node->privkey)) { + // generate new keypair + $backend = new Backend(); + $keyspriv = $backend->configdpRun("wireguard genkey", 'private'); + $keyspub = $backend->configdpRun("wireguard genkey", 'public'); + $node->privkey = trim($keyspriv); + $node->pubkey = trim($keyspub); + } + return $this->validateAndSave($node, 'server'); + } + return array("result" => "failed"); + } + + public function delServerAction($uuid) + { + return $this->delBase('servers.server', $uuid); + } + + public function setServerAction($uuid = null) + { + if ($this->request->isPost() && $this->request->hasPost("server")) { + if ($uuid != null) { + $node = $this->getModel()->getNodeByReference('servers.server.' . $uuid); + } else { + $node = $this->getModel()->servers->server->Add(); + } + $node->setNodes($this->request->getPost("server")); + if (empty((string)$node->pubkey) && empty((string)$node->privkey)) { + // generate new keypair + $backend = new Backend(); + $keyspriv = $backend->configdpRun("wireguard genkey", 'private'); + $keyspub = $backend->configdpRun("wireguard genkey", 'public'); + $node->privkey = trim($keyspriv); + $node->pubkey = trim($keyspub); + } + return $this->validateAndSave($node, 'server'); + } + return array("result" => "failed"); + } + + public function toggleServerAction($uuid) + { + return $this->toggleBase('servers.server', $uuid); + } +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php new file mode 100644 index 000000000..627911beb --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php @@ -0,0 +1,76 @@ + + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +namespace OPNsense\Wireguard\Api; + +use OPNsense\Base\ApiMutableServiceControllerBase; +use OPNsense\Core\Backend; +use OPNsense\Wireguard\General; + +/** + * Class ServiceController + * @package OPNsense\Wireguard + */ +class ServiceController extends ApiMutableServiceControllerBase +{ + protected static $internalServiceClass = '\OPNsense\Wireguard\General'; + protected static $internalServiceTemplate = 'OPNsense/Wireguard'; + protected static $internalServiceEnabled = 'enabled'; + protected static $internalServiceName = 'wireguard'; + + /** + * hook group interface registration on reconfigure + * @return bool + */ + protected function invokeInterfaceRegistration() + { + return true; + } + + /** + * show wireguard config + * @return array + */ + public function showconfAction() + { + $backend = new Backend(); + $response = $backend->configdRun("wireguard showconf"); + return array("response" => $response); + } + + /** + * show wireguard handshakes + * @return array + */ + public function showhandshakeAction() + { + $backend = new Backend(); + $response = $backend->configdRun("wireguard showhandshake"); + return array("response" => $response); + } +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/GeneralController.php b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/GeneralController.php new file mode 100644 index 000000000..404fce682 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/GeneralController.php @@ -0,0 +1,40 @@ + + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +namespace OPNsense\Wireguard; + +class GeneralController extends \OPNsense\Base\IndexController +{ + public function indexAction() + { + $this->view->generalForm = $this->getForm("general"); + $this->view->formDialogEditWireguardClient = $this->getForm("dialogEditWireguardClient"); + $this->view->formDialogEditWireguardServer = $this->getForm("dialogEditWireguardServer"); + $this->view->pick('OPNsense/Wireguard/general'); + } +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardClient.xml b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardClient.xml new file mode 100644 index 000000000..231e9c692 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardClient.xml @@ -0,0 +1,52 @@ +
+ + client.enabled + + checkbox + This will enable or disable the client config. + + + client.name + + text + Set the name for this instance. + + + client.pubkey + + text + Public key of this instance. + + + client.psk + + text + Shared secret (PSK) for this peer. You can generate a key using "wg genpsk" on a client with WireGuard installed. + + + client.tunneladdress + + + select_multiple + true + List of addresses allowed to pass trough the tunnel adapter. Please use CIDR notation like 10.0.0.1/24. + + + client.serveraddress + + text + Set public IP address the endpoint listens to. + + + client.serverport + + text + Set port the endpoint listens to. + + + client.keepalive + + text + Set persistent keepalive interval in seconds. + +
diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardServer.xml b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardServer.xml new file mode 100644 index 000000000..eff1f9504 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardServer.xml @@ -0,0 +1,82 @@ +
+ + server.enabled + + checkbox + This will enable or disable the server config. + + + server.name + + text + Set the name for this instance. + + + server.instance + + info + This is the instance number to give the wg interface a unique name (wgX). + + + server.pubkey + + text + Public key of this instance. You can specify your own one, or a key will be generated after saving. + + + server.privkey + + text + Private key of this instance. You can specify your own one, or a key will be generated after saving. Please keep this key safe. + + + server.port + + text + Optionally set a fixed port for this instance to listen on. The standard port range starts at 51820. + + + server.mtu + + text + true + Set the interface MTU for this interface. Leaving empty uses the MTU from main interface which is fine for most setups. + + + server.dns + + select_multiple + + true + true + Set the interface specific DNS server. + + + server.tunneladdress + + + select_multiple + true + List of addresses to configure on the tunnel adapter. Please use CIDR notation like 10.0.0.1/24. + + + server.peers + + select_multiple + true + List of peers for this server. + + + server.disableroutes + + checkbox + This will prevent installing routes. Usually you only enable this to do own routing decisions via a local gateway and gateway rules. + + + server.gateway + + text + true + Set the gateway IP here when using Disable Routes feature. You also have to add this as a gateway in OPNsense. + +
diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/general.xml b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/general.xml new file mode 100644 index 000000000..7a74ebf81 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/general.xml @@ -0,0 +1,8 @@ +
+ + general.enabled + + checkbox + This will activate WireGuard and start all enabled instances. + +
diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/ACL/ACL.xml b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/ACL/ACL.xml new file mode 100644 index 000000000..21012db80 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/ACL/ACL.xml @@ -0,0 +1,9 @@ + + + VPN: Wireguard + + ui/wireguard/* + api/wireguard/* + + + diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.php b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.php new file mode 100644 index 000000000..b069a766d --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.php @@ -0,0 +1,31 @@ + + All rights reserved. + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +namespace OPNsense\Wireguard; + +use OPNsense\Base\BaseModel; + +class Client extends BaseModel +{ +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.xml b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.xml new file mode 100644 index 000000000..69527a433 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.xml @@ -0,0 +1,47 @@ + + //OPNsense/wireguard/client + Wireguard Client configuration + 0.0.7 + + + + + 1 + Y + + + + Y + /^([0-9a-zA-Z._\-]){1,64}$/u + Should be a string between 1 and 64 characters. Allowed characters are alphanumeric characters, dash and underscores. + + + Y + Should be a base64-encoded 32 byte string. + + + N + Should be a base64-encoded 32 byte string. + + + + , + Y + Y + + + N + + + N + + + 1 + 86400 + Please specify a value between 1 and 86400. + N + + + + + diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.php b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.php new file mode 100644 index 000000000..6caf9eaba --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.php @@ -0,0 +1,35 @@ + + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +namespace OPNsense\Wireguard; + +use OPNsense\Base\BaseModel; + +class General extends BaseModel +{ +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.xml b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.xml new file mode 100644 index 000000000..432fd654c --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.xml @@ -0,0 +1,11 @@ + + //OPNsense/wireguard/general + WireGuard configuration + 0.0.1 + + + 0 + Y + + + diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml new file mode 100644 index 000000000..a2934e1b0 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml @@ -0,0 +1,5 @@ + + + + + diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.php b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.php new file mode 100644 index 000000000..8fccdd577 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.php @@ -0,0 +1,31 @@ + + All rights reserved. + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +namespace OPNsense\Wireguard; + +use OPNsense\Base\BaseModel; + +class Server extends BaseModel +{ +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml new file mode 100644 index 000000000..476091d23 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml @@ -0,0 +1,77 @@ + + //OPNsense/wireguard/server + Wireguard Server configuration + 0.0.4 + + + + + 1 + Y + + + + Y + /^([0-9a-zA-Z._\-]){1,64}$/u + Should be a string between 1 and 64 characters. Allowed characters are alphanumeric characters, dash and underscores. + + + Y + + + N + + + N + + + N + + + 1 + 9300 + N + + + N + /^([a-fA-F0-9\.:\[\]]*?,)*([a-fA-F0-9\.:\[\]]*)$/ + Please use valid IPv4 or IPv6 addresses. + + + + , + N + Y + + + 0 + Y + + + You have to enable Disable Routes option. + DependConstraint + + gateway + + + + + + N + + + + + + Y + N + Choose an Peer. + + + + + diff --git a/net/wireguard-go/src/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt b/net/wireguard-go/src/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt new file mode 100644 index 000000000..8b0accd2d --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt @@ -0,0 +1,199 @@ +{# + # OPNsense (c) 2014-2018 by Deciso B.V. + # OPNsense (c) 2018 Michael Muenz + # All rights reserved. + # + # Redistribution and use in source and binary forms, with or without modification, + # are permitted provided that the following conditions are met: + # + # 1. Redistributions of source code must retain the above copyright notice, + # this list of conditions and the following disclaimer. + # + # 2. Redistributions in binary form must reproduce the above copyright notice, + # this list of conditions and the following disclaimer in the documentation + # and/or other materials provided with the distribution. + # + # THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + # INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + # AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + # AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + # POSSIBILITY OF SUCH DAMAGE. + #} + + + + +
+
+
+ {{ partial("layout_partials/base_form",['fields':generalForm,'id':'frm_general_settings'])}} +
+
+ +
+
+
+
+ + + + + + + + + + + + + + + + + + + + +
{{ lang._('Enabled') }}{{ lang._('Name') }}{{ lang._('Endpoint Address') }}{{ lang._('Endpoint Port') }}{{ lang._('Allowed IPs') }}{{ lang._('ID') }}{{ lang._('Commands') }}
+ +
+
+
+ +

+
+
+
+ + + + + + + + + + + + + + + + + + + + + +
{{ lang._('Enabled') }}{{ lang._('Name') }}{{ lang._('Interface') }}{{ lang._('Tunnel Address') }}{{ lang._('Port') }}{{ lang._('Endpoints') }}{{ lang._('ID') }}{{ lang._('Commands') }}
+ +
+
+
+ +

+
+
+
+ 

+    

+    

+      

+    

+

+
+{{ partial("layout_partials/base_dialog",['fields':formDialogEditWireguardClient,'id':'dialogEditWireguardClient','label':lang._('Edit Endpoint')])}}
+{{ partial("layout_partials/base_dialog",['fields':formDialogEditWireguardServer,'id':'dialogEditWireguardServer','label':lang._('Edit Local Configuration')])}}
+
+
diff --git a/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/genkey.sh b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/genkey.sh
new file mode 100755
index 000000000..b580bf49d
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/genkey.sh
@@ -0,0 +1,55 @@
+#!/bin/sh
+
+# Copyright (c) 2018 Michael Muenz 
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+
+TMPDIR="/tmp"
+GENPRIV="/usr/local/bin/wg genkey"
+GENPUB="/usr/local/bin/wg pubkey"
+
+cleanup() {
+	# Delete old files
+	rm -f $TMPDIR/wireguard.*
+}
+
+private() {
+	# Generate a private key and put it to /tmp
+	umask 077 && ${GENPRIV} | tee ${TMPDIR}/wireguard.priv
+}
+
+public() {
+	# Generate a public key and put it to /tmp
+	${GENPUB} < ${TMPDIR}/wireguard.priv | tee ${TMPDIR}/wireguard.pub
+}
+
+case "$1" in
+private)
+	cleanup
+	private
+	;;
+public)
+	public
+	;;
+esac
diff --git a/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/post.sh b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/post.sh
new file mode 100755
index 000000000..375ca3835
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/post.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+if [ -f /etc/rc.conf.d/wireguard ]; then
+	. /etc/rc.conf.d/wireguard
+fi
+
+for interface in ${wireguard_interfaces}; do
+	ifconfig ${interface} group wireguard
+done
+
+/usr/local/etc/rc.routing_configure
diff --git a/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/resolve-dns.bash b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/resolve-dns.bash
new file mode 100755
index 000000000..b7faf881a
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/resolve-dns.bash
@@ -0,0 +1,45 @@
+#!/usr/local/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright (C) 2015-2020 Jason A. Donenfeld . All Rights Reserved.
+
+set -e
+shopt -s nocasematch
+shopt -s extglob
+export LC_ALL=C
+
+for CONFIG_FILE in /usr/local/etc/wireguard/*.conf; do
+
+    [[ $CONFIG_FILE =~ /?([a-zA-Z0-9_=+.-]{1,15})\.conf$ ]]
+    INTERFACE="${BASH_REMATCH[1]}"
+
+    process_peer() {
+        [[ $PEER_SECTION -ne 1 || -z $PUBLIC_KEY || -z $ENDPOINT ]] && return 0
+        [[ $(wg show "$INTERFACE" latest-handshakes) =~ ${PUBLIC_KEY//+/\\+}\	([0-9]+) ]] || return 0
+        (( ($EPOCHSECONDS - ${BASH_REMATCH[1]}) > 135 )) || return 0
+        wg set "$INTERFACE" peer "$PUBLIC_KEY" endpoint "$ENDPOINT"
+        reset_peer_section
+    }
+
+    reset_peer_section() {
+        PEER_SECTION=0
+        PUBLIC_KEY=""
+        ENDPOINT=""
+    }
+
+    reset_peer_section
+    while read -r line || [[ -n $line ]]; do
+        stripped="${line%%\#*}"
+        key="${stripped%%=*}"; key="${key##*([[:space:]])}"; key="${key%%*([[:space:]])}"
+        value="${stripped#*=}"; value="${value##*([[:space:]])}"; value="${value%%*([[:space:]])}"
+        [[ $key == "["* ]] && { process_peer; reset_peer_section; }
+        [[ $key == "[Peer]" ]] && PEER_SECTION=1
+        if [[ $PEER_SECTION -eq 1 ]]; then
+            case "$key" in
+                PublicKey) PUBLIC_KEY="$value"; continue ;;
+                Endpoint) ENDPOINT="$value"; continue ;;
+            esac
+        fi
+    done < "$CONFIG_FILE"
+    process_peer
+done
diff --git a/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/setup.sh b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/setup.sh
new file mode 100755
index 000000000..75ba580c9
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/setup.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+mkdir -p /var/run/wireguard
+chmod 755 /var/run/wireguard
diff --git a/net/wireguard-go/src/opnsense/service/conf/actions.d/actions_wireguard.conf b/net/wireguard-go/src/opnsense/service/conf/actions.d/actions_wireguard.conf
new file mode 100644
index 000000000..b2b96828f
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/service/conf/actions.d/actions_wireguard.conf
@@ -0,0 +1,43 @@
+[start]
+command:/usr/local/etc/rc.d/wireguard start; /usr/local/opnsense/scripts/OPNsense/Wireguard/post.sh
+parameters:
+type:script
+message:Starting WireGuard
+
+[stop]
+command:/usr/local/etc/rc.d/wireguard stop
+parameters:
+type:script
+message:Stopping WireGuard
+
+[restart]
+command:/usr/local/etc/rc.d/wireguard restart; /usr/local/opnsense/scripts/OPNsense/Wireguard/post.sh
+parameters:
+type:script
+message:Restarting WireGuard
+description: Restart WireGuard
+
+[renew]
+command:/usr/local/opnsense/scripts/OPNsense/Wireguard/resolve-dns.bash
+parameters:
+type:script
+message:Renew DNS for WireGuard
+description:Renew DNS for WireGuard on stale connections
+
+[genkey]
+command:/usr/local/opnsense/scripts/OPNsense/Wireguard/genkey.sh
+parameters: %s
+type:script_output
+message:Generating WireGuard keys
+
+[showconf]
+command:/usr/local/bin/wg show all
+parameters:
+type:script_output
+message:Show WireGuard config
+
+[showhandshake]
+command:/usr/local/bin/wg show all latest-handshakes
+parameters:
+type:script_output
+message:Show WireGuard handshakes
diff --git a/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/+TARGETS b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/+TARGETS
new file mode 100644
index 000000000..655def7d1
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/+TARGETS
@@ -0,0 +1,2 @@
+wireguard:/etc/rc.conf.d/wireguard
+wireguard-server.conf:/usr/local/etc/wireguard/wg[OPNsense.wireguard.server.servers.server.%.instance].conf
diff --git a/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard
new file mode 100644
index 000000000..c4c12667a
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard
@@ -0,0 +1,15 @@
+{% if helpers.exists('OPNsense.wireguard.general.enabled') and OPNsense.wireguard.general.enabled == '1' %}
+wireguard_setup="/usr/local/opnsense/scripts/OPNsense/Wireguard/setup.sh"
+wireguard_enable="YES"
+{%   if helpers.exists('OPNsense.wireguard.server.servers.server') %}
+{%   set activeservers=[] %}
+{%     for servers in helpers.toList('OPNsense.wireguard.server.servers.server') %}
+{%       if servers.enabled == '1' %}
+{%       do activeservers.append("wg" + servers.instance) %}
+{%       endif %}
+{%     endfor %}
+{%   endif %}
+wireguard_interfaces="{{ activeservers | join(' ') }}"
+{% else %}
+wireguard_enable="NO"
+{% endif %}
diff --git a/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard-server.conf b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard-server.conf
new file mode 100644
index 000000000..355ea0815
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard-server.conf
@@ -0,0 +1,53 @@
+{% if helpers.exists('OPNsense.wireguard.general.enabled') and OPNsense.wireguard.general.enabled == '1' %}
+{% if helpers.exists('OPNsense.wireguard.server.servers.server') %}
+{%   for server_list in helpers.toList('OPNsense.wireguard.server.servers.server') %}
+{%     if TARGET_FILTERS['OPNsense.wireguard.server.servers.server.' ~ loop.index0] or TARGET_FILTERS['OPNsense.wireguard.server.servers.server'] %}
+{%       if server_list.enabled == '1' %}
+[Interface]
+PrivateKey = {{ server_list.privkey }}
+{%         if server_list.tunneladdress|default('') != '' %}
+Address = {{ server_list.tunneladdress }}
+{%         endif %}
+{%         if server_list.port|default('') != '' %}
+ListenPort = {{ server_list.port }}
+{%         endif %}
+{%         if server_list.dns|default('') != '' %}
+DNS = {{ server_list.dns }}
+{%         endif %}
+{%         if server_list.mtu|default('') != '' %}
+MTU = {{ server_list.mtu }}
+{%         endif %}
+{%         if server_list.disableroutes == '1' %}
+Table = off
+{%         endif %}
+{%         if server_list.disableroutes == '1' and server_list.gateway|default('') != '' %}
+PostUp = route {{- ' -6' if ':' in server_list.gateway }} add {{ server_list.gateway }} -iface %i
+PostDown = route {{- ' -6' if ':' in server_list.gateway }} del {{ server_list.gateway }} -iface %i
+{%         endif %}
+{%         if server_list.peers|default('') != '' %}
+{%           for peerlist in server_list.peers.split(",") %}
+{%             set peerlist2_data = helpers.getUUID(peerlist) %}
+{%             if peerlist2_data != {} and peerlist2_data.enabled == '1' %}
+
+[Peer]
+# friendly_name = {{ peerlist2_data.name }}
+PublicKey = {{ peerlist2_data.pubkey }}
+{%               if peerlist2_data.psk|default('') != '' %}
+PresharedKey = {{ peerlist2_data.psk }}
+{%               endif %}
+{%               if peerlist2_data.serveraddress|default('') != '' %}
+Endpoint = {{ peerlist2_data.serveraddress }}{% if peerlist2_data.serverport|default('') != '' %}:{{ peerlist2_data.serverport }}{% else %}:51820{% endif %}
+{%               endif %}
+
+AllowedIPs = {{ peerlist2_data.tunneladdress }}
+{%               if peerlist2_data.keepalive|default('') != '' %}
+PersistentKeepalive = {{ peerlist2_data.keepalive }}
+{%               endif %}
+{%             endif %}
+{%           endfor %}
+{%         endif %}
+{%       endif %}
+{%     endif %}
+{%   endfor %}
+{% endif %}
+{% endif %}
diff --git a/net/wireguard-go/src/www/widgets/include/wireguard.inc b/net/wireguard-go/src/www/widgets/include/wireguard.inc
new file mode 100644
index 000000000..b95fc1fa6
--- /dev/null
+++ b/net/wireguard-go/src/www/widgets/include/wireguard.inc
@@ -0,0 +1,4 @@
+
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+require_once("guiconfig.inc");
+require_once("widgets/include/wireguard.inc");
+
+$enabled = ($config["OPNsense"]["wireguard"]["general"]["enabled"] === "1" ? true : false);
+
+?>
+
+
+    
+        
+            
+            
+            
+            
+            
+        
+    
+    
+
+    
+    
+        
+    
+    
+
+    
+

+
+
diff --git a/net/wireguard/Makefile b/net/wireguard/Makefile
index 72c6bf897..9d7d9cf08 100644
--- a/net/wireguard/Makefile
+++ b/net/wireguard/Makefile
@@ -1,15 +1,9 @@
 PLUGIN_NAME=		wireguard
 PLUGIN_VERSION=		1.13
 PLUGIN_REVISION=	7
-PLUGIN_COMMENT=		WireGuard VPN service
-PLUGIN_DEPENDS=		wireguard-tools
+PLUGIN_COMMENT=		WireGuard VPN service kernel implementation
+PLUGIN_DEPENDS=		wireguard-kmod wireguard-tools
+PLUGIN_CONFLICTS=	wireguard-go
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
-PLUGIN_VARIANTS=	kmod go
-
-kmod_NAME=		wireguard
-kmod_DEPENDS=		wireguard-kmod
-
-go_NAME=		wireguard-go
-go_DEPENDS=		wireguard-go
 
 .include "../../Mk/plugins.mk"