bundlewrap/bundles/wireguard/metadata.py

316 lines
7.7 KiB
Python
Raw Normal View History

2021-04-01 14:27:31 +00:00
from ipaddress import ip_network
from re import sub
2021-04-01 14:27:31 +00:00
from bundlewrap.exceptions import NoSuchNode
from bundlewrap.metadata import atomic
defaults = {
'apt': {
'packages': {
'wireguard': {},
},
},
'wireguard': {
'privatekey': repo.libs.keys.gen_privkey(repo, f'{node.name} wireguard privatekey'),
},
}
if node.os_version <= (11,):
defaults['apt']['repos'] = {
'backports': {
'install_gpg_key': False, # default debian signing key
'items': {
'deb http://deb.debian.org/debian {os_release}-backports main',
},
},
}
else:
defaults['apt']['packages']['wireguard-dkms'] = {
'installed': False,
}
2021-04-23 17:31:28 +00:00
if node.has_bundle('telegraf'):
defaults['telegraf'] = {
'input_plugins': {
'builtin': {
'wireguard': [{}],
},
},
'additional_capabilities': {
'CAP_NET_ADMIN',
},
2021-04-23 17:31:28 +00:00
}
@metadata_reactor.provides(
'wireguard/peers',
)
def peers_auto_full_mesh(metadata):
peers = {}
if node.name not in repo.libs.s2s.WG_AUTOGEN_NODES:
return {}
for rnode in repo.libs.s2s.WG_AUTOGEN_NODES:
if rnode is None or rnode == node.name:
continue
try:
rnode = repo.get_node(rnode)
except NoSuchNode:
continue
if rnode.dummy:
continue
peers[rnode.name] = {}
return {
'wireguard': {
'peers': peers,
},
}
@metadata_reactor.provides(
2021-04-01 14:27:31 +00:00
'wireguard/peers',
)
def peer_psks(metadata):
2021-04-01 14:27:31 +00:00
peers = {}
2021-04-01 14:27:31 +00:00
for peer_name in metadata.get('wireguard/peers', {}):
peers[peer_name] = {
'iface': sub('[^a-z0-9-_]+', '_', peer_name)[:12],
}
try:
repo.get_node(peer_name)
if node.name < peer_name:
peers[peer_name]['psk'] = repo.vault.random_bytes_as_base64_for(f'{node.name} wireguard {peer_name}')
else:
peers[peer_name]['psk'] = repo.vault.random_bytes_as_base64_for(f'{peer_name} wireguard {node.name}')
except NoSuchNode:
pass
2021-04-01 14:27:31 +00:00
return {
'wireguard': {
'peers': peers,
},
}
@metadata_reactor.provides(
'wireguard/peers',
)
2021-04-01 14:27:31 +00:00
def peer_pubkeys(metadata):
peers = {}
2021-04-01 14:27:31 +00:00
for peer_name in metadata.get('wireguard/peers', {}):
try:
rnode = repo.get_node(peer_name)
except NoSuchNode:
continue
2021-04-01 14:27:31 +00:00
peers[peer_name] = {
'pubkey': repo.libs.keys.get_pubkey_from_privkey(
repo,
f'{rnode.name} wireguard pubkey',
rnode.metadata.get('wireguard/privatekey'),
),
}
2021-04-01 14:27:31 +00:00
return {
'wireguard': {
'peers': peers,
},
}
2021-04-01 14:27:31 +00:00
@metadata_reactor.provides(
'wireguard/peers',
)
def peer_ips_and_ports(metadata):
if node.name not in repo.libs.s2s.WG_AUTOGEN_NODES:
raise DoNotRunAgain
2021-04-01 14:27:31 +00:00
peers = {}
base_port = 51820
2021-04-01 14:27:31 +00:00
for number, peer_name in enumerate(sorted(metadata.get('wireguard/peers', {}).keys())):
2021-04-01 14:27:31 +00:00
try:
rnode = repo.get_node(peer_name)
except NoSuchNode:
continue
if rnode.name not in repo.libs.s2s.WG_AUTOGEN_NODES:
continue
ip_a, ip_b = repo.libs.s2s.get_subnet_for_connection(repo, *sorted({node.name, peer_name}))
if peer_name < node.name:
my_ip = ip_a
their_ip = ip_b
else:
my_ip = ip_b
their_ip = ip_a
2021-04-01 14:27:31 +00:00
peers[rnode.name] = {
'my_ip': str(my_ip),
'my_port': base_port + repo.libs.s2s.WG_AUTOGEN_NODES.index(rnode.name),
'their_ip': str(their_ip)
}
return {
'wireguard': {
'peers': peers,
},
}
@metadata_reactor.provides(
'wireguard/peers',
)
def peer_endpoints(metadata):
peers = {}
for name, config in metadata.get('wireguard/peers', {}).items():
try:
rnode = repo.get_node(name)
except NoSuchNode:
continue
if repo.libs.s2s.WG_AUTOGEN_SETTINGS.get(name, {}).get('no_autoconnect'):
continue
peers[rnode.name] = {
'endpoint': '{}:{}'.format(
rnode.hostname,
rnode.metadata.get(f'wireguard/peers/{node.name}/my_port'),
),
2021-04-01 14:27:31 +00:00
}
return {
'wireguard': {
'peers': peers,
},
}
@metadata_reactor.provides(
'icinga2_api/wireguard/services',
)
def icinga2(metadata):
services = {}
for peer, config in sorted(metadata.get('wireguard/peers', {}).items()):
if config.get('exclude_from_monitoring', False):
continue
services[f'WIREGUARD CONNECTION {peer}'] = {
'command_on_monitored_host': config['pubkey'].format_into(f'sudo /usr/local/share/icinga/plugins/check_wireguard_connected wg_{config["iface"]} {{}}'),
}
return {
'icinga2_api': {
'wireguard': {
'services': services,
},
},
}
@metadata_reactor.provides(
'firewall/port_rules',
)
def firewall(metadata):
ports = {}
for name, config in metadata.get('wireguard/peers').items():
2021-04-01 14:27:31 +00:00
try:
rnode = repo.get_node(name)
2021-04-01 14:27:31 +00:00
except NoSuchNode: # roadwarrior
ports['{}/udp'.format(config['my_port'])] = atomic(set(metadata.get('wireguard/restrict-to', set())))
2021-04-01 14:27:31 +00:00
else:
ports['{}/udp'.format(config['my_port'])] = atomic(
set(repo.libs.s2s.WG_AUTOGEN_SETTINGS.get(name, {}).get('firewall', set())) | {name}
)
2021-04-01 14:27:31 +00:00
return {
'firewall': {
'port_rules': ports,
2021-04-01 14:27:31 +00:00
},
}
@metadata_reactor.provides(
'interfaces',
2021-04-01 14:27:31 +00:00
)
def interface_ips(metadata):
interfaces = {}
2023-09-10 19:19:23 +00:00
snat_ip = metadata.get('wireguard/snat_ip', None)
for peer, config in sorted(metadata.get('wireguard/peers', {}).items()):
routes = {}
if '/' in config['my_ip']:
my_ip = config['my_ip']
else:
my_ip = '{}/31'.format(config['my_ip'])
2023-09-10 19:19:23 +00:00
ips = {my_ip}
if snat_ip and peer in repo.libs.s2s.WG_AUTOGEN_NODES:
2023-09-10 19:19:23 +00:00
ips.add(snat_ip)
their_ip = config['their_ip']
if '/' in their_ip:
their_ip = their_ip.split('/')[0]
for route in config.get('routes', set()):
routes[route] = {'via': their_ip}
interfaces[f'wg_{config["iface"]}'] = {
'activation_policy': 'up' if config.get('auto_connection', True) else 'manual',
2023-09-10 19:19:23 +00:00
'ips': ips,
'routes': routes,
}
2021-04-01 14:27:31 +00:00
return {
'interfaces': interfaces,
}
@metadata_reactor.provides(
2023-09-24 18:59:58 +00:00
'nftables/forward/10-wireguard',
'nftables/postrouting/10-wireguard',
)
def snat(metadata):
if not node.has_bundle('nftables') or node.os == 'arch':
raise DoNotRunAgain
2023-09-10 19:19:23 +00:00
snat_ip = metadata.get('wireguard/snat_ip', None)
2023-09-24 18:59:58 +00:00
forward = set()
postrouting = set()
for peer, config in sorted(metadata.get('wireguard/peers', {}).items()):
2023-09-24 18:59:58 +00:00
forward.add(f'iifname wg_{config["iface"]} accept')
forward.add(f'oifname wg_{config["iface"]} accept')
if snat_ip and peer in repo.libs.s2s.WG_AUTOGEN_NODES:
2023-09-24 18:59:58 +00:00
postrouting.add('ip saddr {} ip daddr != {} snat to {}'.format(
config['my_ip'],
config['their_ip'],
2023-09-10 19:19:23 +00:00
snat_ip,
))
elif config.get('masquerade', False):
postrouting.add(f'oifname wg_{peer} masquerade')
return {
'nftables': {
2023-09-24 18:59:58 +00:00
'forward': {
'10-wireguard': sorted(forward),
},
'postrouting': {
'10-wireguard': sorted(postrouting),
},
},
}