341 lines
8.1 KiB
Python
341 lines
8.1 KiB
Python
from ipaddress import ip_network
|
|
from re import sub
|
|
|
|
from bundlewrap.exceptions import NoSuchNode
|
|
from bundlewrap.metadata import atomic
|
|
|
|
defaults = {
|
|
'apt': {
|
|
'packages': {
|
|
'wireguard': {},
|
|
},
|
|
},
|
|
'wireguard': {
|
|
'privatekey': repo.libs.keys.gen_privkey(repo, f'{node.name} wireguard privatekey'),
|
|
},
|
|
}
|
|
|
|
if node.os_version <= (11,):
|
|
defaults['apt']['repos'] = {
|
|
'backports': {
|
|
'install_gpg_key': False, # default debian signing key
|
|
'items': {
|
|
'deb http://deb.debian.org/debian {os_release}-backports main',
|
|
},
|
|
},
|
|
}
|
|
else:
|
|
defaults['apt']['packages']['wireguard-dkms'] = {
|
|
'installed': False,
|
|
}
|
|
|
|
if node.has_bundle('telegraf'):
|
|
defaults['telegraf'] = {
|
|
'input_plugins': {
|
|
'builtin': {
|
|
'wireguard': [{}],
|
|
},
|
|
},
|
|
'additional_capabilities': {
|
|
'CAP_NET_ADMIN',
|
|
},
|
|
}
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'wireguard/peers',
|
|
)
|
|
def peers_auto_full_mesh(metadata):
|
|
peers = {}
|
|
|
|
if node.name not in repo.libs.s2s.WG_AUTOGEN_NODES:
|
|
return {}
|
|
|
|
for rnode in repo.libs.s2s.WG_AUTOGEN_NODES:
|
|
if rnode is None or rnode == node.name:
|
|
continue
|
|
|
|
try:
|
|
rnode = repo.get_node(rnode)
|
|
except NoSuchNode:
|
|
continue
|
|
|
|
if rnode.dummy:
|
|
continue
|
|
|
|
peers[rnode.name] = {}
|
|
|
|
return {
|
|
'wireguard': {
|
|
'peers': peers,
|
|
},
|
|
}
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'wireguard/peers',
|
|
)
|
|
def peer_psks(metadata):
|
|
peers = {}
|
|
|
|
for peer_name in metadata.get('wireguard/peers', {}):
|
|
peers[peer_name] = {
|
|
'iface': sub('[^a-z0-9-_]+', '_', peer_name)[:12],
|
|
}
|
|
|
|
if node.name < peer_name:
|
|
peers[peer_name]['psk'] = repo.vault.random_bytes_as_base64_for(f'{node.name} wireguard {peer_name}')
|
|
else:
|
|
peers[peer_name]['psk'] = repo.vault.random_bytes_as_base64_for(f'{peer_name} wireguard {node.name}')
|
|
|
|
return {
|
|
'wireguard': {
|
|
'peers': peers,
|
|
},
|
|
}
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'wireguard/peers',
|
|
)
|
|
def peer_pubkeys(metadata):
|
|
peers = {}
|
|
|
|
for peer_name in metadata.get('wireguard/peers', {}):
|
|
try:
|
|
rnode = repo.get_node(peer_name)
|
|
except NoSuchNode:
|
|
continue
|
|
|
|
peers[peer_name] = {
|
|
'pubkey': repo.libs.keys.get_pubkey_from_privkey(
|
|
repo,
|
|
f'{rnode.name} wireguard pubkey',
|
|
rnode.metadata.get('wireguard/privatekey'),
|
|
),
|
|
}
|
|
|
|
return {
|
|
'wireguard': {
|
|
'peers': peers,
|
|
},
|
|
}
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'wireguard/peers',
|
|
)
|
|
def peer_ips_and_ports(metadata):
|
|
if node.name not in repo.libs.s2s.WG_AUTOGEN_NODES:
|
|
raise DoNotRunAgain
|
|
|
|
peers = {}
|
|
base_port = 51820
|
|
|
|
for number, peer_name in enumerate(sorted(metadata.get('wireguard/peers', {}).keys())):
|
|
try:
|
|
rnode = repo.get_node(peer_name)
|
|
except NoSuchNode:
|
|
continue
|
|
|
|
if rnode.name not in repo.libs.s2s.WG_AUTOGEN_NODES:
|
|
continue
|
|
|
|
ip_a, ip_b = repo.libs.s2s.get_subnet_for_connection(repo, *sorted({node.name, peer_name}))
|
|
|
|
if peer_name < node.name:
|
|
my_ip = ip_a
|
|
their_ip = ip_b
|
|
else:
|
|
my_ip = ip_b
|
|
their_ip = ip_a
|
|
|
|
peers[rnode.name] = {
|
|
'my_ip': str(my_ip),
|
|
'my_port': base_port + repo.libs.s2s.WG_AUTOGEN_NODES.index(rnode.name),
|
|
'their_ip': str(their_ip)
|
|
}
|
|
|
|
return {
|
|
'wireguard': {
|
|
'peers': peers,
|
|
},
|
|
}
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'wireguard/peers',
|
|
)
|
|
def peer_endpoints(metadata):
|
|
peers = {}
|
|
|
|
for name, config in metadata.get('wireguard/peers', {}).items():
|
|
try:
|
|
rnode = repo.get_node(name)
|
|
except NoSuchNode:
|
|
continue
|
|
|
|
|
|
peers[rnode.name] = {
|
|
'endpoint': '{}:{}'.format(
|
|
rnode.metadata.get('wireguard/external_hostname', rnode.hostname),
|
|
rnode.metadata.get(f'wireguard/peers/{node.name}/my_port', 51820),
|
|
),
|
|
}
|
|
|
|
return {
|
|
'wireguard': {
|
|
'peers': peers,
|
|
},
|
|
}
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'icinga2_api/wireguard/services',
|
|
)
|
|
def icinga2(metadata):
|
|
services = {}
|
|
|
|
for peer, config in sorted(metadata.get('wireguard/peers', {}).items()):
|
|
if config.get('exclude_from_monitoring', False):
|
|
continue
|
|
|
|
services[f'WIREGUARD CONNECTION {peer}'] = {
|
|
'command_on_monitored_host': config['pubkey'].format_into(f'sudo /usr/local/share/icinga/plugins/check_wireguard_connected wg_{config["iface"]} {{}}'),
|
|
}
|
|
|
|
return {
|
|
'icinga2_api': {
|
|
'wireguard': {
|
|
'services': services,
|
|
},
|
|
},
|
|
}
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'firewall/port_rules',
|
|
)
|
|
def firewall(metadata):
|
|
ports = {}
|
|
for name, config in metadata.get('wireguard/peers').items():
|
|
try:
|
|
rnode = repo.get_node(name)
|
|
except NoSuchNode: # roadwarrior
|
|
ports['{}/udp'.format(config['my_port'])] = atomic(set(metadata.get('wireguard/restrict-to', set())))
|
|
else:
|
|
ports['{}/udp'.format(config['my_port'])] = atomic({name})
|
|
|
|
return {
|
|
'firewall': {
|
|
'port_rules': ports,
|
|
},
|
|
}
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'interfaces',
|
|
)
|
|
def interface_ips(metadata):
|
|
interfaces = {}
|
|
snat_ip = metadata.get('wireguard/snat_ip', None)
|
|
|
|
for peer, config in sorted(metadata.get('wireguard/peers', {}).items()):
|
|
routes = {}
|
|
|
|
if '/' in config['my_ip']:
|
|
my_ip = config['my_ip']
|
|
else:
|
|
my_ip = '{}/31'.format(config['my_ip'])
|
|
|
|
ips = {my_ip}
|
|
if snat_ip:
|
|
ips.add(snat_ip)
|
|
|
|
their_ip = config['their_ip']
|
|
if '/' in their_ip:
|
|
their_ip = their_ip.split('/')[0]
|
|
|
|
for route in config.get('routes', set()):
|
|
routes[route] = {'via': their_ip}
|
|
|
|
interfaces[f'wg_{config["iface"]}'] = {
|
|
'activation_policy': 'up' if config.get('auto_connection', True) else 'manual',
|
|
'ips': ips,
|
|
'routes': routes,
|
|
}
|
|
return {
|
|
'interfaces': interfaces,
|
|
}
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'nftables/forward/10-wireguard',
|
|
'nftables/postrouting/10-wireguard',
|
|
)
|
|
def snat(metadata):
|
|
if not node.has_bundle('nftables') or node.os == 'arch':
|
|
raise DoNotRunAgain
|
|
|
|
snat_ip = metadata.get('wireguard/snat_ip', None)
|
|
|
|
forward = set()
|
|
postrouting = set()
|
|
for peer, config in sorted(metadata.get('wireguard/peers', {}).items()):
|
|
forward.add(f'iifname wg_{config["iface"]} accept')
|
|
forward.add(f'oifname wg_{config["iface"]} accept')
|
|
|
|
if snat_ip:
|
|
postrouting.add('ip saddr {} ip daddr != {} snat to {}'.format(
|
|
config['my_ip'],
|
|
config['their_ip'],
|
|
snat_ip,
|
|
))
|
|
|
|
return {
|
|
'nftables': {
|
|
'forward': {
|
|
'10-wireguard': sorted(forward),
|
|
},
|
|
'postrouting': {
|
|
'10-wireguard': sorted(postrouting),
|
|
},
|
|
},
|
|
}
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'wireguard/health_checks',
|
|
'systemd-timers/timers/wg-health-check',
|
|
)
|
|
def health_checks(metadata):
|
|
checks = {}
|
|
|
|
for peer, config in metadata.get('wireguard/peers', {}).items():
|
|
if (
|
|
config.get('exclude_from_monitoring', False)
|
|
or not config.get('auto_connection', True)
|
|
or 'endpoint' not in config
|
|
):
|
|
continue
|
|
|
|
checks[peer] = config['their_ip']
|
|
|
|
if checks:
|
|
timer = {
|
|
'wg-health-check': {
|
|
'command': '/usr/local/bin/wg_health_check',
|
|
'when': 'minutely',
|
|
},
|
|
}
|
|
else:
|
|
timer = {}
|
|
|
|
return {
|
|
'systemd-timers': {
|
|
'timers': timer,
|
|
},
|
|
'wireguard': {
|
|
'health_checks': checks,
|
|
},
|
|
}
|