mirror of https://github.com/h44z/wg-portal.git
908 lines
26 KiB
Go
908 lines
26 KiB
Go
package wireguard
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"log/slog"
|
|
"os"
|
|
"slices"
|
|
"time"
|
|
|
|
"github.com/h44z/wg-portal/internal/app"
|
|
"github.com/h44z/wg-portal/internal/app/audit"
|
|
"github.com/h44z/wg-portal/internal/domain"
|
|
)
|
|
|
|
// GetImportableInterfaces returns all physical interfaces that are available on the system.
|
|
// This function also returns interfaces that are already available in the database.
|
|
func (m Manager) GetImportableInterfaces(ctx context.Context) ([]domain.PhysicalInterface, error) {
|
|
if err := domain.ValidateAdminAccessRights(ctx); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
physicalInterfaces, err := m.wg.GetInterfaces(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return physicalInterfaces, nil
|
|
}
|
|
|
|
// GetInterfaceAndPeers returns the interface and all peers for the given interface identifier.
|
|
func (m Manager) GetInterfaceAndPeers(ctx context.Context, id domain.InterfaceIdentifier) (
|
|
*domain.Interface,
|
|
[]domain.Peer,
|
|
error,
|
|
) {
|
|
if err := domain.ValidateAdminAccessRights(ctx); err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
return m.db.GetInterfaceAndPeers(ctx, id)
|
|
}
|
|
|
|
// GetAllInterfaces returns all interfaces that are available in the database.
|
|
func (m Manager) GetAllInterfaces(ctx context.Context) ([]domain.Interface, error) {
|
|
if err := domain.ValidateAdminAccessRights(ctx); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return m.db.GetAllInterfaces(ctx)
|
|
}
|
|
|
|
// GetAllInterfacesAndPeers returns all interfaces and their peers.
|
|
func (m Manager) GetAllInterfacesAndPeers(ctx context.Context) ([]domain.Interface, [][]domain.Peer, error) {
|
|
if err := domain.ValidateAdminAccessRights(ctx); err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
interfaces, err := m.db.GetAllInterfaces(ctx)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("unable to load all interfaces: %w", err)
|
|
}
|
|
|
|
allPeers := make([][]domain.Peer, len(interfaces))
|
|
for i, iface := range interfaces {
|
|
peers, err := m.db.GetInterfacePeers(ctx, iface.Identifier)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("failed to load peers for interface %s: %w", iface.Identifier, err)
|
|
}
|
|
allPeers[i] = peers
|
|
}
|
|
|
|
return interfaces, allPeers, nil
|
|
}
|
|
|
|
// GetUserInterfaces returns all interfaces that are available for users to create new peers.
|
|
// If self-provisioning is disabled, this function will return an empty list.
|
|
// At the moment, there are no interfaces specific to single users, thus the user id is not used.
|
|
func (m Manager) GetUserInterfaces(ctx context.Context, _ domain.UserIdentifier) ([]domain.Interface, error) {
|
|
if !m.cfg.Core.SelfProvisioningAllowed {
|
|
return nil, nil // self-provisioning is disabled - no interfaces for users
|
|
}
|
|
|
|
interfaces, err := m.db.GetAllInterfaces(ctx)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unable to load all interfaces: %w", err)
|
|
}
|
|
|
|
// strip sensitive data, users only need very limited information
|
|
userInterfaces := make([]domain.Interface, 0, len(interfaces))
|
|
for _, iface := range interfaces {
|
|
if iface.IsDisabled() {
|
|
continue // skip disabled interfaces
|
|
}
|
|
if iface.Type != domain.InterfaceTypeServer {
|
|
continue // skip client interfaces
|
|
}
|
|
|
|
userInterfaces = append(userInterfaces, iface.PublicInfo())
|
|
}
|
|
|
|
return userInterfaces, nil
|
|
}
|
|
|
|
// ImportNewInterfaces imports all new physical interfaces that are available on the system.
|
|
func (m Manager) ImportNewInterfaces(ctx context.Context, filter ...domain.InterfaceIdentifier) (int, error) {
|
|
if err := domain.ValidateAdminAccessRights(ctx); err != nil {
|
|
return 0, err
|
|
}
|
|
|
|
physicalInterfaces, err := m.wg.GetInterfaces(ctx)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
|
|
// if no filter is given, exclude already existing interfaces
|
|
var excludedInterfaces []domain.InterfaceIdentifier
|
|
if len(filter) == 0 {
|
|
existingInterfaces, err := m.db.GetAllInterfaces(ctx)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
for _, existingInterface := range existingInterfaces {
|
|
excludedInterfaces = append(excludedInterfaces, existingInterface.Identifier)
|
|
}
|
|
}
|
|
|
|
imported := 0
|
|
for _, physicalInterface := range physicalInterfaces {
|
|
if slices.Contains(excludedInterfaces, physicalInterface.Identifier) {
|
|
continue
|
|
}
|
|
|
|
if len(filter) != 0 && !slices.Contains(filter, physicalInterface.Identifier) {
|
|
continue
|
|
}
|
|
|
|
slog.Info("importing new interface", "interface", physicalInterface.Identifier)
|
|
|
|
physicalPeers, err := m.wg.GetPeers(ctx, physicalInterface.Identifier)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
|
|
err = m.importInterface(ctx, &physicalInterface, physicalPeers)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("import of %s failed: %w", physicalInterface.Identifier, err)
|
|
}
|
|
|
|
slog.Info("imported new interface", "interface", physicalInterface.Identifier, "peers", len(physicalPeers))
|
|
imported++
|
|
}
|
|
|
|
return imported, nil
|
|
}
|
|
|
|
// ApplyPeerDefaults applies the interface defaults to all peers of the given interface.
|
|
func (m Manager) ApplyPeerDefaults(ctx context.Context, in *domain.Interface) error {
|
|
if err := domain.ValidateAdminAccessRights(ctx); err != nil {
|
|
return err
|
|
}
|
|
|
|
existingInterface, err := m.db.GetInterface(ctx, in.Identifier)
|
|
if err != nil {
|
|
return fmt.Errorf("unable to load existing interface %s: %w", in.Identifier, err)
|
|
}
|
|
|
|
if err := m.validateInterfaceModifications(ctx, existingInterface, in); err != nil {
|
|
return fmt.Errorf("update not allowed: %w", err)
|
|
}
|
|
|
|
peers, err := m.db.GetInterfacePeers(ctx, in.Identifier)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to find peers for interface %s: %w", in.Identifier, err)
|
|
}
|
|
|
|
for i := range peers {
|
|
(&peers[i]).ApplyInterfaceDefaults(in)
|
|
|
|
_, err := m.UpdatePeer(ctx, &peers[i])
|
|
if err != nil {
|
|
return fmt.Errorf("failed to apply interface defaults to peer %s: %w", peers[i].Identifier, err)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// RestoreInterfaceState restores the state of all physical interfaces and their peers.
|
|
// The final state of the interfaces and peers will be the same as stored in the database.
|
|
func (m Manager) RestoreInterfaceState(
|
|
ctx context.Context,
|
|
updateDbOnError bool,
|
|
filter ...domain.InterfaceIdentifier,
|
|
) error {
|
|
if err := domain.ValidateAdminAccessRights(ctx); err != nil {
|
|
return err
|
|
}
|
|
|
|
interfaces, err := m.db.GetAllInterfaces(ctx)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
for _, iface := range interfaces {
|
|
if len(filter) != 0 && !slices.Contains(filter, iface.Identifier) {
|
|
continue // ignore filtered interface
|
|
}
|
|
|
|
peers, err := m.db.GetInterfacePeers(ctx, iface.Identifier)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to load peers for %s: %w", iface.Identifier, err)
|
|
}
|
|
|
|
_, err = m.wg.GetInterface(ctx, iface.Identifier)
|
|
if err != nil && !iface.IsDisabled() {
|
|
slog.Debug("creating missing interface", "interface", iface.Identifier)
|
|
|
|
// try to create a new interface
|
|
_, err = m.saveInterface(ctx, &iface)
|
|
if err != nil {
|
|
if updateDbOnError {
|
|
// disable interface in database as no physical interface exists
|
|
_ = m.db.SaveInterface(ctx, iface.Identifier,
|
|
func(in *domain.Interface) (*domain.Interface, error) {
|
|
now := time.Now()
|
|
in.Disabled = &now // set
|
|
in.DisabledReason = domain.DisabledReasonInterfaceMissing
|
|
return in, nil
|
|
})
|
|
}
|
|
return fmt.Errorf("failed to create physical interface %s: %w", iface.Identifier, err)
|
|
}
|
|
} else {
|
|
slog.Debug("restoring interface state", "interface", iface.Identifier, "disabled", iface.IsDisabled())
|
|
|
|
// try to move interface to stored state
|
|
_, err = m.saveInterface(ctx, &iface)
|
|
if err != nil {
|
|
if updateDbOnError {
|
|
// disable interface in database as no physical interface is available
|
|
_ = m.db.SaveInterface(ctx, iface.Identifier,
|
|
func(in *domain.Interface) (*domain.Interface, error) {
|
|
if iface.IsDisabled() {
|
|
now := time.Now()
|
|
in.Disabled = &now // set
|
|
in.DisabledReason = domain.DisabledReasonInterfaceMissing
|
|
} else {
|
|
in.Disabled = nil
|
|
in.DisabledReason = ""
|
|
}
|
|
return in, nil
|
|
})
|
|
}
|
|
return fmt.Errorf("failed to change physical interface state for %s: %w", iface.Identifier, err)
|
|
}
|
|
}
|
|
|
|
// restore peers
|
|
for _, peer := range peers {
|
|
switch {
|
|
case iface.IsDisabled(): // if interface is disabled, delete all peers
|
|
if err := m.wg.DeletePeer(ctx, iface.Identifier, peer.Identifier); err != nil {
|
|
return fmt.Errorf("failed to remove peer %s for disabled interface %s: %w",
|
|
peer.Identifier, iface.Identifier, err)
|
|
}
|
|
case peer.IsDisabled(): // if peer is disabled, delete it
|
|
if err := m.wg.DeletePeer(ctx, iface.Identifier, peer.Identifier); err != nil {
|
|
return fmt.Errorf("failed to remove disbaled peer %s from interface %s: %w",
|
|
peer.Identifier, iface.Identifier, err)
|
|
}
|
|
default: // update peer
|
|
err := m.wg.SavePeer(ctx, iface.Identifier, peer.Identifier,
|
|
func(pp *domain.PhysicalPeer) (*domain.PhysicalPeer, error) {
|
|
domain.MergeToPhysicalPeer(pp, &peer)
|
|
return pp, nil
|
|
})
|
|
if err != nil {
|
|
return fmt.Errorf("failed to create/update physical peer %s for interface %s: %w",
|
|
peer.Identifier, iface.Identifier, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// remove non-wgportal peers
|
|
physicalPeers, _ := m.wg.GetPeers(ctx, iface.Identifier)
|
|
for _, physicalPeer := range physicalPeers {
|
|
isWgPortalPeer := false
|
|
for _, peer := range peers {
|
|
if peer.Identifier == domain.PeerIdentifier(physicalPeer.PublicKey) {
|
|
isWgPortalPeer = true
|
|
break
|
|
}
|
|
}
|
|
if !isWgPortalPeer {
|
|
err := m.wg.DeletePeer(ctx, iface.Identifier, domain.PeerIdentifier(physicalPeer.PublicKey))
|
|
if err != nil {
|
|
return fmt.Errorf("failed to remove non-wgportal peer %s from interface %s: %w",
|
|
physicalPeer.PublicKey, iface.Identifier, err)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// PrepareInterface generates a new interface with fresh keys, ip addresses and a listen port.
|
|
func (m Manager) PrepareInterface(ctx context.Context) (*domain.Interface, error) {
|
|
if err := domain.ValidateAdminAccessRights(ctx); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
currentUser := domain.GetUserInfo(ctx)
|
|
|
|
kp, err := domain.NewFreshKeypair()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to generate keys: %w", err)
|
|
}
|
|
|
|
id, err := m.getNewInterfaceName(ctx)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to generate new identifier: %w", err)
|
|
}
|
|
|
|
ipv4, ipv6, err := m.getFreshInterfaceIpConfig(ctx)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to generate new ip config: %w", err)
|
|
}
|
|
|
|
port, err := m.getFreshListenPort(ctx)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to generate new listen port: %w", err)
|
|
}
|
|
|
|
ips := []domain.Cidr{ipv4}
|
|
if m.cfg.Advanced.UseIpV6 {
|
|
ips = append(ips, ipv6)
|
|
}
|
|
networks := []domain.Cidr{ipv4.NetworkAddr()}
|
|
if m.cfg.Advanced.UseIpV6 {
|
|
networks = append(networks, ipv6.NetworkAddr())
|
|
}
|
|
|
|
freshInterface := &domain.Interface{
|
|
BaseModel: domain.BaseModel{
|
|
CreatedBy: string(currentUser.Id),
|
|
UpdatedBy: string(currentUser.Id),
|
|
CreatedAt: time.Now(),
|
|
UpdatedAt: time.Now(),
|
|
},
|
|
Identifier: id,
|
|
KeyPair: kp,
|
|
ListenPort: port,
|
|
Addresses: ips,
|
|
DnsStr: "",
|
|
DnsSearchStr: "",
|
|
Mtu: 1420,
|
|
FirewallMark: 0,
|
|
RoutingTable: "",
|
|
PreUp: "",
|
|
PostUp: "",
|
|
PreDown: "",
|
|
PostDown: "",
|
|
SaveConfig: m.cfg.Advanced.ConfigStoragePath != "",
|
|
DisplayName: string(id),
|
|
Type: domain.InterfaceTypeServer,
|
|
DriverType: "",
|
|
Disabled: nil,
|
|
DisabledReason: "",
|
|
PeerDefNetworkStr: domain.CidrsToString(networks),
|
|
PeerDefDnsStr: "",
|
|
PeerDefDnsSearchStr: "",
|
|
PeerDefEndpoint: "",
|
|
PeerDefAllowedIPsStr: domain.CidrsToString(networks),
|
|
PeerDefMtu: 1420,
|
|
PeerDefPersistentKeepalive: 16,
|
|
PeerDefFirewallMark: 0,
|
|
PeerDefRoutingTable: "",
|
|
PeerDefPreUp: "",
|
|
PeerDefPostUp: "",
|
|
PeerDefPreDown: "",
|
|
PeerDefPostDown: "",
|
|
}
|
|
|
|
return freshInterface, nil
|
|
}
|
|
|
|
// CreateInterface creates a new interface with the given configuration.
|
|
func (m Manager) CreateInterface(ctx context.Context, in *domain.Interface) (*domain.Interface, error) {
|
|
if err := domain.ValidateAdminAccessRights(ctx); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
existingInterface, err := m.db.GetInterface(ctx, in.Identifier)
|
|
if err != nil && !errors.Is(err, domain.ErrNotFound) {
|
|
return nil, fmt.Errorf("unable to load existing interface %s: %w", in.Identifier, err)
|
|
}
|
|
if existingInterface != nil {
|
|
return nil, fmt.Errorf("interface %s already exists: %w", in.Identifier, domain.ErrDuplicateEntry)
|
|
}
|
|
|
|
if err := m.validateInterfaceCreation(ctx, existingInterface, in); err != nil {
|
|
return nil, fmt.Errorf("creation not allowed: %w", err)
|
|
}
|
|
|
|
in, err = m.saveInterface(ctx, in)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("creation failure: %w", err)
|
|
}
|
|
|
|
m.bus.Publish(app.TopicInterfaceCreated, *in)
|
|
|
|
return in, nil
|
|
}
|
|
|
|
// UpdateInterface updates the given interface with the new configuration.
|
|
func (m Manager) UpdateInterface(ctx context.Context, in *domain.Interface) (*domain.Interface, []domain.Peer, error) {
|
|
if err := domain.ValidateAdminAccessRights(ctx); err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
existingInterface, existingPeers, err := m.db.GetInterfaceAndPeers(ctx, in.Identifier)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("unable to load existing interface %s: %w", in.Identifier, err)
|
|
}
|
|
|
|
if err := m.validateInterfaceModifications(ctx, existingInterface, in); err != nil {
|
|
return nil, nil, fmt.Errorf("update not allowed: %w", err)
|
|
}
|
|
|
|
in, err = m.saveInterface(ctx, in)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("update failure: %w", err)
|
|
}
|
|
|
|
m.bus.Publish(app.TopicInterfaceUpdated, *in)
|
|
|
|
return in, existingPeers, nil
|
|
}
|
|
|
|
// DeleteInterface deletes the given interface.
|
|
func (m Manager) DeleteInterface(ctx context.Context, id domain.InterfaceIdentifier) error {
|
|
if err := domain.ValidateAdminAccessRights(ctx); err != nil {
|
|
return err
|
|
}
|
|
|
|
existingInterface, err := m.db.GetInterface(ctx, id)
|
|
if err != nil {
|
|
return fmt.Errorf("unable to find interface %s: %w", id, err)
|
|
}
|
|
|
|
if err := m.validateInterfaceDeletion(ctx, existingInterface); err != nil {
|
|
return fmt.Errorf("deletion not allowed: %w", err)
|
|
}
|
|
|
|
now := time.Now()
|
|
existingInterface.Disabled = &now // simulate a disabled interface
|
|
existingInterface.DisabledReason = domain.DisabledReasonDeleted
|
|
|
|
physicalInterface, _ := m.wg.GetInterface(ctx, id)
|
|
|
|
if err := m.handleInterfacePreSaveHooks(true, existingInterface); err != nil {
|
|
return fmt.Errorf("pre-delete hooks failed: %w", err)
|
|
}
|
|
|
|
if err := m.handleInterfacePreSaveActions(existingInterface); err != nil {
|
|
return fmt.Errorf("pre-delete actions failed: %w", err)
|
|
}
|
|
|
|
if err := m.deleteInterfacePeers(ctx, id); err != nil {
|
|
return fmt.Errorf("peer deletion failure: %w", err)
|
|
}
|
|
|
|
if err := m.wg.DeleteInterface(ctx, id); err != nil {
|
|
return fmt.Errorf("wireguard deletion failure: %w", err)
|
|
}
|
|
|
|
if err := m.db.DeleteInterface(ctx, id); err != nil {
|
|
return fmt.Errorf("deletion failure: %w", err)
|
|
}
|
|
|
|
fwMark := existingInterface.FirewallMark
|
|
if physicalInterface != nil && fwMark == 0 {
|
|
fwMark = physicalInterface.FirewallMark
|
|
}
|
|
m.bus.Publish(app.TopicRouteRemove, domain.RoutingTableInfo{
|
|
FwMark: fwMark,
|
|
Table: existingInterface.GetRoutingTable(),
|
|
})
|
|
|
|
if err := m.handleInterfacePostSaveHooks(true, existingInterface); err != nil {
|
|
return fmt.Errorf("post-delete hooks failed: %w", err)
|
|
}
|
|
|
|
m.bus.Publish(app.TopicInterfaceDeleted, *existingInterface)
|
|
|
|
return nil
|
|
}
|
|
|
|
// region helper-functions
|
|
|
|
func (m Manager) saveInterface(ctx context.Context, iface *domain.Interface) (
|
|
*domain.Interface,
|
|
error,
|
|
) {
|
|
if err := iface.Validate(); err != nil {
|
|
return nil, fmt.Errorf("interface validation failed: %w", err)
|
|
}
|
|
|
|
stateChanged := m.hasInterfaceStateChanged(ctx, iface)
|
|
|
|
if err := m.handleInterfacePreSaveHooks(stateChanged, iface); err != nil {
|
|
return nil, fmt.Errorf("pre-save hooks failed: %w", err)
|
|
}
|
|
|
|
if err := m.handleInterfacePreSaveActions(iface); err != nil {
|
|
return nil, fmt.Errorf("pre-save actions failed: %w", err)
|
|
}
|
|
|
|
err := m.db.SaveInterface(ctx, iface.Identifier, func(i *domain.Interface) (*domain.Interface, error) {
|
|
iface.CopyCalculatedAttributes(i)
|
|
|
|
err := m.wg.SaveInterface(ctx, iface.Identifier,
|
|
func(pi *domain.PhysicalInterface) (*domain.PhysicalInterface, error) {
|
|
domain.MergeToPhysicalInterface(pi, iface)
|
|
return pi, nil
|
|
})
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to save physical interface %s: %w", iface.Identifier, err)
|
|
}
|
|
|
|
return iface, nil
|
|
})
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to save interface: %w", err)
|
|
}
|
|
|
|
if iface.IsDisabled() {
|
|
physicalInterface, _ := m.wg.GetInterface(ctx, iface.Identifier)
|
|
fwMark := iface.FirewallMark
|
|
if physicalInterface != nil && fwMark == 0 {
|
|
fwMark = physicalInterface.FirewallMark
|
|
}
|
|
m.bus.Publish(app.TopicRouteRemove, domain.RoutingTableInfo{
|
|
FwMark: fwMark,
|
|
Table: iface.GetRoutingTable(),
|
|
})
|
|
} else {
|
|
m.bus.Publish(app.TopicRouteUpdate, "interface updated: "+string(iface.Identifier))
|
|
}
|
|
|
|
if err := m.handleInterfacePostSaveHooks(stateChanged, iface); err != nil {
|
|
return nil, fmt.Errorf("post-save hooks failed: %w", err)
|
|
}
|
|
|
|
m.bus.Publish(app.TopicAuditInterfaceChanged, domain.AuditEventWrapper[audit.InterfaceEvent]{
|
|
Ctx: ctx,
|
|
Event: audit.InterfaceEvent{
|
|
Interface: *iface,
|
|
Action: "save",
|
|
},
|
|
})
|
|
|
|
return iface, nil
|
|
}
|
|
|
|
func (m Manager) hasInterfaceStateChanged(ctx context.Context, iface *domain.Interface) bool {
|
|
oldInterface, err := m.db.GetInterface(ctx, iface.Identifier)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
|
|
if oldInterface.IsDisabled() != iface.IsDisabled() {
|
|
return true // interface in db has changed
|
|
}
|
|
|
|
wgInterface, err := m.wg.GetInterface(ctx, iface.Identifier)
|
|
if err != nil {
|
|
return true // interface might not exist - so we assume that there must be a change
|
|
}
|
|
|
|
// compare physical interface settings
|
|
if len(wgInterface.Addresses) != len(iface.Addresses) ||
|
|
wgInterface.Mtu != iface.Mtu ||
|
|
wgInterface.FirewallMark != iface.FirewallMark ||
|
|
wgInterface.ListenPort != iface.ListenPort ||
|
|
wgInterface.PrivateKey != iface.PrivateKey ||
|
|
wgInterface.PublicKey != iface.PublicKey {
|
|
return true
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
func (m Manager) handleInterfacePreSaveActions(iface *domain.Interface) error {
|
|
if !iface.IsDisabled() {
|
|
if err := m.quick.SetDNS(iface.Identifier, iface.DnsStr, iface.DnsSearchStr); err != nil {
|
|
return fmt.Errorf("failed to update dns settings: %w", err)
|
|
}
|
|
} else {
|
|
if err := m.quick.UnsetDNS(iface.Identifier); err != nil {
|
|
return fmt.Errorf("failed to clear dns settings: %w", err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (m Manager) handleInterfacePreSaveHooks(stateChanged bool, iface *domain.Interface) error {
|
|
if !stateChanged {
|
|
return nil // do nothing if state did not change
|
|
}
|
|
|
|
if !iface.IsDisabled() {
|
|
if err := m.quick.ExecuteInterfaceHook(iface.Identifier, iface.PreUp); err != nil {
|
|
return fmt.Errorf("failed to execute pre-up hook: %w", err)
|
|
}
|
|
} else {
|
|
if err := m.quick.ExecuteInterfaceHook(iface.Identifier, iface.PreDown); err != nil {
|
|
return fmt.Errorf("failed to execute pre-down hook: %w", err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (m Manager) handleInterfacePostSaveHooks(stateChanged bool, iface *domain.Interface) error {
|
|
if !stateChanged {
|
|
return nil // do nothing if state did not change
|
|
}
|
|
|
|
if !iface.IsDisabled() {
|
|
if err := m.quick.ExecuteInterfaceHook(iface.Identifier, iface.PostUp); err != nil {
|
|
return fmt.Errorf("failed to execute post-up hook: %w", err)
|
|
}
|
|
} else {
|
|
if err := m.quick.ExecuteInterfaceHook(iface.Identifier, iface.PostDown); err != nil {
|
|
return fmt.Errorf("failed to execute post-down hook: %w", err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (m Manager) getNewInterfaceName(ctx context.Context) (domain.InterfaceIdentifier, error) {
|
|
namePrefix := "wg"
|
|
nameSuffix := 0
|
|
|
|
existingInterfaces, err := m.db.GetAllInterfaces(ctx)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
var name domain.InterfaceIdentifier
|
|
for {
|
|
name = domain.InterfaceIdentifier(fmt.Sprintf("%s%d", namePrefix, nameSuffix))
|
|
|
|
conflict := false
|
|
for _, in := range existingInterfaces {
|
|
if in.Identifier == name {
|
|
conflict = true
|
|
break
|
|
}
|
|
}
|
|
if !conflict {
|
|
break
|
|
}
|
|
|
|
nameSuffix++
|
|
}
|
|
|
|
return name, nil
|
|
}
|
|
|
|
func (m Manager) getFreshInterfaceIpConfig(ctx context.Context) (ipV4, ipV6 domain.Cidr, err error) {
|
|
ips, err := m.db.GetInterfaceIps(ctx)
|
|
if err != nil {
|
|
err = fmt.Errorf("failed to get existing IP addresses: %w", err)
|
|
return
|
|
}
|
|
|
|
useV6 := m.cfg.Advanced.UseIpV6
|
|
ipV4, _ = domain.CidrFromString(m.cfg.Advanced.StartCidrV4)
|
|
ipV6, _ = domain.CidrFromString(m.cfg.Advanced.StartCidrV6)
|
|
|
|
ipV4 = ipV4.FirstAddr()
|
|
ipV6 = ipV6.FirstAddr()
|
|
|
|
netV4 := ipV4.NetworkAddr()
|
|
netV6 := ipV6.NetworkAddr()
|
|
for {
|
|
v4Conflict := false
|
|
v6Conflict := false
|
|
for _, usedIps := range ips {
|
|
for _, usedIp := range usedIps {
|
|
usedNetwork := usedIp.NetworkAddr()
|
|
if netV4 == usedNetwork {
|
|
v4Conflict = true
|
|
}
|
|
|
|
if netV6 == usedNetwork {
|
|
v6Conflict = true
|
|
}
|
|
}
|
|
}
|
|
|
|
if !v4Conflict && (!useV6 || !v6Conflict) {
|
|
break
|
|
}
|
|
|
|
if v4Conflict {
|
|
netV4 = netV4.NextSubnet()
|
|
}
|
|
|
|
if v6Conflict && useV6 {
|
|
netV6 = netV6.NextSubnet()
|
|
}
|
|
|
|
if !netV4.IsValid() {
|
|
return domain.Cidr{}, domain.Cidr{}, fmt.Errorf("IPv4 space exhausted")
|
|
}
|
|
|
|
if useV6 && !netV6.IsValid() {
|
|
return domain.Cidr{}, domain.Cidr{}, fmt.Errorf("IPv6 space exhausted")
|
|
}
|
|
}
|
|
|
|
// use first address in network for interface
|
|
ipV4 = netV4.NextAddr()
|
|
ipV6 = netV6.NextAddr()
|
|
|
|
return
|
|
}
|
|
|
|
func (m Manager) getFreshListenPort(ctx context.Context) (port int, err error) {
|
|
existingInterfaces, err := m.db.GetAllInterfaces(ctx)
|
|
if err != nil {
|
|
return -1, err
|
|
}
|
|
|
|
port = m.cfg.Advanced.StartListenPort
|
|
|
|
for {
|
|
conflict := false
|
|
for _, in := range existingInterfaces {
|
|
if in.ListenPort == port {
|
|
conflict = true
|
|
break
|
|
}
|
|
}
|
|
if !conflict {
|
|
break
|
|
}
|
|
|
|
port++
|
|
}
|
|
|
|
if port > 65535 { // maximum allowed port number (16 bit uint)
|
|
return -1, fmt.Errorf("port space exhausted")
|
|
}
|
|
|
|
return
|
|
}
|
|
|
|
func (m Manager) importInterface(ctx context.Context, in *domain.PhysicalInterface, peers []domain.PhysicalPeer) error {
|
|
now := time.Now()
|
|
iface := domain.ConvertPhysicalInterface(in)
|
|
iface.BaseModel = domain.BaseModel{
|
|
CreatedBy: domain.CtxSystemWgImporter,
|
|
UpdatedBy: domain.CtxSystemWgImporter,
|
|
CreatedAt: now,
|
|
UpdatedAt: now,
|
|
}
|
|
iface.PeerDefAllowedIPsStr = iface.AddressStr()
|
|
|
|
existingInterface, err := m.db.GetInterface(ctx, iface.Identifier)
|
|
if err != nil && !errors.Is(err, domain.ErrNotFound) {
|
|
return err
|
|
}
|
|
if existingInterface != nil {
|
|
return errors.New("interface already exists")
|
|
}
|
|
|
|
err = m.db.SaveInterface(ctx, iface.Identifier, func(_ *domain.Interface) (*domain.Interface, error) {
|
|
return iface, nil
|
|
})
|
|
if err != nil {
|
|
return fmt.Errorf("database save failed: %w", err)
|
|
}
|
|
|
|
// import peers
|
|
for _, peer := range peers {
|
|
err = m.importPeer(ctx, iface, &peer)
|
|
if err != nil {
|
|
return fmt.Errorf("import of peer %s failed: %w", peer.Identifier, err)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (m Manager) importPeer(ctx context.Context, in *domain.Interface, p *domain.PhysicalPeer) error {
|
|
now := time.Now()
|
|
peer := domain.ConvertPhysicalPeer(p)
|
|
peer.BaseModel = domain.BaseModel{
|
|
CreatedBy: domain.CtxSystemWgImporter,
|
|
UpdatedBy: domain.CtxSystemWgImporter,
|
|
CreatedAt: now,
|
|
UpdatedAt: now,
|
|
}
|
|
|
|
peer.InterfaceIdentifier = in.Identifier
|
|
peer.EndpointPublicKey = domain.NewConfigOption(in.PublicKey, true)
|
|
peer.AllowedIPsStr = domain.NewConfigOption(in.PeerDefAllowedIPsStr, true)
|
|
peer.Interface.Addresses = p.AllowedIPs // use allowed IP's as the peer IP's TODO: Should this also match server interface address' prefix length?
|
|
peer.Interface.DnsStr = domain.NewConfigOption(in.PeerDefDnsStr, true)
|
|
peer.Interface.DnsSearchStr = domain.NewConfigOption(in.PeerDefDnsSearchStr, true)
|
|
peer.Interface.Mtu = domain.NewConfigOption(in.PeerDefMtu, true)
|
|
peer.Interface.FirewallMark = domain.NewConfigOption(in.PeerDefFirewallMark, true)
|
|
peer.Interface.RoutingTable = domain.NewConfigOption(in.PeerDefRoutingTable, true)
|
|
peer.Interface.PreUp = domain.NewConfigOption(in.PeerDefPreUp, true)
|
|
peer.Interface.PostUp = domain.NewConfigOption(in.PeerDefPostUp, true)
|
|
peer.Interface.PreDown = domain.NewConfigOption(in.PeerDefPreDown, true)
|
|
peer.Interface.PostDown = domain.NewConfigOption(in.PeerDefPostDown, true)
|
|
|
|
switch in.Type {
|
|
case domain.InterfaceTypeAny:
|
|
peer.Interface.Type = domain.InterfaceTypeAny
|
|
peer.DisplayName = "Autodetected Peer (" + peer.Interface.PublicKey[0:8] + ")"
|
|
case domain.InterfaceTypeClient:
|
|
peer.Interface.Type = domain.InterfaceTypeServer
|
|
peer.DisplayName = "Autodetected Endpoint (" + peer.Interface.PublicKey[0:8] + ")"
|
|
case domain.InterfaceTypeServer:
|
|
peer.Interface.Type = domain.InterfaceTypeClient
|
|
peer.DisplayName = "Autodetected Client (" + peer.Interface.PublicKey[0:8] + ")"
|
|
}
|
|
|
|
err := m.db.SavePeer(ctx, peer.Identifier, func(_ *domain.Peer) (*domain.Peer, error) {
|
|
return peer, nil
|
|
})
|
|
if err != nil {
|
|
return fmt.Errorf("database save failed: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (m Manager) deleteInterfacePeers(ctx context.Context, id domain.InterfaceIdentifier) error {
|
|
allPeers, err := m.db.GetInterfacePeers(ctx, id)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
for _, peer := range allPeers {
|
|
err = m.wg.DeletePeer(ctx, id, peer.Identifier)
|
|
if err != nil && !errors.Is(err, os.ErrNotExist) {
|
|
return fmt.Errorf("wireguard peer deletion failure for %s: %w", peer.Identifier, err)
|
|
}
|
|
|
|
err = m.db.DeletePeer(ctx, peer.Identifier)
|
|
if err != nil {
|
|
return fmt.Errorf("peer deletion failure for %s: %w", peer.Identifier, err)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (m Manager) validateInterfaceModifications(ctx context.Context, _, _ *domain.Interface) error {
|
|
currentUser := domain.GetUserInfo(ctx)
|
|
|
|
if !currentUser.IsAdmin {
|
|
return fmt.Errorf("insufficient permissions")
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (m Manager) validateInterfaceCreation(ctx context.Context, _, new *domain.Interface) error {
|
|
currentUser := domain.GetUserInfo(ctx)
|
|
|
|
if new.Identifier == "" {
|
|
return fmt.Errorf("invalid interface identifier")
|
|
}
|
|
|
|
if !currentUser.IsAdmin {
|
|
return fmt.Errorf("insufficient permissions")
|
|
}
|
|
|
|
// validate public key if it is set
|
|
if new.PublicKey != "" && new.PrivateKey != "" {
|
|
if domain.PublicKeyFromPrivateKey(new.PrivateKey) != new.PublicKey {
|
|
return fmt.Errorf("invalid public key for given privatekey: %w", domain.ErrInvalidData)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (m Manager) validateInterfaceDeletion(ctx context.Context, _ *domain.Interface) error {
|
|
currentUser := domain.GetUserInfo(ctx)
|
|
|
|
if !currentUser.IsAdmin {
|
|
return fmt.Errorf("insufficient permissions")
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// endregion helper-functions
|