Page MenuHomeVyOS Platform
Files F117520841

No OneTemporary
Actions

Size
13 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/debian/control b/debian/control
index c42915cb7..851152d95 100644
--- a/debian/control
+++ b/debian/control
@@ -1,156 +1,157 @@
Source: vyos-1x
Section: contrib/net
Priority: extra
Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
Build-Depends:
debhelper (>= 9),
fakeroot,
gcc-multilib [amd64],
clang [amd64],
llvm [amd64],
libelf-dev (>= 0.2) [amd64],
libpcap-dev [amd64],
build-essential,
libvyosconfig0 (>= 0.0.7),
libzmq3-dev,
python3,
python3-coverage,
python3-lxml,
python3-netifaces,
python3-nose,
python3-jinja2,
python3-psutil,
python3-setuptools,
python3-sphinx,
python3-xmltodict,
quilt,
whois
Standards-Version: 3.9.6
Package: vyos-1x
Architecture: amd64 arm64
Depends:
accel-ppp,
beep,
bmon,
bsdmainutils,
conntrack,
conserver-client,
conserver-server,
console-data,
crda,
cron,
dbus,
ddclient (>= 3.9.1),
dropbear,
easy-rsa,
etherwake,
fastnetmon,
file,
frr (>= 7.5),
frr-pythontools,
frr-rpki-rtrlib,
frr-snmp,
grc,
hostapd (>= 0.6.8),
hvinfo,
igmpproxy,
ipaddrcheck,
iperf,
iperf3,
iputils-arping,
isc-dhcp-client,
isc-dhcp-relay,
isc-dhcp-server,
iw,
keepalived (>=2.0.5),
lcdproc,
libatomic1,
libndp-tools,
libpam-radius-auth (>= 1.5.0),
libvyosconfig0,
lldpd,
lm-sensors,
lsscsi,
mdns-repeater,
minisign,
mtr-tiny,
netplug,
nftables (>= 0.9.3),
nginx-light,
ntp,
ntpdate,
ocserv,
openssh-server,
openssl,
openvpn,
openvpn-auth-ldap,
openvpn-auth-radius,
pciutils,
pdns-recursor,
pmacct (>= 1.6.0),
podman,
pppoe,
procps,
python3,
python3-certbot-nginx,
${python3:Depends},
python3-flask,
python3-hurry.filesize,
python3-isc-dhcp-leases,
python3-jinja2,
python3-jmespath,
python3-netaddr,
python3-netifaces,
python3-paramiko,
python3-psutil,
python3-pystache,
python3-pyudev,
python3-six,
python3-tabulate,
python3-vici (>= 5.7.2),
python3-voluptuous,
python3-waitress,
python3-xmltodict,
python3-zmq,
+ qrencode,
radvd,
salt-minion,
snmp,
snmpd,
squid,
squidclient,
squidguard,
ssl-cert,
systemd,
tcpdump,
tcptraceroute,
telnet,
tftpd-hpa,
traceroute,
tuned,
udp-broadcast-relay,
usb-modeswitch,
usbutils,
vyos-http-api-tools,
vyos-utils,
wide-dhcpv6-client,
wireguard-tools,
wireless-regdb,
wpasupplicant (>= 0.6.7),
ndppd
Description: VyOS configuration scripts and data
VyOS configuration scripts, interface definitions, and everything
Package: vyos-1x-vmware
Architecture: amd64
Depends:
vyos-1x,
open-vm-tools
Description: VyOS configuration scripts and data for VMware
Adds configuration files required for VyOS running on VMware hosts.
Package: vyos-1x-smoketest
Architecture: all
Depends:
vyos-1x
Description: VyOS build sanity checking toolkit
diff --git a/op-mode-definitions/wireguard.xml.in b/op-mode-definitions/wireguard.xml.in
index 4aee4b1ac..1e9801252 100644
--- a/op-mode-definitions/wireguard.xml.in
+++ b/op-mode-definitions/wireguard.xml.in
@@ -1,137 +1,169 @@
<?xml version="1.0"?>
<!-- Wireguard key management -->
<interfaceDefinition>
<node name="generate">
<children>
<node name="wireguard">
<properties>
<help>Generate Wireguard keys</help>
</properties>
<children>
<leafNode name="default-keypair">
<properties>
<help>Generate the default Wireguard keypair</help>
</properties>
<command>sudo ${vyos_op_scripts_dir}/wireguard.py --genkey</command>
</leafNode>
<leafNode name="preshared-key">
<properties>
<help>Generate a Wireguard preshared key</help>
</properties>
<command>${vyos_op_scripts_dir}/wireguard.py --genpsk</command>
</leafNode>
<tagNode name="named-keypairs">
<properties>
<help>Generate specified Wireguard keypairs</help>
</properties>
<command>sudo ${vyos_op_scripts_dir}/wireguard.py --genkey --location "$4"</command>
</tagNode>
+ <tagNode name="mobile-config">
+ <properties>
+ <help>Generate QR code and movile configuration for Wireguard interface</help>
+ <completionHelp>
+ <script>${vyos_completion_dir}/list_interfaces.py --type wireguard</script>
+ </completionHelp>
+ </properties>
+ <children>
+ <tagNode name="server">
+ <properties>
+ <help>IP address or FQDN the client will connect to</help>
+ <completionHelp>
+ <script>${vyos_completion_dir}/list_local_ips.sh --both</script>
+ <list>&lt;hostname&gt;</list>
+ </completionHelp>
+ </properties>
+ <command>sudo ${vyos_op_scripts_dir}/wireguard_client.py --interface "$4" --server "$6"</command>
+ <children>
+ <tagNode name="address">
+ <properties>
+ <help>IPv4/IPv6 address used on the client side</help>
+ <completionHelp>
+ <script>${vyos_completion_dir}/list_local_ips.sh --both</script>
+ <list>&lt;hostname&gt;</list>
+ </completionHelp>
+ </properties>
+ <command>sudo ${vyos_op_scripts_dir}/wireguard_client.py --interface "$4" --server "$6" --address "$8"</command>
+ </tagNode>
+ </children>
+ </tagNode>
+ </children>
+ </tagNode>
</children>
</node>
</children>
</node>
<node name="show">
<children>
<node name="wireguard">
<properties>
<help>Show Wireguard properties</help>
</properties>
<children>
<node name="keypairs">
<properties>
<help>Show Wireguard keys</help>
</properties>
<children>
<tagNode name="pubkey">
<properties>
<help>Show specified Wireguard public key</help>
<completionHelp>
<script>${vyos_op_scripts_dir}/wireguard.py --listkdir</script>
</completionHelp>
</properties>
<command>${vyos_op_scripts_dir}/wireguard.py --showpub --location "$5"</command>
</tagNode>
<tagNode name="privkey">
<properties>
<help>Show specified Wireguard private key</help>
<completionHelp>
<script>${vyos_op_scripts_dir}/wireguard.py --listkdir</script>
</completionHelp>
</properties>
<command>${vyos_op_scripts_dir}/wireguard.py --showpriv --location "$5"</command>
</tagNode>
</children>
</node>
</children>
</node>
<node name="interfaces">
<children>
<tagNode name="wireguard">
<properties>
<help>Show Wireguard interface information</help>
<completionHelp>
<script>${vyos_completion_dir}/list_interfaces.py --type wireguard</script>
</completionHelp>
</properties>
- <command>sudo ${vyos_op_scripts_dir}/wireguard.py --showinterface "$4"</command>
+ <command>sudo ${vyos_op_scripts_dir}/wireguard.py --showinterface "$4"</command>
<children>
<leafNode name="allowed-ips">
<properties>
<help>Show all IP addresses allowed for the specified interface</help>
</properties>
<command>sudo wg show "$4" allowed-ips</command>
</leafNode>
<leafNode name="endpoints">
<properties>
<help>Show all endpoints for the specified interface</help>
</properties>
<command>sudo wg show "$4" endpoints</command>
</leafNode>
<leafNode name="peers">
<properties>
<help>Show all peer IDs for the specified interface</help>
</properties>
<command>sudo wg show "$4" peers</command>
</leafNode>
<!-- more commands upon request -->
</children>
</tagNode>
<node name="wireguard">
<properties>
<help>Show Wireguard interface information</help>
</properties>
<command>${vyos_op_scripts_dir}/show_interfaces.py --intf-type=wireguard --action=show-brief</command>
<children>
<leafNode name="detail">
<properties>
<help>Show detailed Wireguard interface information</help>
</properties>
<command>${vyos_op_scripts_dir}/show_interfaces.py --intf-type=wireguard --action=show</command>
</leafNode>
</children>
</node>
</children>
</node>
</children>
</node>
<node name="delete">
<children>
<node name="wireguard">
<properties>
<help>Delete Wireguard properties</help>
</properties>
<children>
<tagNode name="keypair">
<properties>
<help>Delete a Wireguard keypair</help>
<completionHelp>
<script>${vyos_op_scripts_dir}/wireguard.py --listkdir</script>
</completionHelp>
</properties>
<command>sudo ${vyos_op_scripts_dir}/wireguard.py --delkdir --location "$4"</command>
</tagNode>
</children>
</node>
</children>
</node>
</interfaceDefinition>
diff --git a/src/op_mode/wireguard_client.py b/src/op_mode/wireguard_client.py
new file mode 100755
index 000000000..b25aac2c8
--- /dev/null
+++ b/src/op_mode/wireguard_client.py
@@ -0,0 +1,92 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import argparse
+import os
+
+from jinja2 import Template
+from ipaddress import ip_interface
+
+from vyos.template import is_ipv4
+from vyos.template import is_ipv6
+from vyos.util import cmd
+from vyos.util import popen
+
+if os.geteuid() != 0:
+ exit("You need to have root privileges to run this script.\nPlease try again, this time using 'sudo'. Exiting.")
+
+tmpl = """
+[Interface]
+PrivateKey = {{ privkey }}
+{% if address is defined and address|length > 0 %}
+Address = {{ address | join(', ')}}
+{% endif %}
+
+[Peer]
+PublicKey = {{ system_pubkey }}
+Endpoint = {{ server }}:{{ port }}
+AllowedIPs = 0.0.0.0/0, ::/0
+"""
+
+if __name__ == '__main__':
+ parser = argparse.ArgumentParser()
+ parser.add_argument("-i", "--interface", type=str, help='WireGuard interface the client is connecting to', required=True)
+ parser.add_argument("-s", "--server", type=str, help='WireGuard server IPv4/IPv6 address or FQDN', required=True)
+ parser.add_argument("-a", "--address", type=str, help='WireGuard client IPv4/IPv6 address', action='append')
+ args = parser.parse_args()
+
+ interface = args.interface
+ wg_pubkey = cmd(f'wg show {interface} | grep "public key"').split(':')[-1].lstrip()
+ wg_port = cmd(f'wg show {interface} | grep "listening port"').split(':')[-1].lstrip()
+
+ # Generate WireGuard private key
+ privkey,_ = popen('wg genkey')
+ # Generate public key portion from given private key
+ pubkey,_ = popen('wg pubkey', input=privkey)
+
+ config = {
+ 'system_pubkey' : wg_pubkey,
+ 'privkey': privkey,
+ 'pubkey' : pubkey,
+ 'server' : args.server,
+ 'port' : wg_port,
+ 'address' : [],
+ }
+
+ if args.address:
+ v4_addr = 0
+ v6_addr = 0
+ for tmp in args.address:
+ try:
+ config['address'].append(str(ip_interface(tmp)))
+ if is_ipv4(tmp):
+ v4_addr += 1
+ elif is_ipv6(tmp):
+ v6_addr += 1
+ except:
+ print(tmp)
+ exit('Client IP address invalid!')
+
+ if (v4_addr > 1) or (v6_addr > 1):
+ exit('Client can only have one IPv4 and one IPv6 address.')
+
+ tmp = Template(tmpl, trim_blocks=True).render(config)
+ qrcode,err = popen('qrencode -t ansiutf8', input=tmp)
+
+ print(f'\nWireGuard client configuration for interface: {interface}')
+ print(tmp)
+ print('\n')
+ print(qrcode)

File Metadata

Mime Type
text/x-diff
Expires
Sat, Sep 26, 12:31 PM (1 d, 17 h)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
4285146
Default Alt Text
(13 KB)

Event Timeline