Merge pull request #4200 from sskaje/T4930-1

T4930: Allow WireGuard peers via DNS hostname

4 files changed, 137 insertions, 111 deletions

diff --git a/python/vyos/configquery.py b/python/vyos/configquery.py
index 5d6ca9be9..4c4ead0a3 100644
--- a/python/vyos/configquery.py
+++ b/python/vyos/configquery.py
@@ -1,4 +1,4 @@
-# Copyright 2021-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2021-2025 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -120,11 +120,14 @@ class ConfigTreeQuery(GenericConfigQuery):
 
     def get_config_dict(self, path=[], effective=False, key_mangling=None,
                         get_first_key=False, no_multi_convert=False,
-                        no_tag_node_value_mangle=False):
+                        no_tag_node_value_mangle=False, with_defaults=False,
+                        with_recursive_defaults=False):
         return self.config.get_config_dict(path, effective=effective,
                 key_mangling=key_mangling, get_first_key=get_first_key,
                 no_multi_convert=no_multi_convert,
-                no_tag_node_value_mangle=no_tag_node_value_mangle)
+                no_tag_node_value_mangle=no_tag_node_value_mangle,
+                with_defaults=with_defaults,
+                with_recursive_defaults=with_recursive_defaults)
 
 class VbashOpRun(GenericOpRun):
     def __init__(self):
diff --git a/python/vyos/ifconfig/control.py b/python/vyos/ifconfig/control.py
index 7402da55a..a886c1b9e 100644
--- a/python/vyos/ifconfig/control.py
+++ b/python/vyos/ifconfig/control.py
@@ -48,7 +48,7 @@ class Control(Section):
     def _popen(self, command):
         return popen(command, self.debug)
 
-    def _cmd(self, command):
+    def _cmd(self, command, env=None):
         import re
         if 'netns' in self.config:
             # This command must be executed from default netns 'ip link set dev X netns X'
@@ -61,7 +61,7 @@ class Control(Section):
                 command = command
             else:
                 command = f'ip netns exec {self.config["netns"]} {command}'
-        return cmd(command, self.debug)
+        return cmd(command, self.debug, env=env)
 
     def _get_command(self, config, name):
         """
diff --git a/python/vyos/ifconfig/wireguard.py b/python/vyos/ifconfig/wireguard.py
index 519012625..341fd32ff 100644
--- a/python/vyos/ifconfig/wireguard.py
+++ b/python/vyos/ifconfig/wireguard.py
@@ -1,4 +1,4 @@
-# Copyright 2019-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2019-2025 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -22,9 +22,11 @@ from tempfile import NamedTemporaryFile
 from hurry.filesize import size
 from hurry.filesize import alternative
 
+from vyos.configquery import ConfigTreeQuery
 from vyos.ifconfig import Interface
 from vyos.ifconfig import Operational
 from vyos.template import is_ipv6
+from vyos.template import is_ipv4
 
 class WireGuardOperational(Operational):
     def _dump(self):
@@ -80,80 +82,76 @@ class WireGuardOperational(Operational):
                 }
         return output
 
-    def show_interface(self):
-        from vyos.config import Config
+    def get_latest_handshakes(self):
+        """Get latest handshake time for each peer"""
+        output = {}
 
-        c = Config()
+        # Dump wireguard last handshake
+        tmp = self._cmd(f'wg show {self.ifname} latest-handshakes')
+        # Output:
+        # PUBLIC-KEY=    1732812147
+        for line in tmp.split('\n'):
+            if not line:
+                # Skip empty lines and last line
+                continue
+            items = line.split('\t')
 
-        wgdump = self._dump().get(self.config['ifname'], None)
+            if len(items) != 2:
+                continue
 
-        c.set_level(['interfaces', 'wireguard', self.config['ifname']])
-        description = c.return_effective_value(['description'])
-        ips = c.return_effective_values(['address'])
+            output[items[0]] = int(items[1])
 
-        answer = 'interface: {}\n'.format(self.config['ifname'])
-        if description:
-            answer += '  description: {}\n'.format(description)
-        if ips:
-            answer += '  address: {}\n'.format(', '.join(ips))
+        return output
+
+    def reset_peer(self, peer_name=None, public_key=None):
+        c = ConfigTreeQuery()
+        tmp = c.get_config_dict(['interfaces', 'wireguard', self.ifname],
+                                effective=True, get_first_key=True,
+                                key_mangling=('-', '_'), with_defaults=True)
+
+        current_peers = self._dump().get(self.ifname, {}).get('peers', {})
+
+        for peer, peer_config in tmp['peer'].items():
+            peer_public_key = peer_config['public_key']
+            if peer_name is None or peer == peer_name or public_key == peer_public_key:
+                if ('address' not in peer_config and 'host_name' not in peer_config) or 'port' not in peer_config:
+                    if peer_name is not None:
+                        print(f'WireGuard interface "{self.ifname}" peer "{peer_name}" address/host-name unset!')
+                    continue
 
-        answer += '  public key: {}\n'.format(wgdump['public_key'])
-        answer += '  private key: (hidden)\n'
-        answer += '  listening port: {}\n'.format(wgdump['listen_port'])
-        answer += '\n'
+                # As we work with an effective config, a port CLI node is always
+                # available when an address/host-name is defined on the CLI
+                port = peer_config['port']
 
-        for peer in c.list_effective_nodes(['peer']):
-            if wgdump['peers']:
-                pubkey = c.return_effective_value(['peer', peer, 'public-key'])
-                if pubkey in wgdump['peers']:
-                    wgpeer = wgdump['peers'][pubkey]
+                # address has higher priority than host-name
+                if 'address' in peer_config:
+                    address = peer_config['address']
+                    new_endpoint = f'{address}:{port}'
+                else:
+                    host_name = peer_config['host_name']
+                    new_endpoint = f'{host_name}:{port}'
 
-                    answer += '  peer: {}\n'.format(peer)
-                    answer += '    public key: {}\n'.format(pubkey)
+                if 'disable' in peer_config:
+                    print(f'WireGuard interface "{self.ifname}" peer "{peer_name}" disabled!')
+                    continue
 
-                    """ figure out if the tunnel is recently active or not """
-                    status = 'inactive'
-                    if wgpeer['latest_handshake'] is None:
-                        """ no handshake ever """
-                        status = 'inactive'
+                cmd = f'wg set {self.ifname} peer {peer_public_key} endpoint {new_endpoint}'
+                try:
+                    if (peer_public_key in current_peers
+                        and 'endpoint' in current_peers[peer_public_key]
+                        and current_peers[peer_public_key]['endpoint'] is not None
+                    ):
+                        current_endpoint = current_peers[peer_public_key]['endpoint']
+                        message = f'Resetting {self.ifname} peer {peer_public_key} from {current_endpoint} endpoint to {new_endpoint} ... '
                     else:
-                        if int(wgpeer['latest_handshake']) > 0:
-                            delta = timedelta(
-                                seconds=int(time.time() - wgpeer['latest_handshake'])
-                            )
-                            answer += '    latest handshake: {}\n'.format(delta)
-                            if time.time() - int(wgpeer['latest_handshake']) < (60 * 5):
-                                """ Five minutes and the tunnel is still active """
-                                status = 'active'
-                            else:
-                                """ it's been longer than 5 minutes """
-                                status = 'inactive'
-                        elif int(wgpeer['latest_handshake']) == 0:
-                            """ no handshake ever """
-                            status = 'inactive'
-                        answer += '    status: {}\n'.format(status)
-
-                    if wgpeer['endpoint'] is not None:
-                        answer += '    endpoint: {}\n'.format(wgpeer['endpoint'])
-
-                    if wgpeer['allowed_ips'] is not None:
-                        answer += '    allowed ips: {}\n'.format(
-                            ','.join(wgpeer['allowed_ips']).replace(',', ', ')
-                        )
-
-                    if wgpeer['transfer_rx'] > 0 or wgpeer['transfer_tx'] > 0:
-                        rx_size = size(wgpeer['transfer_rx'], system=alternative)
-                        tx_size = size(wgpeer['transfer_tx'], system=alternative)
-                        answer += '    transfer: {} received, {} sent\n'.format(
-                            rx_size, tx_size
-                        )
-
-                    if wgpeer['persistent_keepalive'] is not None:
-                        answer += '    persistent keepalive: every {} seconds\n'.format(
-                            wgpeer['persistent_keepalive']
-                        )
-                answer += '\n'
-        return answer
+                        message = f'Resetting {self.ifname} peer {peer_public_key} endpoint to {new_endpoint} ... '
+                    print(message, end='')
+
+                    self._cmd(cmd, env={'WG_ENDPOINT_RESOLUTION_RETRIES':
+                                        tmp['max_dns_retry']})
+                    print('done')
+                except:
+                    print(f'Error\nPlease try to run command manually:\n{cmd}\n')
 
 
 @Interface.register
@@ -180,22 +178,26 @@ class WireGuardIf(Interface):
         get_config_dict(). It's main intention is to consolidate the scattered
         interface setup code and provide a single point of entry when workin
         on any interface."""
-
         tmp_file = NamedTemporaryFile('w')
         tmp_file.write(config['private_key'])
         tmp_file.flush()
 
         # Wireguard base command is identical for every peer
-        base_cmd = 'wg set {ifname}'
+        base_cmd = f'wg set {self.ifname}'
+        interface_cmd = base_cmd
         if 'port' in config:
-            base_cmd += ' listen-port {port}'
+            interface_cmd += ' listen-port {port}'
         if 'fwmark' in config:
-            base_cmd += ' fwmark {fwmark}'
+            interface_cmd += ' fwmark {fwmark}'
 
-        base_cmd += f' private-key {tmp_file.name}'
-        base_cmd = base_cmd.format(**config)
+        interface_cmd += f' private-key {tmp_file.name}'
+        interface_cmd = interface_cmd.format(**config)
         # T6490: execute command to ensure interface configured
-        self._cmd(base_cmd)
+        self._cmd(interface_cmd)
+
+        # If no PSK is given remove it by using /dev/null - passing keys via
+        # the shell (usually bash) is considered insecure, thus we use a file
+        no_psk_file = '/dev/null'
 
         if 'peer' in config:
             for peer, peer_config in config['peer'].items():
@@ -203,43 +205,60 @@ class WireGuardIf(Interface):
                 # marked as disabled - also active sessions are terminated as
                 # the public key was already removed when entering this method!
                 if 'disable' in peer_config:
+                    # remove peer if disabled, no error report even if peer not exists
+                    cmd = base_cmd + ' peer {public_key} remove'
+                    self._cmd(cmd.format(**peer_config))
                     continue
 
-                # start of with a fresh 'wg' command
-                cmd = base_cmd + ' peer {public_key}'
-
-                # If no PSK is given remove it by using /dev/null - passing keys via
-                # the shell (usually bash) is considered insecure, thus we use a file
-                no_psk_file = '/dev/null'
                 psk_file = no_psk_file
-                if 'preshared_key' in peer_config:
-                    psk_file = '/tmp/tmp.wireguard.psk'
-                    with open(psk_file, 'w') as f:
-                        f.write(peer_config['preshared_key'])
-                cmd += f' preshared-key {psk_file}'
-
-                # Persistent keepalive is optional
-                if 'persistent_keepalive' in peer_config:
-                    cmd += ' persistent-keepalive {persistent_keepalive}'
-
-                # Multiple allowed-ip ranges can be defined - ensure we are always
-                # dealing with a list
-                if isinstance(peer_config['allowed_ips'], str):
-                    peer_config['allowed_ips'] = [peer_config['allowed_ips']]
-                cmd += ' allowed-ips ' + ','.join(peer_config['allowed_ips'])
-
-                # Endpoint configuration is optional
-                if {'address', 'port'} <= set(peer_config):
-                    if is_ipv6(peer_config['address']):
-                        cmd += ' endpoint [{address}]:{port}'
-                    else:
-                        cmd += ' endpoint {address}:{port}'
 
-                self._cmd(cmd.format(**peer_config))
-
-                # PSK key file is not required to be stored persistently as its backed by CLI
-                if psk_file != no_psk_file and os.path.exists(psk_file):
-                    os.remove(psk_file)
+                # start of with a fresh 'wg' command
+                peer_cmd = base_cmd + ' peer {public_key}'
+
+                try:
+                    cmd = peer_cmd
+
+                    if 'preshared_key' in peer_config:
+                        psk_file = '/tmp/tmp.wireguard.psk'
+                        with open(psk_file, 'w') as f:
+                            f.write(peer_config['preshared_key'])
+                    cmd += f' preshared-key {psk_file}'
+
+                    # Persistent keepalive is optional
+                    if 'persistent_keepalive' in peer_config:
+                        cmd += ' persistent-keepalive {persistent_keepalive}'
+
+                    # Multiple allowed-ip ranges can be defined - ensure we are always
+                    # dealing with a list
+                    if isinstance(peer_config['allowed_ips'], str):
+                        peer_config['allowed_ips'] = [peer_config['allowed_ips']]
+                    cmd += ' allowed-ips ' + ','.join(peer_config['allowed_ips'])
+
+                    self._cmd(cmd.format(**peer_config))
+
+                    cmd = peer_cmd
+
+                    # Ensure peer is created even if dns not working
+                    if {'address', 'port'} <= set(peer_config):
+                        if is_ipv6(peer_config['address']):
+                            cmd += ' endpoint [{address}]:{port}'
+                        elif is_ipv4(peer_config['address']):
+                            cmd += ' endpoint {address}:{port}'
+                        else:
+                            # don't set endpoint if address uses domain name
+                            continue
+                    elif {'host_name', 'port'} <= set(peer_config):
+                        cmd += ' endpoint {host_name}:{port}'
+
+                    self._cmd(cmd.format(**peer_config), env={
+                        'WG_ENDPOINT_RESOLUTION_RETRIES': config['max_dns_retry']})
+                except:
+                    # todo: logging
+                    pass
+                finally:
+                    # PSK key file is not required to be stored persistently as its backed by CLI
+                    if psk_file != no_psk_file and os.path.exists(psk_file):
+                        os.remove(psk_file)
 
         # call base class
         super().update(config)
diff --git a/python/vyos/utils/kernel.py b/python/vyos/utils/kernel.py
index 847f80108..05eac8a6a 100644
--- a/python/vyos/utils/kernel.py
+++ b/python/vyos/utils/kernel.py
@@ -15,6 +15,10 @@
 
 import os
 
+# A list of used Kernel constants
+# https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireguard/messages.h?h=linux-6.6.y#n45
+WIREGUARD_REKEY_AFTER_TIME = 120
+
 def check_kmod(k_mod):
     """ Common utility function to load required kernel modules on demand """
     from vyos import ConfigError