summaryrefslogtreecommitdiff
path: root/src/conf_mode
diff options
context:
space:
mode:
authorChristian Poessinger <christian@poessinger.com>2020-04-05 13:21:44 +0200
committerChristian Poessinger <christian@poessinger.com>2020-04-05 13:21:44 +0200
commit347606ed319744c5b09161ce736a11f5443d91e2 (patch)
treeb13ab62bf465a1ccb013c4b077666b1597ad1296 /src/conf_mode
parent66103774a9298452dc323f6eb3908bb657a01b5e (diff)
downloadvyos-1x-347606ed319744c5b09161ce736a11f5443d91e2.tar.gz
vyos-1x-347606ed319744c5b09161ce736a11f5443d91e2.zip
wireguard: T2206: split endpoint node into address and port
WireGuard has been the only subsystem combining a remote ip address and a remote port number into a single node. This is bad as there is no possiblity for the XML based input validation for IP address and port numbers. That's the reason the peer endpoint node goets migrated into a peer address and a peer port node utilizing the embedded syntax node checking for IP addresses and port ranges.
Diffstat (limited to 'src/conf_mode')
-rwxr-xr-xsrc/conf_mode/interfaces-wireguard.py27
1 files changed, 15 insertions, 12 deletions
diff --git a/src/conf_mode/interfaces-wireguard.py b/src/conf_mode/interfaces-wireguard.py
index d8c327e19..5c0c07dc4 100755
--- a/src/conf_mode/interfaces-wireguard.py
+++ b/src/conf_mode/interfaces-wireguard.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python3
#
-# Copyright (C) 2018 VyOS maintainers and contributors
+# Copyright (C) 2018-2020 VyOS maintainers and contributors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
@@ -13,13 +13,12 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-#
import sys
import os
import re
import subprocess
+
from copy import deepcopy
from netifaces import interfaces
@@ -30,10 +29,9 @@ from vyos.ifconfig import WireGuardIf
kdir = r'/config/auth/wireguard'
-
def _check_kmod():
if not os.path.exists('/sys/module/wireguard'):
- if os.system('sudo modprobe wireguard') != 0:
+ if os.system('modprobe wireguard') != 0:
raise ConfigError("modprobe wireguard failed")
@@ -135,7 +133,8 @@ def get_config():
{
p: {
'allowed-ips': [],
- 'endpoint': '',
+ 'address': '',
+ 'port': '',
'pubkey': ''
}
}
@@ -144,10 +143,14 @@ def get_config():
if c.exists(['peer', p, 'allowed-ips']):
wg['peer'][p]['allowed-ips'] = c.return_values(
['peer', p, 'allowed-ips'])
- # peer endpoint
- if c.exists(['peer', p, 'endpoint']):
- wg['peer'][p]['endpoint'] = c.return_value(
- ['peer', p, 'endpoint'])
+ # peer address
+ if c.exists(['peer', p, 'address']):
+ wg['peer'][p]['address'] = c.return_value(
+ ['peer', p, 'address'])
+ # peer port
+ if c.exists(['peer', p, 'port']):
+ wg['peer'][p]['port'] = c.return_value(
+ ['peer', p, 'port'])
# persistent-keepalive
if c.exists(['peer', p, 'persistent-keepalive']):
wg['peer'][p]['persistent-keepalive'] = c.return_value(
@@ -251,8 +254,8 @@ def apply(c):
if c['fwmark']:
intfc.config['fwmark'] = c['fwmark']
# endpoint
- if c['peer'][p]['endpoint']:
- intfc.config['endpoint'] = c['peer'][p]['endpoint']
+ if c['peer'][p]['address'] and c['peer'][p]['port']:
+ intfc.config['endpoint'] = "{}:{}".format(c['peer'][p]['address'], c['peer'][p]['port'])
# persistent-keepalive
if 'persistent-keepalive' in c['peer'][p]: