summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--python/vyos/ifconfig.py4
-rwxr-xr-xsrc/conf_mode/interface-wireguard.py15
2 files changed, 7 insertions, 12 deletions
diff --git a/python/vyos/ifconfig.py b/python/vyos/ifconfig.py
index 5b1c11a47..62bf94d79 100644
--- a/python/vyos/ifconfig.py
+++ b/python/vyos/ifconfig.py
@@ -1349,7 +1349,7 @@ class WireGuardIf(Interface):
# fmask permission check?
pass
- cmd = "sudo wg set {} ".format(self._ifname)
+ cmd = "wg set {} ".format(self._ifname)
cmd += "listen-port {} ".format(self.config['port'])
cmd += "fwmark {} ".format(str(self.config['fwmark']))
cmd += "private-key {} ".format(self.config['private-key'])
@@ -1380,7 +1380,7 @@ class WireGuardIf(Interface):
Giving it a readable name is a vyos feature, to remove a peer the pubkey
and the interface is needed, to remove the entry.
"""
- cmd = "sudo wg set {0} peer {1} remove".format(
+ cmd = "wg set {0} peer {1} remove".format(
self._ifname, str(peerkey))
self._cmd(cmd)
diff --git a/src/conf_mode/interface-wireguard.py b/src/conf_mode/interface-wireguard.py
index e7b9a267f..4c0e90ca6 100755
--- a/src/conf_mode/interface-wireguard.py
+++ b/src/conf_mode/interface-wireguard.py
@@ -29,12 +29,6 @@ from vyos.ifconfig import WireGuardIf
ifname = str(os.environ['VYOS_TAGNODE_VALUE'])
intfc = WireGuardIf(ifname)
-dir = r'/config/auth/wireguard'
-pk = dir + '/private.key'
-pub = dir + '/public.key'
-psk_file = dir + '/psk'
-
-
def check_kmod():
if not os.path.exists('/sys/module/wireguard'):
sl.syslog(sl.LOG_NOTICE, "loading wirguard kmod")
@@ -57,7 +51,8 @@ def get_config():
'state': 'enabled',
'fwmark': 0x00,
'mtu': 1420,
- 'peer': {}
+ 'peer': {},
+ 'pk' : '/config/auth/wireguard/private.key'
}
}
@@ -112,12 +107,11 @@ def get_config():
return config_data
-
def verify(c):
if not c:
return None
- if not os.path.exists(pk):
+ if not os.path.exists(c[ifname]['pk']):
raise ConfigError(
"No keys found, generate them by executing: \'run generate wireguard keypair\'")
@@ -225,7 +219,7 @@ def apply(c):
sl.LOG_NOTICE, "peer {0} pubkey changed from {1} to {2} on interface {3}".format(p, ekey, nkey, ifname))
intfc.remove_peer(ekey)
- intfc.config['private-key'] = pk
+ intfc.config['private-key'] = c[ifname]['pk']
for p in c[ifname]['peer']:
intfc.config['pubkey'] = str(c[ifname]['peer'][p]['pubkey'])
intfc.config['allowed-ips'] = (c[ifname]['peer'][p]['allowed-ips'])
@@ -249,6 +243,7 @@ def apply(c):
# preshared-key - needs to be read from a file
if 'psk' in c[ifname]['peer'][p]:
+ psk_file = '/config/auth/wireguard/psk'
old_umask = os.umask(0o077)
open(psk_file, 'w').write(str(c[ifname]['peer'][p]['psk']))
os.umask(old_umask)