diff options
Diffstat (limited to 'src/op_mode')
| -rwxr-xr-x | src/op_mode/pki.py | 2 | ||||
| -rwxr-xr-x | src/op_mode/wireguard.py | 154 | ||||
| -rwxr-xr-x | src/op_mode/wireguard_client.py | 2 |
3 files changed, 43 insertions, 115 deletions
diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py index 7dbeb4097..b4a68b31c 100755 --- a/src/op_mode/pki.py +++ b/src/op_mode/pki.py @@ -215,7 +215,7 @@ def install_wireguard_key(name, private_key, public_key): print("") print("Public key for use on peer configuration: " + public_key) else: - print("set interfaces wireguard [INTERFACE] peer %s pubkey '%s'" % (name, public_key)) + print("set interfaces wireguard [INTERFACE] peer %s public-key '%s'" % (name, public_key)) print("") print("Private key for use on peer configuration: " + private_key) diff --git a/src/op_mode/wireguard.py b/src/op_mode/wireguard.py index e08bc983a..3ed8e17ca 100755 --- a/src/op_mode/wireguard.py +++ b/src/op_mode/wireguard.py @@ -1,6 +1,6 @@ #!/usr/bin/env python3 # -# Copyright (C) 2018-2020 VyOS maintainers and contributors +# Copyright (C) 2018-2021 VyOS maintainers and contributors # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 or later as @@ -15,132 +15,65 @@ # along with this program. If not, see <http://www.gnu.org/licenses/>. import argparse -import os import sys -import shutil -import syslog as sl -import re +import tabulate from vyos.config import Config from vyos.ifconfig import WireGuardIf from vyos.util import cmd -from vyos.util import run -from vyos.util import check_kmod from vyos import ConfigError -dir = r'/config/auth/wireguard' -psk = dir + '/preshared.key' - -k_mod = 'wireguard' - -def generate_keypair(pk, pub): - """ generates a keypair which is stored in /config/auth/wireguard """ - old_umask = os.umask(0o027) - if run(f'wg genkey | tee {pk} | wg pubkey > {pub}') != 0: - raise ConfigError("wireguard key-pair generation failed") - else: - sl.syslog( - sl.LOG_NOTICE, "new keypair wireguard key generated in " + dir) - os.umask(old_umask) - - -def genkey(location): - """ helper function to check, regenerate the keypair """ - pk = "{}/private.key".format(location) - pub = "{}/public.key".format(location) - old_umask = os.umask(0o027) - if os.path.exists(pk) and os.path.exists(pub): - try: - choice = input( - "You already have a wireguard key-pair, do you want to re-generate? [y/n] ") - if choice == 'y' or choice == 'Y': - generate_keypair(pk, pub) - except KeyboardInterrupt: - sys.exit(0) - else: - """ if keypair is bing executed from a running iso """ - if not os.path.exists(location): - run(f'sudo mkdir -p {location}') - run(f'sudo chgrp vyattacfg {location}') - run(f'sudo chmod 750 {location}') - generate_keypair(pk, pub) - os.umask(old_umask) - - -def showkey(key): - """ helper function to show privkey or pubkey """ - if os.path.exists(key): - print (open(key).read().strip()) - else: - print ("{} not found".format(key)) - - -def genpsk(): - """ - generates a preshared key and shows it on stdout, - it's stored only in the cli config - """ - - psk = cmd('wg genpsk') - print(psk) - -def list_key_dirs(): - """ lists all dirs under /config/auth/wireguard """ - if os.path.exists(dir): - nks = next(os.walk(dir))[1] - for nk in nks: - print (nk) - -def del_key_dir(kname): - """ deletes /config/auth/wireguard/<kname> """ - kdir = "{0}/{1}".format(dir,kname) - if not os.path.isdir(kdir): - print ("named keypair {} not found".format(kname)) - return 1 - shutil.rmtree(kdir) - +base = ['interfaces', 'wireguard'] + +def get_public_keys(): + config = Config() + headers = ['Interface', 'Peer', 'Public Key'] + out = [] + if config.exists(base): + wg_interfaces = config.get_config_dict(base, key_mangling=('-', '_'), + get_first_key=True, + no_tag_node_value_mangle=True) + + for wg, wg_conf in wg_interfaces.items(): + if 'peer' in wg_conf: + for peer, peer_conf in wg_conf['peer'].items(): + out.append([wg, peer, peer_conf['public_key']]) + + print("Wireguard Public Keys:") + print(tabulate.tabulate(out, headers)) + +def get_private_keys(): + config = Config() + headers = ['Interface', 'Private Key', 'Public Key'] + out = [] + if config.exists(base): + wg_interfaces = config.get_config_dict(base, key_mangling=('-', '_'), + get_first_key=True, + no_tag_node_value_mangle=True) + + for wg, wg_conf in wg_interfaces.items(): + private_key = wg_conf['private_key'] + public_key = cmd('wg pubkey', input=private_key) + out.append([wg, private_key, public_key]) + + print("Wireguard Private Keys:") + print(tabulate.tabulate(out, headers)) if __name__ == '__main__': - check_kmod(k_mod) parser = argparse.ArgumentParser(description='wireguard key management') parser.add_argument( - '--genkey', action="store_true", help='generate key-pair') - parser.add_argument( - '--showpub', action="store_true", help='shows public key') - parser.add_argument( - '--showpriv', action="store_true", help='shows private key') - parser.add_argument( - '--genpsk', action="store_true", help='generates preshared-key') - parser.add_argument( - '--location', action="store", help='key location within {}'.format(dir)) - parser.add_argument( - '--listkdir', action="store_true", help='lists named keydirectories') + '--showpub', action="store_true", help='shows public keys') parser.add_argument( - '--delkdir', action="store_true", help='removes named keydirectories') + '--showpriv', action="store_true", help='shows private keys') parser.add_argument( '--showinterface', action="store", help='shows interface details') args = parser.parse_args() try: - if args.genkey: - if args.location: - genkey("{0}/{1}".format(dir, args.location)) - else: - genkey("{}/default".format(dir)) if args.showpub: - if args.location: - showkey("{0}/{1}/public.key".format(dir, args.location)) - else: - showkey("{}/default/public.key".format(dir)) + get_public_keys() if args.showpriv: - if args.location: - showkey("{0}/{1}/private.key".format(dir, args.location)) - else: - showkey("{}/default/private.key".format(dir)) - if args.genpsk: - genpsk() - if args.listkdir: - list_key_dirs() + get_private_keys() if args.showinterface: try: intf = WireGuardIf(args.showinterface, create=False, debug=False) @@ -148,11 +81,6 @@ if __name__ == '__main__': # the interface does not exists except Exception: pass - if args.delkdir: - if args.location: - del_key_dir(args.location) - else: - del_key_dir("default") except ConfigError as e: print(e) diff --git a/src/op_mode/wireguard_client.py b/src/op_mode/wireguard_client.py index 7a620a01e..7661254da 100755 --- a/src/op_mode/wireguard_client.py +++ b/src/op_mode/wireguard_client.py @@ -38,7 +38,7 @@ To enable this configuration on a VyOS router you can use the following commands {% for addr in address if address is defined %} set interfaces wireguard {{ interface }} peer {{ name }} allowed-ips '{{ addr }}' {% endfor %} -set interfaces wireguard {{ interface }} peer {{ name }} pubkey '{{ pubkey }}' +set interfaces wireguard {{ interface }} peer {{ name }} public-key '{{ pubkey }}' """ client_config = """ |