From 2212a438b234f34f32e08efef2f841ba55a3b6a0 Mon Sep 17 00:00:00 2001 From: sskaje Date: Tue, 31 Dec 2024 10:44:01 +0800 Subject: wireguard: T4930: allow peers via FQDN * set interfaces wireguard wgXX peer YY hostname --- src/services/vyos-domain-resolver | 48 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) (limited to 'src/services') diff --git a/src/services/vyos-domain-resolver b/src/services/vyos-domain-resolver index bc74a05d1..6eab7e7e5 100755 --- a/src/services/vyos-domain-resolver +++ b/src/services/vyos-domain-resolver @@ -27,12 +27,14 @@ from vyos.utils.dict import dict_search_args from vyos.utils.process import cmd from vyos.utils.process import run from vyos.xml_ref import get_defaults +from vyos.template import is_ip base = ['firewall'] timeout = 300 cache = False base_firewall = ['firewall'] base_nat = ['nat'] +base_interfaces = ['interfaces'] domain_state = {} @@ -171,6 +173,50 @@ def update_fqdn(config, node): logger.info(f'Updated {count} sets in {node} - result: {code}') +def update_interfaces(config, node): + if node == 'interfaces': + wireguard_interfaces = dict_search_args(config, 'wireguard') + + # WireGuard redo handshake usually every 180 seconds, but not documented officially. + # If peer with domain name in its endpoint didn't get handshake for over 300 seconds, + # we do re-resolv and reset its endpoint from config tree. + handshake_threshold = 300 + + from vyos.ifconfig import WireGuardIf + + check_wireguard_peer_public_keys = {} + # for each wireguard interfaces + for interface, wireguard in wireguard_interfaces.items(): + check_wireguard_peer_public_keys[interface] = [] + for peer, peer_config in wireguard['peer'].items(): + # check peer if peer host-name or address is set + if 'host-name' in peer_config or 'address' in peer_config: + # check latest handshake + check_wireguard_peer_public_keys[interface].append( + peer_config['public_key'] + ) + + now_time = time.time() + for ( + interface, + check_peer_public_keys + ) in check_wireguard_peer_public_keys.items(): + if len(check_peer_public_keys) == 0: + continue + + intf = WireGuardIf(interface, create=False, debug=False) + handshakes = intf.operational.get_latest_handshakes() + + for public_key, handshake_time in handshakes.items(): + if public_key in check_peer_public_keys and ( + handshake_time == 0 + or now_time - handshake_time > handshake_threshold + ): + intf.operational.reset_peer(public_key=public_key) + + print(f'Wireguard: reset {interface} peer {public_key}') + + if __name__ == '__main__': logger.info(f'VyOS domain resolver') @@ -184,10 +230,12 @@ if __name__ == '__main__': conf = ConfigTreeQuery() firewall = get_config(conf, base_firewall) nat = get_config(conf, base_nat) + interfaces = get_config(conf, base_interfaces) logger.info(f'interval: {timeout}s - cache: {cache}') while True: update_fqdn(firewall, 'firewall') update_fqdn(nat, 'nat') + update_interfaces(interfaces, 'interfaces') time.sleep(timeout) -- cgit v1.2.3 From f01c4d0173bb49bfd5bd4f1ef5675cc8c597595a Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 18 Jan 2025 23:06:37 +0100 Subject: wireguard: T4930: add mnemonic for WIREGUARD_REKEY_AFTER_TIME WireGuard performs a handshake every WIREGUARD_REKEY_AFTER_TIME if data is being transmitted between the peers. If no data is transmitted, the handshake will not be initiated unless new data begins to flow. Each handshake generates a new session key, and the key is rotated at least every 120 seconds or upon data transmission after a prolonged silence. --- python/vyos/utils/kernel.py | 4 ++++ src/services/vyos-domain-resolver | 38 +++++++++++++++++--------------------- 2 files changed, 21 insertions(+), 21 deletions(-) (limited to 'src/services') diff --git a/python/vyos/utils/kernel.py b/python/vyos/utils/kernel.py index 847f80108..05eac8a6a 100644 --- a/python/vyos/utils/kernel.py +++ b/python/vyos/utils/kernel.py @@ -15,6 +15,10 @@ import os +# A list of used Kernel constants +# https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireguard/messages.h?h=linux-6.6.y#n45 +WIREGUARD_REKEY_AFTER_TIME = 120 + def check_kmod(k_mod): """ Common utility function to load required kernel modules on demand """ from vyos import ConfigError diff --git a/src/services/vyos-domain-resolver b/src/services/vyos-domain-resolver index 6eab7e7e5..a4b0869fa 100755 --- a/src/services/vyos-domain-resolver +++ b/src/services/vyos-domain-resolver @@ -22,12 +22,13 @@ from vyos.configdict import dict_merge from vyos.configquery import ConfigTreeQuery from vyos.firewall import fqdn_config_parse from vyos.firewall import fqdn_resolve +from vyos.ifconfig import WireGuardIf from vyos.utils.commit import commit_in_progress from vyos.utils.dict import dict_search_args +from vyos.utils.kernel import WIREGUARD_REKEY_AFTER_TIME from vyos.utils.process import cmd from vyos.utils.process import run from vyos.xml_ref import get_defaults -from vyos.template import is_ip base = ['firewall'] timeout = 300 @@ -175,50 +176,45 @@ def update_fqdn(config, node): def update_interfaces(config, node): if node == 'interfaces': - wireguard_interfaces = dict_search_args(config, 'wireguard') + wg_interfaces = dict_search_args(config, 'wireguard') - # WireGuard redo handshake usually every 180 seconds, but not documented officially. - # If peer with domain name in its endpoint didn't get handshake for over 300 seconds, - # we do re-resolv and reset its endpoint from config tree. - handshake_threshold = 300 - - from vyos.ifconfig import WireGuardIf - - check_wireguard_peer_public_keys = {} + peer_public_keys = {} # for each wireguard interfaces - for interface, wireguard in wireguard_interfaces.items(): - check_wireguard_peer_public_keys[interface] = [] + for interface, wireguard in wg_interfaces.items(): + peer_public_keys[interface] = [] for peer, peer_config in wireguard['peer'].items(): # check peer if peer host-name or address is set if 'host-name' in peer_config or 'address' in peer_config: # check latest handshake - check_wireguard_peer_public_keys[interface].append( + peer_public_keys[interface].append( peer_config['public_key'] ) now_time = time.time() - for ( - interface, - check_peer_public_keys - ) in check_wireguard_peer_public_keys.items(): + for (interface, check_peer_public_keys) in peer_public_keys.items(): if len(check_peer_public_keys) == 0: continue intf = WireGuardIf(interface, create=False, debug=False) handshakes = intf.operational.get_latest_handshakes() + # WireGuard performs a handshake every WIREGUARD_REKEY_AFTER_TIME + # if data is being transmitted between the peers. If no data is + # transmitted, the handshake will not be initiated unless new + # data begins to flow. Each handshake generates a new session + # key, and the key is rotated at least every 120 seconds or + # upon data transmission after a prolonged silence. for public_key, handshake_time in handshakes.items(): if public_key in check_peer_public_keys and ( handshake_time == 0 - or now_time - handshake_time > handshake_threshold + or (now_time - handshake_time > 3*WIREGUARD_REKEY_AFTER_TIME) ): intf.operational.reset_peer(public_key=public_key) - - print(f'Wireguard: reset {interface} peer {public_key}') + print(f'WireGuard: reset {interface} peer {public_key}') if __name__ == '__main__': - logger.info(f'VyOS domain resolver') + logger.info('VyOS domain resolver') count = 1 while commit_in_progress(): -- cgit v1.2.3 From 47b6afa14210834f5add9a509e594ec2ed4b1e42 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 18 Jan 2025 23:33:40 +0100 Subject: wireguard: T4930: fix dict key (-/_) when working with config dict Retrieving the config dict sets key_mangling(), thus we need to look for host_name instead of host-name. --- src/services/vyos-domain-resolver | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'src/services') diff --git a/src/services/vyos-domain-resolver b/src/services/vyos-domain-resolver index a4b0869fa..fe0f40a07 100755 --- a/src/services/vyos-domain-resolver +++ b/src/services/vyos-domain-resolver @@ -184,7 +184,7 @@ def update_interfaces(config, node): peer_public_keys[interface] = [] for peer, peer_config in wireguard['peer'].items(): # check peer if peer host-name or address is set - if 'host-name' in peer_config or 'address' in peer_config: + if 'host_name' in peer_config or 'address' in peer_config: # check latest handshake peer_public_keys[interface].append( peer_config['public_key'] @@ -210,8 +210,6 @@ def update_interfaces(config, node): or (now_time - handshake_time > 3*WIREGUARD_REKEY_AFTER_TIME) ): intf.operational.reset_peer(public_key=public_key) - print(f'WireGuard: reset {interface} peer {public_key}') - if __name__ == '__main__': logger.info('VyOS domain resolver') -- cgit v1.2.3