firewall: Actually create WireGuard rules

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/cfgroot/wireguard-functions.pl b/config/cfgroot/wireguard-functions.pl
index bbdf122a61348a79d3c1e19bb3c55070c9277f84..79b3bb0978e81218e810fde81159b781574e0753 100644 (file)
--- a/config/cfgroot/wireguard-functions.pl
+++ b/config/cfgroot/wireguard-functions.pl
@@ -184,6 +184,7 @@ sub load_peer($) {
                "LOCAL_SUBNETS"         => &decode_subnets($peers{$key}[10]),
                "PSK"                   => $peers{$key}[11],
                "KEEPALIVE"             => $peers{$key}[12],
+               "INTERFACE"                             => ($type eq "host") ? "wg0" : "wg${key}",
        );
 
        return \%peer;

diff --git a/config/firewall/firewall-lib.pl b/config/firewall/firewall-lib.pl
index 92c1de95725164a634b75e29bff0611aad930a98..1977be19f1e559595b53d6452be524bdefa88cf5 100644 (file)
--- a/config/firewall/firewall-lib.pl
+++ b/config/firewall/firewall-lib.pl
@@ -385,6 +385,25 @@ sub get_address
                        push(@ret, [$host_address, ""]);
                }
 
+       # WireGuard Peers
+       } elsif ($key eq 'wg_peer_src' || $key eq 'wg_peer_tgt') {
+               my $peer = &Wireguard::get_peer_by_name($value);
+               if (defined $peer) {
+                       my $remotes;
+
+                       # Select the remote IP addresses
+                       if ($peer->{'TYPE'} eq 'host') {
+                               $remotes = $peer->{'CLIENT_ADDRESS'};
+                       } elsif ($peer->{'TYPE'} eq 'net') {
+                               $remotes = $peer->{'REMOTE_SUBNETS'};
+                       }
+
+                       # Add all remotes
+                       foreach my $remote (@$remotes) {
+                               push(@ret, [$remote, $peer->{'INTERFACE'}]);
+                       }
+               }
+
        # OpenVPN networks.
        } elsif ($key ~~ ["ovpn_net_src", "ovpn_net_tgt", "OpenVPN static network"]) {
                my $network_address = &get_ovpn_net_ip($value, 1);