wireguard: Add initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/rootfiles/common/aarch64/initscripts b/config/rootfiles/common/aarch64/initscripts
index cc7833a1808c3d66ca57898f9ff1800e8818f07a..12898701abe26b3d3f062318d638624cc115a17c 100644 (file)
--- a/config/rootfiles/common/aarch64/initscripts
+++ b/config/rootfiles/common/aarch64/initscripts
@@ -92,6 +92,7 @@ etc/rc.d/init.d/udev_retry
 etc/rc.d/init.d/unbound
 etc/rc.d/init.d/vnstat
 etc/rc.d/init.d/waitdrives
+etc/rc.d/init.d/wireguard
 etc/rc.d/init.d/wlanclient
 #etc/rc.d/rc0.d
 etc/rc.d/rc0.d/K01grub-btrfsd
@@ -102,6 +103,7 @@ etc/rc.d/rc0.d/K30sshd
 etc/rc.d/rc0.d/K47setclock
 etc/rc.d/rc0.d/K49cyrus-sasl
 etc/rc.d/rc0.d/K51vnstat
+etc/rc.d/rc0.d/K70wireguard
 etc/rc.d/rc0.d/K77conntrackd
 etc/rc.d/rc0.d/K78suricata
 etc/rc.d/rc0.d/K79leds
@@ -133,6 +135,7 @@ etc/rc.d/rc3.d/S24cyrus-sasl
 etc/rc.d/rc3.d/S30sshd
 etc/rc.d/rc3.d/S32apache
 etc/rc.d/rc3.d/S40fcron
+etc/rc.d/rc3.d/S50wireguard
 etc/rc.d/rc3.d/S98rc.local
 etc/rc.d/rc3.d/S99grub-btrfsd
 #etc/rc.d/rc3.d/S99vdradmin
@@ -145,6 +148,7 @@ etc/rc.d/rc6.d/K30sshd
 etc/rc.d/rc6.d/K47setclock
 etc/rc.d/rc6.d/K49cyrus-sasl
 etc/rc.d/rc6.d/K51vnstat
+etc/rc.d/rc6.d/K70wireguard
 etc/rc.d/rc6.d/K77conntrackd
 etc/rc.d/rc6.d/K78suricata
 etc/rc.d/rc6.d/K79leds

diff --git a/config/rootfiles/common/riscv64/initscripts b/config/rootfiles/common/riscv64/initscripts
index 4ee77ba2109314902c8f1d34f07fa597ca1362f2..11cfaf2be8fbf01aa35f672ded80f224952a9465 100644 (file)
--- a/config/rootfiles/common/riscv64/initscripts
+++ b/config/rootfiles/common/riscv64/initscripts
@@ -91,6 +91,7 @@ etc/rc.d/init.d/udev_retry
 etc/rc.d/init.d/unbound
 etc/rc.d/init.d/vnstat
 etc/rc.d/init.d/waitdrives
+etc/rc.d/init.d/wireguard
 etc/rc.d/init.d/wlanclient
 #etc/rc.d/rc0.d
 etc/rc.d/rc0.d/K01grub-btrfsd
@@ -101,6 +102,7 @@ etc/rc.d/rc0.d/K30sshd
 etc/rc.d/rc0.d/K47setclock
 etc/rc.d/rc0.d/K49cyrus-sasl
 etc/rc.d/rc0.d/K51vnstat
+etc/rc.d/rc0.d/K70wireguard
 etc/rc.d/rc0.d/K77conntrackd
 etc/rc.d/rc0.d/K78suricata
 etc/rc.d/rc0.d/K79leds
@@ -132,6 +134,7 @@ etc/rc.d/rc3.d/S24cyrus-sasl
 etc/rc.d/rc3.d/S30sshd
 etc/rc.d/rc3.d/S32apache
 etc/rc.d/rc3.d/S40fcron
+etc/rc.d/rc3.d/S50wireguard
 etc/rc.d/rc3.d/S98rc.local
 etc/rc.d/rc3.d/S99grub-btrfsd
 #etc/rc.d/rc3.d/S99vdradmin
@@ -144,6 +147,7 @@ etc/rc.d/rc6.d/K30sshd
 etc/rc.d/rc6.d/K47setclock
 etc/rc.d/rc6.d/K49cyrus-sasl
 etc/rc.d/rc6.d/K51vnstat
+etc/rc.d/rc6.d/K70wireguard
 etc/rc.d/rc6.d/K77conntrackd
 etc/rc.d/rc6.d/K78suricata
 etc/rc.d/rc6.d/K79leds

diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts
index 4ee77ba2109314902c8f1d34f07fa597ca1362f2..11cfaf2be8fbf01aa35f672ded80f224952a9465 100644 (file)
--- a/config/rootfiles/common/x86_64/initscripts
+++ b/config/rootfiles/common/x86_64/initscripts
@@ -91,6 +91,7 @@ etc/rc.d/init.d/udev_retry
 etc/rc.d/init.d/unbound
 etc/rc.d/init.d/vnstat
 etc/rc.d/init.d/waitdrives
+etc/rc.d/init.d/wireguard
 etc/rc.d/init.d/wlanclient
 #etc/rc.d/rc0.d
 etc/rc.d/rc0.d/K01grub-btrfsd
@@ -101,6 +102,7 @@ etc/rc.d/rc0.d/K30sshd
 etc/rc.d/rc0.d/K47setclock
 etc/rc.d/rc0.d/K49cyrus-sasl
 etc/rc.d/rc0.d/K51vnstat
+etc/rc.d/rc0.d/K70wireguard
 etc/rc.d/rc0.d/K77conntrackd
 etc/rc.d/rc0.d/K78suricata
 etc/rc.d/rc0.d/K79leds
@@ -132,6 +134,7 @@ etc/rc.d/rc3.d/S24cyrus-sasl
 etc/rc.d/rc3.d/S30sshd
 etc/rc.d/rc3.d/S32apache
 etc/rc.d/rc3.d/S40fcron
+etc/rc.d/rc3.d/S50wireguard
 etc/rc.d/rc3.d/S98rc.local
 etc/rc.d/rc3.d/S99grub-btrfsd
 #etc/rc.d/rc3.d/S99vdradmin
@@ -144,6 +147,7 @@ etc/rc.d/rc6.d/K30sshd
 etc/rc.d/rc6.d/K47setclock
 etc/rc.d/rc6.d/K49cyrus-sasl
 etc/rc.d/rc6.d/K51vnstat
+etc/rc.d/rc6.d/K70wireguard
 etc/rc.d/rc6.d/K77conntrackd
 etc/rc.d/rc6.d/K78suricata
 etc/rc.d/rc6.d/K79leds

diff --git a/lfs/initscripts b/lfs/initscripts
index 82e20bfa7e6833c2c1690fc4ead863f7a833348e..700e9124459fb0cb53b7f740c26f2a4bb2411f4e 100644 (file)
--- a/lfs/initscripts
+++ b/lfs/initscripts
@@ -99,6 +99,7 @@ $(TARGET) :
        ln -sf ../init.d/setclock               /etc/rc.d/rc0.d/K47setclock
        ln -sf  ../init.d/cyrus-sasl            /etc/rc.d/rc0.d/K49cyrus-sasl
        ln -sf ../init.d/vnstat                 /etc/rc.d/rc0.d/K51vnstat
+       ln -sf ../init.d/wireguard              /etc/rc.d/rc0.d/K70wireguard
        ln -sf ../init.d/conntrackd             /etc/rc.d/rc0.d/K77conntrackd
        ln -sf ../init.d/suricata               /etc/rc.d/rc0.d/K78suricata
        ln -sf ../init.d/leds                   /etc/rc.d/rc0.d/K79leds
@@ -128,6 +129,7 @@ $(TARGET) :
        ln -sf ../init.d/sshd                   /etc/rc.d/rc3.d/S30sshd
        ln -sf ../init.d/apache                 /etc/rc.d/rc3.d/S32apache
        ln -sf ../init.d/fcron                  /etc/rc.d/rc3.d/S40fcron
+       ln -sf ../init.d/wireguard              /etc/rc.d/rc3.d/S50wireguard
        ln -sf ../../sysconfig/rc.local         /etc/rc.d/rc3.d/S98rc.local
        ln -sf ../init.d/grub-btrfsd            /etc/rc.d/rc3.d/S99grub-btrfsd
        ln -sf ../init.d/vdradmin               /etc/rc.d/rc3.d/S99vdradmin
@@ -140,6 +142,7 @@ $(TARGET) :
        ln -sf ../init.d/setclock               /etc/rc.d/rc6.d/K47setclock
        ln -sf  ../init.d/cyrus-sasl            /etc/rc.d/rc6.d/K49cyrus-sasl
        ln -sf ../init.d/vnstat                 /etc/rc.d/rc6.d/K51vnstat
+       ln -sf ../init.d/wireguard              /etc/rc.d/rc6.d/K70wireguard
        ln -sf ../init.d/conntrackd             /etc/rc.d/rc6.d/K77conntrackd
        ln -sf ../init.d/suricata               /etc/rc.d/rc6.d/K78suricata
        ln -sf ../init.d/leds                   /etc/rc.d/rc6.d/K79leds

diff --git a/src/initscripts/system/wireguard b/src/initscripts/system/wireguard
new file mode 100644 (file)
index 0000000..42428ae
--- /dev/null
+++ b/src/initscripts/system/wireguard
@@ -0,0 +1,137 @@
+#!/bin/sh
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2024 Michael Tremer <michael.tremer@ipfire.org>               #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+. /etc/sysconfig/rc
+. ${rc_functions}
+
+INTF="wg0"
+
+eval $(/usr/local/bin/readhash /var/ipfire/wireguard/settings)
+
+generate_config() {
+       echo "[Interface]"
+       echo "PrivateKey = ${PRIVATE_KEY}"
+
+       # Optionally set the port
+       if [ -n "${PORT}" ]; then
+               echo "ListenPort = ${PORT}"
+       fi
+
+       local IFS=','
+
+       local id
+       local enabled
+       local type
+       local name
+       local pubkey
+       local endpoint
+       local port
+       local routes
+       local _rest
+
+       local route
+
+       # Flush all previously set routes
+       ip route flush dev "${INTF}"
+
+       while read -r id enabled type name pubkey endpoint port routes _rest; do
+               # Skip peers that are not enabled
+               [ "${enabled}" = "on" ] || continue
+
+               echo "[Peer]"
+               echo "PublicKey = ${pubkey}"
+
+               # Set endpoint
+               if [ -n "${endpoint}" ]; then
+                       echo "Endpoint = ${endpoint}${port:+:}${port}"
+               fi
+
+               # Set routes
+               if [ -n "${routes}" ]; then
+                       echo "AllowedIPs = ${routes//|/, }"
+
+                       # Apply the routes
+                       if [ "${type}" = "net" ]; then
+                               for route in ${routes//|/,}; do
+                                       ip route add "${route}" dev "${INTF}"
+                               done
+                       fi
+               fi
+       done < /var/ipfire/wireguard/peers
+}
+
+wg_start() {
+       # Create the interface if it does not exist
+       if [ ! -d "/sys/class/net/${INTF}" ]; then
+               ip link add "${INTF}" type wireguard || return $?
+       fi
+
+       # Set up the interface
+       ip link set "${INTF}" up
+
+       # Set the MTU
+       if [ -n "${MTU}" ]; then
+               ip link set "${INTF}" mtu "${MTU}" || return $?
+       fi
+
+       # Load the configuration into the kernel
+       wg syncconf "${INTF}" <(generate_config) || return $?
+
+       return 0
+}
+
+wg_stop() {
+       if [ -d "/sys/class/net/${INTF}" ]; then
+               ip link del "${INTF}" || return $?
+       fi
+}
+
+case "${1}" in
+       start)
+               if [ "${ENABLED}" != "on" ]; then
+                       exit 0
+               fi
+
+               boot_mesg "Starting WireGuard VPN..."
+               wg_start; evaluate_retval
+               ;;
+
+       stop)
+               boot_mesg "Stopping WireGuard VPN..."
+               wg_stop; evaluate_retval
+               ;;
+
+       reload)
+               boot_mesg "Reloading WireGuard VPN..."
+               wg_start; evaluate_retval
+               ;;
+
+       restart)
+               ${0} stop
+               sleep 1
+               ${0} start
+               ;;
+
+       *)
+               echo "Usage: ${0} {start|stop|reload|restart}"
+               exit 1
+               ;;
+esac