init:
- Working basic wg controls
- Working ip_pool allocation
- Working basic HTTP API
Signed-off-by: HeshamTB <hishaminv@gmail.com>
This commit is contained in:
commit
1a611616bd
GPG Key ID:
74876157D199B09E
2
cmd/hvpn-node/.gitignore
vendored
Normal file
2
cmd/hvpn-node/.gitignore
vendored
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
hvpn-node
|
||||||
|
|
||||||
257
cmd/hvpn-node/hvpn-node.go
Normal file
257
cmd/hvpn-node/hvpn-node.go
Normal file
@ -0,0 +1,257 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"log/slog"
|
||||||
|
"net/http"
|
||||||
|
"os"
|
||||||
|
"os/signal"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/urfave/cli/v2"
|
||||||
|
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||||
|
|
||||||
|
hvpnnode3 "gitea.hbanafa.com/HeshamTB/hvpn-node3"
|
||||||
|
)
|
||||||
|
|
||||||
|
var IPPool *hvpnnode3.IPPool
|
||||||
|
var VPNIPCIDR string
|
||||||
|
var PrivateKeyPath cli.Path
|
||||||
|
var InterfaceName string
|
||||||
|
var WgPort int
|
||||||
|
var wgLink *hvpnnode3.WGLink
|
||||||
|
|
||||||
|
var httpPort int
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
|
||||||
|
|
||||||
|
// TODO: Define error exit codes
|
||||||
|
slog.SetLogLoggerLevel(slog.LevelDebug)
|
||||||
|
|
||||||
|
app := createCliApp()
|
||||||
|
err := app.Run(os.Args)
|
||||||
|
if err != nil {
|
||||||
|
slog.Error(err.Error())
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
func run() {
|
||||||
|
IPPool, err := hvpnnode3.NewPool(VPNIPCIDR)
|
||||||
|
if err != nil {
|
||||||
|
slog.Error(fmt.Sprintf("main.IPPool: %s", err))
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
slog.Info(fmt.Sprintf("Init ip pool %s", VPNIPCIDR))
|
||||||
|
|
||||||
|
testVip, err := IPPool.Allocate()
|
||||||
|
if err != nil {
|
||||||
|
slog.Error("main.testVip: ", err)
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
|
||||||
|
slog.Info(fmt.Sprintf("main.testVip: IP Pool Test IP: %s", testVip.String()))
|
||||||
|
err = IPPool.Free(testVip)
|
||||||
|
if err != nil {
|
||||||
|
slog.Error("main.testVip: Could not free test Vip from IPPool!", err)
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
slog.Info("main.testVip: Test IP Freed")
|
||||||
|
|
||||||
|
apiMux := http.NewServeMux()
|
||||||
|
apiMux.HandleFunc("GET /peer", hvpnnode3.HandleGetPeer(wgLink))
|
||||||
|
apiMux.HandleFunc("POST /peer", hvpnnode3.HandlePostPeer(IPPool, wgLink))
|
||||||
|
apiMux.HandleFunc("GET /peers", hvpnnode3.HandleGetPeers(wgLink))
|
||||||
|
|
||||||
|
var handler http.Handler = apiMux
|
||||||
|
handler = hvpnnode3.HttpLogHandler2(handler)
|
||||||
|
|
||||||
|
port := fmt.Sprintf("%d", httpPort)
|
||||||
|
host := "0.0.0.0"
|
||||||
|
hostPort := fmt.Sprintf("%s:%s", host, port)
|
||||||
|
|
||||||
|
slog.Info(fmt.Sprintf("Starting HVPN node on %s", hostPort))
|
||||||
|
srv := &http.Server{
|
||||||
|
ReadTimeout: 120 * time.Second,
|
||||||
|
WriteTimeout: 120 * time.Second,
|
||||||
|
IdleTimeout: 120 * time.Second,
|
||||||
|
Handler: handler,
|
||||||
|
Addr: hostPort,
|
||||||
|
}
|
||||||
|
|
||||||
|
defer wgLink.Close()
|
||||||
|
slog.Warn(srv.ListenAndServe().Error())
|
||||||
|
}
|
||||||
|
|
||||||
|
func createCliApp() *cli.App {
|
||||||
|
app := cli.NewApp()
|
||||||
|
app.Name = os.Args[0]
|
||||||
|
app.HideHelpCommand = true
|
||||||
|
app.Usage = "HVPN node API server"
|
||||||
|
app.Args = true
|
||||||
|
|
||||||
|
author1 := cli.Author{
|
||||||
|
Name: "Hesham T. Banafa",
|
||||||
|
Email: "hishaminv@gmail.com"}
|
||||||
|
app.Authors = append(app.Authors, &author1)
|
||||||
|
|
||||||
|
logLevel := cli.StringFlag{
|
||||||
|
Name: "log-level",
|
||||||
|
Value: "INFO",
|
||||||
|
EnvVars: []string{"LOG_LEVEL"},
|
||||||
|
Action: func(ctx *cli.Context, s string) error {
|
||||||
|
switch s {
|
||||||
|
case "INFO":
|
||||||
|
slog.SetLogLoggerLevel(slog.LevelInfo)
|
||||||
|
case "DEBUG":
|
||||||
|
slog.SetLogLoggerLevel(slog.LevelDebug)
|
||||||
|
case "WARN":
|
||||||
|
slog.SetLogLoggerLevel(slog.LevelWarn)
|
||||||
|
case "ERROR":
|
||||||
|
slog.SetLogLoggerLevel(slog.LevelError)
|
||||||
|
default:
|
||||||
|
return cli.Exit(fmt.Sprintf("Undefined log level: %s", s), 1)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
},
|
||||||
|
}
|
||||||
|
app.Flags = append(app.Flags, &logLevel)
|
||||||
|
|
||||||
|
privateKeyFileFlag := cli.PathFlag{
|
||||||
|
Name: "private-key",
|
||||||
|
Required: true,
|
||||||
|
Usage: "Path to file with private key",
|
||||||
|
Destination: &PrivateKeyPath,
|
||||||
|
}
|
||||||
|
app.Flags = append(app.Flags, &privateKeyFileFlag)
|
||||||
|
|
||||||
|
vpnIpCIDR := cli.StringFlag{
|
||||||
|
Name: "cidr",
|
||||||
|
Usage: "The network subnet used for the internal IP Pool",
|
||||||
|
Value: "10.42.0.0/16",
|
||||||
|
Aliases: []string{"n"},
|
||||||
|
Destination: &VPNIPCIDR,
|
||||||
|
}
|
||||||
|
app.Flags = append(app.Flags, &vpnIpCIDR)
|
||||||
|
|
||||||
|
wgInterfaceName := cli.StringFlag{
|
||||||
|
Name: "interface",
|
||||||
|
Usage: "Name of the Wireguard interface to be created and managed",
|
||||||
|
Value: "hvpn0",
|
||||||
|
Aliases: []string{"i"},
|
||||||
|
Destination: &InterfaceName,
|
||||||
|
}
|
||||||
|
app.Flags = append(app.Flags, &wgInterfaceName)
|
||||||
|
|
||||||
|
wgPort := cli.IntFlag{
|
||||||
|
Name: "port",
|
||||||
|
Usage: "UDP Port for wireguard device",
|
||||||
|
Value: 6416,
|
||||||
|
Aliases: []string{"p"},
|
||||||
|
Destination: &WgPort,
|
||||||
|
}
|
||||||
|
app.Flags = append(app.Flags, &wgPort)
|
||||||
|
|
||||||
|
httpPort := cli.IntFlag{
|
||||||
|
Name: "http-port",
|
||||||
|
Usage: "TCP Port for HTTP API",
|
||||||
|
Value: 8080,
|
||||||
|
Destination: &httpPort,
|
||||||
|
}
|
||||||
|
app.Flags = append(app.Flags, &httpPort)
|
||||||
|
|
||||||
|
|
||||||
|
app.Action = func(ctx *cli.Context) error {
|
||||||
|
err := setup()
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
run()
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
return app
|
||||||
|
}
|
||||||
|
|
||||||
|
func setup() error {
|
||||||
|
privKeyFile, err := os.Open(PrivateKeyPath)
|
||||||
|
if err != nil {
|
||||||
|
return cli.Exit(err, 1)
|
||||||
|
}
|
||||||
|
defer privKeyFile.Close()
|
||||||
|
slog.Debug("Keyfile opened for reading")
|
||||||
|
|
||||||
|
|
||||||
|
privateKeyStr := make([]byte, 45)
|
||||||
|
n, err := privKeyFile.Read(privateKeyStr)
|
||||||
|
if err != nil {
|
||||||
|
return cli.Exit(err, 1)
|
||||||
|
}
|
||||||
|
if n != 45 {
|
||||||
|
slog.Warn("Private key length did not math the expected 45!")
|
||||||
|
}
|
||||||
|
slog.Debug(fmt.Sprintf("Read %d bytes from keyfile", n))
|
||||||
|
|
||||||
|
privateKey, err := wgtypes.ParseKey(string(privateKeyStr))
|
||||||
|
if err != nil {
|
||||||
|
return cli.Exit(err, 1)
|
||||||
|
}
|
||||||
|
slog.Debug("Private key parsed and is correct")
|
||||||
|
|
||||||
|
wg, err := hvpnnode3.InitWGLink(
|
||||||
|
InterfaceName,
|
||||||
|
&privateKey,
|
||||||
|
WgPort,
|
||||||
|
)
|
||||||
|
if err != nil {
|
||||||
|
return cli.Exit(err, 1)
|
||||||
|
}
|
||||||
|
|
||||||
|
wgLink = wg
|
||||||
|
|
||||||
|
// this is done to recover from the next call to wgLink.Device call
|
||||||
|
// idk a better way to recover or prevent the panic when running user
|
||||||
|
// does not have root or CAP_NET_ADMIN.
|
||||||
|
defer func() {
|
||||||
|
if r := recover(); r != nil {
|
||||||
|
slog.Error(fmt.Sprint(r))
|
||||||
|
slog.Error("Recovered from panic. Ensure to run as root or with CAP_NET_ADMIN")
|
||||||
|
cli.Exit(errors.New("Recovered from panic. Ensure to run as root or with CAP_NET_ADMIN"),1)
|
||||||
|
os.Exit(-1)
|
||||||
|
}
|
||||||
|
}()
|
||||||
|
|
||||||
|
slog.Info("Wireguard device is setup and running")
|
||||||
|
|
||||||
|
|
||||||
|
dev, err := wgLink.Device(InterfaceName)
|
||||||
|
if err != nil {
|
||||||
|
return cli.Exit(err, 1)
|
||||||
|
}
|
||||||
|
slog.Info("Initialized Wireguard device using wgctrl")
|
||||||
|
|
||||||
|
slog.Info(
|
||||||
|
fmt.Sprintf(
|
||||||
|
"Device name: %s, UDP port: %d, Type: %s",
|
||||||
|
dev.Name, dev.ListenPort, dev.Type.String(),
|
||||||
|
),
|
||||||
|
)
|
||||||
|
|
||||||
|
//defer wgLink.Close()
|
||||||
|
c := make(chan os.Signal, 1)
|
||||||
|
signal.Notify(c, os.Interrupt, os.Kill)
|
||||||
|
go func() {
|
||||||
|
slog.Debug("Listening for SIGINT, SIGKILL")
|
||||||
|
<- c
|
||||||
|
slog.Warn("Recived SIGINT! Closing Wireguard Device")
|
||||||
|
wgLink.Close()
|
||||||
|
os.Exit(0)
|
||||||
|
}()
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
27
go.mod
Normal file
27
go.mod
Normal file
@ -0,0 +1,27 @@
|
|||||||
|
module gitea.hbanafa.com/HeshamTB/hvpn-node3
|
||||||
|
|
||||||
|
go 1.22.0
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/felixge/httpsnoop v1.0.4
|
||||||
|
github.com/urfave/cli/v2 v2.27.1
|
||||||
|
github.com/vishvananda/netlink v1.1.0
|
||||||
|
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
|
||||||
|
)
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
|
||||||
|
github.com/google/go-cmp v0.5.9 // indirect
|
||||||
|
github.com/josharian/native v1.1.0 // indirect
|
||||||
|
github.com/mdlayher/genetlink v1.3.2 // indirect
|
||||||
|
github.com/mdlayher/netlink v1.7.2 // indirect
|
||||||
|
github.com/mdlayher/socket v0.4.1 // indirect
|
||||||
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
||||||
|
github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df // indirect
|
||||||
|
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
|
||||||
|
golang.org/x/crypto v0.8.0 // indirect
|
||||||
|
golang.org/x/net v0.9.0 // indirect
|
||||||
|
golang.org/x/sync v0.1.0 // indirect
|
||||||
|
golang.org/x/sys v0.7.0 // indirect
|
||||||
|
golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b // indirect
|
||||||
|
)
|
||||||
39
go.sum
Normal file
39
go.sum
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
|
||||||
|
github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
|
||||||
|
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
|
||||||
|
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
|
||||||
|
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
|
||||||
|
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||||
|
github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
|
||||||
|
github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
|
||||||
|
github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
|
||||||
|
github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
|
||||||
|
github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
|
||||||
|
github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
|
||||||
|
github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
|
||||||
|
github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
|
||||||
|
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
|
||||||
|
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
|
||||||
|
github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
|
||||||
|
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
|
||||||
|
github.com/urfave/cli/v2 v2.27.1 h1:8xSQ6szndafKVRmfyeUMxkNUJQMjL1F2zmsZ+qHpfho=
|
||||||
|
github.com/urfave/cli/v2 v2.27.1/go.mod h1:8qnjx1vcq5s2/wpsqoZFndg2CE5tNFyrTvS6SinrnYQ=
|
||||||
|
github.com/vishvananda/netlink v1.1.0 h1:1iyaYNBLmP6L0220aDnYQpo1QEV4t4hJ+xEEhhJH8j0=
|
||||||
|
github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
|
||||||
|
github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df h1:OviZH7qLw/7ZovXvuNyL3XQl8UFofeikI1NW1Gypu7k=
|
||||||
|
github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
|
||||||
|
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
|
||||||
|
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
|
||||||
|
golang.org/x/crypto v0.8.0 h1:pd9TJtTueMTVQXzk8E2XESSMQDj/U7OUu0PqJqPXQjQ=
|
||||||
|
golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
|
||||||
|
golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
|
||||||
|
golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
|
||||||
|
golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
|
||||||
|
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
|
||||||
|
golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b h1:J1CaxgLerRR5lgx3wnr6L04cJFbWoceSK9JWBdglINo=
|
||||||
|
golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
|
||||||
|
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvYQH2OU3/TnxLx97WDSUDRABfT18pCOYwc2GE=
|
||||||
|
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6/go.mod h1:3rxYc4HtVcSG9gVaTs2GEBdehh+sYPOwKtyUWEOTb80=
|
||||||
137
handlers.go
Normal file
137
handlers.go
Normal file
@ -0,0 +1,137 @@
|
|||||||
|
package hvpnnode3
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"log/slog"
|
||||||
|
"net"
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/felixge/httpsnoop"
|
||||||
|
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||||
|
|
||||||
|
"gitea.hbanafa.com/HeshamTB/hvpn-node3/proto"
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
func HandleGetPeer(wgLink *WGLink) http.HandlerFunc {
|
||||||
|
return func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
w.WriteHeader(http.StatusNotImplemented)
|
||||||
|
slog.Info("GET Peer is not implemented")
|
||||||
|
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func HandleGetPeers(wgLink *WGLink) http.HandlerFunc {
|
||||||
|
return func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
dev, err := wgLink.Device(wgLink.Name)
|
||||||
|
if err != nil {
|
||||||
|
w.WriteHeader(http.StatusInternalServerError)
|
||||||
|
slog.Error(err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
var peers []proto.Peer
|
||||||
|
for _, peer := range dev.Peers {
|
||||||
|
p := proto.Peer{
|
||||||
|
Address: peer.AllowedIPs[0].IP,
|
||||||
|
PublicKey: peer.PublicKey.String(),
|
||||||
|
PersistentKeepalive: peer.PersistentKeepaliveInterval,
|
||||||
|
TX: peer.TransmitBytes,
|
||||||
|
RX: peer.ReceiveBytes,
|
||||||
|
}
|
||||||
|
peers = append(peers, p)
|
||||||
|
}
|
||||||
|
err = json.NewEncoder(w).Encode(peers)
|
||||||
|
if err != nil {
|
||||||
|
w.WriteHeader(http.StatusInternalServerError)
|
||||||
|
}
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
func HandlePostPeer(IPPool IPPool, wgLink *WGLink) http.HandlerFunc {
|
||||||
|
return func(w http.ResponseWriter, r* http.Request) {
|
||||||
|
peerRequest := proto.CreatePeerRequest{}
|
||||||
|
err := json.NewDecoder(r.Body).Decode(&peerRequest)
|
||||||
|
if err != nil {
|
||||||
|
w.WriteHeader(http.StatusBadRequest)
|
||||||
|
json.NewEncoder(w).Encode(
|
||||||
|
&proto.ErrJSONResponse{Message: "Invalid request JSON"},
|
||||||
|
)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
// TODO: Check if pubkey is already registered
|
||||||
|
dev, err := wgLink.Device(wgLink.Name)
|
||||||
|
if err != nil {
|
||||||
|
slog.Error(err.Error())
|
||||||
|
w.WriteHeader(http.StatusInternalServerError)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, peer := range dev.Peers {
|
||||||
|
if peer.PublicKey.String() == peerRequest.PublicKey {
|
||||||
|
w.WriteHeader(http.StatusAccepted)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
newIP, err := IPPool.Allocate()
|
||||||
|
if err != nil {
|
||||||
|
slog.Error(err.Error())
|
||||||
|
w.WriteHeader(http.StatusInternalServerError)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO: Add peer to wg device
|
||||||
|
// TODO: Declare subnet mask for the service
|
||||||
|
pkey, _ := wgtypes.GeneratePrivateKey()
|
||||||
|
newPeer := wgtypes.PeerConfig{
|
||||||
|
PublicKey: pkey.PublicKey(),
|
||||||
|
ReplaceAllowedIPs: true,
|
||||||
|
AllowedIPs: []net.IPNet{
|
||||||
|
{
|
||||||
|
IP: newIP,
|
||||||
|
Mask: net.IPv4Mask(255, 255, 255, 255),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
err = wgLink.ConfigureDevice(
|
||||||
|
wgLink.Name,
|
||||||
|
wgtypes.Config{
|
||||||
|
Peers: []wgtypes.PeerConfig{
|
||||||
|
newPeer,
|
||||||
|
},
|
||||||
|
ReplacePeers: false,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
if err != nil {
|
||||||
|
slog.Error(err.Error())
|
||||||
|
w.WriteHeader(http.StatusInternalServerError)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
json.NewEncoder(w).Encode(
|
||||||
|
&proto.Peer{
|
||||||
|
Address: newIP,
|
||||||
|
MTU: 1384,
|
||||||
|
PublicKey: peerRequest.PublicKey,
|
||||||
|
Endpoint: "vpn.test.com:8487",
|
||||||
|
AllowedIPs: net.ParseIP("0.0.0.0/0"),
|
||||||
|
PersistentKeepalive: 25,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
func HttpLogHandler2(h http.Handler) http.Handler {
|
||||||
|
// https://blog.kowalczyk.info/article/e00e89c3841e4f8c8c769a78b8a90b47/logging-http-requests-in-go.html
|
||||||
|
fn := func(w http.ResponseWriter, r* http.Request) {
|
||||||
|
m := httpsnoop.CaptureMetrics(h, w, r)
|
||||||
|
msg := fmt.Sprintf(
|
||||||
|
"%s %s %s %d %s", r.RemoteAddr, r.Method,
|
||||||
|
r.URL.String(),m.Code, m.Duration)
|
||||||
|
slog.Info(msg)
|
||||||
|
}
|
||||||
|
return http.HandlerFunc(fn)
|
||||||
|
}
|
||||||
28
init/isolate.sh
Executable file
28
init/isolate.sh
Executable file
@ -0,0 +1,28 @@
|
|||||||
|
#!/bin/env bash
|
||||||
|
|
||||||
|
# A POSIX variable
|
||||||
|
OPTIND=1 # Reset in case getopts has been used previously in the shell.
|
||||||
|
|
||||||
|
# Initialize our own variables:
|
||||||
|
wg_interface=""
|
||||||
|
|
||||||
|
while getopts "h?i:" opt; do
|
||||||
|
case "$opt" in
|
||||||
|
h|\?)
|
||||||
|
#show_help
|
||||||
|
echo "Usage: isolate.sh -i <wg_interface>"
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
i) wg_interface=$OPTARG
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
shift $((OPTIND-1))
|
||||||
|
|
||||||
|
[ "${1:-}" = "--" ] && shift
|
||||||
|
|
||||||
|
|
||||||
|
set -x
|
||||||
|
iptables -I FORWARD -i $wg_interface -o $wg_interface -j DROP
|
||||||
|
set +x
|
||||||
21
init/systemd/hvpn.service
Normal file
21
init/systemd/hvpn.service
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=HVPN node service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=exec
|
||||||
|
User=hvpnnode
|
||||||
|
Group=hvpn
|
||||||
|
ExecStart=/opt/hvpn-node/hvpn-node
|
||||||
|
AmbientCapabilities=CAP_NET_ADMIN
|
||||||
|
RemainAfterExit=true
|
||||||
|
NoNewPrivileges=true
|
||||||
|
PrivateTmp=true
|
||||||
|
ProtectSystem=full
|
||||||
|
PrivateDevices=true
|
||||||
|
ProtectKernelTunables=true
|
||||||
|
|
||||||
|
#Nice=19
|
||||||
|
#IOSchedulingClass=idle
|
||||||
|
#IOSchedulingPriority=7
|
||||||
|
#PrivateDevices=true
|
||||||
|
#PrivateNetwork=true
|
||||||
102
ip_pool.go
Normal file
102
ip_pool.go
Normal file
@ -0,0 +1,102 @@
|
|||||||
|
package hvpnnode3
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/binary"
|
||||||
|
"errors"
|
||||||
|
"net"
|
||||||
|
"sync"
|
||||||
|
)
|
||||||
|
|
||||||
|
// IPPool knows how to allocate IPs and free previously allocated ones.
|
||||||
|
type IPPool interface {
|
||||||
|
Allocate() (net.IP, error)
|
||||||
|
Free(net.IP) error
|
||||||
|
Remove(...net.IP) error
|
||||||
|
}
|
||||||
|
|
||||||
|
// Pool is a pool of available IP numbers for allocation.
|
||||||
|
type Pool struct {
|
||||||
|
network *net.IPNet
|
||||||
|
available []net.IP
|
||||||
|
allocMu sync.Mutex
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewPool creates a new pool with a CIDR.
|
||||||
|
func NewPool(cidr string) (*Pool, error) {
|
||||||
|
networkip, network, err := net.ParseCIDR(cidr)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
mask, size := network.Mask.Size()
|
||||||
|
maskbits := binary.BigEndian.Uint32(network.Mask)
|
||||||
|
max := uint32(1 << uint(size-mask))
|
||||||
|
// Remove unusable host ranges
|
||||||
|
max -= 2
|
||||||
|
|
||||||
|
available := make([]net.IP, max)
|
||||||
|
networkipbits := maskbits & binary.BigEndian.Uint32(networkip.To4())
|
||||||
|
for ; max > 0; max-- {
|
||||||
|
ip := make([]byte, 4)
|
||||||
|
binary.BigEndian.PutUint32(ip, uint32(networkipbits|max))
|
||||||
|
available[max-1] = net.IP(ip)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &Pool{
|
||||||
|
network: network,
|
||||||
|
available: available,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Remove selected IPs from the available pool.
|
||||||
|
func (p *Pool) Remove(ips ...net.IP) error {
|
||||||
|
p.allocMu.Lock()
|
||||||
|
defer p.allocMu.Unlock()
|
||||||
|
|
||||||
|
all := p.available
|
||||||
|
for _, ip := range ips {
|
||||||
|
if !p.network.Contains(ip) {
|
||||||
|
return errors.New("IP is not part of this pool")
|
||||||
|
}
|
||||||
|
for n, a := range p.available {
|
||||||
|
if a.Equal(ip) {
|
||||||
|
all = append(all[:n], all[n+1:]...)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
p.available = all
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Allocate assigns a new IP to the pool for use.
|
||||||
|
func (p *Pool) Allocate() (ip net.IP, err error) {
|
||||||
|
p.allocMu.Lock()
|
||||||
|
defer p.allocMu.Unlock()
|
||||||
|
|
||||||
|
if len(p.available) > 0 {
|
||||||
|
ip = p.available[0]
|
||||||
|
p.available = p.available[1:]
|
||||||
|
} else {
|
||||||
|
err = errors.New("No more IPs currently available")
|
||||||
|
}
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// Free returns the IP to the pool to be used by other allocations.
|
||||||
|
func (p *Pool) Free(ip net.IP) error {
|
||||||
|
if !p.network.Contains(ip) {
|
||||||
|
return errors.New("IP is not part of this pool")
|
||||||
|
}
|
||||||
|
p.allocMu.Lock()
|
||||||
|
defer p.allocMu.Unlock()
|
||||||
|
|
||||||
|
p.available = append([]net.IP{ip}, p.available...)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ip4To6 will prefix IPv4 with the IPv6 network to create an IPv6 address.
|
||||||
|
func ip4To6(ip4 net.IP, ip6prefix *net.IPNet) (ip6 net.IP) {
|
||||||
|
b6 := ip6prefix.IP.To16()
|
||||||
|
return append(b6[:12], ip4.To4()...)
|
||||||
|
}
|
||||||
|
|
||||||
69
ip_pool_test.go
Normal file
69
ip_pool_test.go
Normal file
@ -0,0 +1,69 @@
|
|||||||
|
package hvpnnode3
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestPoolIP4(t *testing.T) {
|
||||||
|
pool, err := NewPool("10.2.0.0/16")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
if l := len(pool.available); l != 65534 {
|
||||||
|
t.Error("Expected 65534 available addresses, got", l)
|
||||||
|
}
|
||||||
|
|
||||||
|
ip, err := pool.Allocate()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if l := len(pool.available); l != 65533 {
|
||||||
|
t.Error("Expected 65533 available addresses, got", l)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := pool.Free(ip); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
if l := len(pool.available); l != 65534 {
|
||||||
|
t.Error("Expected 65534 available addresses, got", l)
|
||||||
|
}
|
||||||
|
|
||||||
|
if ip.String() != "10.2.0.1" {
|
||||||
|
t.Error("Wrong ip", ip)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err = pool.Free(net.ParseIP("1.2.3.4")); err == nil {
|
||||||
|
t.Error("expected error trying to free invalid IP")
|
||||||
|
}
|
||||||
|
|
||||||
|
if l := len(pool.available); l != 65534 {
|
||||||
|
t.Error("Expected 65534 available addresses, got", l)
|
||||||
|
}
|
||||||
|
if err := pool.Remove(net.ParseIP("10.2.0.100"), net.ParseIP("10.2.0.200")); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
if l := len(pool.available); l != 65532 {
|
||||||
|
t.Error("invalid number of available addresses, ", l)
|
||||||
|
}
|
||||||
|
for _, ip := range pool.available {
|
||||||
|
if ip.Equal(net.ParseIP("10.2.0.100")) {
|
||||||
|
t.Error("IP was not removed")
|
||||||
|
break
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIP4To6(t *testing.T) {
|
||||||
|
_, prefix, err := net.ParseCIDR("fdad:b10c:a::/48")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
ip6 := ip4To6(net.IP{10, 1, 2, 3}, prefix)
|
||||||
|
if s := net.IP(ip6).String(); s != "fdad:b10c:a::a01:203" {
|
||||||
|
t.Log(s)
|
||||||
|
t.Error("invalid IP")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
77
link.go
Normal file
77
link.go
Normal file
@ -0,0 +1,77 @@
|
|||||||
|
package hvpnnode3
|
||||||
|
|
||||||
|
import (
|
||||||
|
"errors"
|
||||||
|
|
||||||
|
"github.com/vishvananda/netlink"
|
||||||
|
"golang.zx2c4.com/wireguard/wgctrl"
|
||||||
|
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||||
|
)
|
||||||
|
|
||||||
|
type WGLink struct {
|
||||||
|
*netlink.LinkAttrs
|
||||||
|
*wgctrl.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
// Retruns an existing or create a WGLink
|
||||||
|
func InitWGLink(ifName string, privateKey *wgtypes.Key, port int) (*WGLink, error){
|
||||||
|
attrs := netlink.NewLinkAttrs()
|
||||||
|
attrs.Name = ifName
|
||||||
|
wg := WGLink{LinkAttrs: &attrs}
|
||||||
|
link, err := netlink.LinkByName(ifName)
|
||||||
|
if err != nil {
|
||||||
|
switch err.(type) {
|
||||||
|
case netlink.LinkNotFoundError:
|
||||||
|
if err := netlink.LinkAdd(&wg); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
default:
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
wg.LinkAttrs = link.Attrs()
|
||||||
|
}
|
||||||
|
|
||||||
|
err = wg.initClient()
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
err = wg.ConfigureDevice(
|
||||||
|
ifName,
|
||||||
|
wgtypes.Config{
|
||||||
|
PrivateKey: privateKey,
|
||||||
|
ListenPort: &port,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return &wg, netlink.LinkSetUp(&wg)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (WGLink) Type() string {
|
||||||
|
return "wireguard"
|
||||||
|
}
|
||||||
|
|
||||||
|
func (wg *WGLink) Attrs() *netlink.LinkAttrs {
|
||||||
|
return wg.LinkAttrs
|
||||||
|
}
|
||||||
|
|
||||||
|
func (wg *WGLink) Close() error {
|
||||||
|
return netlink.LinkDel(wg)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (wg *WGLink) initClient() error {
|
||||||
|
client, err := wgctrl.New()
|
||||||
|
if client == nil {
|
||||||
|
return errors.New("Could not initialize new Wireguard Client")
|
||||||
|
}
|
||||||
|
wg.Client = client
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
5
proto/error.go
Normal file
5
proto/error.go
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
package proto
|
||||||
|
|
||||||
|
type ErrJSONResponse struct {
|
||||||
|
Message string `json:"message"`
|
||||||
|
}
|
||||||
26
proto/peer.go
Normal file
26
proto/peer.go
Normal file
@ -0,0 +1,26 @@
|
|||||||
|
package proto
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
type CreatePeerRequest struct {
|
||||||
|
UUID string `json:"uuid"`
|
||||||
|
PublicKey string `json:"public_key"`
|
||||||
|
}
|
||||||
|
|
||||||
|
/* JSON returned for user to use. This means that the peer can connect with
|
||||||
|
these parameters as a wireguard peer */
|
||||||
|
type Peer struct {
|
||||||
|
Address net.IP `json:"address"`
|
||||||
|
MTU uint16 `json:"mtu"`
|
||||||
|
PublicKey string `json:"public_key"`
|
||||||
|
Endpoint string `json:"endpoint"`
|
||||||
|
AllowedIPs net.IP `json:"allowed_ips"`
|
||||||
|
PersistentKeepalive time.Duration `json:"presistent_keepalive"`
|
||||||
|
TX int64
|
||||||
|
RX int64
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user