Add wg2nd-web sourceHEADmain

1 files changed, 625 insertions, 0 deletions

diff --git a/src/models/wg2nd.cpp b/src/models/wg2nd.cpp
new file mode 100644
index 0000000..9397a0b
--- /dev/null
+++ b/src/models/wg2nd.cpp
@@ -0,0 +1,625 @@
+// SPDX-License-Identifier: GPL-2.0 OR MIT
+
+/*
+ * Copyright (C) 2023 Alex David <flu0r1ne@flu0r1ne.net>
+ */
+
+#include "wg2nd.hpp"
+
+#include <exception>
+#include <sstream>
+#include <random>
+#include <regex>
+
+#include <string_view>
+
+#include "crypto/pubkey.hpp"
+
+extern "C" {
+	#include "crypto/halfsiphash.h"
+}
+
+constexpr char const * PRIVATE_KEY_SUFFIX = ".privkey";
+constexpr char const * SYMMETRIC_KEY_SUFFIX = ".symkey";
+
+
+namespace wg2nd {
+	std::string private_keyfile_name(std::string const & priv_key) {
+		char pub_key[WG_KEY_LEN_BASE32];
+
+		// Derive public key
+		if(wg_pubkey_base32(priv_key.c_str(), pub_key)) {
+			throw ParsingException("Private key is formatted improperly");
+		}
+
+		std::string keyfile_name { pub_key };
+		keyfile_name.append(PRIVATE_KEY_SUFFIX);
+
+		return keyfile_name;
+	}
+
+	std::string public_keyfile_name(std::string const & pub_key) {
+		char pub_key32[WG_KEY_LEN_BASE32];
+
+		if(wg_key_convert_base32(pub_key.c_str(), pub_key32)) {
+			throw ParsingException("Public key for [Peer] " + pub_key + " is formatted improperly");
+		}
+
+		std::string keyfile_name { pub_key32 };
+		keyfile_name.append(SYMMETRIC_KEY_SUFFIX);
+
+		return keyfile_name;
+	}
+
+	uint32_t deterministic_fwmark(std::string const & interface_name) {
+		constexpr uint8_t const SIP_KEY[8] = {
+			0x90, 0x08, 0x82, 0xd7,
+			0x75, 0x68, 0xf4, 0x8e,
+		};
+
+		uint32_t mark;
+
+		halfsiphash(interface_name.c_str(), interface_name.size(), SIP_KEY, (uint8_t *) &mark, sizeof(mark));
+
+		return mark;
+	}
+
+	std::string interface_name_from_filename(std::filesystem::path config_path) {
+		std::string interface_name = config_path.filename().string();
+		interface_name = interface_name.substr(
+			0, interface_name.size() - config_path.extension().string().size()
+		);
+		return interface_name;
+	}
+
+	bool _is_default_route(std::string const & cidr) {
+		static std::regex ipv4_wildcard("0(\\.0){0,3}\\/0");
+		static std::regex ipv6_wildcard("(0{0,4}:){0,7}0{0,4}\\/0{1,4}");
+		
+		return std::regex_match(cidr, ipv4_wildcard) or std::regex_match(cidr, ipv6_wildcard);
+	}
+
+	bool _is_ipv4_route(std::string const & cidr) {
+		static std::regex ipv4("\\d{1,3}(\\.\\d{1,3}){0,3}(\\/\\d{1,2})?");
+
+		return std::regex_match(cidr, ipv4);
+	}
+
+	std::string_view _get_addr(std::string_view const & cidr) {
+		size_t suffix = cidr.rfind('/');
+
+		if(suffix == std::string::npos) {
+			return cidr;
+		} else {
+			return cidr.substr(0, suffix);
+		}
+	}
+
+	constexpr uint32_t MAIN_TABLE = 254;
+	constexpr uint32_t LOCAL_TABLE = 255;
+
+	// Parse the wireguard configuration from an input stream
+	// into a Config object. If an invalid key or section occurs,
+	// exists, a ParsingException is thrown.
+	Config parse_config(std::string const & interface_name, std::istream & stream) {
+		Config cfg;
+
+		cfg.intf.name = interface_name;
+		cfg.has_default_route = false;
+		cfg.intf.should_create_routes = true;
+
+		std::string line;
+		uint64_t line_no = 0;
+
+		enum class Section {
+			Interface,
+			Peer,
+			None
+		};
+
+		Section section = Section::None;
+
+		bool peer_has_default_route = false;
+
+		while (std::getline(stream, line)) {
+			++line_no;
+
+			// Strip whitespace (\t) from line in-place
+			{
+				size_t i = 0, j = 0;
+				for(; i < line.size(); i++) {
+					if(line[i] != ' ' and line[i] != '\t') {
+						line[j] = line[i];
+						j++;
+					}
+				}
+				line.erase(j);
+			}
+
+			// Remove content exceeding a comment
+			size_t comment_start = line.find('#');
+			if(comment_start != std::string::npos) {
+				line.erase(comment_start);
+			}
+
+			// Ignore empty lines
+			if (line.empty()) {
+				continue;
+			}
+
+			// Handle section: [Interface] or [Peer] specifies further
+			// configuration concerns an interface or peer respectively
+			
+			bool interface_sec_wanted = line == "[Interface]";
+			bool peer_sec_wanted = line == "[Peer]";
+
+			if(interface_sec_wanted || peer_sec_wanted) {
+				cfg.has_default_route = cfg.has_default_route or peer_has_default_route;
+				peer_has_default_route = false;
+			}
+
+			if (interface_sec_wanted) {
+				section = Section::Interface;
+				continue;
+			} else if (peer_sec_wanted) {
+				section = Section::Peer;
+				cfg.peers.emplace_back();
+				continue;
+			}
+
+			// Split key
+			size_t pos = line.find('=');
+			if(pos == std::string::npos) {
+				throw ParsingException("Expected key-value pair, got \"" + line + "\"", line_no);
+			}
+
+			std::string key = line.substr(0, pos);
+			std::string value = line.substr(pos + 1);
+
+			// Read keys according to corresponding section
+			switch (section) {
+			case Section::Interface: {
+				if (key == "PrivateKey") {
+					cfg.intf.private_key = value;
+				} else if (key == "DNS") {
+					std::istringstream dnsStream(value);
+					std::string dnsIp;
+					while (std::getline(dnsStream, dnsIp, ',')) {
+						cfg.intf.DNS.push_back(dnsIp);
+					}
+				} else if (key == "Address") {
+					std::istringstream addressStream(value);
+					std::string address;
+					while (std::getline(addressStream, address, ',')) {
+						cfg.intf.addresses.push_back(address);
+					}
+				} else if (key == "Table") {
+					if(value == "off") {
+						cfg.intf.table = 0;
+						cfg.intf.should_create_routes = false;
+					} else {
+						cfg.intf.should_create_routes = true;
+						if(value == "auto") {
+							cfg.intf.table = 0;
+						} else if(value == "main") {
+							cfg.intf.table = MAIN_TABLE;
+						} else if(value == "local") {
+							cfg.intf.table = LOCAL_TABLE;
+						} else {
+							long long table;
+							try {
+								table = std::stoll(value);
+							} catch(std::exception const & e) {
+								table = -1;
+							}
+
+							if(table < 1 || table > UINT32_MAX) {
+								throw ParsingException("Invalid option to \"Table\", must be one of \"off\", \"auto\" or a table number", line_no);
+							}
+
+							cfg.intf.table = table;
+						}
+					}
+				} else if (key == "ListenPort") {
+					int port;
+					try {
+						port = std::stoi(value);
+					} catch(std::exception & e) {
+						port = -1;
+					}
+
+					if(port < 0 || port > UINT16_MAX) {
+						throw ParsingException("Invalid port: " + key, line_no);
+					}
+
+					cfg.intf.listen_port = port;
+				} else if (key == "MTU") {
+					cfg.intf.mtu = value;
+				} else if (key == "PreUp") {
+					cfg.intf.preup = value;
+				} else if (key == "PostUp") {
+					cfg.intf.postup = value;
+				} else if (key == "PreDown") {
+					cfg.intf.predown = value;
+				} else if (key == "PostDown") {
+					cfg.intf.postdown = value;
+				} else if (key == "SaveConfig") {
+					cfg.intf.save_config = value;
+				} else {
+					throw ParsingException("Invalid key in [Interface] section: " + key, line_no);
+				}
+				break;
+			}
+			case Section::Peer: {
+				if (key == "Endpoint") {
+					cfg.peers.back().endpoint = value;
+				} else if (key == "AllowedIPs") {
+					std::istringstream allowedIpsStream(value);
+					std::string allowedIp;
+
+					while (std::getline(allowedIpsStream, allowedIp, ',')) {
+						bool is_default_route = _is_default_route(allowedIp);
+
+						if(is_default_route and cfg.has_default_route) {
+							throw ParsingException("Default routes exist on multiple peers");
+						}
+						
+						cfg.peers.back().allowed_ips.push_back(Cidr {
+							.route = allowedIp,
+							.is_default_route = is_default_route,
+							.is_ipv4 = _is_ipv4_route(allowedIp),
+						});
+
+						peer_has_default_route = peer_has_default_route or is_default_route;
+					}
+
+				} else if (key == "PublicKey") {
+					cfg.peers.back().public_key = value;
+				} else if (key == "PersistentKeepalive") {
+					cfg.peers.back().persistent_keepalive = value;
+				} else if (key == "PresharedKey") {
+					cfg.peers.back().preshared_key = value;
+				} else {
+					throw ParsingException("Invalid key in [Peer] section: " + key, line_no);
+				}
+				break;
+			}
+			case Section::None:
+				throw ParsingException("Unexpected key outside of section: " + key, line_no);
+			}
+		}
+
+		cfg.has_default_route = cfg.has_default_route or peer_has_default_route;
+
+#define MissingField(section, key) \
+	ConfigurationException("[" section "] section missing essential field \"" key "\"")
+
+		// Ensure PrivateKey, Address, PublicKey, and AllowedIPs are present
+
+		if(cfg.intf.private_key.empty()) {
+			throw MissingField("Interface", "PrivateKey");
+		}
+
+		if(cfg.intf.addresses.empty()) {
+			throw MissingField("Interface", "Address");
+		}
+
+		for(Peer const & peer : cfg.peers) {
+			if(peer.public_key.empty()) {
+				throw MissingField("Peer", "PublicKey");
+			}
+
+			if(peer.allowed_ips.empty()) {
+				throw MissingField("Peer", "AllowedIPs");
+			}
+		}
+
+#undef MissingField
+
+		return cfg;
+	}
+
+	static void _write_table(std::stringstream & firewall, Config const & cfg, std::vector<std::string_view> addrs, bool ipv4, uint32_t fwd_table) {
+		char const * ip = ipv4 ? "ip" : "ip6";
+
+		firewall << "table " << ip << " " << cfg.intf.name << " {\n"
+		         << "  chain preraw {\n"
+		         << "    type filter hook prerouting priority raw; policy accept;\n";
+
+		for(std::string_view const & addr : addrs) {
+			firewall << "    iifname != \"" << cfg.intf.name << "\" " << ip << " daddr " << addr << " fib saddr type != local drop;\n";
+		}
+
+		firewall << "  }\n"
+		         << "\n"
+		         << "  chain premangle {\n"
+		         << "    type filter hook prerouting priority mangle; policy accept;\n"
+		         << "    meta l4proto udp meta mark set ct mark;\n"
+		         << "  }\n"
+		         << "\n"
+		         << "  chain postmangle {\n"
+		         << "    type filter hook postrouting priority mangle; policy accept;\n"
+		         << "    meta l4proto udp meta mark 0x" << std::hex << fwd_table << std::dec << " ct mark set meta mark;\n"
+		         << "  }\n"
+		         << "}\n";
+		
+	}
+
+	std::string _gen_nftables_firewall(Config const & cfg, uint32_t fwd_table) {
+		std::stringstream firewall;
+
+		std::vector<std::string_view> ipv4_addrs;
+		std::vector<std::string_view> ipv6_addrs;
+
+		for(std::string const & addr : cfg.intf.addresses) {
+			if(_is_ipv4_route(addr)) {
+				ipv4_addrs.push_back(_get_addr(addr));
+			} else {
+				ipv6_addrs.push_back(_get_addr(addr));
+			}
+		}
+
+		if(ipv4_addrs.size() > 0) {
+			_write_table(firewall, cfg, ipv4_addrs, true, fwd_table);
+			firewall << "\n";
+		}
+
+		if(ipv6_addrs.size() > 0) {
+			_write_table(firewall, cfg, ipv6_addrs, false, fwd_table);
+		}
+
+		return firewall.str();
+	}
+
+	static std::string _gen_netdev_cfg(Config const & cfg, uint32_t fwd_table, std::filesystem::path const & private_keyfile,
+			std::vector<SystemdFilespec> & symmetric_keyfiles) {
+		std::stringstream netdev;
+
+		netdev << "# Autogenerated by wg2nd\n";
+		netdev << "[NetDev]\n";
+		netdev << "Name = " << cfg.intf.name << "\n";
+		netdev << "Kind = wireguard\n";
+		netdev << "Description = " << cfg.intf.name << " - wireguard tunnel\n";
+		netdev << "\n";
+
+		netdev << "[WireGuard]\n";
+		netdev << "PrivateKeyFile = " << private_keyfile.string() << "\n";
+
+		if(cfg.intf.listen_port.has_value()) {
+			netdev << "ListenPort = " << cfg.intf.listen_port.value() << "\n";
+		}
+
+		if(cfg.intf.should_create_routes and cfg.intf.table != 0) {
+			netdev << "RouteTable = ";
+
+			switch(cfg.intf.table) {
+				case LOCAL_TABLE:
+					netdev << "local";
+					break;
+				case MAIN_TABLE:
+					netdev << "main";
+					break;
+				default:
+					netdev << cfg.intf.table;
+					break;
+			}
+
+			netdev << "\n";
+		}
+
+		if(cfg.intf.should_create_routes and cfg.has_default_route) {
+			netdev << "FirewallMark = 0x" << std::hex << fwd_table << std::dec << "\n";
+		}
+
+		netdev << "\n";
+
+		for(Peer const & peer : cfg.peers) {
+			netdev << "[WireGuardPeer]\n";
+			netdev << "PublicKey = " << peer.public_key << "\n";
+
+			if(!peer.endpoint.empty()) {
+				netdev << "Endpoint = " << peer.endpoint << "\n";
+			}
+
+			if(!peer.preshared_key.empty()) {
+				std::string filename = public_keyfile_name(peer.public_key);
+
+				symmetric_keyfiles.push_back(SystemdFilespec {
+					.name = filename,
+					.contents = peer.preshared_key + "\n",
+				});
+
+				netdev << "PresharedKeyFile = " << filename << "\n";
+			}
+
+			for(Cidr const & cidr : peer.allowed_ips) {
+				netdev << "AllowedIPs = " << cidr.route << "\n";
+			}
+
+			if(!peer.persistent_keepalive.empty()) {
+				netdev << "PersistentKeepalive = " << peer.persistent_keepalive << "\n";
+			}
+
+			netdev << "\n";
+		}
+
+		return netdev.str();
+	}
+
+	static std::string _gen_network_cfg(Config const & cfg, uint32_t fwd_table) {
+		std::stringstream network;
+
+		network << "# Autogenerated by wg2nd\n";
+		network << "[Match]\n";
+		network << "Name = " << cfg.intf.name << "\n";
+		network << "\n";
+
+		network << "[Link]" << "\n";
+		network << "ActivationPolicy = manual\n";
+		if(!cfg.intf.mtu.empty()) {
+			network << "MTUBytes = " << cfg.intf.mtu << "\n";
+		}
+		network << "\n";
+
+		network << "[Network]\n";
+		for(std::string const & addr : cfg.intf.addresses) {
+			network << "Address = " << addr << "\n";
+		}
+
+		for(std::string const & dns : cfg.intf.DNS) {
+			network << "DNS = " << dns << "\n";
+		}
+
+		if(cfg.has_default_route and cfg.intf.DNS.size() > 0) {
+			network << "Domains = ~." << "\n";
+		}
+
+		network << "\n";
+
+		if(!cfg.intf.should_create_routes) {
+			return network.str();
+		}
+
+		constexpr uint8_t POLICY_ROUTE_NONE = 0;
+		constexpr uint8_t POLICY_ROUTE_V4 = 1 << 0;
+		constexpr uint8_t POLICY_ROUTE_V6 = 1 << 1;
+		constexpr uint8_t POLICY_ROUTE_BOTH = POLICY_ROUTE_V4 | POLICY_ROUTE_V6;
+
+		uint8_t policy_route = POLICY_ROUTE_NONE;
+
+		for(Peer const & peer : cfg.peers) {
+			for(Cidr const & cidr : peer.allowed_ips) {
+				if(cidr.is_default_route) {
+					policy_route |= cidr.is_ipv4 ? POLICY_ROUTE_V4 : POLICY_ROUTE_V6;
+				}
+				
+				network << "[Route]\n";
+				network << "Destination = " << cidr.route << "\n";
+				uint32_t table = cfg.has_default_route ? fwd_table : cfg.intf.table;
+				if(table) {
+					network << "Table = " << table << "\n";
+				}
+				network << "\n";
+			}
+		}
+
+		if(policy_route != POLICY_ROUTE_NONE) {
+
+			char const * family = nullptr;
+
+			switch(policy_route) {
+				case POLICY_ROUTE_V4:
+					family = "ipv6";
+					break;
+				case POLICY_ROUTE_V6:
+					family = "ipv4";
+					break;
+				case POLICY_ROUTE_BOTH:
+					family = "both";
+					break;
+			}
+
+			network << "[RoutingPolicyRule]\n";
+			network << "SuppressPrefixLength = 0\n";
+			network << "Family = " << family << "\n";
+			network << "Priority = 32764\n";
+			network << "\n";
+
+			network << "[RoutingPolicyRule]\n";
+			network << "FirewallMark = 0x" << std::hex << fwd_table << std::dec << "\n";
+			network << "InvertRule = true\n";
+			network << "Table = " << fwd_table << "\n";
+			network << "Family = " << family << "\n";
+			network << "Priority = 32765\n";
+			network << "\n";
+
+		}
+
+		return network.str();
+	}
+
+	static uint32_t _deterministic_random_table(std::string const & interface_name) {
+
+		uint32_t table = 0;
+		while(table == 0 or table == MAIN_TABLE or table == LOCAL_TABLE) {
+			table = deterministic_fwmark(interface_name);
+		}
+
+		return table;
+	}
+
+	SystemdConfig gen_systemd_config(
+		Config const & cfg,
+		std::filesystem::path const & keyfile_or_output_path,
+		std::optional<std::string> const & filename
+	) {
+
+		// If the table is explicitly specified with Table=<number>,
+		// all routes are added to this table.
+		//
+		// If Table=auto and a default route exists, this
+		// table is used by the default route to supersede
+		// non-encrypted traffic traveling to /0 routes in the
+		// main routing table by using suppress_prefix policy rules.
+		// These routes match a fwmark which is identical to the
+		// table name. All other routes are placed in the main routing
+		// table.
+		//
+		// If Table=off, no routes are added.
+		uint32_t fwd_table = _deterministic_random_table(cfg.intf.name);
+
+		std::vector<SystemdFilespec> symmetric_keyfiles;
+
+		std::filesystem::path keyfile_path;
+
+		if(keyfile_or_output_path.has_filename()) {
+			keyfile_path = keyfile_or_output_path;
+		} else {
+			std::string private_keyfile = private_keyfile_name(cfg.intf.private_key);
+			keyfile_path = keyfile_or_output_path / private_keyfile;
+		}
+
+		std::vector<std::string> warnings;
+
+#define WarnOnIntfField(field_, field_name) \
+if(!cfg.intf.field_.empty()) { \
+	warnings.push_back("[Interface] section contains a field \"" field_name "\" which does not have a systemd-networkd analog, omitting"); \
+}
+
+		WarnOnIntfField(preup, "PreUp")
+		WarnOnIntfField(postup, "PostUp")
+		WarnOnIntfField(predown, "PreDown")
+		WarnOnIntfField(postdown, "PostDown")
+		WarnOnIntfField(save_config, "SaveConfig")
+
+		if(!cfg.intf.preup.empty()) {
+			warnings.push_back("[Interface] section contains a field \"PreUp\" which does not have a systemd-networkd analog");
+		}
+
+		std::string const & basename = filename.value_or(cfg.intf.name);
+
+		return SystemdConfig {
+			.netdev = {
+				.name = basename + ".netdev",
+				.contents = _gen_netdev_cfg(cfg, fwd_table, keyfile_path, symmetric_keyfiles),
+			},
+			.network = {
+				.name = basename + ".network",
+				.contents = _gen_network_cfg(cfg, fwd_table)
+			},
+			.private_keyfile = {
+				.name = keyfile_path.filename(),
+				.contents = cfg.intf.private_key + "\n",
+			},
+			.symmetric_keyfiles = std::move(symmetric_keyfiles),
+			.warnings = std::move(warnings),
+			.firewall = _gen_nftables_firewall(cfg, fwd_table),
+		};
+	}
+
+	SystemdConfig wg2nd(std::string const & interface_name, std::istream & stream,
+			std::filesystem::path const & keyfile_or_output_path, std::optional<std::string> const & filename) {
+		return gen_systemd_config(parse_config(interface_name, stream), keyfile_or_output_path, filename);
+	}
+
+}