wgconfmgr

#!/bin/bash

[[ -z "$WG_DIR" ]] && WG_DIR=/etc/wireguard

_main () {
    argv0="$1"
    shift

    cmd="$1"
    shift

    case "$cmd" in
        "")
            _usage "${argv0}"
            ;;
        list)
            _list_interfaces
            ;;
        write-conf)
            _write_conf "$@"
            ;;
        conf)
            _show_conf "$@"
            ;;
        qr)
            ;&
        qrcode)
            _show_qr "$@"
            ;;
        openwrt)
            __peer_remoteconf_openwrt "$@"
            ;;
        ping)
            _ping "$@"
            ;;
        new)
            _new "$@"
            ;;
        reload)
            _reload "$@"
            ;;
        systemd)
            _systemd "$@"
            ;;
        __*)
            "$cmd" "$@"
            ;;
        *)
            echo "Unknown command: $cmd"
            ;;
    esac
}

_usage () {
    echo "$1: CMD"
}

_list_interfaces () {
    local iface
    for iface in $(__list_interfaces); do
        printf "%s: (%s) %d peers\n" "$iface" "$(__iface_conf_address "$iface")" "$(__iface_count_peers "$iface")"
    done
}

_reload () {
    local iface iface2 iface_dir
    iface2="$1"

    for iface in $(__list_interfaces); do
        echo "Interface: $iface"
        [[ -n "$iface2" && "$iface" != "$iface2" ]] && continue
        __iface_reload "$iface"
        echo "Reloaded."
    done
}

_systemd () {
    local iface peer
    iface="$1"
    peer="$2"
    echo "-----BEGIN NETDEV-----"
    __peer_remoteconf_systemd_netdev "$iface" "$peer"
    echo "-----END NETDEV-----"
    echo "-----BEGIN NETWORK-----"
    __peer_remoteconf_systemd_network "$iface" "$peer"
    echo "-----END NETWORK-----"
}

_write_conf () {
    local iface iface2 iface_dir
    iface2="$1"

    for iface in $(__list_interfaces); do
        echo "Found interface: $iface"
        [[ -n "$iface2" && "$iface" != "$iface2" ]] && continue
        iface_dir="$(__iface_dirname "$iface" )"
        umask 077
        {
            printf "# Do not edit this file. It's generated automatically.\n\n"
            __iface_conf "$iface" 
        } > "$iface_dir/interface.conf"
        echo "Saved."
    done
}

_show_conf () {
    local iface peer
    iface="$1"
    peer="$2"
    if [[ -z "$peer" ]]; then
        if __iface_exists "$iface"; then
            __iface_conf "$iface"
        else
            printf "Interface not found: %s\n" "$iface"
            false
        fi
    else
        if __peer_exists "$iface" "$peer"; then
            __peer_remoteconf "$iface" "$peer"
        else
            printf "Peer not found: %s\n" "$peer"
            false
        fi
    fi
}

_show_qr () {
    local iface peer
    iface="$1"
    peer="$2"
    if ! type -P qrencode > /dev/null; then
        echo "Command not found: qrencode"
        false
    fi
    if __peer_exists "$iface" "$peer"; then
        printf "[ QR CODE %s %s ]\n" "$iface" "$peer"
        __peer_remoteconf_striped "$iface" "$peer" | qrencode -t UTF8
    else
        printf "Peer not found: %s\n" "$peer"
    fi
}

_ping () {
    local iface peer ip result pubkey
    iface="$1"
    peer="$2"
    [[ -z "$iface" ]] && ifaces="$(__list_interfaces)" || ifaces="$iface"
    for iface in $ifaces; do
        [[ -z "$peer" ]] && peers="$(__list_peers "$iface")" || peers="$peer"
        for peer in $peers; do
            pubkey="$(__peer_conf_publickey "$iface" "$peer" )"
            printf "%-20s  %s...:  " "$peer" "${pubkey:0:10}"
            while read -r ip result; do
                [[ "x$result" == "xOK" ]] && printf "+" || printf "-"
                printf " %-30s " "$ip"
            done < <(__ping_peer "$iface" "$peer" )
            printf "\n"
        done
        peer=""
    done
}

_new () {
    local iface peer
    iface="$1"
    peer="$2"
    if [[ -z "$peer" ]]; then
        _new_iface "$iface"
    else
        _new_peer "$iface" "$peer"
    fi
}

_new_iface () {
    local iface iface_dirname conffile
    iface="$1"
    if ! __iface_correct_name "$iface"; then
        printf "Incorrect interface name: %s\n" "$iface"
        false
    fi
    if __iface_exists "$iface"; then
        printf "Interface already exists: %s\n" "$iface"
        false
    fi
    iface_dirname="$(__iface_dirname "$iface")"
    mkdir "${iface_dirname}"
    mkdir "${iface_dirname}/peers.d"
    for conffile in "$iface_dirname/"{ip,networks,endpoint}.conf; do
        if ! [[ -e "$conffile" ]]; then
            true > "$conffile"
        fi
    done
    umask 077
    wg genkey > "${iface_dirname}/private.key"
}

_new_peer () {
    local iface peer peer_dirname
    iface="$1"
    peer="$2"
    if ! __iface_exists "$iface"; then
        printf "Interface not found: %s\n" "$iface"
        false
    fi
    if __peer_exists "$iface" "$peer"; then
        printf "Peer already exists: %s (%s)\n" "$peer" "$iface"
        false
    fi
    if ! __peer_correct_name "$peer"; then
        printf "Incorrect peer name: %s\n" "$peer"
        false
    fi
    peer_dirname="$(__peer_dirname "$iface" "$peer")"
    mkdir "$peer_dirname"
    for conffile in "$peer_dirname/"{ip,networks}.conf; do
        if ! [[ -e "$conffile" ]]; then
            true > "$conffile"
        fi
    done
    umask 077
    wg genkey > "${peer_dirname}/private.key"
}

# Network monitoring tools

__ping_peer () {
    local iface peer ips ip result
    iface="$1"
    peer="$2"
    ips="$(__peer_conf_address "$iface" "$peer" )"
    for ip in $ips; do
        if ping -c 1 -W 1 "$ip" > /dev/null 2>&1; then
            result="OK"
        else
            result="failed"
        fi
        printf "%s %s\n" "$ip" "$result"
    done
}


# Common functions:

__conf_address_file() {
    local filename
    filename="$1"
    while read -r line; do
        [[ -z "$line" ]] && continue
        [[ "x${line:0:1}" == "x#" ]] && continue
        printf "%s\n" "$line"
    done < "$filename"
}

# Peer related functions

__peer_exists() {
    local iface peer peer_dirname
    iface="$1"
    peer="$2"
    peer_dirname=$(__peer_dirname "$iface" "$peer")
    test -d "$peer_dirname" && test -n "$peer"
}

__peer_correct_name() {
    local peer pattern
    pattern='^[a-zA-Z][-_a-zA-Z0-9]*$'
    peer="$1"
    printf "%s" "$peer" | grep -q "$pattern"
}

__peer_dirname () {
    local iface peer
    iface="$1"
    peer="$2"
    printf "%s/peers.d/%s\n" "$(__iface_dirname "$iface")" "$peer"
}

__peer_conf_address () {
    local iface peer ips line
    iface="$1"
    peer="$2"
    __conf_address_file "$(__peer_dirname "$iface" "$peer")/ip.conf"
}

__peer_conf_networks () {
    local iface peer ips line peer_dirname
    iface="$1"
    peer="$2"
    peer_dirname="$(__peer_dirname "$iface" "$peer")"
    ips=""
    [[ -e "${peer_dirname}/networks.conf" ]] || return
    __conf_address_file "${peer_dirname}/networks.conf"
}

__peer_conf_allowedips () {
    local iface peer ips ip
    iface="$1"
    peer="$2"
    ips=""
    for ip in $(__peer_conf_address "$iface" "$peer") $(__peer_conf_networks "$iface" "$peer"); do
        printf -v ips "%s, %s" "$ips" "$ip"
    done
    ips="${ips##, }"
    printf "%s\n" "$ips"
}

__peer_conf_myips () {
    local iface peer ips ip
    iface="$1"
    peer="$2"
    ips=""
    for ip in $(__peer_conf_address "$iface" "$peer"); do
        printf -v ips "%s, %s" "$ips" "$ip"
    done
    ips="${ips##, }"
    printf "%s\n" "$ips"
}

__peer_conf_dns () {
    local iface peer ips ip
    iface="$1"
    peer="$2"
    ips=""
    for ip in $(__peer_conf_dns_ips "$iface" "$peer"); do
        printf -v ips "%s, %s" "$ips" "$ip"
    done
    ips="${ips##, }"
    printf "%s\n" "$ips"
}

__peer_conf_dns_ips () {
    local iface peer peer_dirname
    iface="$1"
    peer="$2"
    peer_dirname="$(__peer_dirname "$iface" "$peer")"
    if [[ -e "${peer_dirname}/dns.conf" ]]; then
        __conf_address_file "${peer_dirname}/dns.conf"
    else
        __iface_conf_dns_ips "$iface"
    fi
}

__peer_conf_privatekey () {
    local iface peer privkey line filename
    iface="$1"
    peer="$2"
    peer_dirname="$(__peer_dirname "$iface" "$peer")"
    filename="${peer_dirname}/private.key"
    if [[ -e "${filename}" ]]; then
        read -r privkey < "${filename}"
    else
        privkey="# PRIVATE KEY HERE"
    fi
    printf "%s\n" "$privkey"
}

__peer_conf_publickey () {
    local iface peer pubkey privkey filename
    iface="$1"
    peer="$2"
    filename="$(__peer_dirname "$iface" "$peer")/public.key"
    if [[ -e "$filename" ]]; then
        read -r pubkey < "${filename}"
    else
        privkey="$(__peer_conf_privatekey "$iface" "$peer")"
        if [[ "x${privkey:0:1}" == "x#" ]]; then
            pubkey="# PUBLIC KEY HERE"
        else
            pubkey="$(echo "$privkey" | wg pubkey)"
        fi
    fi
    printf "%s\n" "$pubkey"
}

__peer_conf () {
    local iface peer publickey
    iface="$1"
    peer="$2"
    publickey="$(__peer_conf_publickey "$iface" "$peer")"
    printf "[Peer] # %s\n" "$peer"
    printf "%sPublicKey = %s\n" "$([[ "x${publickey:0:1}" == "x#" ]] && echo "# ")" "${publickey}"
    printf "AllowedIPs = %s\n" "$(__peer_conf_allowedips "$iface" "$peer")"
}

__peer_remoteconf_striped () {
    local iface peer
    iface="$1"
    peer="$2"
    __peer_remoteconf "$iface" "$peer" | sed -ne 's/#.*//;/^.\+$/p'
}

__peer_remoteconf () {
    local iface peer networks n
    iface="$1"
    peer="$2"
    printf "[Interface]\n"
    printf "DNS = %s\n" "$(__peer_conf_dns "$iface" "$peer" )"
    printf "Address = %s\n" "$(__peer_conf_myips "$iface" "$peer" )"
    printf "PrivateKey = %s\n" "$(__peer_conf_privatekey "$iface" "$peer")"
    printf "# PubKey = %s\n" "$(__peer_conf_publickey "$iface" "$peer")"
    printf "\n"
    printf "[Peer] # %s\n" "$HOSTNAME" # FIXME
    printf "PublicKey = %s\n" "$(__iface_conf_publickey "$iface")"
    printf "AllowedIPs = %s\n" "$(__iface_conf_allowedips "$iface")"
    printf "# AllowedIPs = 0.0.0.0/0, ::/0\n"
    printf "Endpoint = %s:%d\n" "$(__iface_conf_endpoint "$iface")" "$(__iface_conf_listenport "$iface")"
    printf "PersistentKeepalive = %d\n" "60"
    networks="$(__peer_conf_networks "$iface" "$peer")"
    if [[ -n "$networks" ]]; then
        printf "\n"
        printf "# Networks to use locally:\n"
        for n in $networks; do
            printf "# - %s\n" "$n"
        done
    fi
}

__peer_remoteconf_openwrt () {
    local iface peer networks n riface ip
    iface="$1"
    peer="$2"
    riface="wg0" #TODO

    printf "# file: /etc/config/network\n\n"
    printf "config interface %s\n" "$riface"
    printf "\toption proto wireguard\n"
    printf "\toption private_key '%s'\n" "$(__peer_conf_privatekey "$iface" "$peer")"
    for ip in $(__peer_conf_address "$iface" "$peer" ); do
        printf "\tlist addresses '%s' # add prefix length manually\n" "$ip"
    done
    printf "\n"
    printf "config wireguard_%s '%s'\n" "$riface" "$HOSTNAME" # FIXME
    printf "\toption public_key '%s'\n" "$(__iface_conf_publickey "$iface")"
    printf "\toption endpoint_host '%s'\n" "$(__iface_conf_endpoint "$iface")"
    printf "\toption endpoint_port %d\n" "$(__iface_conf_listenport "$iface")"
    printf "\toption route_allowed_ips '1'\n"
    printf "\toption persistent_keepalive %d\n" "60"
    for ip in $(__iface_conf_networks "$iface"); do
        printf "\tlist allowed_ips '%s'\n" "$ip"
    done
}

__peer_remoteconf_systemd_netdev () {
    local iface peer networks n allowedip
    iface="$1"
    peer="$2"
    printf "[NetDev]\n"
    printf "Name = wg0\n"
    printf "Kind = wireguard\n"
    printf "Description = Wireguard connection to %s:%d\n" "$(__iface_conf_endpoint "$iface")" "$(__iface_conf_listenport "$iface")"
    printf "\n"
    printf "[WireGuard]\n"
    printf "PrivateKey = %s\n" "$(__peer_conf_privatekey "$iface" "$peer")"
    printf "\n"
    printf "[WireGuardPeer]\n"
    printf "PublicKey = %s\n" "$(__iface_conf_publickey "$iface")"
    for allowedip in $(__iface_conf_networks "$iface")
    do
        printf "AllowedIPs = %s\n" "$allowedip"
    done
    printf "Endpoint = %s:%d\n" "$(__iface_conf_endpoint "$iface")" "$(__iface_conf_listenport "$iface")"
    printf "PersistentKeepalive = %d\n" "60"
}
__peer_remoteconf_systemd_network () {
    local iface peer networks n ip
    iface="$1"
    peer="$2"
    printf "[Match]\n"
    printf "name = wg0\n"
    printf "\n"
    printf "[Network]\n"
    for ip in $(__peer_conf_address "$iface" "$peer")
    do
        printf "Address = %s\n" "$ip"
    done
}

# Interface related functions

__iface_exists() {
    local iface iface_dirname
    iface="$1"
    iface_dirname=$(__iface_dirname "$iface")
    test -e "$iface_dirname"
}

__iface_correct_name() {
    local iface pattern
    pattern='^[a-zA-Z][-_a-zA-Z0-9]*$'
    iface="$1"
    printf "%s" "$iface" | grep -q "$pattern"
}

__iface_dirname () {
    local iface
    iface="$1"
    printf "%s/%s.conf.d\n" "$WG_DIR" "$iface"
}

__iface_reload () {
    local iface
    iface="$1"
    wg addconf "$iface" <( wg-quick strip "$iface" )
}

__iface_count_peers () {
    local iface peer n
    iface="$1"
    n=0
    for peer in $(__list_peers "$iface"); do
        n=$(( n + 1 ))
    done
    printf "%d\n" "$n"
}

__iface_conf () {
    local iface
    iface="$1"
    printf "[Interface] # %s\n" "$iface"
    __iface_conf_local "$iface"
    printf "\n"
    printf "# Peers:\n"
    __iface_conf_peers "$iface"
    printf "# EOF\n"
}

__iface_conf_local () {
    local iface net networks
    iface="$1"
    printf "Address = %s\n" "$(__iface_conf_address "$iface")"
    printf "ListenPort = %d\n" "$(__iface_conf_listenport "$iface")"
    printf "FwMark = %s\n" "$(__iface_conf_fwmark "$iface")"
    printf "PrivateKey = %s\n" "$(__iface_conf_privatekey "$iface")"
    printf "# PublicKey = %s\n" "$(__iface_conf_publickey "$iface")"

    for net in $(__iface_conf_networks "$iface" | __filter_ipv 4); do
        printf "PostUp = iptables -A FORWARD -i %s -j ACCEPT\n" "$iface"
        printf "PostUp = iptables -A FORWARD -o %s -j ACCEPT\n" "$iface"
        printf "PostUp = iptables -t nat -A POSTROUTING -s %s -j MASQUERADE\n" "$net"
        printf "PostDown = iptables -D FORWARD -i %s -j ACCEPT\n" "$iface"
        printf "PostDown = iptables -D FORWARD -o %s -j ACCEPT\n" "$iface"
        printf "PostDown = iptables -t nat -D POSTROUTING -s %s -j MASQUERADE\n" "$net"
    done

    for net in $(__iface_conf_networks "$iface" | __filter_ipv 6); do
        printf "PostUp = ip6tables -A FORWARD -i %s -j ACCEPT\n" "$iface"
        printf "PostUp = ip6tables -A FORWARD -o %s -j ACCEPT\n" "$iface"
        printf "PostUp = ip6tables -t nat -A POSTROUTING -s %s -j MASQUERADE\n" "$net"
        printf "PostDown = ip6tables -D FORWARD -i %s -j ACCEPT\n" "$iface"
        printf "PostDown = ip6tables -D FORWARD -o %s -j ACCEPT\n" "$iface"
        printf "PostDown = ip6tables -t nat -D POSTROUTING -s %s -j MASQUERADE\n" "$net"
    done

    networks="$(__iface_conf_networks "$iface" )"
    if [[ -n "$networks" ]]; then
        printf "# Local networks:\n"
        for net in $networks; do
            printf "# - %s\n" "$net"
        done
        printf "\n"
    fi
}

__iface_conf_address () {
    local iface iface_dirname line
    iface="$1"
    iface_dirname="$(__iface_dirname "$iface")"
    ips=""
    while read -r line; do
        printf -v ips "%s, %s" "$ips" "$line"
    done < "${iface_dirname}/ip.conf"
    ips="${ips##, }"
    printf "%s\n" "$ips"
}

__iface_conf_networks () {
    local iface iface_dirname
    iface="$1"
    iface_dirname="$(__iface_dirname "$iface")"
    __conf_address_file "${iface_dirname}/networks.conf"
}

__iface_conf_dns_ips () {
    local iface iface_dirname dns defaults
    defaults="8.8.8.8 1.1.1.1" #FIXME
    iface="$1"
    iface_dirname="$(__iface_dirname "$iface")"
    if [[ -e "${iface_dirname}/dns.conf" ]]; then
        __conf_address_file "${iface_dirname}/dns.conf"
    else
        for dns in $defaults; do
            printf "%s\n" "$dns"
        done
    fi
}

__iface_conf_allowedips () {
    local iface ips ip
    iface="$1"
    ips=""
    for ip in $(__iface_conf_networks "$iface"); do
        printf -v ips "%s, %s" "$ips" "$ip"
    done
    ips="${ips##, }"
    printf "%s\n" "$ips"
}

__iface_conf_endpoint () {
    local iface endpoint
    iface="$1"
    read -r endpoint < "$(__iface_dirname "$iface" )/endpoint.conf"
    printf "%s\n" "$endpoint"
}

__iface_conf_listenport () {
    local iface lport filename
    iface="$1"
    filename="$(__iface_dirname "$iface" )/port.conf"
    if [[ -e "$filename" ]]; then
        read -r lport < "$filename"
    else
        lport="51820"
    fi
    printf "%d\n" "$lport"
}

__iface_conf_fwmark () {
    local iface fwmark filename
    iface="$1"
    filename="$(__iface_dirname "$iface" )/fwmark.conf"
    if [[ -e "$filename" ]]; then
        read -r fwmark < "$filename"
    else
        fwmark="0xca6c"
    fi
    printf "%s\n" "$fwmark"
}

__iface_conf_privatekey () {
    local iface privkey
    iface="$1"
    read -r privkey < "$(__iface_dirname "$iface" )/private.key"
    printf "%s\n" "$privkey"
}

__iface_conf_publickey () {
    local iface iface_dirname pubkey
    iface="$1"
    iface_dirname="$(__iface_dirname "$iface")"
    if [[ -e "${iface_dirname}/public.key" ]]; then
        read -r pubkey < "${iface_dirname}/public.key"
        printf "%s\n" "$pubkey"
    else
        wg pubkey < "${iface_dirname}/private.key"
    fi
}

__iface_conf_peers () {
    local iface peer
    iface="$1"
    for peer in $(__list_peers "$iface"); do
        __peer_conf "$iface" "$peer"
        printf "\n"
    done
}

__list_interfaces () {
    local iface_dirname iface

    for iface_dirname in "$WG_DIR"/*.conf.d; do
        [[ -d "$iface_dirname" ]] || break
        iface="${iface_dirname}"
        iface="${iface##${WG_DIR}/}"
        iface="${iface%%.conf.d}"
        printf "%s\n" "$iface"
    done
}

__list_peers () {
    local iface iface_dirname peer_dirname peer
    iface="$1"
    iface_dirname="$(__iface_dirname "$iface" )"

    for peer_dirname in "${iface_dirname}"/peers.d/*; do
        [[ -d "$peer_dirname" ]] || break
        peer="${peer_dirname}"
        peer="${peer##${iface_dirname}/peers.d/}"
        printf "%s\n" "$peer"
    done
}

__list_connections () {
    local iface peer
    for iface in $(__list_interfaces); do
        __iface_exists "$iface" || break
        for peer in $(__list_peers "$iface" ); do
            __peer_exists "$iface" "$peer" || break
            printf "%s %s\n" "$iface" "$peer"
        done
    done
}

__filter_ipv () {
    local version addr
    version="$1"

    while read addr; do
        [[ "$version" -eq 4 && "$addr" =~ ^[0-9]{1,3}\.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}(/.*)?$ ]] && printf "%s\n" "$addr" && continue
        [[ "$version" -eq 6 && "$addr" =~ ':' ]] && printf "%s\n" "$addr" && continue
    done
}

set -e

_main "$0" "$@"