Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

T6490: Allow creation of wireguard interfaces without requiring peers #4194

Merged
merged 2 commits into from
Nov 19, 2024
Merged

T6490: Allow creation of wireguard interfaces without requiring peers #4194

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
621c4c9
T6490: Allow creation of wireguard interfaces without requiring peers
sskaje Nov 15, 2024
2a0bf47
T6490: make the peer key globally optional
sskaje Nov 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions python/vyos/ifconfig/wireguard.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,9 @@ def update(self, config):

base_cmd += f' private-key {tmp_file.name}'
base_cmd = base_cmd.format(**config)
# T6490: execute command to ensure interface configured
self._cmd(base_cmd)

if 'peer' in config:
for peer, peer_config in config['peer'].items():
# T4702: No need to configure this peer when it was explicitly
Expand Down
36 changes: 17 additions & 19 deletions src/conf_mode/interfaces_wireguard.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,38 +70,36 @@ def verify(wireguard):
if 'private_key' not in wireguard:
raise ConfigError('Wireguard private-key not defined')

if 'peer' not in wireguard:
raise ConfigError('At least one Wireguard peer is required!')

if 'port' in wireguard and 'port_changed' in wireguard:
listen_port = int(wireguard['port'])
if check_port_availability('0.0.0.0', listen_port, 'udp') is not True:
raise ConfigError(f'UDP port {listen_port} is busy or unavailable and '
'cannot be used for the interface!')

# run checks on individual configured WireGuard peer
public_keys = []
for tmp in wireguard['peer']:
peer = wireguard['peer'][tmp]
if 'peer' in wireguard:
public_keys = []
for tmp in wireguard['peer']:
peer = wireguard['peer'][tmp]

if 'allowed_ips' not in peer:
raise ConfigError(f'Wireguard allowed-ips required for peer "{tmp}"!')
if 'allowed_ips' not in peer:
raise ConfigError(f'Wireguard allowed-ips required for peer "{tmp}"!')

if 'public_key' not in peer:
raise ConfigError(f'Wireguard public-key required for peer "{tmp}"!')
if 'public_key' not in peer:
raise ConfigError(f'Wireguard public-key required for peer "{tmp}"!')

if ('address' in peer and 'port' not in peer) or ('port' in peer and 'address' not in peer):
raise ConfigError('Both Wireguard port and address must be defined '
f'for peer "{tmp}" if either one of them is set!')
if ('address' in peer and 'port' not in peer) or ('port' in peer and 'address' not in peer):
raise ConfigError('Both Wireguard port and address must be defined '
f'for peer "{tmp}" if either one of them is set!')

if peer['public_key'] in public_keys:
raise ConfigError(f'Duplicate public-key defined on peer "{tmp}"')
if peer['public_key'] in public_keys:
raise ConfigError(f'Duplicate public-key defined on peer "{tmp}"')

if 'disable' not in peer:
if is_wireguard_key_pair(wireguard['private_key'], peer['public_key']):
raise ConfigError(f'Peer "{tmp}" has the same public key as the interface "{wireguard["ifname"]}"')
if 'disable' not in peer:
if is_wireguard_key_pair(wireguard['private_key'], peer['public_key']):
raise ConfigError(f'Peer "{tmp}" has the same public key as the interface "{wireguard["ifname"]}"')

public_keys.append(peer['public_key'])
public_keys.append(peer['public_key'])

def generate(wireguard):
return None
Expand Down
Loading