wgconfig.c revision 1.1 1 1.1 riastrad /* $NetBSD: wgconfig.c,v 1.1 2020/08/20 21:28:02 riastradh Exp $ */
2 1.1 riastrad
3 1.1 riastrad /*
4 1.1 riastrad * Copyright (C) Ryota Ozaki <ozaki.ryota (at) gmail.com>
5 1.1 riastrad * All rights reserved.
6 1.1 riastrad *
7 1.1 riastrad * Redistribution and use in source and binary forms, with or without
8 1.1 riastrad * modification, are permitted provided that the following conditions
9 1.1 riastrad * are met:
10 1.1 riastrad * 1. Redistributions of source code must retain the above copyright
11 1.1 riastrad * notice, this list of conditions and the following disclaimer.
12 1.1 riastrad * 2. Redistributions in binary form must reproduce the above copyright
13 1.1 riastrad * notice, this list of conditions and the following disclaimer in the
14 1.1 riastrad * documentation and/or other materials provided with the distribution.
15 1.1 riastrad * 3. Neither the name of the project nor the names of its contributors
16 1.1 riastrad * may be used to endorse or promote products derived from this software
17 1.1 riastrad * without specific prior written permission.
18 1.1 riastrad *
19 1.1 riastrad * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 1.1 riastrad * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 1.1 riastrad * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 1.1 riastrad * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 1.1 riastrad * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 1.1 riastrad * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 1.1 riastrad * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 1.1 riastrad * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 1.1 riastrad * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 1.1 riastrad * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 1.1 riastrad * SUCH DAMAGE.
30 1.1 riastrad */
31 1.1 riastrad
32 1.1 riastrad #include <sys/cdefs.h>
33 1.1 riastrad __RCSID("$NetBSD: wgconfig.c,v 1.1 2020/08/20 21:28:02 riastradh Exp $");
34 1.1 riastrad
35 1.1 riastrad #include <sys/ioctl.h>
36 1.1 riastrad
37 1.1 riastrad #include <net/if.h>
38 1.1 riastrad #include <net/if_wg.h>
39 1.1 riastrad
40 1.1 riastrad #include <arpa/inet.h>
41 1.1 riastrad
42 1.1 riastrad #include <stdio.h>
43 1.1 riastrad #include <stdlib.h>
44 1.1 riastrad #include <string.h>
45 1.1 riastrad #include <err.h>
46 1.1 riastrad #include <unistd.h>
47 1.1 riastrad #include <errno.h>
48 1.1 riastrad #include <resolv.h>
49 1.1 riastrad #include <util.h>
50 1.1 riastrad #include <netdb.h>
51 1.1 riastrad
52 1.1 riastrad #include <prop/proplib.h>
53 1.1 riastrad
54 1.1 riastrad #define PROP_BUFFER_LEN 4096
55 1.1 riastrad #define KEY_LEN 32
56 1.1 riastrad #define KEY_BASE64_LEN 44
57 1.1 riastrad
58 1.1 riastrad __dead static void
59 1.1 riastrad usage(void)
60 1.1 riastrad {
61 1.1 riastrad const char *progname = getprogname();
62 1.1 riastrad #define P(str) fprintf(stderr, "\t%s <interface> %s\n", progname, str)
63 1.1 riastrad
64 1.1 riastrad fprintf(stderr, "Usage:\n");
65 1.1 riastrad P("[show all]");
66 1.1 riastrad P("show peer <peer name> [--show-preshared-key]");
67 1.1 riastrad P("show private-key");
68 1.1 riastrad P("set private-key <file path>");
69 1.1 riastrad P("set listen-port <port>");
70 1.1 riastrad P("add peer <peer name> <base64 public key>\n"
71 1.1 riastrad "\t [--preshared-key=<file path>] [--endpoint=<ip>:<port>]\n"
72 1.1 riastrad "\t [--allowed-ips=<ip1>/<cidr1>[,<ip2>/<cidr2>]...]");
73 1.1 riastrad P("delete peer <peer name>");
74 1.1 riastrad
75 1.1 riastrad exit(EXIT_FAILURE);
76 1.1 riastrad #undef P
77 1.1 riastrad }
78 1.1 riastrad
79 1.1 riastrad static const char *
80 1.1 riastrad format_key(prop_object_t key_prop)
81 1.1 riastrad {
82 1.1 riastrad int error;
83 1.1 riastrad unsigned char *key;
84 1.1 riastrad size_t key_len;
85 1.1 riastrad static char key_b64[KEY_BASE64_LEN + 1];
86 1.1 riastrad static const char *none = "(none)";
87 1.1 riastrad
88 1.1 riastrad if (key_prop == NULL)
89 1.1 riastrad return none;
90 1.1 riastrad
91 1.1 riastrad key = prop_data_data(key_prop);
92 1.1 riastrad key_len = prop_data_size(key_prop);
93 1.1 riastrad if (key_len != KEY_LEN)
94 1.1 riastrad errx(EXIT_FAILURE, "invalid key len: %lu", key_len);
95 1.1 riastrad error = b64_ntop(key, key_len, key_b64, KEY_BASE64_LEN + 1);
96 1.1 riastrad if (error == -1)
97 1.1 riastrad errx(EXIT_FAILURE, "b64_ntop failed");
98 1.1 riastrad key_b64[KEY_BASE64_LEN] = '\0'; /* just in case */
99 1.1 riastrad
100 1.1 riastrad return key_b64;
101 1.1 riastrad }
102 1.1 riastrad
103 1.1 riastrad static const char *
104 1.1 riastrad format_endpoint(prop_object_t endpoint_prop)
105 1.1 riastrad {
106 1.1 riastrad int error;
107 1.1 riastrad static char buf[INET6_ADDRSTRLEN];
108 1.1 riastrad struct sockaddr_storage sockaddr;
109 1.1 riastrad char *addr;
110 1.1 riastrad size_t addr_len;
111 1.1 riastrad
112 1.1 riastrad addr = prop_data_data(endpoint_prop);
113 1.1 riastrad addr_len = prop_data_size(endpoint_prop);
114 1.1 riastrad memcpy(&sockaddr, addr, addr_len);
115 1.1 riastrad
116 1.1 riastrad error = sockaddr_snprintf(buf, sizeof(buf), "%a:%p",
117 1.1 riastrad (struct sockaddr *)&sockaddr);
118 1.1 riastrad if (error == -1)
119 1.1 riastrad err(EXIT_FAILURE, "sockaddr_snprintf failed");
120 1.1 riastrad
121 1.1 riastrad return buf;
122 1.1 riastrad }
123 1.1 riastrad
124 1.1 riastrad static void
125 1.1 riastrad handle_allowed_ips(prop_dictionary_t peer, const char *prefix)
126 1.1 riastrad {
127 1.1 riastrad prop_array_t allowedips;
128 1.1 riastrad prop_object_iterator_t it;
129 1.1 riastrad prop_dictionary_t allowedip;
130 1.1 riastrad bool first = true;
131 1.1 riastrad
132 1.1 riastrad allowedips = prop_dictionary_get(peer, "allowedips");
133 1.1 riastrad if (allowedips == NULL)
134 1.1 riastrad return;
135 1.1 riastrad
136 1.1 riastrad printf("%sallowed-ips: ", prefix);
137 1.1 riastrad
138 1.1 riastrad it = prop_array_iterator(allowedips);
139 1.1 riastrad while ((allowedip = prop_object_iterator_next(it)) != NULL) {
140 1.1 riastrad prop_object_t prop_obj;
141 1.1 riastrad uint8_t family;
142 1.1 riastrad uint8_t cidr;
143 1.1 riastrad char *addr;
144 1.1 riastrad char ntopbuf[INET6_ADDRSTRLEN];
145 1.1 riastrad const char *ntopret;
146 1.1 riastrad
147 1.1 riastrad prop_obj = prop_dictionary_get(allowedip, "family");
148 1.1 riastrad if (prop_obj == NULL) {
149 1.1 riastrad warnx("allowed-ip without family");
150 1.1 riastrad continue;
151 1.1 riastrad }
152 1.1 riastrad
153 1.1 riastrad family = (uint8_t)prop_number_unsigned_integer_value(prop_obj);
154 1.1 riastrad
155 1.1 riastrad prop_obj = prop_dictionary_get(allowedip, "cidr");
156 1.1 riastrad if (prop_obj == NULL) {
157 1.1 riastrad warnx("allowed-ip without cidr");
158 1.1 riastrad continue;
159 1.1 riastrad }
160 1.1 riastrad cidr = (uint8_t)prop_number_unsigned_integer_value(prop_obj);
161 1.1 riastrad
162 1.1 riastrad prop_obj = prop_dictionary_get(allowedip, "ip");
163 1.1 riastrad if (prop_obj == NULL) {
164 1.1 riastrad warnx("allowed-ip without ip");
165 1.1 riastrad continue;
166 1.1 riastrad }
167 1.1 riastrad
168 1.1 riastrad addr = prop_data_data(prop_obj);
169 1.1 riastrad ntopret = inet_ntop(family, addr, ntopbuf, sizeof(ntopbuf));
170 1.1 riastrad if (ntopret == NULL)
171 1.1 riastrad errx(EXIT_FAILURE, "inet_ntop failed");
172 1.1 riastrad printf("%s%s/%u", first ? "" : ",", ntopbuf, cidr);
173 1.1 riastrad first = false;
174 1.1 riastrad }
175 1.1 riastrad if (first)
176 1.1 riastrad printf("(none)\n");
177 1.1 riastrad else
178 1.1 riastrad printf("\n");
179 1.1 riastrad }
180 1.1 riastrad
181 1.1 riastrad static prop_dictionary_t
182 1.1 riastrad ioctl_get(const char *interface)
183 1.1 riastrad {
184 1.1 riastrad int error = 0;
185 1.1 riastrad struct ifdrv ifd;
186 1.1 riastrad int sock;
187 1.1 riastrad char *buf;
188 1.1 riastrad prop_dictionary_t prop_dict;
189 1.1 riastrad
190 1.1 riastrad sock = socket(AF_INET, SOCK_DGRAM, 0);
191 1.1 riastrad if (error == -1)
192 1.1 riastrad err(EXIT_FAILURE, "socket");
193 1.1 riastrad buf = malloc(PROP_BUFFER_LEN);
194 1.1 riastrad if (buf == NULL)
195 1.1 riastrad errx(EXIT_FAILURE, "malloc failed");
196 1.1 riastrad
197 1.1 riastrad strlcpy(ifd.ifd_name, interface, sizeof(ifd.ifd_name));
198 1.1 riastrad ifd.ifd_cmd = 0;
199 1.1 riastrad ifd.ifd_data = buf;
200 1.1 riastrad ifd.ifd_len = PROP_BUFFER_LEN;
201 1.1 riastrad
202 1.1 riastrad error = ioctl(sock, SIOCGDRVSPEC, &ifd);
203 1.1 riastrad if (error == -1)
204 1.1 riastrad err(EXIT_FAILURE, "ioctl(SIOCGDRVSPEC)");
205 1.1 riastrad
206 1.1 riastrad prop_dict = prop_dictionary_internalize(buf);
207 1.1 riastrad if (prop_dict == NULL)
208 1.1 riastrad errx(EXIT_FAILURE, "prop_dictionary_internalize failed");
209 1.1 riastrad
210 1.1 riastrad free(buf);
211 1.1 riastrad close(sock);
212 1.1 riastrad
213 1.1 riastrad return prop_dict;
214 1.1 riastrad }
215 1.1 riastrad
216 1.1 riastrad static void
217 1.1 riastrad show_peer(prop_dictionary_t peer, const char *prefix, bool show_psk)
218 1.1 riastrad {
219 1.1 riastrad prop_object_t prop_obj;
220 1.1 riastrad
221 1.1 riastrad prop_obj = prop_dictionary_get(peer, "public_key");
222 1.1 riastrad if (prop_obj == NULL) {
223 1.1 riastrad warnx("peer without public-key");
224 1.1 riastrad return;
225 1.1 riastrad }
226 1.1 riastrad printf("%spublic-key: %s\n", prefix, format_key(prop_obj));
227 1.1 riastrad
228 1.1 riastrad prop_obj = prop_dictionary_get(peer, "endpoint");
229 1.1 riastrad if (prop_obj == NULL)
230 1.1 riastrad printf("%sendpoint: (none)\n", prefix);
231 1.1 riastrad else
232 1.1 riastrad printf("%sendpoint: %s\n", prefix, format_endpoint(prop_obj));
233 1.1 riastrad
234 1.1 riastrad if (show_psk) {
235 1.1 riastrad prop_obj = prop_dictionary_get(peer, "preshared_key");
236 1.1 riastrad printf("%spreshared-key: %s\n", prefix, format_key(prop_obj));
237 1.1 riastrad } else {
238 1.1 riastrad printf("%spreshared-key: (hidden)\n", prefix);
239 1.1 riastrad }
240 1.1 riastrad
241 1.1 riastrad handle_allowed_ips(peer, prefix);
242 1.1 riastrad
243 1.1 riastrad prop_obj = prop_dictionary_get(peer, "last_handshake_time_sec");
244 1.1 riastrad if (prop_obj != NULL) {
245 1.1 riastrad uint64_t sec = prop_number_unsigned_integer_value(prop_obj);
246 1.1 riastrad printf("%slatest-handshake: %"PRIu64"\n", prefix, sec);
247 1.1 riastrad } else
248 1.1 riastrad printf("%slatest-handshake: (none)\n", prefix);
249 1.1 riastrad #if 0
250 1.1 riastrad prop_obj = prop_dictionary_get(peer, "last_handshake_time_nsec");
251 1.1 riastrad #endif
252 1.1 riastrad }
253 1.1 riastrad
254 1.1 riastrad static int
255 1.1 riastrad cmd_show_all(const char *interface, int argc, char *argv[])
256 1.1 riastrad {
257 1.1 riastrad prop_dictionary_t prop_dict;
258 1.1 riastrad prop_object_t prop_obj;
259 1.1 riastrad
260 1.1 riastrad prop_dict = ioctl_get(interface);
261 1.1 riastrad
262 1.1 riastrad printf("interface: %s\n", interface);
263 1.1 riastrad
264 1.1 riastrad #if 0
265 1.1 riastrad prop_obj = prop_dictionary_get(prop_dict, "private_key");
266 1.1 riastrad printf("\tprivate-key: %s\n", format_key(prop_obj));
267 1.1 riastrad #else
268 1.1 riastrad printf("\tprivate-key: (hidden)\n");
269 1.1 riastrad #endif
270 1.1 riastrad
271 1.1 riastrad prop_obj = prop_dictionary_get(prop_dict, "listen_port");
272 1.1 riastrad if (prop_obj != NULL) {
273 1.1 riastrad uint64_t port = prop_number_unsigned_integer_value(prop_obj);
274 1.1 riastrad if (port != (uint64_t)(uint16_t)port)
275 1.1 riastrad errx(EXIT_FAILURE, "invalid port: %" PRIu64, port);
276 1.1 riastrad printf("\tlisten-port: %u\n", (uint16_t)port);
277 1.1 riastrad } else {
278 1.1 riastrad printf("\tlisten-port: (none)\n");
279 1.1 riastrad }
280 1.1 riastrad
281 1.1 riastrad prop_array_t peers = prop_dictionary_get(prop_dict, "peers");
282 1.1 riastrad if (peers == NULL)
283 1.1 riastrad return EXIT_SUCCESS;
284 1.1 riastrad
285 1.1 riastrad prop_object_iterator_t it = prop_array_iterator(peers);
286 1.1 riastrad prop_dictionary_t peer;
287 1.1 riastrad while ((peer = prop_object_iterator_next(it)) != NULL) {
288 1.1 riastrad prop_obj = prop_dictionary_get(peer, "name");
289 1.1 riastrad if (prop_obj != NULL) {
290 1.1 riastrad const char *name = prop_string_cstring_nocopy(prop_obj);
291 1.1 riastrad printf("\tpeer: %s\n", name);
292 1.1 riastrad } else
293 1.1 riastrad printf("\tpeer: (none)\n");
294 1.1 riastrad
295 1.1 riastrad show_peer(peer, "\t\t", false);
296 1.1 riastrad }
297 1.1 riastrad
298 1.1 riastrad return EXIT_SUCCESS;
299 1.1 riastrad }
300 1.1 riastrad
301 1.1 riastrad static int
302 1.1 riastrad cmd_show_peer(const char *interface, int argc, char *argv[])
303 1.1 riastrad {
304 1.1 riastrad prop_dictionary_t prop_dict;
305 1.1 riastrad const char *target;
306 1.1 riastrad const char *opt = "--show-preshared-key";
307 1.1 riastrad bool show_psk = false;
308 1.1 riastrad
309 1.1 riastrad if (argc != 1 && argc != 2)
310 1.1 riastrad usage();
311 1.1 riastrad target = argv[0];
312 1.1 riastrad if (argc == 2) {
313 1.1 riastrad if (strncmp(argv[1], opt, strlen(opt)) != 0)
314 1.1 riastrad usage();
315 1.1 riastrad show_psk = true;
316 1.1 riastrad }
317 1.1 riastrad
318 1.1 riastrad prop_dict = ioctl_get(interface);
319 1.1 riastrad
320 1.1 riastrad prop_array_t peers = prop_dictionary_get(prop_dict, "peers");
321 1.1 riastrad if (peers == NULL)
322 1.1 riastrad return EXIT_SUCCESS;
323 1.1 riastrad
324 1.1 riastrad prop_object_iterator_t it = prop_array_iterator(peers);
325 1.1 riastrad prop_dictionary_t peer;
326 1.1 riastrad while ((peer = prop_object_iterator_next(it)) != NULL) {
327 1.1 riastrad prop_object_t prop_obj;
328 1.1 riastrad prop_obj = prop_dictionary_get(peer, "name");
329 1.1 riastrad if (prop_obj == NULL)
330 1.1 riastrad continue;
331 1.1 riastrad const char *name = prop_string_cstring_nocopy(prop_obj);
332 1.1 riastrad if (strcmp(name, target) == 0) {
333 1.1 riastrad printf("peer: %s\n", name);
334 1.1 riastrad show_peer(peer, "\t", show_psk);
335 1.1 riastrad break;
336 1.1 riastrad }
337 1.1 riastrad }
338 1.1 riastrad
339 1.1 riastrad return EXIT_SUCCESS;
340 1.1 riastrad }
341 1.1 riastrad
342 1.1 riastrad static int
343 1.1 riastrad cmd_show_private_key(const char *interface, int argc, char *argv[])
344 1.1 riastrad {
345 1.1 riastrad prop_dictionary_t prop_dict;
346 1.1 riastrad prop_object_t prop_obj;
347 1.1 riastrad
348 1.1 riastrad prop_dict = ioctl_get(interface);
349 1.1 riastrad
350 1.1 riastrad prop_obj = prop_dictionary_get(prop_dict, "private_key");
351 1.1 riastrad printf("private-key: %s\n", format_key(prop_obj));
352 1.1 riastrad
353 1.1 riastrad return EXIT_SUCCESS;
354 1.1 riastrad }
355 1.1 riastrad
356 1.1 riastrad static void
357 1.1 riastrad ioctl_set(const char *interface, int cmd, char *propstr)
358 1.1 riastrad {
359 1.1 riastrad int error;
360 1.1 riastrad struct ifdrv ifd;
361 1.1 riastrad int sock;
362 1.1 riastrad
363 1.1 riastrad strlcpy(ifd.ifd_name, interface, sizeof(ifd.ifd_name));
364 1.1 riastrad ifd.ifd_cmd = cmd;
365 1.1 riastrad ifd.ifd_data = propstr;
366 1.1 riastrad ifd.ifd_len = strlen(propstr);
367 1.1 riastrad sock = socket(AF_INET, SOCK_DGRAM, 0);
368 1.1 riastrad error = ioctl(sock, SIOCSDRVSPEC, &ifd);
369 1.1 riastrad if (error == -1)
370 1.1 riastrad err(EXIT_FAILURE, "ioctl(SIOCSDRVSPEC): cmd=%d", cmd);
371 1.1 riastrad close(sock);
372 1.1 riastrad }
373 1.1 riastrad
374 1.1 riastrad static void
375 1.1 riastrad base64_decode(const char keyb64buf[KEY_BASE64_LEN + 1],
376 1.1 riastrad unsigned char keybuf[KEY_LEN])
377 1.1 riastrad {
378 1.1 riastrad int ret;
379 1.1 riastrad
380 1.1 riastrad ret = b64_pton(keyb64buf, keybuf, KEY_LEN);
381 1.1 riastrad if (ret == -1)
382 1.1 riastrad errx(EXIT_FAILURE, "b64_pton failed");
383 1.1 riastrad }
384 1.1 riastrad
385 1.1 riastrad static void
386 1.1 riastrad read_key(const char *path, unsigned char keybuf[KEY_LEN])
387 1.1 riastrad {
388 1.1 riastrad FILE *fp;
389 1.1 riastrad char keyb64buf[KEY_BASE64_LEN + 1];
390 1.1 riastrad size_t n;
391 1.1 riastrad
392 1.1 riastrad fp = fopen(path, "r");
393 1.1 riastrad if (fp == NULL)
394 1.1 riastrad err(EXIT_FAILURE, "fopen");
395 1.1 riastrad
396 1.1 riastrad n = fread(keyb64buf, 1, KEY_BASE64_LEN, fp);
397 1.1 riastrad if (n != KEY_BASE64_LEN)
398 1.1 riastrad errx(EXIT_FAILURE, "base64 key len is short: %lu", n);
399 1.1 riastrad keyb64buf[KEY_BASE64_LEN] = '\0';
400 1.1 riastrad
401 1.1 riastrad base64_decode(keyb64buf, keybuf);
402 1.1 riastrad }
403 1.1 riastrad
404 1.1 riastrad static int
405 1.1 riastrad cmd_set_private_key(const char *interface, int argc, char *argv[])
406 1.1 riastrad {
407 1.1 riastrad unsigned char keybuf[KEY_LEN];
408 1.1 riastrad
409 1.1 riastrad if (argc != 1)
410 1.1 riastrad usage();
411 1.1 riastrad
412 1.1 riastrad read_key(argv[0], keybuf);
413 1.1 riastrad
414 1.1 riastrad prop_dictionary_t prop_dict;
415 1.1 riastrad prop_dict = prop_dictionary_create();
416 1.1 riastrad prop_data_t privkey = prop_data_create_data(keybuf, sizeof(keybuf));
417 1.1 riastrad prop_dictionary_set(prop_dict, "private_key", privkey);
418 1.1 riastrad prop_object_release(privkey);
419 1.1 riastrad
420 1.1 riastrad char *buf = prop_dictionary_externalize(prop_dict);
421 1.1 riastrad if (buf == NULL)
422 1.1 riastrad err(EXIT_FAILURE, "prop_dictionary_externalize failed");
423 1.1 riastrad ioctl_set(interface, WG_IOCTL_SET_PRIVATE_KEY, buf);
424 1.1 riastrad
425 1.1 riastrad return EXIT_SUCCESS;
426 1.1 riastrad }
427 1.1 riastrad
428 1.1 riastrad static uint16_t
429 1.1 riastrad strtouint16(const char *str)
430 1.1 riastrad {
431 1.1 riastrad char *ep;
432 1.1 riastrad long val;
433 1.1 riastrad
434 1.1 riastrad errno = 0;
435 1.1 riastrad val = strtol(str, &ep, 10);
436 1.1 riastrad if (ep == str)
437 1.1 riastrad errx(EXIT_FAILURE, "strtol: not a number");
438 1.1 riastrad if (*ep != '\0')
439 1.1 riastrad errx(EXIT_FAILURE, "strtol: trailing garbage");
440 1.1 riastrad if (errno != 0)
441 1.1 riastrad err(EXIT_FAILURE, "strtol");
442 1.1 riastrad if (val < 0 || val > USHRT_MAX)
443 1.1 riastrad errx(EXIT_FAILURE, "out of range");
444 1.1 riastrad
445 1.1 riastrad return (uint16_t)val;
446 1.1 riastrad }
447 1.1 riastrad
448 1.1 riastrad static int
449 1.1 riastrad cmd_set_listen_port(const char *interface, int argc, char *argv[])
450 1.1 riastrad {
451 1.1 riastrad uint16_t port;
452 1.1 riastrad
453 1.1 riastrad if (argc != 1)
454 1.1 riastrad usage();
455 1.1 riastrad
456 1.1 riastrad port = strtouint16(argv[0]);
457 1.1 riastrad if (port == 0)
458 1.1 riastrad errx(EXIT_FAILURE, "port 0 is not allowed");
459 1.1 riastrad
460 1.1 riastrad prop_dictionary_t prop_dict;
461 1.1 riastrad prop_dict = prop_dictionary_create();
462 1.1 riastrad prop_number_t prop_port = prop_number_create_unsigned_integer(port);
463 1.1 riastrad prop_dictionary_set(prop_dict, "listen_port", prop_port);
464 1.1 riastrad prop_object_release(prop_port);
465 1.1 riastrad
466 1.1 riastrad char *buf = prop_dictionary_externalize(prop_dict);
467 1.1 riastrad if (buf == NULL)
468 1.1 riastrad err(EXIT_FAILURE, "prop_dictionary_externalize failed");
469 1.1 riastrad ioctl_set(interface, WG_IOCTL_SET_LISTEN_PORT, buf);
470 1.1 riastrad
471 1.1 riastrad return EXIT_SUCCESS;
472 1.1 riastrad }
473 1.1 riastrad
474 1.1 riastrad static void
475 1.1 riastrad handle_option_endpoint(const char *_addr_port, prop_dictionary_t prop_dict)
476 1.1 riastrad {
477 1.1 riastrad int error;
478 1.1 riastrad prop_data_t prop_addr;
479 1.1 riastrad char *port;
480 1.1 riastrad struct addrinfo hints, *res;
481 1.1 riastrad char *addr_port, *addr;
482 1.1 riastrad
483 1.1 riastrad addr = addr_port = strdup(_addr_port);
484 1.1 riastrad
485 1.1 riastrad if (addr_port[0] == '[') {
486 1.1 riastrad /* [<ipv6>]:<port> */
487 1.1 riastrad /* Accept [<ipv4>]:<port> too, but it's not a big deal. */
488 1.1 riastrad char *bracket, *colon;
489 1.1 riastrad if (strlen(addr_port) < strlen("[::]:0"))
490 1.1 riastrad errx(EXIT_FAILURE, "invalid endpoint format");
491 1.1 riastrad addr = addr_port + 1;
492 1.1 riastrad bracket = strchr(addr, ']');
493 1.1 riastrad if (bracket == NULL)
494 1.1 riastrad errx(EXIT_FAILURE, "invalid endpoint format");
495 1.1 riastrad *bracket = '\0';
496 1.1 riastrad colon = bracket + 1;
497 1.1 riastrad if (*colon != ':')
498 1.1 riastrad errx(EXIT_FAILURE, "invalid endpoint format");
499 1.1 riastrad *colon = '\0';
500 1.1 riastrad port = colon + 1;
501 1.1 riastrad } else {
502 1.1 riastrad char *colon, *tmp;
503 1.1 riastrad colon = strchr(addr_port, ':');
504 1.1 riastrad if (colon == NULL)
505 1.1 riastrad errx(EXIT_FAILURE, "no ':' found in endpoint");
506 1.1 riastrad tmp = strchr(colon + 1, ':');
507 1.1 riastrad if (tmp != NULL) {
508 1.1 riastrad /* <ipv6>:<port> */
509 1.1 riastrad /* Assume the last colon is a separator */
510 1.1 riastrad char *last_colon = tmp;
511 1.1 riastrad while ((tmp = strchr(tmp + 1, ':')) != NULL)
512 1.1 riastrad last_colon = tmp;
513 1.1 riastrad colon = last_colon;
514 1.1 riastrad *colon = '\0';
515 1.1 riastrad port = colon + 1;
516 1.1 riastrad } else {
517 1.1 riastrad /* <ipv4>:<port> */
518 1.1 riastrad *colon = '\0';
519 1.1 riastrad port = colon + 1;
520 1.1 riastrad }
521 1.1 riastrad }
522 1.1 riastrad
523 1.1 riastrad memset(&hints, 0, sizeof(hints));
524 1.1 riastrad hints.ai_family = AF_UNSPEC;
525 1.1 riastrad hints.ai_flags = AI_NUMERICHOST;
526 1.1 riastrad error = getaddrinfo(addr, port, &hints, &res);
527 1.1 riastrad if (error != 0)
528 1.1 riastrad err(EXIT_FAILURE, "getaddrinfo");
529 1.1 riastrad
530 1.1 riastrad prop_addr = prop_data_create_data(res->ai_addr, res->ai_addrlen);
531 1.1 riastrad prop_dictionary_set(prop_dict, "endpoint", prop_addr);
532 1.1 riastrad prop_object_release(prop_addr);
533 1.1 riastrad
534 1.1 riastrad freeaddrinfo(res);
535 1.1 riastrad free(addr_port);
536 1.1 riastrad }
537 1.1 riastrad
538 1.1 riastrad static void
539 1.1 riastrad handle_option_allowed_ips(const char *_allowed_ips, prop_dictionary_t prop_dict)
540 1.1 riastrad {
541 1.1 riastrad prop_array_t allowedips;
542 1.1 riastrad int i;
543 1.1 riastrad char *allowed_ips, *ip;
544 1.1 riastrad
545 1.1 riastrad allowed_ips = strdup(_allowed_ips);
546 1.1 riastrad
547 1.1 riastrad allowedips = prop_array_create();
548 1.1 riastrad i = 0;
549 1.1 riastrad while ((ip = strsep(&allowed_ips, ",")) != NULL) {
550 1.1 riastrad prop_dictionary_t prop_allowedip;
551 1.1 riastrad prop_allowedip = prop_dictionary_create();
552 1.1 riastrad uint16_t cidr;
553 1.1 riastrad char *cidrp;
554 1.1 riastrad struct addrinfo hints, *res;
555 1.1 riastrad int error;
556 1.1 riastrad
557 1.1 riastrad cidrp = strchr(ip, '/');
558 1.1 riastrad if (cidrp == NULL)
559 1.1 riastrad errx(EXIT_FAILURE, "no '/' found in allowed-ip");
560 1.1 riastrad *cidrp = '\0';
561 1.1 riastrad cidrp++;
562 1.1 riastrad
563 1.1 riastrad cidr = strtouint16(cidrp);
564 1.1 riastrad
565 1.1 riastrad memset(&hints, 0, sizeof(hints));
566 1.1 riastrad hints.ai_family = AF_UNSPEC;
567 1.1 riastrad hints.ai_flags = AI_NUMERICHOST;
568 1.1 riastrad error = getaddrinfo(ip, 0, &hints, &res);
569 1.1 riastrad if (error != 0)
570 1.1 riastrad err(EXIT_FAILURE, "getaddrinfo");
571 1.1 riastrad
572 1.1 riastrad sa_family_t family = res->ai_addr->sa_family;
573 1.1 riastrad prop_number_t prop_family = prop_number_create_unsigned_integer(family);
574 1.1 riastrad prop_dictionary_set(prop_allowedip, "family", prop_family);
575 1.1 riastrad prop_object_release(prop_family);
576 1.1 riastrad
577 1.1 riastrad prop_data_t addr;
578 1.1 riastrad if (family == AF_INET) {
579 1.1 riastrad struct sockaddr_in *sin = (struct sockaddr_in *)res->ai_addr;
580 1.1 riastrad addr = prop_data_create_data(&sin->sin_addr, sizeof(sin->sin_addr));
581 1.1 riastrad } else if (family == AF_INET6) {
582 1.1 riastrad struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)res->ai_addr;
583 1.1 riastrad addr = prop_data_create_data(&sin6->sin6_addr, sizeof(sin6->sin6_addr));
584 1.1 riastrad } else
585 1.1 riastrad errx(EXIT_FAILURE, "invalid family: %d", family);
586 1.1 riastrad prop_dictionary_set(prop_allowedip, "ip", addr);
587 1.1 riastrad prop_object_release(addr);
588 1.1 riastrad
589 1.1 riastrad prop_number_t prop_cidr = prop_number_create_unsigned_integer(cidr);
590 1.1 riastrad prop_dictionary_set(prop_allowedip, "cidr", prop_cidr);
591 1.1 riastrad prop_object_release(prop_cidr);
592 1.1 riastrad
593 1.1 riastrad freeaddrinfo(res);
594 1.1 riastrad prop_array_set(allowedips, i, prop_allowedip);
595 1.1 riastrad i++;
596 1.1 riastrad }
597 1.1 riastrad prop_dictionary_set(prop_dict, "allowedips", allowedips);
598 1.1 riastrad
599 1.1 riastrad free(allowed_ips);
600 1.1 riastrad }
601 1.1 riastrad
602 1.1 riastrad static void
603 1.1 riastrad handle_option_preshared_key(const char *path, prop_dictionary_t prop_dict)
604 1.1 riastrad {
605 1.1 riastrad unsigned char keybuf[KEY_LEN];
606 1.1 riastrad prop_data_t psk;
607 1.1 riastrad
608 1.1 riastrad read_key(path, keybuf);
609 1.1 riastrad psk = prop_data_create_data(keybuf, sizeof(keybuf));
610 1.1 riastrad prop_dictionary_set(prop_dict, "preshared_key", psk);
611 1.1 riastrad prop_object_release(psk);
612 1.1 riastrad }
613 1.1 riastrad
614 1.1 riastrad static const struct option {
615 1.1 riastrad const char *option;
616 1.1 riastrad void (*func)(const char *, prop_dictionary_t);
617 1.1 riastrad } options[] = {
618 1.1 riastrad {"--endpoint=", handle_option_endpoint},
619 1.1 riastrad {"--allowed-ips=", handle_option_allowed_ips},
620 1.1 riastrad {"--preshared-key=", handle_option_preshared_key},
621 1.1 riastrad };
622 1.1 riastrad
623 1.1 riastrad static void
624 1.1 riastrad handle_options(int argc, char *argv[], prop_dictionary_t prop_dict)
625 1.1 riastrad {
626 1.1 riastrad
627 1.1 riastrad while (argc > 0) {
628 1.1 riastrad for (size_t i = 0; i < __arraycount(options); i++) {
629 1.1 riastrad const struct option *opt = &options[i];
630 1.1 riastrad size_t optlen = strlen(opt->option);
631 1.1 riastrad if (strncmp(argv[0], opt->option, optlen) == 0) {
632 1.1 riastrad opt->func(argv[0] + optlen, prop_dict);
633 1.1 riastrad break;
634 1.1 riastrad }
635 1.1 riastrad }
636 1.1 riastrad argc -= 1;
637 1.1 riastrad argv += 1;
638 1.1 riastrad }
639 1.1 riastrad
640 1.1 riastrad if (argc != 0)
641 1.1 riastrad usage();
642 1.1 riastrad }
643 1.1 riastrad
644 1.1 riastrad static int
645 1.1 riastrad cmd_add_peer(const char *interface, int argc, char *argv[])
646 1.1 riastrad {
647 1.1 riastrad const char *name;
648 1.1 riastrad unsigned char keybuf[KEY_LEN];
649 1.1 riastrad
650 1.1 riastrad if (argc < 2)
651 1.1 riastrad usage();
652 1.1 riastrad
653 1.1 riastrad prop_dictionary_t prop_dict;
654 1.1 riastrad prop_dict = prop_dictionary_create();
655 1.1 riastrad
656 1.1 riastrad name = argv[0];
657 1.1 riastrad if (strlen(name) > WG_PEER_NAME_MAXLEN)
658 1.1 riastrad errx(EXIT_FAILURE, "peer name too long");
659 1.1 riastrad if (strnlen(argv[1], KEY_BASE64_LEN + 1) != KEY_BASE64_LEN)
660 1.1 riastrad errx(EXIT_FAILURE, "invalid public-key length: %lu", strlen(argv[1]));
661 1.1 riastrad base64_decode(argv[1], keybuf);
662 1.1 riastrad
663 1.1 riastrad prop_string_t prop_name = prop_string_create_cstring(name);
664 1.1 riastrad prop_dictionary_set(prop_dict, "name", prop_name);
665 1.1 riastrad prop_object_release(prop_name);
666 1.1 riastrad
667 1.1 riastrad prop_data_t pubkey = prop_data_create_data(keybuf, sizeof(keybuf));
668 1.1 riastrad prop_dictionary_set(prop_dict, "public_key", pubkey);
669 1.1 riastrad prop_object_release(pubkey);
670 1.1 riastrad
671 1.1 riastrad argc -= 2;
672 1.1 riastrad argv += 2;
673 1.1 riastrad
674 1.1 riastrad handle_options(argc, argv, prop_dict);
675 1.1 riastrad
676 1.1 riastrad char *buf = prop_dictionary_externalize(prop_dict);
677 1.1 riastrad if (buf == NULL)
678 1.1 riastrad err(EXIT_FAILURE, "prop_dictionary_externalize failed");
679 1.1 riastrad ioctl_set(interface, WG_IOCTL_ADD_PEER, buf);
680 1.1 riastrad
681 1.1 riastrad return EXIT_SUCCESS;
682 1.1 riastrad }
683 1.1 riastrad
684 1.1 riastrad static int
685 1.1 riastrad cmd_delete_peer(const char *interface, int argc, char *argv[])
686 1.1 riastrad {
687 1.1 riastrad const char *name;
688 1.1 riastrad
689 1.1 riastrad if (argc != 1)
690 1.1 riastrad usage();
691 1.1 riastrad
692 1.1 riastrad prop_dictionary_t prop_dict;
693 1.1 riastrad prop_dict = prop_dictionary_create();
694 1.1 riastrad
695 1.1 riastrad name = argv[0];
696 1.1 riastrad if (strlen(name) > WG_PEER_NAME_MAXLEN)
697 1.1 riastrad errx(EXIT_FAILURE, "peer name too long");
698 1.1 riastrad
699 1.1 riastrad prop_string_t prop_name = prop_string_create_cstring(name);
700 1.1 riastrad prop_dictionary_set(prop_dict, "name", prop_name);
701 1.1 riastrad prop_object_release(prop_name);
702 1.1 riastrad
703 1.1 riastrad char *buf = prop_dictionary_externalize(prop_dict);
704 1.1 riastrad if (buf == NULL)
705 1.1 riastrad err(EXIT_FAILURE, "prop_dictionary_externalize failed");
706 1.1 riastrad ioctl_set(interface, WG_IOCTL_DELETE_PEER, buf);
707 1.1 riastrad
708 1.1 riastrad return EXIT_SUCCESS;
709 1.1 riastrad }
710 1.1 riastrad
711 1.1 riastrad static const struct command {
712 1.1 riastrad const char *command;
713 1.1 riastrad const char *target;
714 1.1 riastrad int (*func)(const char *, int, char **);
715 1.1 riastrad } commands[] = {
716 1.1 riastrad {"show", "all", cmd_show_all},
717 1.1 riastrad {"show", "peer", cmd_show_peer},
718 1.1 riastrad {"show", "private-key", cmd_show_private_key},
719 1.1 riastrad {"set", "private-key", cmd_set_private_key},
720 1.1 riastrad {"set", "listen-port", cmd_set_listen_port},
721 1.1 riastrad {"add", "peer", cmd_add_peer},
722 1.1 riastrad {"delete", "peer", cmd_delete_peer},
723 1.1 riastrad };
724 1.1 riastrad
725 1.1 riastrad int
726 1.1 riastrad main(int argc, char *argv[])
727 1.1 riastrad {
728 1.1 riastrad const char *interface;
729 1.1 riastrad const char *command;
730 1.1 riastrad const char *target;
731 1.1 riastrad
732 1.1 riastrad if (argc < 2) {
733 1.1 riastrad usage();
734 1.1 riastrad }
735 1.1 riastrad
736 1.1 riastrad interface = argv[1];
737 1.1 riastrad if (strlen(interface) > IFNAMSIZ)
738 1.1 riastrad errx(EXIT_FAILURE, "interface name too long");
739 1.1 riastrad if (argc == 2) {
740 1.1 riastrad return cmd_show_all(interface, 0, NULL);
741 1.1 riastrad }
742 1.1 riastrad if (argc < 4) {
743 1.1 riastrad usage();
744 1.1 riastrad }
745 1.1 riastrad command = argv[2];
746 1.1 riastrad target = argv[3];
747 1.1 riastrad
748 1.1 riastrad argc -= 4;
749 1.1 riastrad argv += 4;
750 1.1 riastrad
751 1.1 riastrad for (size_t i = 0; i < __arraycount(commands); i++) {
752 1.1 riastrad const struct command *cmd = &commands[i];
753 1.1 riastrad if (strncmp(command, cmd->command, strlen(cmd->command)) == 0 &&
754 1.1 riastrad strncmp(target, cmd->target, strlen(cmd->target)) == 0) {
755 1.1 riastrad return cmd->func(interface, argc, argv);
756 1.1 riastrad }
757 1.1 riastrad }
758 1.1 riastrad
759 1.1 riastrad usage();
760 1.1 riastrad }
761