Home | History | Annotate | Line # | Download | only in wgconfig
wgconfig.c revision 1.1
      1  1.1  riastrad /*	$NetBSD: wgconfig.c,v 1.1 2020/08/20 21:28:02 riastradh Exp $	*/
      2  1.1  riastrad 
      3  1.1  riastrad /*
      4  1.1  riastrad  * Copyright (C) Ryota Ozaki <ozaki.ryota (at) gmail.com>
      5  1.1  riastrad  * All rights reserved.
      6  1.1  riastrad  *
      7  1.1  riastrad  * Redistribution and use in source and binary forms, with or without
      8  1.1  riastrad  * modification, are permitted provided that the following conditions
      9  1.1  riastrad  * are met:
     10  1.1  riastrad  * 1. Redistributions of source code must retain the above copyright
     11  1.1  riastrad  *    notice, this list of conditions and the following disclaimer.
     12  1.1  riastrad  * 2. Redistributions in binary form must reproduce the above copyright
     13  1.1  riastrad  *    notice, this list of conditions and the following disclaimer in the
     14  1.1  riastrad  *    documentation and/or other materials provided with the distribution.
     15  1.1  riastrad  * 3. Neither the name of the project nor the names of its contributors
     16  1.1  riastrad  *    may be used to endorse or promote products derived from this software
     17  1.1  riastrad  *    without specific prior written permission.
     18  1.1  riastrad  *
     19  1.1  riastrad  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     20  1.1  riastrad  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     21  1.1  riastrad  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     22  1.1  riastrad  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     23  1.1  riastrad  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     24  1.1  riastrad  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     25  1.1  riastrad  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     26  1.1  riastrad  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     27  1.1  riastrad  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     28  1.1  riastrad  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     29  1.1  riastrad  * SUCH DAMAGE.
     30  1.1  riastrad  */
     31  1.1  riastrad 
     32  1.1  riastrad #include <sys/cdefs.h>
     33  1.1  riastrad __RCSID("$NetBSD: wgconfig.c,v 1.1 2020/08/20 21:28:02 riastradh Exp $");
     34  1.1  riastrad 
     35  1.1  riastrad #include <sys/ioctl.h>
     36  1.1  riastrad 
     37  1.1  riastrad #include <net/if.h>
     38  1.1  riastrad #include <net/if_wg.h>
     39  1.1  riastrad 
     40  1.1  riastrad #include <arpa/inet.h>
     41  1.1  riastrad 
     42  1.1  riastrad #include <stdio.h>
     43  1.1  riastrad #include <stdlib.h>
     44  1.1  riastrad #include <string.h>
     45  1.1  riastrad #include <err.h>
     46  1.1  riastrad #include <unistd.h>
     47  1.1  riastrad #include <errno.h>
     48  1.1  riastrad #include <resolv.h>
     49  1.1  riastrad #include <util.h>
     50  1.1  riastrad #include <netdb.h>
     51  1.1  riastrad 
     52  1.1  riastrad #include <prop/proplib.h>
     53  1.1  riastrad 
     54  1.1  riastrad #define PROP_BUFFER_LEN	4096
     55  1.1  riastrad #define KEY_LEN			32
     56  1.1  riastrad #define KEY_BASE64_LEN		44
     57  1.1  riastrad 
     58  1.1  riastrad __dead static void
     59  1.1  riastrad usage(void)
     60  1.1  riastrad {
     61  1.1  riastrad 	const char *progname = getprogname();
     62  1.1  riastrad #define P(str) fprintf(stderr, "\t%s <interface> %s\n", progname, str)
     63  1.1  riastrad 
     64  1.1  riastrad 	fprintf(stderr, "Usage:\n");
     65  1.1  riastrad 	P("[show all]");
     66  1.1  riastrad 	P("show peer <peer name> [--show-preshared-key]");
     67  1.1  riastrad 	P("show private-key");
     68  1.1  riastrad 	P("set private-key <file path>");
     69  1.1  riastrad 	P("set listen-port <port>");
     70  1.1  riastrad 	P("add peer <peer name> <base64 public key>\n"
     71  1.1  riastrad 	"\t                     [--preshared-key=<file path>] [--endpoint=<ip>:<port>]\n"
     72  1.1  riastrad 	"\t                     [--allowed-ips=<ip1>/<cidr1>[,<ip2>/<cidr2>]...]");
     73  1.1  riastrad 	P("delete peer <peer name>");
     74  1.1  riastrad 
     75  1.1  riastrad 	exit(EXIT_FAILURE);
     76  1.1  riastrad #undef P
     77  1.1  riastrad }
     78  1.1  riastrad 
     79  1.1  riastrad static const char *
     80  1.1  riastrad format_key(prop_object_t key_prop)
     81  1.1  riastrad {
     82  1.1  riastrad 	int error;
     83  1.1  riastrad 	unsigned char *key;
     84  1.1  riastrad 	size_t key_len;
     85  1.1  riastrad 	static char key_b64[KEY_BASE64_LEN + 1];
     86  1.1  riastrad 	static const char *none = "(none)";
     87  1.1  riastrad 
     88  1.1  riastrad 	if (key_prop == NULL)
     89  1.1  riastrad 		return none;
     90  1.1  riastrad 
     91  1.1  riastrad 	key = prop_data_data(key_prop);
     92  1.1  riastrad 	key_len = prop_data_size(key_prop);
     93  1.1  riastrad 	if (key_len != KEY_LEN)
     94  1.1  riastrad 		errx(EXIT_FAILURE, "invalid key len: %lu", key_len);
     95  1.1  riastrad 	error = b64_ntop(key, key_len, key_b64, KEY_BASE64_LEN + 1);
     96  1.1  riastrad 	if (error == -1)
     97  1.1  riastrad 		errx(EXIT_FAILURE, "b64_ntop failed");
     98  1.1  riastrad 	key_b64[KEY_BASE64_LEN] = '\0'; /* just in case */
     99  1.1  riastrad 
    100  1.1  riastrad 	return key_b64;
    101  1.1  riastrad }
    102  1.1  riastrad 
    103  1.1  riastrad static const char *
    104  1.1  riastrad format_endpoint(prop_object_t endpoint_prop)
    105  1.1  riastrad {
    106  1.1  riastrad 	int error;
    107  1.1  riastrad 	static char buf[INET6_ADDRSTRLEN];
    108  1.1  riastrad 	struct sockaddr_storage sockaddr;
    109  1.1  riastrad 	char *addr;
    110  1.1  riastrad 	size_t addr_len;
    111  1.1  riastrad 
    112  1.1  riastrad 	addr = prop_data_data(endpoint_prop);
    113  1.1  riastrad 	addr_len = prop_data_size(endpoint_prop);
    114  1.1  riastrad 	memcpy(&sockaddr, addr, addr_len);
    115  1.1  riastrad 
    116  1.1  riastrad 	error = sockaddr_snprintf(buf, sizeof(buf), "%a:%p",
    117  1.1  riastrad 	    (struct sockaddr *)&sockaddr);
    118  1.1  riastrad 	if (error == -1)
    119  1.1  riastrad 		err(EXIT_FAILURE, "sockaddr_snprintf failed");
    120  1.1  riastrad 
    121  1.1  riastrad 	return buf;
    122  1.1  riastrad }
    123  1.1  riastrad 
    124  1.1  riastrad static void
    125  1.1  riastrad handle_allowed_ips(prop_dictionary_t peer, const char *prefix)
    126  1.1  riastrad {
    127  1.1  riastrad 	prop_array_t allowedips;
    128  1.1  riastrad 	prop_object_iterator_t it;
    129  1.1  riastrad 	prop_dictionary_t allowedip;
    130  1.1  riastrad 	bool first = true;
    131  1.1  riastrad 
    132  1.1  riastrad 	allowedips = prop_dictionary_get(peer, "allowedips");
    133  1.1  riastrad 	if (allowedips == NULL)
    134  1.1  riastrad 		return;
    135  1.1  riastrad 
    136  1.1  riastrad 	printf("%sallowed-ips: ", prefix);
    137  1.1  riastrad 
    138  1.1  riastrad 	it = prop_array_iterator(allowedips);
    139  1.1  riastrad 	while ((allowedip = prop_object_iterator_next(it)) != NULL) {
    140  1.1  riastrad 		prop_object_t prop_obj;
    141  1.1  riastrad 		uint8_t family;
    142  1.1  riastrad 		uint8_t cidr;
    143  1.1  riastrad 		char *addr;
    144  1.1  riastrad 		char ntopbuf[INET6_ADDRSTRLEN];
    145  1.1  riastrad 		const char *ntopret;
    146  1.1  riastrad 
    147  1.1  riastrad 		prop_obj = prop_dictionary_get(allowedip, "family");
    148  1.1  riastrad 		if (prop_obj == NULL) {
    149  1.1  riastrad 			warnx("allowed-ip without family");
    150  1.1  riastrad 			continue;
    151  1.1  riastrad 		}
    152  1.1  riastrad 
    153  1.1  riastrad 		family = (uint8_t)prop_number_unsigned_integer_value(prop_obj);
    154  1.1  riastrad 
    155  1.1  riastrad 		prop_obj = prop_dictionary_get(allowedip, "cidr");
    156  1.1  riastrad 		if (prop_obj == NULL) {
    157  1.1  riastrad 			warnx("allowed-ip without cidr");
    158  1.1  riastrad 			continue;
    159  1.1  riastrad 		}
    160  1.1  riastrad 		cidr = (uint8_t)prop_number_unsigned_integer_value(prop_obj);
    161  1.1  riastrad 
    162  1.1  riastrad 		prop_obj = prop_dictionary_get(allowedip, "ip");
    163  1.1  riastrad 		if (prop_obj == NULL) {
    164  1.1  riastrad 			warnx("allowed-ip without ip");
    165  1.1  riastrad 			continue;
    166  1.1  riastrad 		}
    167  1.1  riastrad 
    168  1.1  riastrad 		addr = prop_data_data(prop_obj);
    169  1.1  riastrad 		ntopret = inet_ntop(family, addr, ntopbuf, sizeof(ntopbuf));
    170  1.1  riastrad 		if (ntopret == NULL)
    171  1.1  riastrad 			errx(EXIT_FAILURE, "inet_ntop failed");
    172  1.1  riastrad 		printf("%s%s/%u", first ? "" : ",", ntopbuf, cidr);
    173  1.1  riastrad 		first = false;
    174  1.1  riastrad 	}
    175  1.1  riastrad 	if (first)
    176  1.1  riastrad 		printf("(none)\n");
    177  1.1  riastrad 	else
    178  1.1  riastrad 		printf("\n");
    179  1.1  riastrad }
    180  1.1  riastrad 
    181  1.1  riastrad static prop_dictionary_t
    182  1.1  riastrad ioctl_get(const char *interface)
    183  1.1  riastrad {
    184  1.1  riastrad 	int error = 0;
    185  1.1  riastrad 	struct ifdrv ifd;
    186  1.1  riastrad 	int sock;
    187  1.1  riastrad 	char *buf;
    188  1.1  riastrad 	prop_dictionary_t prop_dict;
    189  1.1  riastrad 
    190  1.1  riastrad 	sock = socket(AF_INET, SOCK_DGRAM, 0);
    191  1.1  riastrad 	if (error == -1)
    192  1.1  riastrad 		err(EXIT_FAILURE, "socket");
    193  1.1  riastrad 	buf = malloc(PROP_BUFFER_LEN);
    194  1.1  riastrad 	if (buf == NULL)
    195  1.1  riastrad 		errx(EXIT_FAILURE, "malloc failed");
    196  1.1  riastrad 
    197  1.1  riastrad 	strlcpy(ifd.ifd_name, interface, sizeof(ifd.ifd_name));
    198  1.1  riastrad 	ifd.ifd_cmd = 0;
    199  1.1  riastrad 	ifd.ifd_data = buf;
    200  1.1  riastrad 	ifd.ifd_len = PROP_BUFFER_LEN;
    201  1.1  riastrad 
    202  1.1  riastrad 	error = ioctl(sock, SIOCGDRVSPEC, &ifd);
    203  1.1  riastrad 	if (error == -1)
    204  1.1  riastrad 		err(EXIT_FAILURE, "ioctl(SIOCGDRVSPEC)");
    205  1.1  riastrad 
    206  1.1  riastrad 	prop_dict = prop_dictionary_internalize(buf);
    207  1.1  riastrad 	if (prop_dict == NULL)
    208  1.1  riastrad 		errx(EXIT_FAILURE, "prop_dictionary_internalize failed");
    209  1.1  riastrad 
    210  1.1  riastrad 	free(buf);
    211  1.1  riastrad 	close(sock);
    212  1.1  riastrad 
    213  1.1  riastrad 	return prop_dict;
    214  1.1  riastrad }
    215  1.1  riastrad 
    216  1.1  riastrad static void
    217  1.1  riastrad show_peer(prop_dictionary_t peer, const char *prefix, bool show_psk)
    218  1.1  riastrad {
    219  1.1  riastrad 	prop_object_t prop_obj;
    220  1.1  riastrad 
    221  1.1  riastrad 	prop_obj = prop_dictionary_get(peer, "public_key");
    222  1.1  riastrad 	if (prop_obj == NULL) {
    223  1.1  riastrad 		warnx("peer without public-key");
    224  1.1  riastrad 		return;
    225  1.1  riastrad 	}
    226  1.1  riastrad 	printf("%spublic-key: %s\n", prefix, format_key(prop_obj));
    227  1.1  riastrad 
    228  1.1  riastrad 	prop_obj = prop_dictionary_get(peer, "endpoint");
    229  1.1  riastrad 	if (prop_obj == NULL)
    230  1.1  riastrad 		printf("%sendpoint: (none)\n", prefix);
    231  1.1  riastrad 	else
    232  1.1  riastrad 		printf("%sendpoint: %s\n", prefix, format_endpoint(prop_obj));
    233  1.1  riastrad 
    234  1.1  riastrad 	if (show_psk) {
    235  1.1  riastrad 		prop_obj = prop_dictionary_get(peer, "preshared_key");
    236  1.1  riastrad 		printf("%spreshared-key: %s\n", prefix, format_key(prop_obj));
    237  1.1  riastrad 	} else {
    238  1.1  riastrad 		printf("%spreshared-key: (hidden)\n", prefix);
    239  1.1  riastrad 	}
    240  1.1  riastrad 
    241  1.1  riastrad 	handle_allowed_ips(peer, prefix);
    242  1.1  riastrad 
    243  1.1  riastrad 	prop_obj = prop_dictionary_get(peer, "last_handshake_time_sec");
    244  1.1  riastrad 	if (prop_obj != NULL) {
    245  1.1  riastrad 		uint64_t sec = prop_number_unsigned_integer_value(prop_obj);
    246  1.1  riastrad 		printf("%slatest-handshake: %"PRIu64"\n", prefix, sec);
    247  1.1  riastrad 	} else
    248  1.1  riastrad 		printf("%slatest-handshake: (none)\n", prefix);
    249  1.1  riastrad #if 0
    250  1.1  riastrad 	prop_obj = prop_dictionary_get(peer, "last_handshake_time_nsec");
    251  1.1  riastrad #endif
    252  1.1  riastrad }
    253  1.1  riastrad 
    254  1.1  riastrad static int
    255  1.1  riastrad cmd_show_all(const char *interface, int argc, char *argv[])
    256  1.1  riastrad {
    257  1.1  riastrad 	prop_dictionary_t prop_dict;
    258  1.1  riastrad 	prop_object_t prop_obj;
    259  1.1  riastrad 
    260  1.1  riastrad 	prop_dict = ioctl_get(interface);
    261  1.1  riastrad 
    262  1.1  riastrad 	printf("interface: %s\n", interface);
    263  1.1  riastrad 
    264  1.1  riastrad #if 0
    265  1.1  riastrad 	prop_obj = prop_dictionary_get(prop_dict, "private_key");
    266  1.1  riastrad 	printf("\tprivate-key: %s\n", format_key(prop_obj));
    267  1.1  riastrad #else
    268  1.1  riastrad 	printf("\tprivate-key: (hidden)\n");
    269  1.1  riastrad #endif
    270  1.1  riastrad 
    271  1.1  riastrad 	prop_obj = prop_dictionary_get(prop_dict, "listen_port");
    272  1.1  riastrad 	if (prop_obj != NULL) {
    273  1.1  riastrad 		uint64_t port = prop_number_unsigned_integer_value(prop_obj);
    274  1.1  riastrad 		if (port != (uint64_t)(uint16_t)port)
    275  1.1  riastrad 			errx(EXIT_FAILURE, "invalid port: %" PRIu64, port);
    276  1.1  riastrad 		printf("\tlisten-port: %u\n", (uint16_t)port);
    277  1.1  riastrad 	} else {
    278  1.1  riastrad 		printf("\tlisten-port: (none)\n");
    279  1.1  riastrad 	}
    280  1.1  riastrad 
    281  1.1  riastrad 	prop_array_t peers = prop_dictionary_get(prop_dict, "peers");
    282  1.1  riastrad 	if (peers == NULL)
    283  1.1  riastrad 		return EXIT_SUCCESS;
    284  1.1  riastrad 
    285  1.1  riastrad 	prop_object_iterator_t it = prop_array_iterator(peers);
    286  1.1  riastrad 	prop_dictionary_t peer;
    287  1.1  riastrad 	while ((peer = prop_object_iterator_next(it)) != NULL) {
    288  1.1  riastrad 		prop_obj = prop_dictionary_get(peer, "name");
    289  1.1  riastrad 		if (prop_obj != NULL) {
    290  1.1  riastrad 			const char *name = prop_string_cstring_nocopy(prop_obj);
    291  1.1  riastrad 			printf("\tpeer: %s\n", name);
    292  1.1  riastrad 		} else
    293  1.1  riastrad 			printf("\tpeer: (none)\n");
    294  1.1  riastrad 
    295  1.1  riastrad 		show_peer(peer, "\t\t", false);
    296  1.1  riastrad 	}
    297  1.1  riastrad 
    298  1.1  riastrad 	return EXIT_SUCCESS;
    299  1.1  riastrad }
    300  1.1  riastrad 
    301  1.1  riastrad static int
    302  1.1  riastrad cmd_show_peer(const char *interface, int argc, char *argv[])
    303  1.1  riastrad {
    304  1.1  riastrad 	prop_dictionary_t prop_dict;
    305  1.1  riastrad 	const char *target;
    306  1.1  riastrad 	const char *opt = "--show-preshared-key";
    307  1.1  riastrad 	bool show_psk = false;
    308  1.1  riastrad 
    309  1.1  riastrad 	if (argc != 1 && argc != 2)
    310  1.1  riastrad 		usage();
    311  1.1  riastrad 	target = argv[0];
    312  1.1  riastrad 	if (argc == 2) {
    313  1.1  riastrad 		if (strncmp(argv[1], opt, strlen(opt)) != 0)
    314  1.1  riastrad 			usage();
    315  1.1  riastrad 		show_psk = true;
    316  1.1  riastrad 	}
    317  1.1  riastrad 
    318  1.1  riastrad 	prop_dict = ioctl_get(interface);
    319  1.1  riastrad 
    320  1.1  riastrad 	prop_array_t peers = prop_dictionary_get(prop_dict, "peers");
    321  1.1  riastrad 	if (peers == NULL)
    322  1.1  riastrad 		return EXIT_SUCCESS;
    323  1.1  riastrad 
    324  1.1  riastrad 	prop_object_iterator_t it = prop_array_iterator(peers);
    325  1.1  riastrad 	prop_dictionary_t peer;
    326  1.1  riastrad 	while ((peer = prop_object_iterator_next(it)) != NULL) {
    327  1.1  riastrad 		prop_object_t prop_obj;
    328  1.1  riastrad 		prop_obj = prop_dictionary_get(peer, "name");
    329  1.1  riastrad 		if (prop_obj == NULL)
    330  1.1  riastrad 			continue;
    331  1.1  riastrad 		const char *name = prop_string_cstring_nocopy(prop_obj);
    332  1.1  riastrad 		if (strcmp(name, target) == 0) {
    333  1.1  riastrad 			printf("peer: %s\n", name);
    334  1.1  riastrad 			show_peer(peer, "\t", show_psk);
    335  1.1  riastrad 			break;
    336  1.1  riastrad 		}
    337  1.1  riastrad 	}
    338  1.1  riastrad 
    339  1.1  riastrad 	return EXIT_SUCCESS;
    340  1.1  riastrad }
    341  1.1  riastrad 
    342  1.1  riastrad static int
    343  1.1  riastrad cmd_show_private_key(const char *interface, int argc, char *argv[])
    344  1.1  riastrad {
    345  1.1  riastrad 	prop_dictionary_t prop_dict;
    346  1.1  riastrad 	prop_object_t prop_obj;
    347  1.1  riastrad 
    348  1.1  riastrad 	prop_dict = ioctl_get(interface);
    349  1.1  riastrad 
    350  1.1  riastrad 	prop_obj = prop_dictionary_get(prop_dict, "private_key");
    351  1.1  riastrad 	printf("private-key: %s\n", format_key(prop_obj));
    352  1.1  riastrad 
    353  1.1  riastrad 	return EXIT_SUCCESS;
    354  1.1  riastrad }
    355  1.1  riastrad 
    356  1.1  riastrad static void
    357  1.1  riastrad ioctl_set(const char *interface, int cmd, char *propstr)
    358  1.1  riastrad {
    359  1.1  riastrad 	int error;
    360  1.1  riastrad 	struct ifdrv ifd;
    361  1.1  riastrad 	int sock;
    362  1.1  riastrad 
    363  1.1  riastrad 	strlcpy(ifd.ifd_name, interface, sizeof(ifd.ifd_name));
    364  1.1  riastrad 	ifd.ifd_cmd = cmd;
    365  1.1  riastrad 	ifd.ifd_data = propstr;
    366  1.1  riastrad 	ifd.ifd_len = strlen(propstr);
    367  1.1  riastrad 	sock = socket(AF_INET, SOCK_DGRAM, 0);
    368  1.1  riastrad 	error = ioctl(sock, SIOCSDRVSPEC, &ifd);
    369  1.1  riastrad 	if (error == -1)
    370  1.1  riastrad 		err(EXIT_FAILURE, "ioctl(SIOCSDRVSPEC): cmd=%d", cmd);
    371  1.1  riastrad 	close(sock);
    372  1.1  riastrad }
    373  1.1  riastrad 
    374  1.1  riastrad static void
    375  1.1  riastrad base64_decode(const char keyb64buf[KEY_BASE64_LEN + 1],
    376  1.1  riastrad     unsigned char keybuf[KEY_LEN])
    377  1.1  riastrad {
    378  1.1  riastrad 	int ret;
    379  1.1  riastrad 
    380  1.1  riastrad 	ret = b64_pton(keyb64buf, keybuf, KEY_LEN);
    381  1.1  riastrad 	if (ret == -1)
    382  1.1  riastrad 		errx(EXIT_FAILURE, "b64_pton failed");
    383  1.1  riastrad }
    384  1.1  riastrad 
    385  1.1  riastrad static void
    386  1.1  riastrad read_key(const char *path, unsigned char keybuf[KEY_LEN])
    387  1.1  riastrad {
    388  1.1  riastrad 	FILE *fp;
    389  1.1  riastrad 	char keyb64buf[KEY_BASE64_LEN + 1];
    390  1.1  riastrad 	size_t n;
    391  1.1  riastrad 
    392  1.1  riastrad 	fp = fopen(path, "r");
    393  1.1  riastrad 	if (fp == NULL)
    394  1.1  riastrad 		err(EXIT_FAILURE, "fopen");
    395  1.1  riastrad 
    396  1.1  riastrad 	n = fread(keyb64buf, 1, KEY_BASE64_LEN, fp);
    397  1.1  riastrad 	if (n != KEY_BASE64_LEN)
    398  1.1  riastrad 		errx(EXIT_FAILURE, "base64 key len is short: %lu", n);
    399  1.1  riastrad 	keyb64buf[KEY_BASE64_LEN] = '\0';
    400  1.1  riastrad 
    401  1.1  riastrad 	base64_decode(keyb64buf, keybuf);
    402  1.1  riastrad }
    403  1.1  riastrad 
    404  1.1  riastrad static int
    405  1.1  riastrad cmd_set_private_key(const char *interface, int argc, char *argv[])
    406  1.1  riastrad {
    407  1.1  riastrad 	unsigned char keybuf[KEY_LEN];
    408  1.1  riastrad 
    409  1.1  riastrad 	if (argc != 1)
    410  1.1  riastrad 		usage();
    411  1.1  riastrad 
    412  1.1  riastrad 	read_key(argv[0], keybuf);
    413  1.1  riastrad 
    414  1.1  riastrad 	prop_dictionary_t prop_dict;
    415  1.1  riastrad 	prop_dict = prop_dictionary_create();
    416  1.1  riastrad 	prop_data_t privkey = prop_data_create_data(keybuf, sizeof(keybuf));
    417  1.1  riastrad 	prop_dictionary_set(prop_dict, "private_key", privkey);
    418  1.1  riastrad 	prop_object_release(privkey);
    419  1.1  riastrad 
    420  1.1  riastrad 	char *buf = prop_dictionary_externalize(prop_dict);
    421  1.1  riastrad 	if (buf == NULL)
    422  1.1  riastrad 		err(EXIT_FAILURE, "prop_dictionary_externalize failed");
    423  1.1  riastrad 	ioctl_set(interface, WG_IOCTL_SET_PRIVATE_KEY, buf);
    424  1.1  riastrad 
    425  1.1  riastrad 	return EXIT_SUCCESS;
    426  1.1  riastrad }
    427  1.1  riastrad 
    428  1.1  riastrad static uint16_t
    429  1.1  riastrad strtouint16(const char *str)
    430  1.1  riastrad {
    431  1.1  riastrad 	char *ep;
    432  1.1  riastrad 	long val;
    433  1.1  riastrad 
    434  1.1  riastrad 	errno = 0;
    435  1.1  riastrad 	val = strtol(str, &ep, 10);
    436  1.1  riastrad 	if (ep == str)
    437  1.1  riastrad 		errx(EXIT_FAILURE, "strtol: not a number");
    438  1.1  riastrad 	if (*ep != '\0')
    439  1.1  riastrad 		errx(EXIT_FAILURE, "strtol: trailing garbage");
    440  1.1  riastrad 	if (errno != 0)
    441  1.1  riastrad 		err(EXIT_FAILURE, "strtol");
    442  1.1  riastrad 	if (val < 0 || val > USHRT_MAX)
    443  1.1  riastrad 		errx(EXIT_FAILURE, "out of range");
    444  1.1  riastrad 
    445  1.1  riastrad 	return (uint16_t)val;
    446  1.1  riastrad }
    447  1.1  riastrad 
    448  1.1  riastrad static int
    449  1.1  riastrad cmd_set_listen_port(const char *interface, int argc, char *argv[])
    450  1.1  riastrad {
    451  1.1  riastrad 	uint16_t port;
    452  1.1  riastrad 
    453  1.1  riastrad 	if (argc != 1)
    454  1.1  riastrad 		usage();
    455  1.1  riastrad 
    456  1.1  riastrad 	port = strtouint16(argv[0]);
    457  1.1  riastrad 	if (port == 0)
    458  1.1  riastrad 		errx(EXIT_FAILURE, "port 0 is not allowed");
    459  1.1  riastrad 
    460  1.1  riastrad 	prop_dictionary_t prop_dict;
    461  1.1  riastrad 	prop_dict = prop_dictionary_create();
    462  1.1  riastrad 	prop_number_t prop_port = prop_number_create_unsigned_integer(port);
    463  1.1  riastrad 	prop_dictionary_set(prop_dict, "listen_port", prop_port);
    464  1.1  riastrad 	prop_object_release(prop_port);
    465  1.1  riastrad 
    466  1.1  riastrad 	char *buf = prop_dictionary_externalize(prop_dict);
    467  1.1  riastrad 	if (buf == NULL)
    468  1.1  riastrad 		err(EXIT_FAILURE, "prop_dictionary_externalize failed");
    469  1.1  riastrad 	ioctl_set(interface, WG_IOCTL_SET_LISTEN_PORT, buf);
    470  1.1  riastrad 
    471  1.1  riastrad 	return EXIT_SUCCESS;
    472  1.1  riastrad }
    473  1.1  riastrad 
    474  1.1  riastrad static void
    475  1.1  riastrad handle_option_endpoint(const char *_addr_port, prop_dictionary_t prop_dict)
    476  1.1  riastrad {
    477  1.1  riastrad 	int error;
    478  1.1  riastrad 	prop_data_t prop_addr;
    479  1.1  riastrad 	char *port;
    480  1.1  riastrad 	struct addrinfo hints, *res;
    481  1.1  riastrad 	char *addr_port, *addr;
    482  1.1  riastrad 
    483  1.1  riastrad 	addr = addr_port = strdup(_addr_port);
    484  1.1  riastrad 
    485  1.1  riastrad 	if (addr_port[0] == '[') {
    486  1.1  riastrad 		/* [<ipv6>]:<port> */
    487  1.1  riastrad 		/* Accept [<ipv4>]:<port> too, but it's not a big deal. */
    488  1.1  riastrad 		char *bracket, *colon;
    489  1.1  riastrad 		if (strlen(addr_port) < strlen("[::]:0"))
    490  1.1  riastrad 			errx(EXIT_FAILURE, "invalid endpoint format");
    491  1.1  riastrad 		addr = addr_port + 1;
    492  1.1  riastrad 		bracket = strchr(addr, ']');
    493  1.1  riastrad 		if (bracket == NULL)
    494  1.1  riastrad 			errx(EXIT_FAILURE, "invalid endpoint format");
    495  1.1  riastrad 		*bracket = '\0';
    496  1.1  riastrad 		colon = bracket + 1;
    497  1.1  riastrad 		if (*colon != ':')
    498  1.1  riastrad 			errx(EXIT_FAILURE, "invalid endpoint format");
    499  1.1  riastrad 		*colon = '\0';
    500  1.1  riastrad 		port = colon + 1;
    501  1.1  riastrad 	} else {
    502  1.1  riastrad 		char *colon, *tmp;
    503  1.1  riastrad 		colon = strchr(addr_port, ':');
    504  1.1  riastrad 		if (colon == NULL)
    505  1.1  riastrad 			errx(EXIT_FAILURE, "no ':' found in endpoint");
    506  1.1  riastrad 		tmp = strchr(colon + 1, ':');
    507  1.1  riastrad 		if (tmp != NULL) {
    508  1.1  riastrad 			/* <ipv6>:<port> */
    509  1.1  riastrad 			/* Assume the last colon is a separator */
    510  1.1  riastrad 			char *last_colon = tmp;
    511  1.1  riastrad 			while ((tmp = strchr(tmp + 1, ':')) != NULL)
    512  1.1  riastrad 				last_colon = tmp;
    513  1.1  riastrad 			colon = last_colon;
    514  1.1  riastrad 			*colon = '\0';
    515  1.1  riastrad 			port = colon + 1;
    516  1.1  riastrad 		} else {
    517  1.1  riastrad 			/* <ipv4>:<port> */
    518  1.1  riastrad 			*colon = '\0';
    519  1.1  riastrad 			port = colon + 1;
    520  1.1  riastrad 		}
    521  1.1  riastrad 	}
    522  1.1  riastrad 
    523  1.1  riastrad 	memset(&hints, 0, sizeof(hints));
    524  1.1  riastrad 	hints.ai_family = AF_UNSPEC;
    525  1.1  riastrad 	hints.ai_flags = AI_NUMERICHOST;
    526  1.1  riastrad 	error = getaddrinfo(addr, port, &hints, &res);
    527  1.1  riastrad 	if (error != 0)
    528  1.1  riastrad 		err(EXIT_FAILURE, "getaddrinfo");
    529  1.1  riastrad 
    530  1.1  riastrad 	prop_addr = prop_data_create_data(res->ai_addr, res->ai_addrlen);
    531  1.1  riastrad 	prop_dictionary_set(prop_dict, "endpoint", prop_addr);
    532  1.1  riastrad 	prop_object_release(prop_addr);
    533  1.1  riastrad 
    534  1.1  riastrad 	freeaddrinfo(res);
    535  1.1  riastrad 	free(addr_port);
    536  1.1  riastrad }
    537  1.1  riastrad 
    538  1.1  riastrad static void
    539  1.1  riastrad handle_option_allowed_ips(const char *_allowed_ips, prop_dictionary_t prop_dict)
    540  1.1  riastrad {
    541  1.1  riastrad 	prop_array_t allowedips;
    542  1.1  riastrad 	int i;
    543  1.1  riastrad 	char *allowed_ips, *ip;
    544  1.1  riastrad 
    545  1.1  riastrad 	allowed_ips = strdup(_allowed_ips);
    546  1.1  riastrad 
    547  1.1  riastrad 	allowedips = prop_array_create();
    548  1.1  riastrad 	i = 0;
    549  1.1  riastrad 	while ((ip = strsep(&allowed_ips, ",")) != NULL) {
    550  1.1  riastrad 		prop_dictionary_t prop_allowedip;
    551  1.1  riastrad 		prop_allowedip = prop_dictionary_create();
    552  1.1  riastrad 		uint16_t cidr;
    553  1.1  riastrad 		char *cidrp;
    554  1.1  riastrad 		struct addrinfo hints, *res;
    555  1.1  riastrad 		int error;
    556  1.1  riastrad 
    557  1.1  riastrad 		cidrp = strchr(ip, '/');
    558  1.1  riastrad 		if (cidrp == NULL)
    559  1.1  riastrad 			errx(EXIT_FAILURE, "no '/' found in allowed-ip");
    560  1.1  riastrad 		*cidrp = '\0';
    561  1.1  riastrad 		cidrp++;
    562  1.1  riastrad 
    563  1.1  riastrad 		cidr = strtouint16(cidrp);
    564  1.1  riastrad 
    565  1.1  riastrad 		memset(&hints, 0, sizeof(hints));
    566  1.1  riastrad 		hints.ai_family = AF_UNSPEC;
    567  1.1  riastrad 		hints.ai_flags = AI_NUMERICHOST;
    568  1.1  riastrad 		error = getaddrinfo(ip, 0, &hints, &res);
    569  1.1  riastrad 		if (error != 0)
    570  1.1  riastrad 			err(EXIT_FAILURE, "getaddrinfo");
    571  1.1  riastrad 
    572  1.1  riastrad 		sa_family_t family = res->ai_addr->sa_family;
    573  1.1  riastrad 		prop_number_t prop_family = prop_number_create_unsigned_integer(family);
    574  1.1  riastrad 		prop_dictionary_set(prop_allowedip, "family", prop_family);
    575  1.1  riastrad 		prop_object_release(prop_family);
    576  1.1  riastrad 
    577  1.1  riastrad 		prop_data_t addr;
    578  1.1  riastrad 		if (family == AF_INET) {
    579  1.1  riastrad 			struct sockaddr_in *sin = (struct sockaddr_in *)res->ai_addr;
    580  1.1  riastrad 			addr = prop_data_create_data(&sin->sin_addr, sizeof(sin->sin_addr));
    581  1.1  riastrad 		} else if (family == AF_INET6) {
    582  1.1  riastrad 			struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)res->ai_addr;
    583  1.1  riastrad 			addr = prop_data_create_data(&sin6->sin6_addr, sizeof(sin6->sin6_addr));
    584  1.1  riastrad 		} else
    585  1.1  riastrad 			errx(EXIT_FAILURE, "invalid family: %d", family);
    586  1.1  riastrad 		prop_dictionary_set(prop_allowedip, "ip", addr);
    587  1.1  riastrad 		prop_object_release(addr);
    588  1.1  riastrad 
    589  1.1  riastrad 		prop_number_t prop_cidr = prop_number_create_unsigned_integer(cidr);
    590  1.1  riastrad 		prop_dictionary_set(prop_allowedip, "cidr", prop_cidr);
    591  1.1  riastrad 		prop_object_release(prop_cidr);
    592  1.1  riastrad 
    593  1.1  riastrad 		freeaddrinfo(res);
    594  1.1  riastrad 		prop_array_set(allowedips, i, prop_allowedip);
    595  1.1  riastrad 		i++;
    596  1.1  riastrad 	}
    597  1.1  riastrad 	prop_dictionary_set(prop_dict, "allowedips", allowedips);
    598  1.1  riastrad 
    599  1.1  riastrad 	free(allowed_ips);
    600  1.1  riastrad }
    601  1.1  riastrad 
    602  1.1  riastrad static void
    603  1.1  riastrad handle_option_preshared_key(const char *path, prop_dictionary_t prop_dict)
    604  1.1  riastrad {
    605  1.1  riastrad 	unsigned char keybuf[KEY_LEN];
    606  1.1  riastrad 	prop_data_t psk;
    607  1.1  riastrad 
    608  1.1  riastrad 	read_key(path, keybuf);
    609  1.1  riastrad 	psk = prop_data_create_data(keybuf, sizeof(keybuf));
    610  1.1  riastrad 	prop_dictionary_set(prop_dict, "preshared_key", psk);
    611  1.1  riastrad 	prop_object_release(psk);
    612  1.1  riastrad }
    613  1.1  riastrad 
    614  1.1  riastrad static const struct option {
    615  1.1  riastrad 	const char	*option;
    616  1.1  riastrad 	void		(*func)(const char *, prop_dictionary_t);
    617  1.1  riastrad } options[] = {
    618  1.1  riastrad 	{"--endpoint=",		handle_option_endpoint},
    619  1.1  riastrad 	{"--allowed-ips=",	handle_option_allowed_ips},
    620  1.1  riastrad 	{"--preshared-key=",	handle_option_preshared_key},
    621  1.1  riastrad };
    622  1.1  riastrad 
    623  1.1  riastrad static void
    624  1.1  riastrad handle_options(int argc, char *argv[], prop_dictionary_t prop_dict)
    625  1.1  riastrad {
    626  1.1  riastrad 
    627  1.1  riastrad 	while (argc > 0) {
    628  1.1  riastrad 		for (size_t i = 0; i < __arraycount(options); i++) {
    629  1.1  riastrad 			const struct option *opt = &options[i];
    630  1.1  riastrad 			size_t optlen = strlen(opt->option);
    631  1.1  riastrad 			if (strncmp(argv[0], opt->option, optlen) == 0) {
    632  1.1  riastrad 				opt->func(argv[0] + optlen, prop_dict);
    633  1.1  riastrad 				break;
    634  1.1  riastrad 			}
    635  1.1  riastrad 		}
    636  1.1  riastrad 		argc -= 1;
    637  1.1  riastrad 		argv += 1;
    638  1.1  riastrad 	}
    639  1.1  riastrad 
    640  1.1  riastrad 	if (argc != 0)
    641  1.1  riastrad 		usage();
    642  1.1  riastrad }
    643  1.1  riastrad 
    644  1.1  riastrad static int
    645  1.1  riastrad cmd_add_peer(const char *interface, int argc, char *argv[])
    646  1.1  riastrad {
    647  1.1  riastrad 	const char *name;
    648  1.1  riastrad 	unsigned char keybuf[KEY_LEN];
    649  1.1  riastrad 
    650  1.1  riastrad 	if (argc < 2)
    651  1.1  riastrad 		usage();
    652  1.1  riastrad 
    653  1.1  riastrad 	prop_dictionary_t prop_dict;
    654  1.1  riastrad 	prop_dict = prop_dictionary_create();
    655  1.1  riastrad 
    656  1.1  riastrad 	name = argv[0];
    657  1.1  riastrad 	if (strlen(name) > WG_PEER_NAME_MAXLEN)
    658  1.1  riastrad 		errx(EXIT_FAILURE, "peer name too long");
    659  1.1  riastrad 	if (strnlen(argv[1], KEY_BASE64_LEN + 1) != KEY_BASE64_LEN)
    660  1.1  riastrad 		errx(EXIT_FAILURE, "invalid public-key length: %lu", strlen(argv[1]));
    661  1.1  riastrad 	base64_decode(argv[1], keybuf);
    662  1.1  riastrad 
    663  1.1  riastrad 	prop_string_t prop_name = prop_string_create_cstring(name);
    664  1.1  riastrad 	prop_dictionary_set(prop_dict, "name", prop_name);
    665  1.1  riastrad 	prop_object_release(prop_name);
    666  1.1  riastrad 
    667  1.1  riastrad 	prop_data_t pubkey = prop_data_create_data(keybuf, sizeof(keybuf));
    668  1.1  riastrad 	prop_dictionary_set(prop_dict, "public_key", pubkey);
    669  1.1  riastrad 	prop_object_release(pubkey);
    670  1.1  riastrad 
    671  1.1  riastrad 	argc -= 2;
    672  1.1  riastrad 	argv += 2;
    673  1.1  riastrad 
    674  1.1  riastrad 	handle_options(argc, argv, prop_dict);
    675  1.1  riastrad 
    676  1.1  riastrad 	char *buf = prop_dictionary_externalize(prop_dict);
    677  1.1  riastrad 	if (buf == NULL)
    678  1.1  riastrad 		err(EXIT_FAILURE, "prop_dictionary_externalize failed");
    679  1.1  riastrad 	ioctl_set(interface, WG_IOCTL_ADD_PEER, buf);
    680  1.1  riastrad 
    681  1.1  riastrad 	return EXIT_SUCCESS;
    682  1.1  riastrad }
    683  1.1  riastrad 
    684  1.1  riastrad static int
    685  1.1  riastrad cmd_delete_peer(const char *interface, int argc, char *argv[])
    686  1.1  riastrad {
    687  1.1  riastrad 	const char *name;
    688  1.1  riastrad 
    689  1.1  riastrad 	if (argc != 1)
    690  1.1  riastrad 		usage();
    691  1.1  riastrad 
    692  1.1  riastrad 	prop_dictionary_t prop_dict;
    693  1.1  riastrad 	prop_dict = prop_dictionary_create();
    694  1.1  riastrad 
    695  1.1  riastrad 	name = argv[0];
    696  1.1  riastrad 	if (strlen(name) > WG_PEER_NAME_MAXLEN)
    697  1.1  riastrad 		errx(EXIT_FAILURE, "peer name too long");
    698  1.1  riastrad 
    699  1.1  riastrad 	prop_string_t prop_name = prop_string_create_cstring(name);
    700  1.1  riastrad 	prop_dictionary_set(prop_dict, "name", prop_name);
    701  1.1  riastrad 	prop_object_release(prop_name);
    702  1.1  riastrad 
    703  1.1  riastrad 	char *buf = prop_dictionary_externalize(prop_dict);
    704  1.1  riastrad 	if (buf == NULL)
    705  1.1  riastrad 		err(EXIT_FAILURE, "prop_dictionary_externalize failed");
    706  1.1  riastrad 	ioctl_set(interface, WG_IOCTL_DELETE_PEER, buf);
    707  1.1  riastrad 
    708  1.1  riastrad 	return EXIT_SUCCESS;
    709  1.1  riastrad }
    710  1.1  riastrad 
    711  1.1  riastrad static const struct command {
    712  1.1  riastrad 	const char	*command;
    713  1.1  riastrad 	const char	*target;
    714  1.1  riastrad 	int		(*func)(const char *, int, char **);
    715  1.1  riastrad } commands[] = {
    716  1.1  riastrad 	{"show",	"all",		cmd_show_all},
    717  1.1  riastrad 	{"show",	"peer",		cmd_show_peer},
    718  1.1  riastrad 	{"show",	"private-key",	cmd_show_private_key},
    719  1.1  riastrad 	{"set",		"private-key",	cmd_set_private_key},
    720  1.1  riastrad 	{"set",		"listen-port",	cmd_set_listen_port},
    721  1.1  riastrad 	{"add",		"peer",		cmd_add_peer},
    722  1.1  riastrad 	{"delete",	"peer",		cmd_delete_peer},
    723  1.1  riastrad };
    724  1.1  riastrad 
    725  1.1  riastrad int
    726  1.1  riastrad main(int argc, char *argv[])
    727  1.1  riastrad {
    728  1.1  riastrad 	const char *interface;
    729  1.1  riastrad 	const char *command;
    730  1.1  riastrad 	const char *target;
    731  1.1  riastrad 
    732  1.1  riastrad 	if (argc < 2) {
    733  1.1  riastrad 		usage();
    734  1.1  riastrad 	}
    735  1.1  riastrad 
    736  1.1  riastrad 	interface = argv[1];
    737  1.1  riastrad 	if (strlen(interface) > IFNAMSIZ)
    738  1.1  riastrad 		errx(EXIT_FAILURE, "interface name too long");
    739  1.1  riastrad 	if (argc == 2) {
    740  1.1  riastrad 		return cmd_show_all(interface, 0, NULL);
    741  1.1  riastrad 	}
    742  1.1  riastrad 	if (argc < 4) {
    743  1.1  riastrad 		usage();
    744  1.1  riastrad 	}
    745  1.1  riastrad 	command = argv[2];
    746  1.1  riastrad 	target = argv[3];
    747  1.1  riastrad 
    748  1.1  riastrad 	argc -= 4;
    749  1.1  riastrad 	argv += 4;
    750  1.1  riastrad 
    751  1.1  riastrad 	for (size_t i = 0; i < __arraycount(commands); i++) {
    752  1.1  riastrad 		const struct command *cmd = &commands[i];
    753  1.1  riastrad 		if (strncmp(command, cmd->command, strlen(cmd->command)) == 0 &&
    754  1.1  riastrad 		    strncmp(target, cmd->target, strlen(cmd->target)) == 0) {
    755  1.1  riastrad 			return cmd->func(interface, argc, argv);
    756  1.1  riastrad 		}
    757  1.1  riastrad 	}
    758  1.1  riastrad 
    759  1.1  riastrad 	usage();
    760  1.1  riastrad }
    761