webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-28 11:43:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

wireguard-tools: backport IPFire wireguard-tools

Browse Source 
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
This commit is contained in:
Vincent Li
2025-07-02 19:02:49 +00:00
parent d30518a04a
commit dd9a60e720
4 changed files with 211 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
config/rootfiles/common/wireguard-tools Normal file
View File

@@ -0,0 +1,4 @@
etc/fcron.cyclic/wg-dynamic
usr/bin/wg
#usr/share/bash-completion/completions/wg
#usr/share/man/man8/wg.8

122
config/wireguard/wg-dynamic Normal file
View File

@@ -0,0 +1,122 @@
#!/bin/bash
###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2024 Michael Tremer <michael.tremer@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation, either version 3 of the License, or #
# (at your option) any later version. #
# #
# This program is distributed in the hope that it will be useful, #
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
# GNU General Public License for more details. #
# #
# You should have received a copy of the GNU General Public License #
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
# #
###############################################################################
# #
# This script tries to keep WireGuard connections with dynamic peers alive #
# #
# It resolves the endpoint if it is an FQDN, and if so, will check if the #
# currently connected endpoint matches any of the resolved IP addresses. If #
# not it will reload the WireGuard configuration in the hope that wg will #
# update the kernel with the new IP address and the connection comes back up #
# again. #
# #
###############################################################################
. /etc/sysconfig/rc
. ${rc_functions}
# Fetches the first endpoint that is currently active on the given interface
current_endpoint() {
local intf="${1}"
local pubkey
local endpoint
# List the first endpoint (are there even more than one?)
wg show "${intf}" endpoints | while read -r pubkey endpoint; do
echo "${endpoint%:*}"
break
done
return 0
}
# Resolves a hostname
resolve() {
local endpoint="${1}"
dig +short "A" "${endpoint}" 2>/dev/null
}
main() {
local -A settings=()
# Read WireGuard settings
readhash settings /var/ipfire/wireguard/settings
# Do nothing if WireGuard is not enabled
if [ "${settings[ENABLED]}" != "on" ]; then
return 0
fi
local line
while IFS=',' read -r -a line; do
local id="${line[0]}"
local enabled="${line[1]}"
local type="${line[2]}"
local name="${line[3]}"
local endpoint="${line[7]}"
# Only process enabled net-to-net connections
case "${enabled},${type}" in
on,net)
;;
*)
continue
;;
esac
# The endpoint must be an FQDN
case "${endpoint}" in
# Ignore IP addresses
[0-9]*.[0-9]*.[0-9]*.[0-9]*)
continue
;;
# Ignore if we don't know the endpoint
"")
continue
;;
esac
local address
local match=0
# Fetch the current endpoint address
local current_address="$(current_endpoint "wg${id}")"
# Walk through all IP addresses the FQDN resolves to
for address in $(resolve "${endpoint}"); do
if [ "${current_address}" = "${address}" ]; then
match=1
break
fi
done
# If there has been no match, we have to reload everything
if [ "${match}" -eq 0 ]; then
exec /etc/init.d/wireguard reload
fi
done < /var/ipfire/wireguard/peers
return 0
}
main "$@" || exit $?

84
lfs/wireguard-tools Normal file
View File

@@ -0,0 +1,84 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2007-2024 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation, either version 3 of the License, or #
# (at your option) any later version. #
# #
# This program is distributed in the hope that it will be useful, #
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
# GNU General Public License for more details. #
# #
# You should have received a copy of the GNU General Public License #
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
# #
###############################################################################
###############################################################################
# Definitions
###############################################################################
include Config
VER = 1.0.20210914
THISAPP = wireguard-tools-$(VER)
DL_FILE = $(THISAPP).tar.xz
DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
# Disable wg-quick
export WITH_WGQUICK = no
###############################################################################
# Top-level Rules
###############################################################################
objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
$(DL_FILE)_BLAKE2 = 89e7d79ae57f26c05b9d56752c4a8e34d2e121f6e9a3b80dace3858f62a130bab5e968e172af2aebdb1dc501dfc6b29eb1c50f728da4fc733a46c473784515b3
install : $(TARGET)
check : $(patsubst %,$(DIR_CHK)/%,$(objects))
download :$(patsubst %,$(DIR_DL)/%,$(objects))
b2 : $(subst %,%_BLAKE2,$(objects))
###############################################################################
# Downloading, checking, b2sum
###############################################################################
$(patsubst %,$(DIR_CHK)/%,$(objects)) :
@$(CHECK)
$(patsubst %,$(DIR_DL)/%,$(objects)) :
@$(LOAD)
$(subst %,%_BLAKE2,$(objects)) :
@$(B2SUM)
###############################################################################
# Installation Details
###############################################################################
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
cd $(DIR_APP)/src && make $(MAKETUNING)
cd $(DIR_APP)/src && make install
# Install wg-dynamic
install -v -m 755 $(DIR_SRC)/config/wireguard/wg-dynamic \
/etc/fcron.cyclic/wg-dynamic
@rm -rf $(DIR_APP)
@$(POSTBUILD)

1
make.sh
View File

@@ -1724,6 +1724,7 @@ buildipfire() {
lfsmake2 loxilb lfsmake2 loxilb
lfsmake2 libbpf-bootstrap lfsmake2 libbpf-bootstrap
lfsmake2 pwru lfsmake2 pwru
lfsmake2 wireguard-tools
# Kernelbuild ... current we have no platform that need # Kernelbuild ... current we have no platform that need