AZEN-SGG/amnezia-client
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

added passing new wireguard config parameters over uapi and configuring the amneziawireguard container

Browse source
This commit is contained in:
vladimir.kuznetsov 2023-09-27 00:40:01 +05:00
parent 7284bb54bc
commit af53c456ea
19 changed files with 342 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

51
client/configurators/amneziaWireGuardConfigurator.cpp
View file

@ -1,7 +1,10 @@
#include "amneziaWireGuardConfigurator.h"
#include <QJsonDocument>
#include <QJsonObject>
AmneziaWireGuardConfigurator::AmneziaWireGuardConfigurator(std::shared_ptr<Settings> settings, QObject *parent)
: WireguardConfigurator(settings, parent)
: WireguardConfigurator(settings, true, parent)
{
}
@ -9,7 +12,49 @@ QString AmneziaWireGuardConfigurator::genAmneziaWireGuardConfig(const ServerCred
DockerContainer container,
const QJsonObject &containerConfig, ErrorCode *errorCode)
{
auto config = WireguardConfigurator::genWireguardConfig(credentials, container, containerConfig, errorCode);
QString config = WireguardConfigurator::genWireguardConfig(credentials, container, containerConfig, errorCode);
return config;
QJsonObject jsonConfig = QJsonDocument::fromJson(config.toUtf8()).object();
QJsonObject awgConfig = containerConfig.value(config_key::amneziaWireguard).toObject();
auto junkPacketCount =
awgConfig.value(config_key::junkPacketCount).toString(protocols::amneziawireguard::defaultJunkPacketCount);
auto junkPacketMinSize =
awgConfig.value(config_key::junkPacketMinSize).toString(protocols::amneziawireguard::defaultJunkPacketMinSize);
auto junkPacketMaxSize =
awgConfig.value(config_key::junkPacketMaxSize).toString(protocols::amneziawireguard::defaultJunkPacketMaxSize);
auto initPacketJunkSize =
awgConfig.value(config_key::initPacketJunkSize).toString(protocols::amneziawireguard::defaultInitPacketJunkSize);
auto responsePacketJunkSize =
awgConfig.value(config_key::responsePacketJunkSize).toString(protocols::amneziawireguard::defaultResponsePacketJunkSize);
auto initPacketMagicHeader =
awgConfig.value(config_key::initPacketMagicHeader).toString(protocols::amneziawireguard::defaultInitPacketMagicHeader);
auto responsePacketMagicHeader =
awgConfig.value(config_key::responsePacketMagicHeader).toString(protocols::amneziawireguard::defaultResponsePacketMagicHeader);
auto underloadPacketMagicHeader =
awgConfig.value(config_key::underloadPacketMagicHeader).toString(protocols::amneziawireguard::defaultUnderloadPacketMagicHeader);
auto transportPacketMagicHeader =
awgConfig.value(config_key::transportPacketMagicHeader).toString(protocols::amneziawireguard::defaultTransportPacketMagicHeader);
config.replace("$JUNK_PACKET_COUNT", junkPacketCount);
config.replace("$JUNK_PACKET_MIN_SIZE", junkPacketMinSize);
config.replace("$JUNK_PACKET_MAX_SIZE", junkPacketMaxSize);
config.replace("$INIT_PACKET_JUNK_SIZE", initPacketJunkSize);
config.replace("$RESPONSE_PACKET_JUNK_SIZE", responsePacketJunkSize);
config.replace("$INIT_PACKET_MAGIC_HEADER", initPacketMagicHeader);
config.replace("$RESPONSE_PACKET_MAGIC_HEADER", responsePacketMagicHeader);
config.replace("$UNDERLOAD_PACKET_MAGIC_HEADER", underloadPacketMagicHeader);
config.replace("$TRANSPORT_PACKET_MAGIC_HEADER", transportPacketMagicHeader);
jsonConfig[config_key::junkPacketCount] = junkPacketCount;
jsonConfig[config_key::junkPacketMinSize] = junkPacketMinSize;
jsonConfig[config_key::junkPacketMaxSize] = junkPacketMaxSize;
jsonConfig[config_key::initPacketJunkSize] = initPacketJunkSize;
jsonConfig[config_key::responsePacketJunkSize] = responsePacketJunkSize;
jsonConfig[config_key::initPacketMagicHeader] = initPacketMagicHeader;
jsonConfig[config_key::responsePacketMagicHeader] = responsePacketMagicHeader;
jsonConfig[config_key::underloadPacketMagicHeader] = underloadPacketMagicHeader;
jsonConfig[config_key::transportPacketMagicHeader] = transportPacketMagicHeader;
return QJsonDocument(jsonConfig).toJson();
}

6
client/configurators/vpn_configurator.cpp
View file

@ -5,6 +5,7 @@
#include "shadowsocks_configurator.h"
#include "ssh_configurator.h"
#include "wireguard_configurator.h"
#include "amneziaWireGuardConfigurator.h"
#include <QFile>
#include <QJsonDocument>
@ -20,9 +21,10 @@ VpnConfigurator::VpnConfigurator(std::shared_ptr<Settings> settings, QObject *pa
openVpnConfigurator = std::shared_ptr<OpenVpnConfigurator>(new OpenVpnConfigurator(settings, this));
shadowSocksConfigurator = std::shared_ptr<ShadowSocksConfigurator>(new ShadowSocksConfigurator(settings, this));
cloakConfigurator = std::shared_ptr<CloakConfigurator>(new CloakConfigurator(settings, this));
wireguardConfigurator = std::shared_ptr<WireguardConfigurator>(new WireguardConfigurator(settings, this));
wireguardConfigurator = std::shared_ptr<WireguardConfigurator>(new WireguardConfigurator(settings, false, this));
ikev2Configurator = std::shared_ptr<Ikev2Configurator>(new Ikev2Configurator(settings, this));
sshConfigurator = std::shared_ptr<SshConfigurator>(new SshConfigurator(settings, this));
amneziaWireGuardConfigurator = std::shared_ptr<AmneziaWireGuardConfigurator>(new AmneziaWireGuardConfigurator(settings, this));
}
QString VpnConfigurator::genVpnProtocolConfig(const ServerCredentials &credentials, DockerContainer container,
@ -41,7 +43,7 @@ QString VpnConfigurator::genVpnProtocolConfig(const ServerCredentials &credentia
return wireguardConfigurator->genWireguardConfig(credentials, container, containerConfig, errorCode);
case Proto::AmneziaWireGuard:
return wireguardConfigurator->genWireguardConfig(credentials, container, containerConfig, errorCode);
return amneziaWireGuardConfigurator->genAmneziaWireGuardConfig(credentials, container, containerConfig, errorCode);
case Proto::Ikev2: return ikev2Configurator->genIkev2Config(credentials, container, containerConfig, errorCode);

4
client/configurators/vpn_configurator.h
View file

@ -13,13 +13,14 @@ class CloakConfigurator;
class WireguardConfigurator;
class Ikev2Configurator;
class SshConfigurator;
class AmneziaWireGuardConfigurator;
// Retrieve connection settings from server
class VpnConfigurator : ConfiguratorBase
{
Q_OBJECT
public:
VpnConfigurator(std::shared_ptr<Settings> settings, QObject *parent = nullptr);
explicit VpnConfigurator(std::shared_ptr<Settings> settings, QObject *parent = nullptr);
QString genVpnProtocolConfig(const ServerCredentials &credentials, DockerContainer container,
const QJsonObject &containerConfig, Proto proto, ErrorCode *errorCode = nullptr);
@ -40,6 +41,7 @@ public:
std::shared_ptr<WireguardConfigurator> wireguardConfigurator;
std::shared_ptr<Ikev2Configurator> ikev2Configurator;
std::shared_ptr<SshConfigurator> sshConfigurator;
std::shared_ptr<AmneziaWireGuardConfigurator> amneziaWireGuardConfigurator;
};
#endif // VPN_CONFIGURATOR_H

43
client/configurators/wireguard_configurator.cpp
View file

@ -19,9 +19,17 @@
#include "settings.h"
#include "utilities.h"
WireguardConfigurator::WireguardConfigurator(std::shared_ptr<Settings> settings, QObject *parent)
: ConfiguratorBase(settings, parent)
WireguardConfigurator::WireguardConfigurator(std::shared_ptr<Settings> settings, bool isAmneziaWireGuard, QObject *parent)
: ConfiguratorBase(settings, parent), m_isAmneziaWireGuard(isAmneziaWireGuard)
{
m_serverConfigPath = m_isAmneziaWireGuard ? amnezia::protocols::amneziawireguard::serverConfigPath
: amnezia::protocols::wireguard::serverConfigPath;
m_serverPublicKeyPath = m_isAmneziaWireGuard ? amnezia::protocols::amneziawireguard::serverPublicKeyPath
: amnezia::protocols::wireguard::serverPublicKeyPath;
m_serverPskKeyPath = m_isAmneziaWireGuard ? amnezia::protocols::amneziawireguard::serverPskKeyPath
: amnezia::protocols::wireguard::serverPskKeyPath;
m_configTemplate = m_isAmneziaWireGuard ? ProtocolScriptType::amnezia_wireguard_template
: ProtocolScriptType::wireguard_template;
}
WireguardConfigurator::ConnectionData WireguardConfigurator::genClientKeys()
@ -62,7 +70,7 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
{
WireguardConfigurator::ConnectionData connData = WireguardConfigurator::genClientKeys();
connData.host = credentials.hostName;
connData.port = containerConfig.value(config_key::wireguard)
connData.port = containerConfig.value(m_isAmneziaWireGuard ? config_key::amneziaWireguard : config_key::wireguard)
.toObject()
.value(config_key::port)
.toString(protocols::wireguard::defaultPort);
@ -79,7 +87,7 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
// Get list of already created clients (only IP addresses)
QString nextIpNumber;
{
QString script = QString("cat %1 | grep AllowedIPs").arg(amnezia::protocols::wireguard::serverConfigPath);
QString script = QString("cat %1 | grep AllowedIPs").arg(m_serverConfigPath);
QString stdOut;
auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
stdOut += data + "\n";
@ -126,8 +134,7 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
}
// Get keys
connData.serverPubKey = serverController.getTextFileFromContainer(
container, credentials, amnezia::protocols::wireguard::serverPublicKeyPath, &e);
connData.serverPubKey = serverController.getTextFileFromContainer(container, credentials, m_serverPublicKeyPath, &e);
connData.serverPubKey.replace("\n", "");
if (e) {
if (errorCode)
@ -135,8 +142,7 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
return connData;
}
connData.pskKey = serverController.getTextFileFromContainer(container, credentials,
amnezia::protocols::wireguard::serverPskKeyPath, &e);
connData.pskKey = serverController.getTextFileFromContainer(container, credentials, m_serverPskKeyPath, &e);
connData.pskKey.replace("\n", "");
if (e) {
@ -150,12 +156,9 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
"PublicKey = %1\n"
"PresharedKey = %2\n"
"AllowedIPs = %3/32\n\n")
.arg(connData.clientPubKey)
.arg(connData.pskKey)
.arg(connData.clientIP);
.arg(connData.clientPubKey, connData.pskKey, connData.clientIP);
e = serverController.uploadTextFileToContainer(container, credentials, configPart,
protocols::wireguard::serverConfigPath,
e = serverController.uploadTextFileToContainer(container, credentials, configPart, m_serverConfigPath,
libssh::SftpOverwriteMode::SftpAppendToExisting);
if (e) {
@ -164,11 +167,11 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
return connData;
}
QString script = QString("sudo docker exec -i $CONTAINER_NAME bash -c 'wg syncconf wg0 <(wg-quick strip %1)'")
.arg(m_serverConfigPath);
e = serverController.runScript(
credentials,
serverController.replaceVars("sudo docker exec -i $CONTAINER_NAME bash -c 'wg syncconf wg0 <(wg-quick "
"strip /opt/amnezia/wireguard/wg0.conf)'",
serverController.genVarsForScript(credentials, container)));
credentials, serverController.replaceVars(script, serverController.genVarsForScript(credentials, container)));
return connData;
}
@ -177,9 +180,9 @@ QString WireguardConfigurator::genWireguardConfig(const ServerCredentials &crede
const QJsonObject &containerConfig, ErrorCode *errorCode)
{
ServerController serverController(m_settings);
QString config =
serverController.replaceVars(amnezia::scriptData(ProtocolScriptType::wireguard_template, container),
serverController.genVarsForScript(credentials, container, containerConfig));
QString scriptData = amnezia::scriptData(m_configTemplate, container);
QString config = serverController.replaceVars(
scriptData, serverController.genVarsForScript(credentials, container, containerConfig));
ConnectionData connData = prepareWireguardConfig(credentials, container, containerConfig, errorCode);
if (errorCode && *errorCode) {

9
client/configurators/wireguard_configurator.h
View file

@ -6,12 +6,13 @@
#include "configurator_base.h"
#include "core/defs.h"
#include "core/scripts_registry.h"
class WireguardConfigurator : public ConfiguratorBase
{
Q_OBJECT
public:
WireguardConfigurator(std::shared_ptr<Settings> settings, QObject *parent = nullptr);
WireguardConfigurator(std::shared_ptr<Settings> settings, bool isAmneziaWireGuard, QObject *parent = nullptr);
struct ConnectionData
{
@ -35,6 +36,12 @@ private:
const QJsonObject &containerConfig, ErrorCode *errorCode = nullptr);
ConnectionData genClientKeys();
bool m_isAmneziaWireGuard;
QString m_serverConfigPath;
QString m_serverPublicKeyPath;
QString m_serverPskKeyPath;
amnezia::ProtocolScriptType m_configTemplate;
};
#endif // WIREGUARD_CONFIGURATOR_H

3
client/core/scripts_registry.cpp
View file

@ -11,7 +11,7 @@ QString amnezia::scriptFolder(amnezia::DockerContainer container)
case DockerContainer::Cloak: return QLatin1String("openvpn_cloak");
case DockerContainer::ShadowSocks: return QLatin1String("openvpn_shadowsocks");
case DockerContainer::WireGuard: return QLatin1String("wireguard");
case DockerContainer::AmneziaWireGuard: return QLatin1String("wireguard");
case DockerContainer::AmneziaWireGuard: return QLatin1String("amnezia_wireguard");
case DockerContainer::Ipsec: return QLatin1String("ipsec");
case DockerContainer::TorWebSite: return QLatin1String("website_tor");
@ -46,6 +46,7 @@ QString amnezia::scriptName(ProtocolScriptType type)
case ProtocolScriptType::container_startup: return QLatin1String("start.sh");
case ProtocolScriptType::openvpn_template: return QLatin1String("template.ovpn");
case ProtocolScriptType::wireguard_template: return QLatin1String("template.conf");
case ProtocolScriptType::amnezia_wireguard_template: return QLatin1String("template.conf");
}
}

3
client/core/scripts_registry.h
View file

@ -26,7 +26,8 @@ enum ProtocolScriptType {
configure_container,
container_startup,
openvpn_template,
wireguard_template
wireguard_template,
amnezia_wireguard_template
};

31
client/core/servercontroller.cpp
View file

@ -584,6 +584,37 @@ ServerController::Vars ServerController::genVarsForScript(const ServerCredential
vars.append({ { "$SFTP_USER", sftpConfig.value(config_key::userName).toString() } });
vars.append({ { "$SFTP_PASSWORD", sftpConfig.value(config_key::password).toString() } });
// Amnezia wireguard vars
vars.append({ { "$AMNEZIAWIREGUARD_SERVER_PORT",
amneziaWireguarConfig.value(config_key::port).toString(protocols::amneziawireguard::defaultPort) } });
vars.append({ { "$JUNK_PACKET_COUNT",
amneziaWireguarConfig.value(config_key::junkPacketCount)
.toString(protocols::amneziawireguard::defaultJunkPacketCount) } });
vars.append({ { "$JUNK_PACKET_MIN_SIZE",
amneziaWireguarConfig.value(config_key::junkPacketMinSize)
.toString(protocols::amneziawireguard::defaultJunkPacketMinSize) } });
vars.append({ { "$JUNK_PACKET_MAX_SIZE",
amneziaWireguarConfig.value(config_key::junkPacketMaxSize)
.toString(protocols::amneziawireguard::defaultJunkPacketMaxSize) } });
vars.append({ { "$INIT_PACKET_JUNK_SIZE",
amneziaWireguarConfig.value(config_key::initPacketJunkSize)
.toString(protocols::amneziawireguard::defaultInitPacketJunkSize) } });
vars.append({ { "$RESPONSE_PACKET_JUNK_SIZE",
amneziaWireguarConfig.value(config_key::responsePacketJunkSize)
.toString(protocols::amneziawireguard::defaultResponsePacketJunkSize) } });
vars.append({ { "$INIT_PACKET_MAGIC_HEADER",
amneziaWireguarConfig.value(config_key::initPacketMagicHeader)
.toString(protocols::amneziawireguard::defaultInitPacketMagicHeader) } });
vars.append({ { "$RESPONSE_PACKET_MAGIC_HEADER",
amneziaWireguarConfig.value(config_key::responsePacketMagicHeader)
.toString(protocols::amneziawireguard::defaultResponsePacketMagicHeader) } });
vars.append({ { "$UNDERLOAD_PACKET_MAGIC_HEADER",
amneziaWireguarConfig.value(config_key::underloadPacketMagicHeader)
.toString(protocols::amneziawireguard::defaultUnderloadPacketMagicHeader) } });
vars.append({ { "$TRANSPORT_PACKET_MAGIC_HEADER",
amneziaWireguarConfig.value(config_key::transportPacketMagicHeader)
.toString(protocols::amneziawireguard::defaultTransportPacketMagicHeader) } });
QString serverIp = Utils::getIPAddress(credentials.hostName);
if (!serverIp.isEmpty()) {
vars.append({ { "$SERVER_IP_ADDRESS", serverIp } });

11
client/daemon/daemon.cpp
View file

@ -359,6 +359,17 @@ bool Daemon::parseConfig(const QJsonObject& obj, InterfaceConfig& config) {
if (!parseStringList(obj, "vpnDisabledApps", config.m_vpnDisabledApps)) {
return false;
}
config.m_junkPacketCount = obj.value("Jc").toString();
config.m_junkPacketMinSize = obj.value("Jmin").toString();
config.m_junkPacketMaxSize = obj.value("Jmax").toString();
config.m_initPacketJunkSize = obj.value("S1").toString();
config.m_responsePacketJunkSize = obj.value("S2").toString();
config.m_initPacketMagicHeader = obj.value("H1").toString();
config.m_responsePacketMagicHeader = obj.value("H2").toString();
config.m_underloadPacketMagicHeader = obj.value("H3").toString();
config.m_transportPacketMagicHeader = obj.value("H4").toString();
return true;
}

10
client/daemon/interfaceconfig.h
View file

@ -40,6 +40,16 @@ class InterfaceConfig {
QString m_installationId;
#endif
QString m_junkPacketCount;
QString m_junkPacketMinSize;
QString m_junkPacketMaxSize;
QString m_initPacketJunkSize;
QString m_responsePacketJunkSize;
QString m_initPacketMagicHeader;
QString m_responsePacketMagicHeader;
QString m_underloadPacketMagicHeader;
QString m_transportPacketMagicHeader;
QJsonObject toJson() const;
QString toWgConf(
const QMap<QString, QString>& extra = QMap<QString, QString>()) const;

17
client/mozilla/localsocketcontroller.cpp
View file

@ -115,7 +115,9 @@ void LocalSocketController::daemonConnected() {
}
void LocalSocketController::activate(const QJsonObject &rawConfig) {
QJsonObject wgConfig = rawConfig.value("wireguard_config_data").toObject();
QString protocolName = rawConfig.value("protocol").toString();
QJsonObject wgConfig = rawConfig.value(protocolName + "_config_data").toObject();
QJsonObject json;
json.insert("type", "activate");
@ -160,6 +162,19 @@ void LocalSocketController::activate(const QJsonObject &rawConfig) {
// splitTunnelApps.append(QJsonValue(uri));
// }
// json.insert("vpnDisabledApps", splitTunnelApps);
if (protocolName == amnezia::config_key::amneziaWireguard) {
json.insert(amnezia::config_key::junkPacketCount, wgConfig.value(amnezia::config_key::junkPacketCount));
json.insert(amnezia::config_key::junkPacketMinSize, wgConfig.value(amnezia::config_key::junkPacketMinSize));
json.insert(amnezia::config_key::junkPacketMaxSize, wgConfig.value(amnezia::config_key::junkPacketMaxSize));
json.insert(amnezia::config_key::initPacketJunkSize, wgConfig.value(amnezia::config_key::initPacketJunkSize));
json.insert(amnezia::config_key::responsePacketJunkSize, wgConfig.value(amnezia::config_key::responsePacketJunkSize));
json.insert(amnezia::config_key::initPacketMagicHeader, wgConfig.value(amnezia::config_key::initPacketMagicHeader));
json.insert(amnezia::config_key::responsePacketMagicHeader, wgConfig.value(amnezia::config_key::responsePacketMagicHeader));
json.insert(amnezia::config_key::underloadPacketMagicHeader, wgConfig.value(amnezia::config_key::underloadPacketMagicHeader));
json.insert(amnezia::config_key::transportPacketMagicHeader, wgConfig.value(amnezia::config_key::transportPacketMagicHeader));
}
write(json);
}

11
client/platforms/macos/daemon/wireguardutilsmacos.cpp
View file

@ -163,6 +163,17 @@ bool WireguardUtilsMacos::updatePeer(const InterfaceConfig& config) {
out << "allowed_ip=" << ip.toString() << "\n";
}
out << "Jc=" << config.m_junkPacketCount << "\n";
out << "jmin=" << config.m_junkPacketMinSize << "\n";
out << "jmax=" << config.m_junkPacketMaxSize << "\n";
out << "s1=" << config.m_initPacketJunkSize << "\n";
out << "s2=" << config.m_responsePacketJunkSize << "\n";
out << "h1=" << config.m_initPacketMagicHeader << "\n";
out << "h2=" << config.m_responsePacketMagicHeader << "\n";
out << "h3=" << config.m_underloadPacketMagicHeader << "\n";
out << "h4=" << config.m_transportPacketMagicHeader << "\n";
// Exclude the server address, except for multihop exit servers.
if ((config.m_hopType != InterfaceConfig::MultiHopExit) &&
(m_rtmonitor != nullptr)) {

30
client/protocols/protocols_defs.h
View file

@ -61,11 +61,22 @@ namespace amnezia
constexpr char isThirdPartyConfig[] = "isThirdPartyConfig";
constexpr char junkPacketCount[] = "Jc";
constexpr char junkPacketMinSize[] = "Jmin";
constexpr char junkPacketMaxSize[] = "Jmax";
constexpr char initPacketJunkSize[] = "S1";
constexpr char responsePacketJunkSize[] = "S2";
constexpr char initPacketMagicHeader[] = "H1";
constexpr char responsePacketMagicHeader[] = "H2";
constexpr char underloadPacketMagicHeader[] = "H3";
constexpr char transportPacketMagicHeader[] = "H4";
constexpr char openvpn[] = "openvpn";
constexpr char wireguard[] = "wireguard";
constexpr char shadowsocks[] = "shadowsocks";
constexpr char cloak[] = "cloak";
constexpr char sftp[] = "sftp";
constexpr char amneziaWireguard[] = "amneziawireguard";
}
@ -140,6 +151,25 @@ namespace amnezia
} // namespace sftp
namespace amneziawireguard
{
constexpr char defaultPort[] = "55424";
constexpr char serverConfigPath[] = "/opt/amnezia/amneziawireguard/wg0.conf";
constexpr char serverPublicKeyPath[] = "/opt/amnezia/amneziawireguard/wireguard_server_public_key.key";
constexpr char serverPskKeyPath[] = "/opt/amnezia/amneziawireguard/wireguard_psk.key";
constexpr char defaultJunkPacketCount[] = "3";
constexpr char defaultJunkPacketMinSize[] = "10";
constexpr char defaultJunkPacketMaxSize[] = "30";
constexpr char defaultInitPacketJunkSize[] = "15";
constexpr char defaultResponsePacketJunkSize[] = "18";
constexpr char defaultInitPacketMagicHeader[] = "1020325451";
constexpr char defaultResponsePacketMagicHeader[] = "3288052141";
constexpr char defaultTransportPacketMagicHeader[] = "2528465083";
constexpr char defaultUnderloadPacketMagicHeader[] = "1766607858";
}
} // namespace protocols
namespace ProtocolEnumNS

5
client/resources.qrc
View file

@ -216,5 +216,10 @@
<file>ui/qml/Pages2/PageServiceDnsSettings.qml</file>
<file>ui/qml/Controls2/TopCloseButtonType.qml</file>
<file>ui/qml/Pages2/PageProtocolAmneziaWireGuardSettings.qml</file>
<file>server_scripts/amnezia_wireguard/template.conf</file>
<file>server_scripts/amnezia_wireguard/start.sh</file>
<file>server_scripts/amnezia_wireguard/configure_container.sh</file>
<file>server_scripts/amnezia_wireguard/run_container.sh</file>
<file>server_scripts/amnezia_wireguard/Dockerfile</file>
</qresource>
</RCC>

46
client/server_scripts/amnezia_wireguard/Dockerfile Normal file
View file

@ -0,0 +1,46 @@
FROM amneziavpn/amnezia-wg:latest
LABEL maintainer="AmneziaVPN"
#Install required packages
RUN apk add --no-cache curl wireguard-tools dumb-init
RUN apk --update upgrade --no-cache
RUN mkdir -p /opt/amnezia
RUN echo -e "#!/bin/bash\ntail -f /dev/null" > /opt/amnezia/start.sh
RUN chmod a+x /opt/amnezia/start.sh
# Tune network
RUN echo -e " \n\
fs.file-max = 51200 \n\
\n\
net.core.rmem_max = 67108864 \n\
net.core.wmem_max = 67108864 \n\
net.core.netdev_max_backlog = 250000 \n\
net.core.somaxconn = 4096 \n\
\n\
net.ipv4.tcp_syncookies = 1 \n\
net.ipv4.tcp_tw_reuse = 1 \n\
net.ipv4.tcp_tw_recycle = 0 \n\
net.ipv4.tcp_fin_timeout = 30 \n\
net.ipv4.tcp_keepalive_time = 1200 \n\
net.ipv4.ip_local_port_range = 10000 65000 \n\
net.ipv4.tcp_max_syn_backlog = 8192 \n\
net.ipv4.tcp_max_tw_buckets = 5000 \n\
net.ipv4.tcp_fastopen = 3 \n\
net.ipv4.tcp_mem = 25600 51200 102400 \n\
net.ipv4.tcp_rmem = 4096 87380 67108864 \n\
net.ipv4.tcp_wmem = 4096 65536 67108864 \n\
net.ipv4.tcp_mtu_probing = 1 \n\
net.ipv4.tcp_congestion_control = hybla \n\
# for low-latency network, use cubic instead \n\
# net.ipv4.tcp_congestion_control = cubic \n\
" | sed -e 's/^\s\+//g' | tee -a /etc/sysctl.conf && \
mkdir -p /etc/security && \
echo -e " \n\
* soft nofile 51200 \n\
* hard nofile 51200 \n\
" | sed -e 's/^\s\+//g' | tee -a /etc/security/limits.conf
ENTRYPOINT [ "dumb-init", "/opt/amnezia/start.sh" ]
CMD [ "" ]

26
client/server_scripts/amnezia_wireguard/configure_container.sh Normal file
View file

@ -0,0 +1,26 @@
mkdir -p /opt/amnezia/amneziawireguard
cd /opt/amnezia/amneziawireguard
WIREGUARD_SERVER_PRIVATE_KEY=$(wg genkey)
echo $WIREGUARD_SERVER_PRIVATE_KEY > /opt/amnezia/amneziawireguard/wireguard_server_private_key.key
WIREGUARD_SERVER_PUBLIC_KEY=$(echo $WIREGUARD_SERVER_PRIVATE_KEY | wg pubkey)
echo $WIREGUARD_SERVER_PUBLIC_KEY > /opt/amnezia/amneziawireguard/wireguard_server_public_key.key
WIREGUARD_PSK=$(wg genpsk)
echo $WIREGUARD_PSK > /opt/amnezia/amneziawireguard/wireguard_psk.key
cat > /opt/amnezia/amneziawireguard/wg0.conf <<EOF
[Interface]
PrivateKey = $WIREGUARD_SERVER_PRIVATE_KEY
Address = $WIREGUARD_SUBNET_IP/$WIREGUARD_SUBNET_CIDR
ListenPort = $AMNEZIAWIREGUARD_SERVER_PORT
Jc = $JUNK_PACKET_COUNT
Jmin = $JUNK_PACKET_MIN_SIZE
Jmax = $JUNK_PACKET_MAX_SIZE
S1 = $INIT_PACKET_JUNK_SIZE
S2 = $RESPONSE_PACKET_JUNK_SIZE
H1 = $INIT_PACKET_MAGIC_HEADER
H2 = $RESPONSE_PACKET_MAGIC_HEADER
H3 = $UNDERLOAD_PACKET_MAGIC_HEADER
H4 = $TRANSPORT_PACKET_MAGIC_HEADER
EOF

18
client/server_scripts/amnezia_wireguard/run_container.sh Normal file
View file

@ -0,0 +1,18 @@
# Run container
sudo docker run -d \
--log-driver none \
--restart always \
--privileged \
--cap-add=NET_ADMIN \
--cap-add=SYS_MODULE \
-p $AMNEZIAWIREGUARD_SERVER_PORT:$AMNEZIAWIREGUARD_SERVER_PORT/udp \
-v /lib/modules:/lib/modules \
--sysctl="net.ipv4.conf.all.src_valid_mark=1" \
--name $CONTAINER_NAME \
$CONTAINER_NAME
sudo docker network connect amnezia-dns-net $CONTAINER_NAME
# Prevent to route packets outside of the container in case if server behind of the NAT
#sudo docker exec -i $CONTAINER_NAME sh -c "ifconfig eth0:0 $SERVER_IP_ADDRESS netmask 255.255.255.255 up"

28
client/server_scripts/amnezia_wireguard/start.sh Normal file
View file

@ -0,0 +1,28 @@
#!/bin/bash
# This scripts copied from Amnezia client to Docker container to /opt/amnezia and launched every time container starts
echo "Container startup"
#ifconfig eth0:0 $SERVER_IP_ADDRESS netmask 255.255.255.255 up
# kill daemons in case of restart
wg-quick down /opt/amnezia/amneziawireguard/wg0.conf
# start daemons if configured
if [ -f /opt/amnezia/amneziawireguard/wg0.conf ]; then (wg-quick up /opt/amnezia/amneziawireguard/wg0.conf); fi
# Allow traffic on the TUN interface.
iptables -A INPUT -i wg0 -j ACCEPT
iptables -A FORWARD -i wg0 -j ACCEPT
iptables -A OUTPUT -o wg0 -j ACCEPT
# Allow forwarding traffic only from the VPN.
iptables -A FORWARD -i wg0 -o eth0 -s $WIREGUARD_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -j ACCEPT
iptables -A FORWARD -i wg0 -o eth1 -s $WIREGUARD_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s $WIREGUARD_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s $WIREGUARD_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -o eth1 -j MASQUERADE
tail -f /dev/null

20
client/server_scripts/amnezia_wireguard/template.conf Normal file
View file

@ -0,0 +1,20 @@
[Interface]
Address = $WIREGUARD_CLIENT_IP/32
DNS = $PRIMARY_DNS, $SECONDARY_DNS
PrivateKey = $WIREGUARD_CLIENT_PRIVATE_KEY
Jc = $JUNK_PACKET_COUNT
Jmin = $JUNK_PACKET_MIN_SIZE
Jmax = $JUNK_PACKET_MAX_SIZE
S1 = $INIT_PACKET_JUNK_SIZE
S2 = $RESPONSE_PACKET_JUNK_SIZE
H1 = $INIT_PACKET_MAGIC_HEADER
H2 = $RESPONSE_PACKET_MAGIC_HEADER
H3 = $UNDERLOAD_PACKET_MAGIC_HEADER
H4 = $TRANSPORT_PACKET_MAGIC_HEADER
[Peer]
PublicKey = $WIREGUARD_SERVER_PUBLIC_KEY
PresharedKey = $WIREGUARD_PSK
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = $SERVER_IP_ADDRESS:$AMNEZIAWIREGUARD_SERVER_PORT
PersistentKeepalive = 25