Compare commits
15 commits
dev
...
update_ser
Author | SHA1 | Date | |
---|---|---|---|
![]() |
d61e2bc8f6 | ||
![]() |
9e1298550f | ||
![]() |
805bc5fb61 | ||
![]() |
3241782098 | ||
![]() |
b19009b669 | ||
![]() |
26218b22ee | ||
![]() |
3eeeb5094e | ||
![]() |
f309a358c3 | ||
![]() |
be0ec37738 | ||
![]() |
179c6093ce | ||
![]() |
10933ce466 | ||
![]() |
cd9cdd24ec | ||
![]() |
144ed3c988 | ||
![]() |
e046b6df04 | ||
![]() |
548959752c |
10 changed files with 94 additions and 20 deletions
|
@ -35,6 +35,10 @@ WireguardConfigurator::WireguardConfigurator(std::shared_ptr<Settings> settings,
|
|||
|
||||
m_protocolName = m_isAwg ? config_key::awg : config_key::wireguard;
|
||||
m_defaultPort = m_isAwg ? protocols::wireguard::defaultPort : protocols::awg::defaultPort;
|
||||
|
||||
m_interfaceName = m_isAwg ? protocols::awg::interfaceName : protocols::wireguard::interfaceName;
|
||||
m_wgBinaryName = m_isAwg ? protocols::awg::wgBinaryName : protocols::wireguard::wgBinaryName;
|
||||
m_wgQuickBinaryName = m_isAwg ? protocols::awg::wgQuickBinaryName : protocols::wireguard::wgQuickBinaryName;
|
||||
}
|
||||
|
||||
WireguardConfigurator::ConnectionData WireguardConfigurator::genClientKeys()
|
||||
|
@ -103,6 +107,20 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
|
|||
return connData;
|
||||
}
|
||||
|
||||
if (container == DockerContainer::Awg) {
|
||||
if (m_serverController->isNewAwgContainer(credentials)) {
|
||||
m_serverConfigPath = amnezia::protocols::awg::serverConfigPath;
|
||||
m_interfaceName = protocols::awg::interfaceName;
|
||||
m_wgBinaryName = protocols::awg::wgBinaryName;
|
||||
m_wgQuickBinaryName = protocols::awg::wgQuickBinaryName;
|
||||
} else {
|
||||
m_serverConfigPath = "/opt/amnezia/awg/wg0.conf";
|
||||
m_interfaceName = protocols::wireguard::interfaceName;
|
||||
m_wgBinaryName = protocols::wireguard::wgBinaryName;
|
||||
m_wgQuickBinaryName = protocols::wireguard::wgQuickBinaryName;
|
||||
}
|
||||
}
|
||||
|
||||
QString getIpsScript = QString("cat %1 | grep AllowedIPs").arg(m_serverConfigPath);
|
||||
QString stdOut;
|
||||
auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
|
||||
|
@ -168,8 +186,8 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
|
|||
return connData;
|
||||
}
|
||||
|
||||
QString script = QString("sudo docker exec -i $CONTAINER_NAME bash -c 'wg syncconf wg0 <(wg-quick strip %1)'")
|
||||
.arg(m_serverConfigPath);
|
||||
QString script = QString("sudo docker exec -i $CONTAINER_NAME bash -c '%4 syncconf %2 <(%3 strip %1)'")
|
||||
.arg(m_serverConfigPath, m_interfaceName, m_wgQuickBinaryName, m_wgBinaryName);
|
||||
|
||||
errorCode = m_serverController->runScript(
|
||||
credentials,
|
||||
|
|
|
@ -49,6 +49,9 @@ private:
|
|||
amnezia::ProtocolScriptType m_configTemplate;
|
||||
QString m_protocolName;
|
||||
QString m_defaultPort;
|
||||
QString m_interfaceName;
|
||||
QString m_wgBinaryName;
|
||||
QString m_wgQuickBinaryName;
|
||||
};
|
||||
|
||||
#endif // WIREGUARD_CONFIGURATOR_H
|
||||
|
|
|
@ -843,3 +843,24 @@ ErrorCode ServerController::getDecryptedPrivateKey(const ServerCredentials &cred
|
|||
auto error = m_sshClient.getDecryptedPrivateKey(credentials, decryptedPrivateKey, callback);
|
||||
return error;
|
||||
}
|
||||
|
||||
bool ServerController::isNewAwgContainer(const ServerCredentials &credentials)
|
||||
{
|
||||
QString stdOut;
|
||||
auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
|
||||
stdOut += data + "\n";
|
||||
return ErrorCode::NoError;
|
||||
};
|
||||
|
||||
auto cbReadStdErr = [&](const QString &data, libssh::Client &) {
|
||||
stdOut += data + "\n";
|
||||
return ErrorCode::NoError;
|
||||
};
|
||||
|
||||
QString script = QString("sudo docker exec -i $CONTAINER_NAME bash -c 'type awg'");
|
||||
|
||||
runScript(credentials, replaceVars(script, genVarsForScript(credentials, DockerContainer::Awg)), cbReadStdOut, cbReadStdErr);
|
||||
|
||||
return stdOut.contains("/usr/bin/awg");
|
||||
|
||||
}
|
||||
|
|
|
@ -57,6 +57,8 @@ public:
|
|||
ErrorCode getDecryptedPrivateKey(const ServerCredentials &credentials, QString &decryptedPrivateKey,
|
||||
const std::function<QString()> &callback);
|
||||
|
||||
bool isNewAwgContainer(const ServerCredentials &credentials);
|
||||
|
||||
private:
|
||||
ErrorCode installDockerWorker(const ServerCredentials &credentials, DockerContainer container);
|
||||
ErrorCode prepareHostWorker(const ServerCredentials &credentials, DockerContainer container, const QJsonObject &config = QJsonObject());
|
||||
|
|
|
@ -186,6 +186,9 @@ namespace amnezia
|
|||
constexpr char serverPublicKeyPath[] = "/opt/amnezia/wireguard/wireguard_server_public_key.key";
|
||||
constexpr char serverPskKeyPath[] = "/opt/amnezia/wireguard/wireguard_psk.key";
|
||||
|
||||
constexpr char interfaceName[] = "wg0";
|
||||
constexpr char wgBinaryName[] = "wg";
|
||||
constexpr char wgQuickBinaryName[] = "wg-quick";
|
||||
}
|
||||
|
||||
namespace sftp
|
||||
|
@ -203,7 +206,7 @@ namespace amnezia
|
|||
constexpr char defaultMtu[] = "1376";
|
||||
#endif
|
||||
|
||||
constexpr char serverConfigPath[] = "/opt/amnezia/awg/wg0.conf";
|
||||
constexpr char serverConfigPath[] = "/opt/amnezia/awg/awg0.conf";
|
||||
constexpr char serverPublicKeyPath[] = "/opt/amnezia/awg/wireguard_server_public_key.key";
|
||||
constexpr char serverPskKeyPath[] = "/opt/amnezia/awg/wireguard_psk.key";
|
||||
|
||||
|
@ -216,6 +219,10 @@ namespace amnezia
|
|||
constexpr char defaultResponsePacketMagicHeader[] = "3288052141";
|
||||
constexpr char defaultTransportPacketMagicHeader[] = "2528465083";
|
||||
constexpr char defaultUnderloadPacketMagicHeader[] = "1766607858";
|
||||
|
||||
constexpr char interfaceName[] = "awg0";
|
||||
constexpr char wgBinaryName[] = "awg";
|
||||
constexpr char wgQuickBinaryName[] = "awg-quick";
|
||||
}
|
||||
|
||||
namespace socks5Proxy
|
||||
|
|
|
@ -1,4 +1,4 @@
|
|||
FROM amneziavpn/amnezia-wg:latest
|
||||
FROM amneziavpn/amneziawg-go:latest
|
||||
|
||||
LABEL maintainer="AmneziaVPN"
|
||||
|
||||
|
|
|
@ -1,15 +1,15 @@
|
|||
mkdir -p /opt/amnezia/awg
|
||||
cd /opt/amnezia/awg
|
||||
WIREGUARD_SERVER_PRIVATE_KEY=$(wg genkey)
|
||||
WIREGUARD_SERVER_PRIVATE_KEY=$(awg genkey)
|
||||
echo $WIREGUARD_SERVER_PRIVATE_KEY > /opt/amnezia/awg/wireguard_server_private_key.key
|
||||
|
||||
WIREGUARD_SERVER_PUBLIC_KEY=$(echo $WIREGUARD_SERVER_PRIVATE_KEY | wg pubkey)
|
||||
WIREGUARD_SERVER_PUBLIC_KEY=$(echo $WIREGUARD_SERVER_PRIVATE_KEY | awg pubkey)
|
||||
echo $WIREGUARD_SERVER_PUBLIC_KEY > /opt/amnezia/awg/wireguard_server_public_key.key
|
||||
|
||||
WIREGUARD_PSK=$(wg genpsk)
|
||||
WIREGUARD_PSK=$(awg genpsk)
|
||||
echo $WIREGUARD_PSK > /opt/amnezia/awg/wireguard_psk.key
|
||||
|
||||
cat > /opt/amnezia/awg/wg0.conf <<EOF
|
||||
cat > /opt/amnezia/awg/awg0.conf <<EOF
|
||||
[Interface]
|
||||
PrivateKey = $WIREGUARD_SERVER_PRIVATE_KEY
|
||||
Address = $AWG_SUBNET_IP/$WIREGUARD_SUBNET_CIDR
|
||||
|
|
|
@ -6,19 +6,19 @@ echo "Container startup"
|
|||
#ifconfig eth0:0 $SERVER_IP_ADDRESS netmask 255.255.255.255 up
|
||||
|
||||
# kill daemons in case of restart
|
||||
wg-quick down /opt/amnezia/awg/wg0.conf
|
||||
awg-quick down /opt/amnezia/awg/awg0.conf
|
||||
|
||||
# start daemons if configured
|
||||
if [ -f /opt/amnezia/awg/wg0.conf ]; then (wg-quick up /opt/amnezia/awg/wg0.conf); fi
|
||||
if [ -f /opt/amnezia/awg/awg0.conf ]; then (awg-quick up /opt/amnezia/awg/awg0.conf); fi
|
||||
|
||||
# Allow traffic on the TUN interface.
|
||||
iptables -A INPUT -i wg0 -j ACCEPT
|
||||
iptables -A FORWARD -i wg0 -j ACCEPT
|
||||
iptables -A OUTPUT -o wg0 -j ACCEPT
|
||||
iptables -A INPUT -i awg0 -j ACCEPT
|
||||
iptables -A FORWARD -i awg0 -j ACCEPT
|
||||
iptables -A OUTPUT -o awg0 -j ACCEPT
|
||||
|
||||
# Allow forwarding traffic only from the VPN.
|
||||
iptables -A FORWARD -i wg0 -o eth0 -s $AWG_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -j ACCEPT
|
||||
iptables -A FORWARD -i wg0 -o eth1 -s $AWG_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -j ACCEPT
|
||||
iptables -A FORWARD -i awg0 -o eth0 -s $AWG_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -j ACCEPT
|
||||
iptables -A FORWARD -i awg0 -o eth1 -s $AWG_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -j ACCEPT
|
||||
|
||||
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
|
|
|
@ -370,8 +370,17 @@ ErrorCode InstallController::getAlreadyInstalledContainers(const ServerCredentia
|
|||
containerConfig.insert(config_key::transport_proto, transportProto);
|
||||
|
||||
if (protocol == Proto::Awg) {
|
||||
QString serverConfigPath;
|
||||
if (container == DockerContainer::Awg) {
|
||||
if (serverController->isNewAwgContainer(credentials)) {
|
||||
serverConfigPath = amnezia::protocols::awg::serverConfigPath;
|
||||
} else {
|
||||
serverConfigPath = "/opt/amnezia/awg/wg0.conf";
|
||||
}
|
||||
}
|
||||
|
||||
QString serverConfig = serverController->getTextFileFromContainer(container, credentials,
|
||||
protocols::awg::serverConfigPath, errorCode);
|
||||
serverConfigPath, errorCode);
|
||||
|
||||
QMap<QString, QString> serverConfigMap;
|
||||
auto serverConfigLines = serverConfig.split("\n");
|
||||
|
|
|
@ -209,7 +209,8 @@ ErrorCode ClientManagementModel::getWireGuardClients(const DockerContainer conta
|
|||
{
|
||||
ErrorCode error = ErrorCode::NoError;
|
||||
|
||||
const QString wireGuardConfigFile = QString("opt/amnezia/%1/wg0.conf").arg(container == DockerContainer::WireGuard ? "wireguard" : "awg");
|
||||
const QString wireGuardConfigFile =
|
||||
DockerContainer::WireGuard ? amnezia::protocols::wireguard::serverConfigPath : amnezia::protocols::awg::serverConfigPath;
|
||||
const QString wireguardConfigString = serverController->getTextFileFromContainer(container, credentials, wireGuardConfigFile, error);
|
||||
if (error != ErrorCode::NoError) {
|
||||
logger.error() << "Failed to get the wg conf file from the server";
|
||||
|
@ -736,8 +737,17 @@ ErrorCode ClientManagementModel::revokeWireGuard(const int row, const DockerCont
|
|||
{
|
||||
ErrorCode error = ErrorCode::NoError;
|
||||
|
||||
const QString wireGuardConfigFile =
|
||||
QString("/opt/amnezia/%1/wg0.conf").arg(container == DockerContainer::WireGuard ? "wireguard" : "awg");
|
||||
QString wireGuardConfigFile;
|
||||
if (container == DockerContainer::Awg) {
|
||||
if (serverController->isNewAwgContainer(credentials)) {
|
||||
wireGuardConfigFile = amnezia::protocols::awg::serverConfigPath;
|
||||
} else {
|
||||
wireGuardConfigFile = "/opt/amnezia/awg/wg0.conf";
|
||||
}
|
||||
} else {
|
||||
wireGuardConfigFile = amnezia::protocols::wireguard::serverConfigPath;
|
||||
}
|
||||
|
||||
const QString wireguardConfigString = serverController->getTextFileFromContainer(container, credentials, wireGuardConfigFile, error);
|
||||
if (error != ErrorCode::NoError) {
|
||||
logger.error() << "Failed to get the wg conf file from the server";
|
||||
|
@ -780,7 +790,11 @@ ErrorCode ClientManagementModel::revokeWireGuard(const int row, const DockerCont
|
|||
return error;
|
||||
}
|
||||
|
||||
const QString script = "sudo docker exec -i $CONTAINER_NAME bash -c 'wg syncconf wg0 <(wg-quick strip %1)'";
|
||||
QString interfaceName = DockerContainer::WireGuard ? protocols::wireguard::interfaceName : protocols::awg::interfaceName;
|
||||
QString wgBinaryName = DockerContainer::WireGuard ? protocols::wireguard::wgBinaryName : protocols::awg::wgBinaryName;
|
||||
QString wgQuickBinaryName = DockerContainer::WireGuard ? protocols::wireguard::wgQuickBinaryName : protocols::awg::wgQuickBinaryName;
|
||||
QString script = QString("sudo docker exec -i $CONTAINER_NAME bash -c '%4 syncconf %2 <(%3 strip %1)'")
|
||||
.arg(wireGuardConfigFile, interfaceName, wgQuickBinaryName, wgBinaryName);
|
||||
error = serverController->runScript(
|
||||
credentials,
|
||||
serverController->replaceVars(script.arg(wireGuardConfigFile), serverController->genVarsForScript(credentials, container)));
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue