464 lines
16 KiB
Python
Executable File
464 lines
16 KiB
Python
Executable File
#!/usr/bin/python3
|
|
"""Apply the configuration to the running system.
|
|
|
|
Regenerates the configuration files first, then does everything that needs
|
|
the live system: routes, DNS-derived identity, WireGuard keys, firewall rules
|
|
and service reloads. Idempotent - a second run changes nothing.
|
|
|
|
Interface names come from the configuration and are never guessed. The
|
|
firewall and NAT rules are written against them, so choosing the wrong one
|
|
would be a silent and security-relevant mistake.
|
|
"""
|
|
|
|
import json
|
|
import os
|
|
import pathlib
|
|
import re
|
|
import socket
|
|
import subprocess
|
|
import sys
|
|
|
|
sys.path.insert(0, os.path.dirname(os.path.realpath(__file__)))
|
|
|
|
import ldap
|
|
|
|
import vpnrouter
|
|
import vpnrouter_ldap
|
|
from vpnrouter import fail
|
|
|
|
BEFORE_RULES = pathlib.Path('/etc/ufw/before.rules')
|
|
UFW_DEFAULTS = pathlib.Path('/etc/default/ufw')
|
|
WG_DIR = pathlib.Path('/etc/wireguard')
|
|
WEB_STATE = pathlib.Path('/run/vpn-router/web.json')
|
|
|
|
FILTER_ANCHOR = '# End required lines'
|
|
|
|
#: Configuration options left out wherever the configuration is shown.
|
|
SECRET_OPTION = re.compile(r'(^psk$)|secret|password|token|_key$')
|
|
|
|
BLOCKS = (
|
|
('# IPSEC RULES START', '# IPSEC RULES END'),
|
|
('# WIREGUARD RULES START', '# WIREGUARD RULES END'),
|
|
('# OPENVPN RULES START', '# OPENVPN RULES END'),
|
|
('# P2S DNS RULES START', '# P2S DNS RULES END'),
|
|
('# WEB RULES START', '# WEB RULES END'),
|
|
('# ROUTER FORWARD RULES START', '# ROUTER FORWARD RULES END'),
|
|
('# ROUTER NAT RULES START', '# ROUTER NAT RULES END'),
|
|
('# ROUTER MSS RULES START', '# ROUTER MSS RULES END'),
|
|
)
|
|
|
|
|
|
def run(args, check=True):
|
|
result = subprocess.run(args, capture_output=True, text=True)
|
|
if check and result.returncode != 0:
|
|
fail(f'{" ".join(args)} failed: {result.stderr.strip()}')
|
|
return result
|
|
|
|
|
|
def apply_routes(ctx):
|
|
"""Route the protected subnets via the configured internal interface.
|
|
|
|
validate() has already confirmed the interface exists.
|
|
"""
|
|
gateway = ctx['int_gateway_ip']
|
|
iface = ctx['int_iface']
|
|
for cidr in ctx['local_cidr_list']:
|
|
run(['ip', 'route', 'replace', cidr, 'via', gateway, 'dev', iface])
|
|
|
|
|
|
def resolve_public_ip(fqdn):
|
|
try:
|
|
return socket.getaddrinfo(fqdn, None, socket.AF_INET)[0][4][0]
|
|
except socket.gaierror as exc:
|
|
fail(f'cannot resolve {fqdn} for local_id_mode=public_ip: {exc}')
|
|
|
|
|
|
def setup_wireguard(ctx):
|
|
"""Generate the WireGuard key pair when it does not exist."""
|
|
if not ctx['wg_enabled']:
|
|
return
|
|
WG_DIR.mkdir(mode=0o700, parents=True, exist_ok=True)
|
|
key_file = WG_DIR / 'wg0.key'
|
|
pub_file = WG_DIR / 'wg0.pub'
|
|
|
|
if not key_file.exists() or key_file.stat().st_size == 0:
|
|
result = run(['wg', 'genkey'])
|
|
key_file.write_text(result.stdout)
|
|
os.chmod(key_file, 0o600)
|
|
|
|
result = subprocess.run(['wg', 'pubkey'], input=key_file.read_text(),
|
|
capture_output=True, text=True)
|
|
if result.returncode != 0:
|
|
fail(f'wg pubkey failed: {result.stderr.strip()}')
|
|
pub_file.write_text(result.stdout)
|
|
os.chmod(pub_file, 0o644)
|
|
|
|
|
|
def strip_blocks(text):
|
|
"""Remove every block this package owns, and the blank line before it."""
|
|
lines = text.splitlines(keepends=True)
|
|
starts = {start for start, _ in BLOCKS}
|
|
ends = {end for _, end in BLOCKS}
|
|
|
|
out = []
|
|
skipping = False
|
|
for line in lines:
|
|
stripped = line.strip()
|
|
if not skipping and stripped in starts:
|
|
while out and out[-1].strip() == '':
|
|
out.pop()
|
|
skipping = True
|
|
continue
|
|
if skipping:
|
|
if stripped in ends:
|
|
skipping = False
|
|
continue
|
|
out.append(line)
|
|
return ''.join(out)
|
|
|
|
|
|
def is_configured(ctx):
|
|
"""True once any feature is actually configured.
|
|
|
|
While nothing is configured the package leaves the firewall alone: an
|
|
install that has not been filled in yet must not start blocking traffic on
|
|
a host that was working before.
|
|
"""
|
|
return any((vpnrouter.s2s_ready(ctx), vpnrouter.routing_ready(ctx),
|
|
vpnrouter.p2s_ready(ctx), vpnrouter.wg_ready(ctx),
|
|
vpnrouter.openvpn_ready(ctx)))
|
|
|
|
|
|
def filter_block(ctx):
|
|
lines = [
|
|
'',
|
|
'# IPSEC RULES START',
|
|
'-A ufw-before-input -p udp --dport 500 -j ACCEPT',
|
|
'-A ufw-before-input -p udp --dport 4500 -j ACCEPT',
|
|
'-A ufw-before-input -p esp -j ACCEPT',
|
|
'-A ufw-before-input -m policy --dir in --pol ipsec -j ACCEPT',
|
|
'-A ufw-before-output -m policy --dir out --pol ipsec -j ACCEPT',
|
|
'-A ufw-before-forward -m policy --dir in --pol ipsec -j ACCEPT',
|
|
'-A ufw-before-forward -m policy --dir out --pol ipsec -j ACCEPT',
|
|
'# IPSEC RULES END',
|
|
]
|
|
|
|
if vpnrouter.wg_ready(ctx):
|
|
lines += [
|
|
'',
|
|
'# WIREGUARD RULES START',
|
|
f'-A ufw-before-input -p udp --dport {ctx["wg_listen_port"]} -j ACCEPT',
|
|
'# WIREGUARD RULES END',
|
|
]
|
|
|
|
if vpnrouter.openvpn_ready(ctx):
|
|
device = ctx['openvpn_device']
|
|
lines += [
|
|
'',
|
|
'# OPENVPN RULES START',
|
|
f'-A ufw-before-input -i {ctx["wan_iface"]} -p {ctx["openvpn_protocol"]} --dport {ctx["openvpn_port"]} -j ACCEPT',
|
|
]
|
|
for subnet in ctx['local_cidr_list']:
|
|
lines += [
|
|
f'-A ufw-before-forward -i {device} -d {subnet} -j ACCEPT',
|
|
f'-A ufw-before-forward -o {device} -s {subnet} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT',
|
|
]
|
|
lines += ['# OPENVPN RULES END']
|
|
|
|
pools = [pool for ready, pool in ((vpnrouter.p2s_ready(ctx), ctx['p2s_address_pool']),
|
|
(vpnrouter.openvpn_ready(ctx), ctx['openvpn_pool'])) if ready]
|
|
if pools and ctx['local_addr_list']:
|
|
lines += ['', '# P2S DNS RULES START']
|
|
for pool in pools:
|
|
for address in ctx['local_addr_list']:
|
|
lines += [
|
|
f'-A ufw-before-input -s {pool} -d {address} -p udp --dport 53 -j ACCEPT',
|
|
f'-A ufw-before-input -s {pool} -d {address} -p tcp --dport 53 -j ACCEPT',
|
|
]
|
|
lines += ['# P2S DNS RULES END']
|
|
|
|
if ctx['web_enabled'] and ctx['int_iface']:
|
|
lines += [
|
|
'',
|
|
'# WEB RULES START',
|
|
f'-A ufw-before-input -i {ctx["int_iface"]} -p tcp --dport {ctx["web_port"]} -j ACCEPT',
|
|
'# WEB RULES END',
|
|
]
|
|
|
|
if vpnrouter.routing_ready(ctx):
|
|
lines += ['', '# ROUTER FORWARD RULES START']
|
|
for subnet in ctx['local_cidr_list']:
|
|
lines += [
|
|
f'-A ufw-before-forward -s {subnet} -o {ctx["wan_iface"]} -j ACCEPT',
|
|
f'-A ufw-before-forward -d {subnet} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT',
|
|
]
|
|
lines += ['# ROUTER FORWARD RULES END']
|
|
|
|
return ''.join(line + '\n' for line in lines)
|
|
|
|
|
|
def nat_and_mangle_block(ctx):
|
|
lines = []
|
|
|
|
if vpnrouter.routing_ready(ctx):
|
|
subnets = ctx['local_cidr_list']
|
|
remote = ctx['remote_cidr_list']
|
|
lines += [
|
|
'',
|
|
'# ROUTER NAT RULES START',
|
|
'*nat',
|
|
':POSTROUTING ACCEPT [0:0]',
|
|
'-F POSTROUTING',
|
|
]
|
|
# Every RETURN precedes every MASQUERADE, so tunnel-bound traffic
|
|
# escapes NAT whichever local subnet it came from.
|
|
for subnet in subnets:
|
|
for cidr in remote:
|
|
lines.append(f'-A POSTROUTING -s {subnet} -d {cidr} -j RETURN')
|
|
for subnet in subnets:
|
|
lines.append(
|
|
f'-A POSTROUTING -s {subnet} -o {ctx["wan_iface"]} -j MASQUERADE')
|
|
lines += ['COMMIT', '# ROUTER NAT RULES END']
|
|
|
|
lines += [
|
|
'',
|
|
'# ROUTER MSS RULES START',
|
|
'*mangle',
|
|
':FORWARD ACCEPT [0:0]',
|
|
'-A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu',
|
|
'COMMIT',
|
|
'# ROUTER MSS RULES END',
|
|
]
|
|
|
|
return ''.join(line + '\n' for line in lines)
|
|
|
|
|
|
def _insert_after_line(text, marker, block):
|
|
lines = text.splitlines(keepends=True)
|
|
for index, line in enumerate(lines):
|
|
if line.strip() == marker:
|
|
lines.insert(index + 1, block)
|
|
return ''.join(lines)
|
|
return None
|
|
|
|
|
|
def setup_ufw(ctx):
|
|
"""Rewrite the package's blocks in before.rules. Returns True on change."""
|
|
if not BEFORE_RULES.is_file():
|
|
fail(f'{BEFORE_RULES} does not exist')
|
|
|
|
# Nothing configured: remove anything left from an earlier configuration
|
|
# and touch nothing else.
|
|
if not is_configured(ctx):
|
|
original = BEFORE_RULES.read_text(encoding='utf-8')
|
|
text = strip_blocks(original)
|
|
if text == original:
|
|
return False
|
|
BEFORE_RULES.write_text(text, encoding='utf-8')
|
|
return True
|
|
|
|
if UFW_DEFAULTS.is_file():
|
|
text = UFW_DEFAULTS.read_text(encoding='utf-8')
|
|
updated = ''.join(
|
|
'DEFAULT_FORWARD_POLICY="ACCEPT"\n'
|
|
if line.startswith('DEFAULT_FORWARD_POLICY=') else line
|
|
for line in text.splitlines(keepends=True)
|
|
)
|
|
if updated != text:
|
|
UFW_DEFAULTS.write_text(updated, encoding='utf-8')
|
|
|
|
original = BEFORE_RULES.read_text(encoding='utf-8')
|
|
text = strip_blocks(original)
|
|
|
|
result = _insert_after_line(text, FILTER_ANCHOR, filter_block(ctx))
|
|
if result is None:
|
|
fail(f'{BEFORE_RULES}: anchor "{FILTER_ANCHOR}" not found')
|
|
text = result
|
|
|
|
result = _insert_after_line(text, 'COMMIT', nat_and_mangle_block(ctx))
|
|
if result is None:
|
|
fail(f'{BEFORE_RULES}: no COMMIT line found')
|
|
text = result
|
|
|
|
if text == original:
|
|
return False
|
|
BEFORE_RULES.write_text(text, encoding='utf-8')
|
|
return True
|
|
|
|
|
|
def unit_is_active(unit):
|
|
return run(['systemctl', 'is-active', '--quiet', unit],
|
|
check=False).returncode == 0
|
|
|
|
|
|
def manage_strongswan(ctx, changed):
|
|
"""Make sure the IPsec daemon is running and holding the current config.
|
|
|
|
strongswan.service loads swanctl configuration itself on start
|
|
(ExecStartPost) and re-reads it on reload, so starting it is enough on a
|
|
cold boot and a reload is the right response to a configuration change.
|
|
"""
|
|
wanted = vpnrouter.s2s_ready(ctx) or vpnrouter.p2s_ready(ctx)
|
|
if not wanted:
|
|
return
|
|
|
|
if not unit_is_active('strongswan'):
|
|
run(['systemctl', 'enable', '--now', 'strongswan'], check=False)
|
|
elif 'swanctl' in changed:
|
|
run(['systemctl', 'reload', 'strongswan'], check=False)
|
|
|
|
|
|
def manage_wireguard(ctx, changed):
|
|
"""Bring wg0 up when WireGuard is configured, and down when it is not."""
|
|
unit = 'wg-quick@wg0'
|
|
|
|
if not vpnrouter.wg_ready(ctx):
|
|
if unit_is_active(unit):
|
|
run(['systemctl', 'disable', '--now', unit], check=False)
|
|
return
|
|
|
|
if not unit_is_active(unit):
|
|
run(['systemctl', 'enable', '--now', unit], check=False)
|
|
elif 'wireguard' in changed:
|
|
run(['systemctl', 'restart', unit], check=False)
|
|
|
|
|
|
def manage_directory(ctx):
|
|
"""Provision the user directory in slapd while a P2S system that has users is configured.
|
|
|
|
The directory is left in place when they are switched off, so the users are kept.
|
|
"""
|
|
if not (vpnrouter.p2s_ready(ctx) or vpnrouter.openvpn_ready(ctx)):
|
|
return
|
|
if vpnrouter_ldap.ensure_services() or not unit_is_active('slapd'):
|
|
run(['systemctl', 'restart', 'slapd'])
|
|
try:
|
|
vpnrouter_ldap.provision()
|
|
except ldap.LDAPError as exc:
|
|
fail(f'the user directory cannot be provisioned: {exc}')
|
|
|
|
|
|
def manage_openvpn(ctx, changed):
|
|
"""Run the OpenVPN server when it is configured, and stop it when it is not."""
|
|
unit = 'openvpn-server@vpn-router'
|
|
|
|
if not vpnrouter.openvpn_ready(ctx):
|
|
if unit_is_active(unit):
|
|
run(['systemctl', 'disable', '--now', unit], check=False)
|
|
return
|
|
|
|
if not unit_is_active(unit):
|
|
run(['systemctl', 'enable', '--now', unit], check=False)
|
|
elif 'openvpn' in changed or 'swanctl' in changed:
|
|
run(['systemctl', 'restart', unit], check=False)
|
|
|
|
|
|
def run_platform_setup(cfg, ctx):
|
|
"""Let the platform module apply its own state, if it defines any."""
|
|
module = vpnrouter.platform_module(cfg)
|
|
apply = getattr(module, 'apply', None)
|
|
if apply is None:
|
|
return
|
|
try:
|
|
apply(ctx)
|
|
except Exception as exc:
|
|
fail(f'platform module {module.__name__} failed: {exc}')
|
|
|
|
|
|
def refresh_docker_rules():
|
|
"""Apply the new settings to the Docker rules while Docker is running.
|
|
|
|
When Docker is not running, vpn-router-docker applies them after
|
|
docker.service starts. The restart is waited for, so the rules are in place
|
|
when this setup ends; vpn-router-docker is therefore not ordered after
|
|
vpn-router-setup.
|
|
"""
|
|
if unit_is_active('docker.service'):
|
|
run(['systemctl', 'restart', 'vpn-router-docker.service'], check=False)
|
|
|
|
|
|
def refresh_web(cfg, ctx):
|
|
"""Hand the web service the features and facts it shows.
|
|
|
|
The service reads the file at each request: the features of the router,
|
|
the configuration without its secret options and the facts resolved from
|
|
the system, which it cannot work out with the standard library alone. The
|
|
file is readable by root only. The service follows a changed address or
|
|
port itself.
|
|
"""
|
|
public = {
|
|
section: {option: value for option, value in options.items() if not SECRET_OPTION.search(option)}
|
|
for section, options in cfg.items()
|
|
}
|
|
WEB_STATE.parent.mkdir(parents=True, exist_ok=True)
|
|
WEB_STATE.touch(mode=0o600)
|
|
WEB_STATE.chmod(0o600)
|
|
WEB_STATE.write_text(json.dumps({
|
|
'site_to_site': bool(vpnrouter.s2s_ready(ctx)),
|
|
'p2s': bool(vpnrouter.p2s_ready(ctx)),
|
|
'wireguard': bool(vpnrouter.wg_ready(ctx)),
|
|
'openvpn': bool(vpnrouter.openvpn_ready(ctx)),
|
|
'users': bool(vpnrouter.p2s_ready(ctx) or vpnrouter.openvpn_ready(ctx)),
|
|
'configuration': public,
|
|
'network': {
|
|
'external_interface': ctx['wan_iface'],
|
|
'internal_interface': ctx['int_iface'],
|
|
'external_addresses': ctx['local_addr_list'],
|
|
'internal_address': ctx['int_addr'],
|
|
'internal_gateway': ctx['int_gateway_ip'],
|
|
'local_identity': ctx['local_id'],
|
|
'remote_identity': ctx['remote_id'],
|
|
'local_cidrs': ctx['local_cidr_list'],
|
|
'remote_cidrs': ctx['remote_cidr_list'],
|
|
},
|
|
}) + '\n', encoding='utf-8')
|
|
|
|
|
|
def main():
|
|
cfg = vpnrouter.load_config()
|
|
ctx, changed = vpnrouter.configure(cfg)
|
|
|
|
if ctx is None:
|
|
print('vpn-router: platform is none, configuration deferred; '
|
|
f'set general.platform in {vpnrouter.CONFIG_FILE}')
|
|
return 0
|
|
|
|
if vpnrouter.routing_ready(ctx):
|
|
apply_routes(ctx)
|
|
|
|
if ctx['local_id_mode'] == 'public_ip' and ctx['local_fqdn']:
|
|
address = resolve_public_ip(ctx['local_fqdn'])
|
|
ctx, more = vpnrouter.configure(cfg, local_id_override=address)
|
|
changed |= more
|
|
|
|
setup_wireguard(ctx)
|
|
|
|
rules_changed = setup_ufw(ctx)
|
|
if is_configured(ctx):
|
|
status = run(['ufw', 'status'], check=False)
|
|
if not status.stdout.startswith('Status: active'):
|
|
# Only ever enable the firewall after making sure SSH survives it.
|
|
run(['ufw', 'allow', '22/tcp'], check=False)
|
|
run(['ufw', '--force', 'enable'])
|
|
elif rules_changed:
|
|
run(['ufw', 'reload'])
|
|
elif rules_changed:
|
|
run(['ufw', 'reload'], check=False)
|
|
|
|
manage_directory(ctx)
|
|
manage_strongswan(ctx, changed)
|
|
manage_wireguard(ctx, changed)
|
|
manage_openvpn(ctx, changed)
|
|
|
|
if 'resolved' in changed:
|
|
run(['systemctl', 'restart', 'systemd-resolved'], check=False)
|
|
|
|
run_platform_setup(cfg, ctx)
|
|
refresh_docker_rules()
|
|
refresh_web(cfg, ctx)
|
|
return 0
|
|
|
|
|
|
if __name__ == '__main__':
|
|
sys.exit(main())
|