133 lines
5.6 KiB
Bash
Executable File
133 lines
5.6 KiB
Bash
Executable File
#!/bin/bash
|
|
# FILE: dashboard/peer/add
|
|
# DESCRIPTION: Add a new peer from user dashboard
|
|
# USAGE: add $remote_ip $querystring
|
|
# QUERYSTRING: ?t=$token&name=$hostname
|
|
|
|
source /etc/wagon/config
|
|
ip="${1}"; qs="$(<<<"${2}" tr '&' '\n' | sed 's/?//')"
|
|
|
|
# Check hostname
|
|
hostname="$(<<<"${qs}" grep -oP 'name=(.*)' | sed 's/^name//' | xargs | tr -dc 'a-z0-9' | head -c10)"
|
|
printf '%s requested new peer with hostname %s\n' "${ip}" "${hostname}" >&2
|
|
if ! [[ ${#hostname} -ge 3 ]]; then
|
|
printf 'Rejecting hostname %s because it is too short.\n' "${hostname}" >&2
|
|
printf 'Hostname too short\n' | /usr/lib/wagon/http_res 400; exit
|
|
fi
|
|
|
|
# Check token
|
|
token_fail(){
|
|
printf 'Rejecting %s request for new peer due to %s token\n' "${ip}" "${1}" >&2
|
|
printf 'Invalid token\n' | /usr/lib/wagon/http_res 403; exit
|
|
}
|
|
saved_token="$(grep "${ip}" /var/local/wagon/tokens | cut -f2)"
|
|
[ "${saved_token}" == "" ] && token_fail 'missing'
|
|
<<<"${qs}" grep -qx "t=${saved_token}" || token_fail 'mismatched'
|
|
printf '%s token was valid\n' "${ip}" >&2
|
|
|
|
# Check user
|
|
username="$(/usr/lib/wagon/ns_lookup_rdns "${ip}" | cut -d'.' -f2)" || (
|
|
printf 'User domains not found for %s\n' "${ip}" >&2
|
|
/usr/lib/wagon/http_res 500; exit
|
|
)
|
|
printf '%s identified as %s\n' "${ip}" "${username}" >&2
|
|
domain="${hostname}.${username}.${TLD}"
|
|
|
|
# Check if new peer already exists
|
|
if /usr/lib/wagon/ns_lookup_send "${domain}" >/dev/null; then
|
|
printf '%s.%s.%s already exists!\n' "${hostname}" "${username}" "${TLD}" >&2
|
|
printf 'Hostname %s already exists!\n' "${hostname}" | /usr/lib/wagon/http_res 409; exit
|
|
fi
|
|
|
|
# Create new domain
|
|
domain="${hostname:?}.${username:?}.${TLD:?}"
|
|
printf 'New domain will be %s\n' "${domain}" >&2
|
|
|
|
# Get peer IP list
|
|
if ! wg_output="$(sudo /usr/bin/wg show "${TLD}" allowed-ips)"; then
|
|
printf 'ERROR! Wireguard failed!\n' >&2
|
|
/usr/lib/wagon/http_res 500; exit
|
|
fi
|
|
|
|
# Filter out this user's
|
|
user_peers="$(grep "${ip%[.:]*}" <<<"${wg_output}" 2>/dev/null)"
|
|
if [ "${user_peers}" == "" ]; then
|
|
printf "ERROR! %s accessed the dashboard but isn't on the network!\n" "${ip}" >&2
|
|
/usr/lib/wagon/http_res 500; exit
|
|
fi
|
|
|
|
# Get domains
|
|
if ! peers="$(/usr/lib/wagon/ips_to_peers tsv <<<"${user_peers}")"; then
|
|
printf 'ERROR! Failed to parse peers for %s!\n' "${ip}" >&2
|
|
/usr/lib/wagon/http_res 500; exit
|
|
fi
|
|
|
|
# Make sure hostname isn't taken
|
|
hostnames="$(<<<"${peers}" awk '{print $1}' | cut -d'.' -f1)"
|
|
if <<<"${hostnames}" grep -x "${hostname}"; then
|
|
printf 'User %s already has a host named %s!\n' "${username}" "${hostname}" >&2
|
|
/usr/lib/wagon/http_res 500; exit
|
|
fi
|
|
|
|
# Create new IPs
|
|
ipv4s="$(<<<"${peers}" awk '{print $2}')"
|
|
#ipv6s="$(<<<"${peers}" awk '{print $3}')"
|
|
usernumber="$(<<<"${ipv4s}" head -n1 | cut -d'.' -f3)"
|
|
# Increment hostnumber from 1 until an unused one is found
|
|
used_hostnumbers="$(<<<"${ipv4s}" cut -d'.' -f4 | sort | uniq)"
|
|
hostnumber=1; while <<<"${used_hostnumbers}" grep -q "${hostnumber}"
|
|
do ((hostnumber++))
|
|
done
|
|
ipv4="${IPV4_NET%.*.*}.${usernumber}.${hostnumber}"
|
|
ipv6="${IPV6_NET%:*:*}:${usernumber}:${hostnumber}"
|
|
if ! printf 'IP addresses for %s created: %s %s\n' "${domain:?}" "${ipv4:?}" "${ipv6:?}" >&2; then
|
|
printf 'ERROR! Failed to create IP addresses for %s!' "${domain}" >&2
|
|
/usr/lib/wagon/http_res 500; exit
|
|
fi
|
|
|
|
# Create wg config
|
|
privkey="$(/usr/bin/wg genkey)"
|
|
pubkey="$(echo "${privkey}" | /usr/bin/wg pubkey)"
|
|
address="${ipv4}/${IPV4_NET##*/},${ipv6}/${IPV6_NET##*/}"
|
|
|
|
# Update nameserver
|
|
if /usr/lib/wagon/ns_update_add "${domain:?}" "${ipv4:?}" "${ipv6:?}"
|
|
then printf 'Successfully added %s to DNS server.\n' "${domain}" >&2
|
|
else printf 'ERROR! Failed to add %s %s %s to DNS server!\n' "${domain}" "${ipv4}" "${ipv6}" >&2
|
|
fi &
|
|
|
|
# Create SSL cert
|
|
if /usr/lib/wagon/ssl_peer_add "${hostname:?}" "${username:?}" "IP:${ipv4},IP:${ipv6}"
|
|
then printf 'Successfully signed SSL certs for %s\n' "${domain}" >&2
|
|
else printf 'ERROR! Failed to create certs for %s with IPS: %s %s!\n' "${domain}" "${ipv4}" "${ipv6}" >&2
|
|
fi
|
|
|
|
# Do the wireguard and tell the user
|
|
server_blocks=''
|
|
while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_endpoint server_url server_secret; do
|
|
[[ ${server_hostname:0:1} = \# ]] && continue
|
|
server_psk="$(/usr/bin/wg genpsk)"
|
|
# Local server
|
|
if [ "${server_hostname}" == "${LOCAL_SERVER}" ]; then
|
|
server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/${IPV4_NET#*/},${server_ipv6}/${IPV6_NET#*/}\nEndpoint=${server_endpoint}\n"
|
|
# Add new user to local wireguard
|
|
if /usr/lib/wagon/wg_peer_add "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128"; then
|
|
printf 'Added %s to local wireguard server.\n' "${domain}" >&2
|
|
else
|
|
printf 'ERROR! Failed to add %s to local wireguard server!\n' "${domain}" >&2
|
|
/usr/lib/wagon/http_res 500; exit
|
|
fi
|
|
# Remote server
|
|
else
|
|
server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/32,${server_ipv6}/128\nEndpoint=${server_endpoint}\n"
|
|
# Send new user config to federated server
|
|
if /usr/lib/wagon/fed_peer_add "${server_url}" "${server_secret}" "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128" "${server_secret}"; then
|
|
printf 'Sent %s to remote wireguard server %s.\n' "${domain}" "${server_hostname}" >&2
|
|
else
|
|
printf 'ERROR! Failed to send %s to remote wireguard server %s!\n' "${domain}" "${server_hostname}" >&2
|
|
fi
|
|
fi
|
|
done </etc/wagon/servers
|
|
wg_config="[Interface] # ${hostname}.${username}.${TLD}\nPrivateKey=${privkey:?}\nAddress=${address:?}\n${WG_DNS}\n${server_blocks:?}"
|
|
<<<"${wg_config}" /usr/lib/wagon/http_res 202
|