wireguard.js 31 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874
  1. 'use strict';
  2. 'require fs';
  3. 'require ui';
  4. 'require dom';
  5. 'require uci';
  6. 'require rpc';
  7. 'require form';
  8. 'require network';
  9. 'require validation';
  10. var generateKey = rpc.declare({
  11. object: 'luci.wireguard',
  12. method: 'generateKeyPair',
  13. expect: { keys: {} }
  14. });
  15. var getPublicAndPrivateKeyFromPrivate = rpc.declare({
  16. object: 'luci.wireguard',
  17. method: 'getPublicAndPrivateKeyFromPrivate',
  18. params: ['privkey'],
  19. expect: { keys: {} }
  20. });
  21. var generatePsk = rpc.declare({
  22. object: 'luci.wireguard',
  23. method: 'generatePsk',
  24. expect: { psk: '' }
  25. });
  26. var qrIcon = '<svg viewBox="0 0 29 29" xmlns="http://www.w3.org/2000/svg"><path fill="#fff" d="M0 0h29v29H0z"/><path d="M4 4h1v1H4zM5 4h1v1H5zM6 4h1v1H6zM7 4h1v1H7zM8 4h1v1H8zM9 4h1v1H9zM10 4h1v1h-1zM12 4h1v1h-1zM13 4h1v1h-1zM14 4h1v1h-1zM15 4h1v1h-1zM16 4h1v1h-1zM18 4h1v1h-1zM19 4h1v1h-1zM20 4h1v1h-1zM21 4h1v1h-1zM22 4h1v1h-1zM23 4h1v1h-1zM24 4h1v1h-1zM4 5h1v1H4zM10 5h1v1h-1zM12 5h1v1h-1zM14 5h1v1h-1zM16 5h1v1h-1zM18 5h1v1h-1zM24 5h1v1h-1zM4 6h1v1H4zM6 6h1v1H6zM7 6h1v1H7zM8 6h1v1H8zM10 6h1v1h-1zM12 6h1v1h-1zM18 6h1v1h-1zM20 6h1v1h-1zM21 6h1v1h-1zM22 6h1v1h-1zM24 6h1v1h-1zM4 7h1v1H4zM6 7h1v1H6zM7 7h1v1H7zM8 7h1v1H8zM10 7h1v1h-1zM12 7h1v1h-1zM13 7h1v1h-1zM14 7h1v1h-1zM15 7h1v1h-1zM18 7h1v1h-1zM20 7h1v1h-1zM21 7h1v1h-1zM22 7h1v1h-1zM24 7h1v1h-1zM4 8h1v1H4zM6 8h1v1H6zM7 8h1v1H7zM8 8h1v1H8zM10 8h1v1h-1zM16 8h1v1h-1zM18 8h1v1h-1zM20 8h1v1h-1zM21 8h1v1h-1zM22 8h1v1h-1zM24 8h1v1h-1zM4 9h1v1H4zM10 9h1v1h-1zM12 9h1v1h-1zM13 9h1v1h-1zM15 9h1v1h-1zM18 9h1v1h-1zM24 9h1v1h-1zM4 10h1v1H4zM5 10h1v1H5zM6 10h1v1H6zM7 10h1v1H7zM8 10h1v1H8zM9 10h1v1H9zM10 10h1v1h-1zM12 10h1v1h-1zM14 10h1v1h-1zM16 10h1v1h-1zM18 10h1v1h-1zM19 10h1v1h-1zM20 10h1v1h-1zM21 10h1v1h-1zM22 10h1v1h-1zM23 10h1v1h-1zM24 10h1v1h-1zM13 11h1v1h-1zM14 11h1v1h-1zM15 11h1v1h-1zM16 11h1v1h-1zM4 12h1v1H4zM5 12h1v1H5zM8 12h1v1H8zM9 12h1v1H9zM10 12h1v1h-1zM13 12h1v1h-1zM15 12h1v1h-1zM19 12h1v1h-1zM21 12h1v1h-1zM22 12h1v1h-1zM23 12h1v1h-1zM24 12h1v1h-1zM5 13h1v1H5zM6 13h1v1H6zM8 13h1v1H8zM11 13h1v1h-1zM13 13h1v1h-1zM14 13h1v1h-1zM15 13h1v1h-1zM16 13h1v1h-1zM19 13h1v1h-1zM22 13h1v1h-1zM4 14h1v1H4zM5 14h1v1H5zM9 14h1v1H9zM10 14h1v1h-1zM11 14h1v1h-1zM15 14h1v1h-1zM18 14h1v1h-1zM19 14h1v1h-1zM20 14h1v1h-1zM21 14h1v1h-1zM22 14h1v1h-1zM23 14h1v1h-1zM7 15h1v1H7zM8 15h1v1H8zM9 15h1v1H9zM11 15h1v1h-1zM12 15h1v1h-1zM13 15h1v1h-1zM17 15h1v1h-1zM18 15h1v1h-1zM20 15h1v1h-1zM21 15h1v1h-1zM23 15h1v1h-1zM4 16h1v1H4zM6 16h1v1H6zM10 16h1v1h-1zM11 16h1v1h-1zM13 16h1v1h-1zM14 16h1v1h-1zM16 16h1v1h-1zM17 16h1v1h-1zM18 16h1v1h-1zM22 16h1v1h-1zM23 16h1v1h-1zM24 16h1v1h-1zM12 17h1v1h-1zM16 17h1v1h-1zM17 17h1v1h-1zM18 17h1v1h-1zM4 18h1v1H4zM5 18h1v1H5zM6 18h1v1H6zM7 18h1v1H7zM8 18h1v1H8zM9 18h1v1H9zM10 18h1v1h-1zM14 18h1v1h-1zM16 18h1v1h-1zM17 18h1v1h-1zM21 18h1v1h-1zM22 18h1v1h-1zM23 18h1v1h-1zM4 19h1v1H4zM10 19h1v1h-1zM12 19h1v1h-1zM13 19h1v1h-1zM15 19h1v1h-1zM16 19h1v1h-1zM19 19h1v1h-1zM21 19h1v1h-1zM23 19h1v1h-1zM24 19h1v1h-1zM4 20h1v1H4zM6 20h1v1H6zM7 20h1v1H7zM8 20h1v1H8zM10 20h1v1h-1zM12 20h1v1h-1zM13 20h1v1h-1zM15 20h1v1h-1zM18 20h1v1h-1zM19 20h1v1h-1zM20 20h1v1h-1zM22 20h1v1h-1zM23 20h1v1h-1zM24 20h1v1h-1zM4 21h1v1H4zM6 21h1v1H6zM7 21h1v1H7zM8 21h1v1H8zM10 21h1v1h-1zM13 21h1v1h-1zM15 21h1v1h-1zM16 21h1v1h-1zM19 21h1v1h-1zM21 21h1v1h-1zM23 21h1v1h-1zM24 21h1v1h-1zM4 22h1v1H4zM6 22h1v1H6zM7 22h1v1H7zM8 22h1v1H8zM10 22h1v1h-1zM13 22h1v1h-1zM15 22h1v1h-1zM18 22h1v1h-1zM19 22h1v1h-1zM20 22h1v1h-1zM21 22h1v1h-1zM22 22h1v1h-1zM4 23h1v1H4zM10 23h1v1h-1zM12 23h1v1h-1zM13 23h1v1h-1zM14 23h1v1h-1zM17 23h1v1h-1zM18 23h1v1h-1zM20 23h1v1h-1zM22 23h1v1h-1zM4 24h1v1H4zM5 24h1v1H5zM6 24h1v1H6zM7 24h1v1H7zM8 24h1v1H8zM9 24h1v1H9zM10 24h1v1h-1zM12 24h1v1h-1zM13 24h1v1h-1zM14 24h1v1h-1zM16 24h1v1h-1zM17 24h1v1h-1zM18 24h1v1h-1zM22 24h1v1h-1zM24 24h1v1h-1z"/></svg>';
  27. function validateBase64(section_id, value) {
  28. if (value.length == 0)
  29. return true;
  30. if (value.length != 44 || !value.match(/^(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?$/))
  31. return _('Invalid Base64 key string');
  32. if (value[43] != "=" )
  33. return _('Invalid Base64 key string');
  34. return true;
  35. }
  36. var stubValidator = {
  37. factory: validation,
  38. apply: function(type, value, args) {
  39. if (value != null)
  40. this.value = value;
  41. return validation.types[type].apply(this, args);
  42. },
  43. assert: function(condition) {
  44. return !!condition;
  45. }
  46. };
  47. function generateDescription(name, texts) {
  48. return E('li', { 'style': 'color: inherit;' }, [
  49. E('span', name),
  50. E('ul', texts.map(function (text) {
  51. return E('li', { 'style': 'color: inherit;' }, text);
  52. }))
  53. ]);
  54. }
  55. function invokeQREncode(data, code) {
  56. return fs.exec_direct('/usr/bin/qrencode', [
  57. '--inline', '--8bit', '--type=SVG',
  58. '--output=-', '--', data
  59. ]).then(function(svg) {
  60. code.style.opacity = '';
  61. dom.content(code, Object.assign(E(svg), { style: 'width:100%;height:auto' }));
  62. }).catch(function(error) {
  63. code.style.opacity = '';
  64. if (L.isObject(error) && error.name == 'NotFoundError') {
  65. dom.content(code, [
  66. Object.assign(E(qrIcon), { style: 'width:32px;height:32px;opacity:.2' }),
  67. E('p', _('The <em>qrencode</em> package is required for generating an QR code image of the configuration.'))
  68. ]);
  69. }
  70. else {
  71. dom.content(code, [
  72. _('Unable to generate QR code: %s').format(L.isObject(error) ? error.message : error)
  73. ]);
  74. }
  75. });
  76. }
  77. var cbiKeyPairGenerate = form.DummyValue.extend({
  78. cfgvalue: function(section_id, value) {
  79. return E('button', {
  80. 'class': 'btn',
  81. 'click': ui.createHandlerFn(this, function(section_id, ev) {
  82. var prv = this.section.getUIElement(section_id, 'private_key'),
  83. pub = this.section.getUIElement(section_id, 'public_key'),
  84. map = this.map;
  85. if ((prv.getValue() || pub.getValue()) && !confirm(_('Do you want to replace the current keys?')))
  86. return;
  87. return generateKey().then(function(keypair) {
  88. prv.setValue(keypair.priv);
  89. pub.setValue(keypair.pub);
  90. map.save(null, true);
  91. });
  92. }, section_id)
  93. }, [ _('Generate new key pair') ]);
  94. }
  95. });
  96. function handleWindowDragDropIgnore(ev) {
  97. ev.preventDefault()
  98. }
  99. return network.registerProtocol('wireguard', {
  100. getI18n: function() {
  101. return _('WireGuard VPN');
  102. },
  103. getIfname: function() {
  104. return this._ubus('l3_device') || this.sid;
  105. },
  106. getOpkgPackage: function() {
  107. return 'wireguard-tools';
  108. },
  109. isFloating: function() {
  110. return true;
  111. },
  112. isVirtual: function() {
  113. return true;
  114. },
  115. getDevices: function() {
  116. return null;
  117. },
  118. containsDevice: function(ifname) {
  119. return (network.getIfnameOf(ifname) == this.getIfname());
  120. },
  121. renderFormOptions: function(s) {
  122. var o, ss, ss2;
  123. // -- general ---------------------------------------------------------------------
  124. o = s.taboption('general', form.Value, 'private_key', _('Private Key'), _('Required. Base64-encoded private key for this interface.'));
  125. o.password = true;
  126. o.validate = validateBase64;
  127. o.rmempty = false;
  128. var serverName = this.getIfname();
  129. o = s.taboption('general', form.Value, 'public_key', _('Public Key'), _('Base64-encoded public key of this interface for sharing.'));
  130. o.rmempty = false;
  131. o.write = function() {/* write nothing */};
  132. o.load = function(section_id) {
  133. var privKey = s.formvalue(section_id, 'private_key') || uci.get('network', section_id, 'private_key');
  134. return getPublicAndPrivateKeyFromPrivate(privKey).then(
  135. function(keypair) {
  136. return keypair.pub || '';
  137. },
  138. function(error) {
  139. return _('Error getting PublicKey');
  140. }, this)
  141. };
  142. s.taboption('general', cbiKeyPairGenerate, '_gen_server_keypair', ' ');
  143. o = s.taboption('general', form.Value, 'listen_port', _('Listen Port'), _('Optional. UDP port used for outgoing and incoming packets.'));
  144. o.datatype = 'port';
  145. o.placeholder = _('random');
  146. o.optional = true;
  147. o = s.taboption('general', form.DynamicList, 'addresses', _('IP Addresses'), _('Recommended. IP addresses of the WireGuard interface.'));
  148. o.datatype = 'ipaddr';
  149. o.optional = true;
  150. o = s.taboption('general', form.Flag, 'nohostroute', _('No Host Routes'), _('Optional. Do not create host routes to peers.'));
  151. o.optional = true;
  152. o = s.taboption('general', form.Button, '_import', _('Import configuration'), _('Imports settings from an existing WireGuard configuration file'));
  153. o.inputtitle = _('Load configuration…');
  154. o.onclick = function() {
  155. return ss.handleConfigImport('full');
  156. };
  157. // -- advanced --------------------------------------------------------------------
  158. o = s.taboption('advanced', form.Value, 'mtu', _('MTU'), _('Optional. Maximum Transmission Unit of tunnel interface.'));
  159. o.datatype = 'range(0,8940)';
  160. o.placeholder = '1420';
  161. o.optional = true;
  162. o = s.taboption('advanced', form.Value, 'fwmark', _('Firewall Mark'), _('Optional. 32-bit mark for outgoing encrypted packets. Enter value in hex, starting with <code>0x</code>.'));
  163. o.optional = true;
  164. o.validate = function(section_id, value) {
  165. if (value.length > 0 && !value.match(/^0x[a-fA-F0-9]{1,8}$/))
  166. return _('Invalid hexadecimal value');
  167. return true;
  168. };
  169. // -- peers -----------------------------------------------------------------------
  170. try {
  171. s.tab('peers', _('Peers'), _('Further information about WireGuard interfaces and peers at <a href=\'http://wireguard.com\'>wireguard.com</a>.'));
  172. }
  173. catch(e) {}
  174. o = s.taboption('peers', form.SectionValue, '_peers', form.GridSection, 'wireguard_%s'.format(s.section));
  175. o.depends('proto', 'wireguard');
  176. ss = o.subsection;
  177. ss.anonymous = true;
  178. ss.addremove = true;
  179. ss.addbtntitle = _('Add peer');
  180. ss.nodescriptions = true;
  181. ss.modaltitle = _('Edit peer');
  182. ss.handleDragConfig = function(ev) {
  183. ev.stopPropagation();
  184. ev.preventDefault();
  185. ev.dataTransfer.dropEffect = 'copy';
  186. };
  187. ss.handleDropConfig = function(mode, ev) {
  188. var file = ev.dataTransfer.files[0],
  189. nodes = ev.currentTarget,
  190. input = nodes.querySelector('textarea'),
  191. reader = new FileReader();
  192. if (file) {
  193. reader.onload = function(rev) {
  194. input.value = rev.target.result.trim();
  195. ss.handleApplyConfig(mode, nodes, file.name, ev);
  196. };
  197. reader.readAsText(file);
  198. }
  199. ev.stopPropagation();
  200. ev.preventDefault();
  201. };
  202. ss.parseConfig = function(data) {
  203. var lines = String(data).split(/(\r?\n)+/),
  204. section = null,
  205. config = { peers: [] },
  206. s;
  207. for (var i = 0; i < lines.length; i++) {
  208. var line = lines[i].replace(/#.*$/, '').trim();
  209. if (line.match(/^\[(\w+)\]$/)) {
  210. section = RegExp.$1.toLowerCase();
  211. if (section == 'peer')
  212. config.peers.push(s = {});
  213. else
  214. s = config;
  215. }
  216. else if (section && line.match(/^(\w+)\s*=\s*(.+)$/)) {
  217. var key = RegExp.$1,
  218. val = RegExp.$2.trim();
  219. if (val.length)
  220. s[section + '_' + key.toLowerCase()] = val;
  221. }
  222. }
  223. if (config.interface_address) {
  224. config.interface_address = config.interface_address.split(/[, ]+/);
  225. for (var i = 0; i < config.interface_address.length; i++)
  226. if (!stubValidator.apply('ipaddr', config.interface_address[i]))
  227. return _('Address setting is invalid');
  228. }
  229. if (config.interface_dns) {
  230. config.interface_dns = config.interface_dns.split(/[, ]+/);
  231. for (var i = 0; i < config.interface_dns.length; i++)
  232. if (!stubValidator.apply('ipaddr', config.interface_dns[i], ['nomask']))
  233. return _('DNS setting is invalid');
  234. }
  235. if (!config.interface_privatekey || validateBase64(null, config.interface_privatekey) !== true)
  236. return _('PrivateKey setting is missing or invalid');
  237. if (!stubValidator.apply('port', config.interface_listenport || '0'))
  238. return _('ListenPort setting is invalid');
  239. for (var i = 0; i < config.peers.length; i++) {
  240. var pconf = config.peers[i];
  241. if (pconf.peer_publickey != null && validateBase64(null, pconf.peer_publickey) !== true)
  242. return _('PublicKey setting is invalid');
  243. if (pconf.peer_presharedkey != null && validateBase64(null, pconf.peer_presharedkey) !== true)
  244. return _('PresharedKey setting is invalid');
  245. if (pconf.peer_allowedips) {
  246. pconf.peer_allowedips = pconf.peer_allowedips.split(/[, ]+/);
  247. for (var j = 0; j < pconf.peer_allowedips.length; j++)
  248. if (!stubValidator.apply('ipaddr', pconf.peer_allowedips[j]))
  249. return _('AllowedIPs setting is invalid');
  250. }
  251. else {
  252. pconf.peer_allowedips = [ '0.0.0.0/0', '::/0' ];
  253. }
  254. if (pconf.peer_endpoint) {
  255. var host_port = pconf.peer_endpoint.match(/^\[([a-fA-F0-9:]+)\]:(\d+)$/) || pconf.peer_endpoint.match(/^(.+):(\d+)$/);
  256. if (!host_port || !stubValidator.apply('host', host_port[1]) || !stubValidator.apply('port', host_port[2]))
  257. return _('Endpoint setting is invalid');
  258. pconf.peer_endpoint = [ host_port[1], host_port[2] ];
  259. }
  260. if (pconf.peer_persistentkeepalive == 'off' || pconf.peer_persistentkeepalive == '0')
  261. delete pconf.peer_persistentkeepalive;
  262. if (!stubValidator.apply('port', pconf.peer_persistentkeepalive || '0'))
  263. return _('PersistentKeepAlive setting is invalid');
  264. }
  265. return config;
  266. };
  267. ss.handleApplyConfig = function(mode, nodes, comment, ev) {
  268. var input = nodes.querySelector('textarea').value,
  269. error = nodes.querySelector('.alert-message'),
  270. cancel = nodes.nextElementSibling.querySelector('.btn'),
  271. config = this.parseConfig(input);
  272. if (typeof(config) == 'string') {
  273. error.firstChild.data = _('Cannot parse configuration: %s').format(config);
  274. error.style.display = 'block';
  275. return;
  276. }
  277. if (mode == 'full') {
  278. var prv = s.formvalue(s.section, 'private_key');
  279. if (prv && prv != config.interface_privatekey && !confirm(_('Overwrite the current settings with the imported configuration?')))
  280. return;
  281. return getPublicAndPrivateKeyFromPrivate(config.interface_privatekey).then(function(keypair) {
  282. s.getOption('private_key').getUIElement(s.section).setValue(keypair.priv);
  283. s.getOption('public_key').getUIElement(s.section).setValue(keypair.pub);
  284. s.getOption('listen_port').getUIElement(s.section).setValue(config.interface_listenport || '');
  285. s.getOption('addresses').getUIElement(s.section).setValue(config.interface_address);
  286. if (config.interface_dns)
  287. s.getOption('dns').getUIElement(s.section).setValue(config.interface_dns);
  288. for (var i = 0; i < config.peers.length; i++) {
  289. var pconf = config.peers[i];
  290. var sid = uci.add('network', 'wireguard_' + s.section);
  291. uci.sections('network', 'wireguard_' + s.section, function(peer) {
  292. if (peer.public_key == pconf.peer_publickey)
  293. uci.remove('network', peer['.name']);
  294. });
  295. uci.set('network', sid, 'description', comment || _('Imported peer configuration'));
  296. uci.set('network', sid, 'public_key', pconf.peer_publickey);
  297. uci.set('network', sid, 'preshared_key', pconf.peer_presharedkey);
  298. uci.set('network', sid, 'allowed_ips', pconf.peer_allowedips);
  299. uci.set('network', sid, 'persistent_keepalive', pconf.peer_persistentkeepalive);
  300. if (pconf.peer_endpoint) {
  301. uci.set('network', sid, 'endpoint_host', pconf.peer_endpoint[0]);
  302. uci.set('network', sid, 'endpoint_port', pconf.peer_endpoint[1]);
  303. }
  304. }
  305. return s.map.save(null, true);
  306. }).then(function() {
  307. cancel.click();
  308. });
  309. }
  310. else {
  311. return getPublicAndPrivateKeyFromPrivate(config.interface_privatekey).then(function(keypair) {
  312. var sid = uci.add('network', 'wireguard_' + s.section);
  313. var pub = s.formvalue(s.section, 'public_key');
  314. uci.sections('network', 'wireguard_' + s.section, function(peer) {
  315. if (peer.public_key == keypair.pub)
  316. uci.remove('network', peer['.name']);
  317. });
  318. uci.set('network', sid, 'description', comment || _('Imported peer configuration'));
  319. uci.set('network', sid, 'public_key', keypair.pub);
  320. uci.set('network', sid, 'private_key', keypair.priv);
  321. for (var i = 0; i < config.peers.length; i++) {
  322. var pconf = config.peers[i];
  323. if (pconf.peer_publickey == pub) {
  324. uci.set('network', sid, 'preshared_key', pconf.peer_presharedkey);
  325. uci.set('network', sid, 'allowed_ips', pconf.peer_allowedips);
  326. uci.set('network', sid, 'persistent_keepalive', pconf.peer_persistentkeepalive);
  327. break;
  328. }
  329. }
  330. return s.map.save(null, true);
  331. }).then(function() {
  332. cancel.click();
  333. });
  334. }
  335. };
  336. ss.handleConfigImport = function(mode) {
  337. var mapNode = ss.getActiveModalMap(),
  338. headNode = mapNode.parentNode.querySelector('h4'),
  339. parent = this.map;
  340. var nodes = E('div', {
  341. 'dragover': this.handleDragConfig,
  342. 'drop': this.handleDropConfig.bind(this, mode)
  343. }, [
  344. E([], (mode == 'full') ? [
  345. E('p', _('Drag or paste a valid <em>*.conf</em> file below to configure the local WireGuard interface.'))
  346. ] : [
  347. E('p', _('Paste or drag a WireGuard configuration (commonly <em>wg0.conf</em>) from another system below to create a matching peer entry allowing that system to connect to the local WireGuard interface.')),
  348. E('p', _('To fully configure the local WireGuard interface from an existing (e.g. provider supplied) configuration file, use the <strong><a class="full-import" href="#">configuration import</a></strong> instead.'))
  349. ]),
  350. E('p', [
  351. E('textarea', {
  352. 'placeholder': (mode == 'full')
  353. ? _('Paste or drag supplied WireGuard configuration file…')
  354. : _('Paste or drag WireGuard peer configuration (wg0.conf) file…'),
  355. 'style': 'height:5em;width:100%; white-space:pre'
  356. })
  357. ]),
  358. E('div', {
  359. 'class': 'alert-message',
  360. 'style': 'display:none'
  361. }, [''])
  362. ]);
  363. var cancelFn = function() {
  364. nodes.parentNode.removeChild(nodes.nextSibling);
  365. nodes.parentNode.removeChild(nodes);
  366. mapNode.classList.remove('hidden');
  367. mapNode.nextSibling.classList.remove('hidden');
  368. headNode.removeChild(headNode.lastChild);
  369. window.removeEventListener('dragover', handleWindowDragDropIgnore);
  370. window.removeEventListener('drop', handleWindowDragDropIgnore);
  371. };
  372. var a = nodes.querySelector('a.full-import');
  373. if (a) {
  374. a.addEventListener('click', ui.createHandlerFn(this, function(mode) {
  375. cancelFn();
  376. this.handleConfigImport('full');
  377. }));
  378. }
  379. mapNode.classList.add('hidden');
  380. mapNode.nextElementSibling.classList.add('hidden');
  381. headNode.appendChild(E('span', [ ' » ', (mode == 'full') ? _('Import configuration') : _('Import as peer') ]));
  382. mapNode.parentNode.appendChild(E([], [
  383. nodes,
  384. E('div', {
  385. 'class': 'right'
  386. }, [
  387. E('button', {
  388. 'class': 'btn',
  389. 'click': cancelFn
  390. }, [ _('Cancel') ]),
  391. ' ',
  392. E('button', {
  393. 'class': 'btn primary',
  394. 'click': ui.createHandlerFn(this, 'handleApplyConfig', mode, nodes, null)
  395. }, [ _('Import settings') ])
  396. ])
  397. ]));
  398. window.addEventListener('dragover', handleWindowDragDropIgnore);
  399. window.addEventListener('drop', handleWindowDragDropIgnore);
  400. };
  401. ss.renderSectionAdd = function(/* ... */) {
  402. var nodes = this.super('renderSectionAdd', arguments);
  403. nodes.appendChild(E('button', {
  404. 'class': 'btn',
  405. 'click': ui.createHandlerFn(this, 'handleConfigImport', 'peer')
  406. }, [ _('Import configuration as peer…') ]));
  407. return nodes;
  408. };
  409. ss.renderSectionPlaceholder = function() {
  410. return E('em', _('No peers defined yet.'));
  411. };
  412. o = ss.option(form.Flag, 'disabled', _('Peer disabled'), _('Enable / Disable peer. Restart wireguard interface to apply changes.'));
  413. o.modalonly = true;
  414. o.optional = true;
  415. o = ss.option(form.Value, 'description', _('Description'), _('Optional. Description of peer.'));
  416. o.placeholder = 'My Peer';
  417. o.datatype = 'string';
  418. o.optional = true;
  419. o.width = '30%';
  420. o.textvalue = function(section_id) {
  421. var dis = ss.getOption('disabled'),
  422. pub = ss.getOption('public_key'),
  423. prv = ss.getOption('private_key'),
  424. psk = ss.getOption('preshared_key'),
  425. name = this.cfgvalue(section_id),
  426. key = pub.cfgvalue(section_id);
  427. var desc = [
  428. E('p', [
  429. name ? E('span', [ name ]) : E('em', [ _('Untitled peer') ])
  430. ])
  431. ];
  432. if (dis.cfgvalue(section_id) == '1')
  433. desc.push(E('span', {
  434. 'class': 'ifacebadge',
  435. 'data-tooltip': _('WireGuard peer is disabled')
  436. }, [
  437. E('em', [ _('Disabled', 'Label indicating that WireGuard peer is disabled') ])
  438. ]), ' ');
  439. if (!key || !pub.isValid(section_id)) {
  440. desc.push(E('span', {
  441. 'class': 'ifacebadge',
  442. 'data-tooltip': _('Public key is missing')
  443. }, [
  444. E('em', [ _('Key missing', 'Label indicating that WireGuard peer lacks public key') ])
  445. ]));
  446. }
  447. else {
  448. desc.push(
  449. E('span', {
  450. 'class': 'ifacebadge',
  451. 'data-tooltip': _('Public key: %h', 'Tooltip displaying full WireGuard peer public key').format(key)
  452. }, [
  453. E('code', [ key.replace(/^(.{5}).+(.{6})$/, '$1…$2') ])
  454. ]),
  455. ' ',
  456. (prv.cfgvalue(section_id) && prv.isValid(section_id))
  457. ? E('span', {
  458. 'class': 'ifacebadge',
  459. 'data-tooltip': _('Private key present')
  460. }, [ _('Private', 'Label indicating that WireGuard peer private key is stored') ]) : '',
  461. ' ',
  462. (psk.cfgvalue(section_id) && psk.isValid(section_id))
  463. ? E('span', {
  464. 'class': 'ifacebadge',
  465. 'data-tooltip': _('Preshared key in use')
  466. }, [ _('PSK', 'Label indicating that WireGuard peer uses a PSK') ]) : ''
  467. );
  468. }
  469. return E([], desc);
  470. };
  471. function handleKeyChange(ev, section_id, value) {
  472. var prv = this.section.getUIElement(section_id, 'private_key'),
  473. btn = this.map.findElement('.btn.qr-code');
  474. btn.disabled = (!prv.isValid() || !prv.getValue());
  475. }
  476. o = ss.option(form.Value, 'public_key', _('Public Key'), _('Required. Public key of the WireGuard peer.'));
  477. o.modalonly = true;
  478. o.validate = validateBase64;
  479. o.onchange = handleKeyChange;
  480. o = ss.option(form.Value, 'private_key', _('Private Key'), _('Optional. Private key of the WireGuard peer. The key is not required for establishing a connection but allows generating a peer configuration or QR code if available. It can be removed after the configuration has been exported.'));
  481. o.modalonly = true;
  482. o.validate = validateBase64;
  483. o.onchange = handleKeyChange;
  484. o.password = true;
  485. o = ss.option(cbiKeyPairGenerate, '_gen_peer_keypair', ' ');
  486. o.modalonly = true;
  487. o = ss.option(form.Value, 'preshared_key', _('Preshared Key'), _('Optional. Base64-encoded preshared key. Adds in an additional layer of symmetric-key cryptography for post-quantum resistance.'));
  488. o.modalonly = true;
  489. o.validate = validateBase64;
  490. o.password = true;
  491. o = ss.option(form.DummyValue, '_gen_psk', ' ');
  492. o.modalonly = true;
  493. o.cfgvalue = function(section_id, value) {
  494. return E('button', {
  495. 'class': 'btn',
  496. 'click': ui.createHandlerFn(this, function(section_id, ev) {
  497. var psk = this.section.getUIElement(section_id, 'preshared_key'),
  498. map = this.map;
  499. if (psk.getValue() && !confirm(_('Do you want to replace the current PSK?')))
  500. return;
  501. return generatePsk().then(function(key) {
  502. psk.setValue(key);
  503. map.save(null, true);
  504. });
  505. }, section_id)
  506. }, [ _('Generate preshared key') ]);
  507. };
  508. o = ss.option(form.DynamicList, 'allowed_ips', _('Allowed IPs'), _("Optional. IP addresses and prefixes that this peer is allowed to use inside the tunnel. Usually the peer's tunnel IP addresses and the networks the peer routes through the tunnel."));
  509. o.datatype = 'ipaddr';
  510. o.textvalue = function(section_id) {
  511. var ips = L.toArray(this.cfgvalue(section_id)),
  512. list = [];
  513. for (var i = 0; i < ips.length; i++) {
  514. if (i > 7) {
  515. list.push(E('em', {
  516. 'class': 'ifacebadge cbi-tooltip-container'
  517. }, [
  518. _('+ %d more', 'Label indicating further amount of allowed ips').format(ips.length - i),
  519. E('span', {
  520. 'class': 'cbi-tooltip'
  521. }, [
  522. E('ul', ips.map(function(ip) {
  523. return E('li', [
  524. E('span', { 'class': 'ifacebadge' }, [ ip ])
  525. ]);
  526. }))
  527. ])
  528. ]));
  529. break;
  530. }
  531. list.push(E('span', { 'class': 'ifacebadge' }, [ ips[i] ]));
  532. }
  533. if (!list.length)
  534. list.push('*');
  535. return E('span', { 'style': 'display:inline-flex;flex-wrap:wrap;gap:.125em' }, list);
  536. };
  537. o = ss.option(form.Flag, 'route_allowed_ips', _('Route Allowed IPs'), _('Optional. Create routes for Allowed IPs for this peer.'));
  538. o.modalonly = true;
  539. o = ss.option(form.Value, 'endpoint_host', _('Endpoint Host'), _('Optional. Host of peer. Names are resolved prior to bringing up the interface.'));
  540. o.placeholder = 'vpn.example.com';
  541. o.datatype = 'host';
  542. o.textvalue = function(section_id) {
  543. var host = this.cfgvalue(section_id),
  544. port = this.section.cfgvalue(section_id, 'endpoint_port');
  545. return (host && port)
  546. ? '%h:%d'.format(host, port)
  547. : (host
  548. ? '%h:*'.format(host)
  549. : (port
  550. ? '*:%d'.format(port)
  551. : '*'));
  552. };
  553. o = ss.option(form.Value, 'endpoint_port', _('Endpoint Port'), _('Optional. Port of peer.'));
  554. o.modalonly = true;
  555. o.placeholder = '51820';
  556. o.datatype = 'port';
  557. o = ss.option(form.Value, 'persistent_keepalive', _('Persistent Keep Alive'), _('Optional. Seconds between keep alive messages. Default is 0 (disabled). Recommended value if this device is behind a NAT is 25.'));
  558. o.modalonly = true;
  559. o.datatype = 'range(0,65535)';
  560. o.placeholder = '0';
  561. o = ss.option(form.DummyValue, '_keyops', _('Configuration Export'),
  562. _('Generates a configuration suitable for import on a WireGuard peer'));
  563. o.modalonly = true;
  564. o.createPeerConfig = function(section_id, endpoint, ips) {
  565. var pub = s.formvalue(s.section, 'public_key'),
  566. port = s.formvalue(s.section, 'listen_port') || '51820',
  567. prv = this.section.formvalue(section_id, 'private_key'),
  568. psk = this.section.formvalue(section_id, 'preshared_key'),
  569. eport = this.section.formvalue(section_id, 'endpoint_port'),
  570. keep = this.section.formvalue(section_id, 'persistent_keepalive');
  571. // If endpoint is IPv6 we must escape it with []
  572. if (endpoint.indexOf(':') > 0) {
  573. endpoint = '['+endpoint+']';
  574. }
  575. return [
  576. '[Interface]',
  577. 'PrivateKey = ' + prv,
  578. eport ? 'ListenPort = ' + eport : '# ListenPort not defined',
  579. '',
  580. '[Peer]',
  581. 'PublicKey = ' + pub,
  582. psk ? 'PresharedKey = ' + psk : '# PresharedKey not used',
  583. ips && ips.length ? 'AllowedIPs = ' + ips.join(', ') : '# AllowedIPs not defined',
  584. endpoint ? 'Endpoint = ' + endpoint + ':' + port : '# Endpoint not defined',
  585. keep ? 'PersistentKeepAlive = ' + keep : '# PersistentKeepAlive not defined'
  586. ].join('\n');
  587. };
  588. o.handleGenerateQR = function(section_id, ev) {
  589. var mapNode = ss.getActiveModalMap(),
  590. headNode = mapNode.parentNode.querySelector('h4'),
  591. configGenerator = this.createPeerConfig.bind(this, section_id),
  592. parent = this.map;
  593. return Promise.all([
  594. network.getWANNetworks(),
  595. network.getWAN6Networks(),
  596. L.resolveDefault(uci.load('ddns')),
  597. L.resolveDefault(uci.load('system')),
  598. parent.save(null, true)
  599. ]).then(function(data) {
  600. var hostnames = [];
  601. uci.sections('ddns', 'service', function(s) {
  602. if (typeof(s.lookup_host) == 'string' && s.enabled == '1')
  603. hostnames.push(s.lookup_host);
  604. });
  605. uci.sections('system', 'system', function(s) {
  606. if (typeof(s.hostname) == 'string' && s.hostname.indexOf('.') > 0)
  607. hostnames.push(s.hostname);
  608. });
  609. for (var i = 0; i < data[0].length; i++)
  610. hostnames.push.apply(hostnames, data[0][i].getIPAddrs().map(function(ip) { return ip.split('/')[0] }));
  611. for (var i = 0; i < data[1].length; i++)
  612. hostnames.push.apply(hostnames, data[1][i].getIP6Addrs().map(function(ip) { return ip.split('/')[0] }));
  613. var ips = [ '0.0.0.0/0', '::/0' ];
  614. var qrm, qrs, qro;
  615. qrm = new form.JSONMap({ config: { endpoint: hostnames[0], allowed_ips: ips } }, null, _('The generated configuration can be imported into a WireGuard client application to set up a connection towards this device.'));
  616. qrm.parent = parent;
  617. qrs = qrm.section(form.NamedSection, 'config');
  618. function handleConfigChange(ev, section_id, value) {
  619. var code = this.map.findElement('.qr-code'),
  620. conf = this.map.findElement('.client-config'),
  621. endpoint = this.section.getUIElement(section_id, 'endpoint'),
  622. ips = this.section.getUIElement(section_id, 'allowed_ips');
  623. if (this.isValid(section_id)) {
  624. conf.firstChild.data = configGenerator(endpoint.getValue(), ips.getValue());
  625. code.style.opacity = '.5';
  626. invokeQREncode(conf.firstChild.data, code);
  627. }
  628. };
  629. qro = qrs.option(form.Value, 'endpoint', _('Connection endpoint'), _('The public hostname or IP address of this system the peer should connect to. This usually is a static public IP address, a static hostname or a DDNS domain.'));
  630. qro.datatype = 'or(ipaddr,hostname)';
  631. hostnames.forEach(function(hostname) { qro.value(hostname) });
  632. qro.onchange = handleConfigChange;
  633. qro = qrs.option(form.DynamicList, 'allowed_ips', _('Allowed IPs'), _('IP addresses that are allowed inside the tunnel. The peer will accept tunnelled packets with source IP addresses matching this list and route back packets with matching destination IP.'));
  634. qro.datatype = 'ipaddr';
  635. qro.default = ips;
  636. ips.forEach(function(ip) { qro.value(ip) });
  637. qro.onchange = handleConfigChange;
  638. qro = qrs.option(form.DummyValue, 'output');
  639. qro.renderWidget = function() {
  640. var peer_config = configGenerator(hostnames[0], ips);
  641. var node = E('div', {
  642. 'style': 'display:flex;flex-wrap:wrap;align-items:center;gap:.5em;width:100%'
  643. }, [
  644. E('div', {
  645. 'class': 'qr-code',
  646. 'style': 'width:320px;flex:0 1 320px;text-align:center'
  647. }, [
  648. E('em', { 'class': 'spinning' }, [ _('Generating QR code…') ])
  649. ]),
  650. E('pre', {
  651. 'class': 'client-config',
  652. 'style': 'flex:1;white-space:pre;overflow:auto',
  653. 'click': function(ev) {
  654. var sel = window.getSelection(),
  655. range = document.createRange();
  656. range.selectNodeContents(ev.currentTarget);
  657. sel.removeAllRanges();
  658. sel.addRange(range);
  659. }
  660. }, [ peer_config ])
  661. ]);
  662. invokeQREncode(peer_config, node.firstChild);
  663. return node;
  664. };
  665. return qrm.render().then(function(nodes) {
  666. mapNode.classList.add('hidden');
  667. mapNode.nextElementSibling.classList.add('hidden');
  668. headNode.appendChild(E('span', [ ' » ', _('Generate configuration') ]));
  669. mapNode.parentNode.appendChild(E([], [
  670. nodes,
  671. E('div', {
  672. 'class': 'right'
  673. }, [
  674. E('button', {
  675. 'class': 'btn',
  676. 'click': function() {
  677. nodes.parentNode.removeChild(nodes.nextSibling);
  678. nodes.parentNode.removeChild(nodes);
  679. mapNode.classList.remove('hidden');
  680. mapNode.nextSibling.classList.remove('hidden');
  681. headNode.removeChild(headNode.lastChild);
  682. }
  683. }, [ _('Back to peer configuration') ])
  684. ])
  685. ]));
  686. if (!s.formvalue(s.section, 'listen_port')) {
  687. nodes.appendChild(E('div', { 'class': 'alert-message' }, [
  688. E('p', [
  689. _('No fixed interface listening port defined, peers might not be able to initiate connections to this WireGuard instance!')
  690. ])
  691. ]));
  692. }
  693. });
  694. });
  695. };
  696. o.cfgvalue = function(section_id, value) {
  697. var privkey = this.section.cfgvalue(section_id, 'private_key');
  698. return E('button', {
  699. 'class': 'btn qr-code',
  700. 'style': 'display:inline-flex;align-items:center;gap:.5em',
  701. 'click': ui.createHandlerFn(this, 'handleGenerateQR', section_id),
  702. 'disabled': privkey ? null : ''
  703. }, [
  704. Object.assign(E(qrIcon), { style: 'width:22px;height:22px' }),
  705. _('Generate configuration…')
  706. ]);
  707. };
  708. },
  709. deleteConfiguration: function() {
  710. uci.sections('network', 'wireguard_%s'.format(this.sid), function(s) {
  711. uci.remove('network', s['.name']);
  712. });
  713. }
  714. });