improve client mode, todo: migrate peers (new db schema)

internal/server/configuration.go

@@ -106,7 +106,7 @@ func NewConfig() *Config {
 	cfg.LDAP.DisabledAttribute = "userAccountControl"
 	cfg.LDAP.AdminLdapGroup = "CN=WireGuardAdmins,OU=_O_IT,DC=COMPANY,DC=LOCAL"
 
-	cfg.WG.DeviceNames = []string{"wg0"}
+	cfg.WG.DeviceNames = []string{"wg0", "wg1"}
 	cfg.WG.DefaultDeviceName = "wg0"
 	cfg.WG.ConfigDirectoryPath = "/etc/wireguard"
 	cfg.WG.ManageIPAddresses = true

internal/server/handlers_interface.go

@@ -162,7 +162,6 @@ func (s *Server) GetApplyGlobalConfig(c *gin.Context) {
 		peer.PersistentKeepalive = device.DefaultPersistentKeepalive
 		peer.DNSStr = device.DNSStr
 		peer.Mtu = device.Mtu
-		peer.EndpointPublicKey = device.PublicKey
 
 		if err := s.peers.UpdatePeer(peer); err != nil {
 			SetFlashMessage(c, err.Error(), "danger")

internal/server/server_helper.go

@@ -23,37 +23,37 @@ func (s *Server) PrepareNewPeer(device string) (wireguard.Peer, error) {
 
 	peer := wireguard.Peer{}
 	peer.IsNew = true
-	peerIPs := make([]string, len(deviceIPs))
-	for i := range deviceIPs {
-		freeIP, err := s.peers.GetAvailableIp(device, deviceIPs[i])
-		if err != nil {
-			return wireguard.Peer{}, errors.WithMessage(err, "failed to get available IP addresses")
-		}
-		peerIPs[i] = freeIP
-	}
-	peer.SetIPAddresses(peerIPs...)
-	psk, err := wgtypes.GenerateKey()
-	if err != nil {
-		return wireguard.Peer{}, errors.Wrap(err, "failed to generate key")
-	}
-	key, err := wgtypes.GeneratePrivateKey()
-	if err != nil {
-		return wireguard.Peer{}, errors.Wrap(err, "failed to generate private key")
-	}
-	peer.PresharedKey = psk.String()
-	peer.PrivateKey = key.String()
-	peer.PublicKey = key.PublicKey().String()
-	peer.UID = fmt.Sprintf("u%x", md5.Sum([]byte(peer.PublicKey)))
 
 	switch dev.Type {
 	case wireguard.DeviceTypeServer:
-		peer.EndpointPublicKey = dev.PublicKey
+		peerIPs := make([]string, len(deviceIPs))
+		for i := range deviceIPs {
+			freeIP, err := s.peers.GetAvailableIp(device, deviceIPs[i])
+			if err != nil {
+				return wireguard.Peer{}, errors.WithMessage(err, "failed to get available IP addresses")
+			}
+			peerIPs[i] = freeIP
+		}
+		peer.SetIPAddresses(peerIPs...)
+		psk, err := wgtypes.GenerateKey()
+		if err != nil {
+			return wireguard.Peer{}, errors.Wrap(err, "failed to generate key")
+		}
+		key, err := wgtypes.GeneratePrivateKey()
+		if err != nil {
+			return wireguard.Peer{}, errors.Wrap(err, "failed to generate private key")
+		}
+		peer.PresharedKey = psk.String()
+		peer.PrivateKey = key.String()
+		peer.PublicKey = key.PublicKey().String()
+		peer.UID = fmt.Sprintf("u%x", md5.Sum([]byte(peer.PublicKey)))
 		peer.Endpoint = dev.DefaultEndpoint
 		peer.DNSStr = dev.DNSStr
 		peer.PersistentKeepalive = dev.DefaultPersistentKeepalive
 		peer.AllowedIPsStr = dev.DefaultAllowedIPsStr
 		peer.Mtu = dev.Mtu
 	case wireguard.DeviceTypeClient:
+		peer.UID = "newendpoint"
 	}
 
 	return peer, nil
@@ -90,7 +90,7 @@ func (s *Server) CreatePeer(device string, peer wireguard.Peer) error {
 	peerIPs := peer.GetIPAddresses()
 
 	peer.AllowedIPsStr = dev.DefaultAllowedIPsStr
-	if len(peerIPs) == 0 {
+	if len(peerIPs) == 0 && dev.Type == wireguard.DeviceTypeServer {
 		peerIPs = make([]string, len(deviceIPs))
 		for i := range deviceIPs {
 			freeIP, err := s.peers.GetAvailableIp(device, deviceIPs[i])
@@ -101,7 +101,7 @@ func (s *Server) CreatePeer(device string, peer wireguard.Peer) error {
 		}
 		peer.SetIPAddresses(peerIPs...)
 	}
-	if peer.PrivateKey == "" { // if private key is empty create a new one
+	if peer.PrivateKey == "" && dev.Type == wireguard.DeviceTypeServer { // if private key is empty create a new one
 		psk, err := wgtypes.GenerateKey()
 		if err != nil {
 			return errors.Wrap(err, "failed to generate key")
@@ -141,12 +141,7 @@ func (s *Server) UpdatePeer(peer wireguard.Peer, updateTime time.Time) error {
 	var err error
 	switch {
 	case peer.DeactivatedAt != nil && *peer.DeactivatedAt == updateTime:
-		switch dev.Type {
-		case wireguard.DeviceTypeServer:
-			err = s.wg.RemovePeer(peer.DeviceName, peer.PublicKey)
-		case wireguard.DeviceTypeClient:
-			err = s.wg.RemovePeer(peer.DeviceName, peer.EndpointPublicKey)
-		}
+		err = s.wg.RemovePeer(peer.DeviceName, peer.PublicKey)
 	case peer.DeactivatedAt == nil && currentPeer.Peer != nil:
 		err = s.wg.UpdatePeer(peer.DeviceName, peer.GetConfig(&dev))
 	case peer.DeactivatedAt == nil && currentPeer.Peer == nil:
@@ -156,6 +151,8 @@ func (s *Server) UpdatePeer(peer wireguard.Peer, updateTime time.Time) error {
 		return errors.WithMessage(err, "failed to update WireGuard peer")
 	}
 
+	peer.UID = fmt.Sprintf("u%x", md5.Sum([]byte(peer.PublicKey)))
+
 	// Update in database
 	if err := s.peers.UpdatePeer(peer); err != nil {
 		return errors.WithMessage(err, "failed to update peer")
@@ -166,18 +163,8 @@ func (s *Server) UpdatePeer(peer wireguard.Peer, updateTime time.Time) error {
 
 // DeletePeer removes the peer from the physical WireGuard interface and the database.
 func (s *Server) DeletePeer(peer wireguard.Peer) error {
-	dev := s.peers.GetDevice(peer.DeviceName)
-
-	var publicKey string
-	switch dev.Type {
-	case wireguard.DeviceTypeServer:
-		publicKey = peer.PublicKey
-	case wireguard.DeviceTypeClient:
-		publicKey = peer.EndpointPublicKey
-	}
-
 	// Delete WireGuard peer
-	if err := s.wg.RemovePeer(peer.DeviceName, publicKey); err != nil {
+	if err := s.wg.RemovePeer(peer.DeviceName, peer.PublicKey); err != nil {
 		return errors.WithMessage(err, "failed to remove WireGuard peer")
 	}
 

internal/wireguard/peermanager.go

@@ -88,10 +88,9 @@ type Peer struct {
 	PersistentKeepalive int    `form:"keepalive" binding:"gte=0"`
 
 	// Misc. WireGuard Settings
-	EndpointPublicKey string `form:"endpointpubkey" binding:"required,base64"` // the public key of the remote endpoint
-	PrivateKey        string `form:"privkey" binding:"omitempty,base64"`
-	IPsStr            string `form:"ip" binding:"cidrlist,required_if=DeviceType server"` // a comma separated list of IPs of the client
-	DNSStr            string `form:"dns" binding:"iplist"`                                // comma separated list of the DNS servers for the client
+	PrivateKey string `form:"privkey" binding:"omitempty,base64"`
+	IPsStr     string `form:"ip" binding:"cidrlist,required_if=DeviceType server"` // a comma separated list of IPs of the client
+	DNSStr     string `form:"dns" binding:"iplist"`                                // comma separated list of the DNS servers for the client
 	// Global Device Settings (can be ignored, only make sense if device is in server mode)
 	Mtu int `form:"mtu" binding:"gte=0,lte=1500"`
 
@@ -126,14 +125,8 @@ func (p Peer) GetAllowedIPs() []string {
 	return common.ParseStringList(p.AllowedIPsStr)
 }
 
-func (p Peer) GetConfig(dev *Device) wgtypes.PeerConfig {
-	var publicKey wgtypes.Key
-	switch dev.Type {
-	case DeviceTypeServer:
-		publicKey, _ = wgtypes.ParseKey(p.PublicKey)
-	case DeviceTypeClient:
-		publicKey, _ = wgtypes.ParseKey(p.EndpointPublicKey)
-	}
+func (p Peer) GetConfig(_ *Device) wgtypes.PeerConfig {
+	publicKey, _ := wgtypes.ParseKey(p.PublicKey)
 
 	var presharedKey *wgtypes.Key
 	if p.PresharedKey != "" {
@@ -432,18 +425,11 @@ func (m *PeerManager) validateOrCreatePeer(device string, wgPeer wgtypes.Peer) e
 			peer.PublicKey = wgPeer.PublicKey.String()
 			peer.Identifier = "Autodetected Client (" + peer.PublicKey[0:8] + ")"
 		} else if dev.Type == DeviceTypeClient {
-			// create a new key pair, not really needed but otherwise our "client exists" detection does not work...
-			key, err := wgtypes.GeneratePrivateKey()
-			if err != nil {
-				return errors.Wrap(err, "failed to generate dummy private key")
-			}
-			peer.PrivateKey = key.String()
-			peer.PublicKey = key.PublicKey().String()
-			peer.EndpointPublicKey = wgPeer.PublicKey.String()
+			peer.PublicKey = wgPeer.PublicKey.String()
 			if wgPeer.Endpoint != nil {
 				peer.Endpoint = wgPeer.Endpoint.String()
 			}
-			peer.Identifier = "Autodetected Endpoint (" + peer.EndpointPublicKey[0:8] + ")"
+			peer.Identifier = "Autodetected Endpoint (" + peer.PublicKey[0:8] + ")"
 		}
 		if wgPeer.PresharedKey != (wgtypes.Key{}) {
 			peer.PresharedKey = wgPeer.PresharedKey.String()
@@ -525,6 +511,7 @@ func (m *PeerManager) populatePeerData(peer *Peer) {
 }
 
 // fixPeerDefaultData tries to fill all required fields for the given peer
+// also tries to migrate data if the database schema changed
 func (m *PeerManager) fixPeerDefaultData(peer *Peer, device *Device) error {
 	updatePeer := false
 
@@ -534,10 +521,6 @@ func (m *PeerManager) fixPeerDefaultData(peer *Peer, device *Device) error {
 			peer.Endpoint = device.DefaultEndpoint
 			updatePeer = true
 		}
-		if peer.EndpointPublicKey == "" {
-			peer.EndpointPublicKey = device.PublicKey
-			updatePeer = true
-		}
 	case DeviceTypeClient:
 	}
 

internal/wireguard/tpl/interface.tpl

@@ -52,14 +52,11 @@ PostDown = {{ .Interface.PostDown }}
 {{- if not .DeactivatedAt}}
 # -WGP- Peer: {{.Identifier}} / Updated: {{.UpdatedAt}} / Created: {{.CreatedAt}}
 # -WGP- Peer email: {{.Email}}
+{{- if .PrivateKey}}
 # -WGP- PrivateKey: {{.PrivateKey}}
+{{- end}}
 [Peer]
-{{- if eq $.Interface.Type "server"}}
 PublicKey = {{ .PublicKey }}
-{{- end}}
-{{- if eq $.Interface.Type "client"}}
-PublicKey = {{ .EndpointPublicKey }}
-{{- end}}
 {{- if .PresharedKey}}
 PresharedKey = {{ .PresharedKey }}
 {{- end}}

internal/wireguard/tpl/peer.tpl

@@ -17,7 +17,7 @@ MTU = {{.Peer.Mtu}}
 {{- end}}
 
 [Peer]
-PublicKey = {{ .Peer.EndpointPublicKey }}
+PublicKey = {{ .Peer.PublicKey }}
 Endpoint = {{ .Peer.Endpoint }}
 {{- if .Peer.AllowedIPsStr}}
 AllowedIPs = {{ .Peer.AllowedIPsStr }}