pavel.muhortov/wireguard-management
1
0
Fork 0
generated from pavel.muhortov/template-bash
Code Issues Pull Requests Projects Releases Wiki Activity

improved execution logic

Browse Source
This commit is contained in:
Pavel Muhortov 2024-01-07 15:49:39 +03:00
parent d888b08c50
commit ebac39dc33
1 changed files with 104 additions and 59 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

163
wg-client-management.sh
View File

@ -163,7 +163,7 @@ startsendtlgm() {
} }
####################################### #######################################
# Create wireguard client certificates. # Create wireguard client peer.
# Globals: # Globals:
# clientname # clientname
# clientaddr # clientaddr
@ -171,22 +171,38 @@ startsendtlgm() {
# Arguments: # Arguments:
# None # None
####################################### #######################################
createcert() { createpeer() {
wg genkey | tee "/etc/wireguard/pki/${clientname}-private.key" | wg pubkey > "/etc/wireguard/pki/${clientname}-public.key" if [ -f "/etc/wireguard/pki/${clientname}-private.key" ]; then
addtologs "${clientname} private key exists, create skipped"
else
wg genkey | tee "/etc/wireguard/pki/${clientname}-private.key" > /dev/null 2>&1
addtologs "created ${clientname} new private key"
fi
wg pubkey > "/etc/wireguard/pki/${clientname}-public.key" < "/etc/wireguard/pki/${clientname}-private.key"
addtologs "created ${clientname} wireguard certificates"
clientpublkey=$(cat "/etc/wireguard/pki/${clientname}-public.key") clientpublkey=$(cat "/etc/wireguard/pki/${clientname}-public.key")
clientprivkey=$(cat "/etc/wireguard/pki/${clientname}-private.key") if grep -q -w "${clientpublkey}" "${servercfgname}"; then
wg set "${iface_name}" peer "${clientpublkey}" \ addtologs "${clientname} peer configuration exists, create skipped"
allowed-ips "${clientaddr}/32" \ else
persistent-keepalive 5 wg set "${iface_name}" peer "${clientpublkey}" \
{ allowed-ips "${clientaddr}/32" \
printf "%s\n" "[Peer]" persistent-keepalive 5
printf "%s\n" " PublicKey = ${clientpublkey}" {
printf "%s\n" " AllowedIPs = ${clientaddr}/32" printf "%s\n" "[Peer]"
printf "%s\n" " PersistentKeepalive = 5" printf "%s\n" " PublicKey = ${clientpublkey}"
} >> "${servercfgname}" printf "%s\n" " AllowedIPs = ${clientaddr}/32"
addtologs "created ${clientname} wireguard certificate" printf "%s\n" " PersistentKeepalive = 5"
ip -4 route add "${clientaddr}/32" dev "${iface_name}" } >> "${servercfgname}"
addtologs "created route to ${clientname} peer" addtologs "created ${clientname} wireguard peer configuration"
fi
if ip ro | grep -q -w "${clientaddr}"; then
addtologs "${clientname} peer address exists in routes, create skipped"
else
ip -4 route add "${clientaddr}/32" dev "${iface_name}"
addtologs "created ${clientname} peer route"
fi
} }
####################################### #######################################
@ -201,6 +217,7 @@ createcert() {
# None # None
####################################### #######################################
createconf() { createconf() {
clientprivkey=$(cat "/etc/wireguard/pki/${clientname}-private.key")
clientconf=$(cat "${clientconfdef}") clientconf=$(cat "${clientconfdef}")
clientconf=${clientconf//clientaddr/${clientaddr}} clientconf=${clientconf//clientaddr/${clientaddr}}
clientconf=${clientconf//clientprivkey/${clientprivkey}} clientconf=${clientconf//clientprivkey/${clientprivkey}}
@ -224,14 +241,14 @@ createinfo() {
"" \ "" \
"${additional}" \ "${additional}" \
"" \ "" \
"Peer Address: \`${clientaddr}\`" \ "Peer Address: \`$(grep 'Address' "/etc/wireguard/${clientname}.conf" | awk '{print $3}')\`" \
) )
qrencode -o "/etc/wireguard/${clientname}.png" -t png -s 6 < "/etc/wireguard/${clientname}.conf" qrencode -o "/etc/wireguard/${clientname}.png" -t png -s 6 < "/etc/wireguard/${clientname}.conf"
addtologs "created ${clientname} qr code" addtologs "created ${clientname} qr code"
} }
####################################### #######################################
# Delete wireguard client certificates. # Delete wireguard client peer.
# Globals: # Globals:
# clientname # clientname
# clientpublkey # clientpublkey
@ -239,24 +256,43 @@ createinfo() {
# Arguments: # Arguments:
# None # None
####################################### #######################################
deletecert() { deletepeer() {
clientpublkey=$(cat "/etc/wireguard/pki/${clientname}-public.key") if [ -f "/etc/wireguard/pki/${clientname}-private.key" ]; then
clientprivkey=$(cat "/etc/wireguard/pki/${clientname}-private.key") wg pubkey > "/etc/wireguard/pki/${clientname}-public.key" < "/etc/wireguard/pki/${clientname}-private.key"
wg set "${iface_name}" peer "${clientpublkey}" remove fi
rm -f "/etc/wireguard/pki/${clientname}-public.key"
rm -f "/etc/wireguard/pki/${clientname}-private.key" if [ -f "/etc/wireguard/pki/${clientname}-public.key" ]; then
addtologs "deleted ${clientname} wireguard certificate" clientpublkey=$(cat "/etc/wireguard/pki/${clientname}-public.key")
# PublicKey = if grep -q -w "${clientpublkey}" "${servercfgname}"; then
s2=$(grep -n "${clientpublkey}" "${servercfgname}" | cut -d":" -f1) wg set "${iface_name}" peer "${clientpublkey}" remove
# [Peer] # PublicKey =
s1=$(( s2 - 1 )) s2=$(grep -n "${clientpublkey}" "${servercfgname}" | cut -d":" -f1)
# AllowedIPs = # [Peer]
s3=$(( s2 + 1 )) s1=$(( s2 - 1 ))
# PersistentKeepalive = # AllowedIPs =
s4=$(( s2 + 2 )) s3=$(( s2 + 1 ))
sed -i "${s1}d;${s2}d;${s3}d;${s4}d" "${servercfgname}" # PersistentKeepalive =
ip -4 route del "${clientaddr}/32" dev "${iface_name}" s4=$(( s2 + 2 ))
addtologs "deleted route to ${clientname} peer" sed -i "${s1}d;${s2}d;${s3}d;${s4}d" "${servercfgname}"
addtologs "deleted ${clientname} wireguard peer configuration"
else
addtologs "${clientname} peer configuration does not exist, delete skipped"
fi
rm -f "/etc/wireguard/pki/${clientname}-public.key" > /dev/null 2>&1
rm -f "/etc/wireguard/pki/${clientname}-private.key" > /dev/null 2>&1
addtologs "deleted ${clientname} wireguard certificates"
else
addtologs "${clientname} certificates do not exist, delete skipped"
fi
if ip ro | grep -q -w "${clientaddr} dev ${iface_name}"; then
ip -4 route del "${clientaddr}/32" dev "${iface_name}"
addtologs "deleted ${clientname} peer route"
else
addtologs "${clientname} peer route does not exist, delete skipped"
fi
} }
####################################### #######################################
@ -267,8 +303,12 @@ deletecert() {
# None # None
####################################### #######################################
deleteconf() { deleteconf() {
rm -f "/etc/wireguard/${clientname}.conf" if [ -f "/etc/wireguard/${clientname}.conf" ]; then
addtologs "deleted ${clientname} wireguard config file" rm -f "/etc/wireguard/${clientname}.conf"
addtologs "deleted ${clientname} wireguard config file"
else
addtologs "${clientname} wireguard config does not exist, delete skipped"
fi
} }
####################################### #######################################
@ -279,8 +319,12 @@ deleteconf() {
# None # None
####################################### #######################################
deleteinfo() { deleteinfo() {
rm -f "/etc/wireguard/${clientname}.png" if [ -f "/etc/wireguard/${clientname}.png" ]; then
addtologs "deleted ${clientname} qr code" rm -f "/etc/wireguard/${clientname}.png"
addtologs "deleted ${clientname} qr code"
else
addtologs "${clientname} qr code does not exist, delete skipped"
fi
} }
# #
@ -307,27 +351,33 @@ done
time=$(date +%s) time=$(date +%s)
logs=/dev/null logs=/dev/null
if ! command -v qrencode &> /dev/null || \
! command -v /usr/local/bin/sendmail.py &> /dev/null || \
! command -v python3 &> /dev/null; then
execerror "Not found dependencies"
fi
# #
# MAIN: # MAIN:
# #
if checkroot; then if checkroot; then
if ! command -v qrencode &> /dev/null || \
! command -v grepcidr &> /dev/null || \
! command -v /usr/local/bin/sendmail.py &> /dev/null || \
! command -v python3 &> /dev/null || \
! command -v curl &> /dev/null; then
execerror "Not found dependencies"
fi
getconfig getconfig
if [ "${clienttodo}" == "add" ] && \ if [ "${clienttodo}" == "add" ] && \
[ -n "${iface_name}" ] && \
[ -n "${clientname}" ] && \ [ -n "${clientname}" ] && \
grepcidr "0.0.0.0/0" <(echo "${clientaddr}") >/dev/null; then grepcidr "0.0.0.0/0" <(echo "${clientaddr}") > /dev/null; then
if [ -f "/etc/wireguard/${clientname}.conf" ] || \ if ip ro | grep -q -w "${clientaddr}" || \
grep -q -w "${clientaddr}/32" "${servercfgname}"; then grep -q -w "${clientaddr}/32" "${servercfgname}"; then
execerror "wireguard config exist or address used, exit" addtologs "${clientaddr} address used, create peer, conf skipped"
else else
createcert createpeer
createconf createconf
fi
if [ ! -f "/etc/wireguard/${clientname}.conf" ]; then
addtologs "${clientname}.conf not found, create info skipped"
else
createinfo createinfo
startsendmail startsendmail
startsendtlgm startsendtlgm
@ -337,17 +387,12 @@ if checkroot; then
systemctl restart "wg-quick@${iface_name}" systemctl restart "wg-quick@${iface_name}"
fi fi
elif [ "${clienttodo}" == "del" ] && \ elif [ "${clienttodo}" == "del" ] && \
[ -n "${iface_name}" ] && \
[ -n "${clientname}" ] && \ [ -n "${clientname}" ] && \
grepcidr "0.0.0.0/0" <(echo "${clientaddr}") >/dev/null; then grepcidr "0.0.0.0/0" <(echo "${clientaddr}") >/dev/null; then
if [ -f "/etc/wireguard/${clientname}.conf" ]; then deleteconf
deleteconf deleteinfo
fi deletepeer
if [ -f "/etc/wireguard/${clientname}.png" ]; then
deleteinfo
fi
if grep -q -w "${clientaddr}/32" "${servercfgname}"; then
deletecert
fi
if [ "${resetforce}" -eq 1 ];then if [ "${resetforce}" -eq 1 ];then
addtologs "restarting wg-quick@${iface_name}..." addtologs "restarting wg-quick@${iface_name}..."
systemctl "restart wg-quick@${iface_name}" systemctl "restart wg-quick@${iface_name}"