From 7d294b8a7a2be7322d4a90c36ed115b88d2d1751 Mon Sep 17 00:00:00 2001 From: bergware Date: Thu, 14 Apr 2022 09:43:42 +0200 Subject: [PATCH 1/6] WireGuard update Add warning when tunnel deletion fails --- plugins/dynamix/WG0.page | 8 ++++- plugins/dynamix/include/update.wireguard.php | 37 ++++++++++++-------- 2 files changed, 30 insertions(+), 15 deletions(-) diff --git a/plugins/dynamix/WG0.page b/plugins/dynamix/WG0.page index b26df4ff7..5ca2fc98a 100644 --- a/plugins/dynamix/WG0.page +++ b/plugins/dynamix/WG0.page @@ -520,7 +520,13 @@ function addTunnel() { } function delTunnel(vtun) { swal({title:"_(Delete Tunnel)_ "+vtun,text:"_(This removes any connections running over this tunnel)_",type:'warning',confirmButtonText:"_(Proceed)_",cancelButtonText:"_(Cancel)_",showCancelButton:true},function(){ - $.post('/webGui/include/update.wireguard.php',{'#cmd':'deltunnel','#vtun':vtun,'#name':''},function(){clearTunnel(vtun);}); + $.post('/webGui/include/update.wireguard.php',{'#cmd':'deltunnel','#vtun':vtun,'#name':''},function(ok){ + if (ok==0) { + clearTunnel(vtun); + } else { + setTimeout(function(){swal({title:"_(Delete tunnel failed)_",text:"_(Tunnel has running containers attached)_
_(Stop corresponding docker containers)_",html:true,type:'error',confirmButtonText:"_(Ok)_"});},250); + } + }); }); } function addPeer(form,vtun) { diff --git a/plugins/dynamix/include/update.wireguard.php b/plugins/dynamix/include/update.wireguard.php index 95e32f06f..80c0d1d3f 100644 --- a/plugins/dynamix/include/update.wireguard.php +++ b/plugins/dynamix/include/update.wireguard.php @@ -54,19 +54,18 @@ function host($ip) { return strpos($ip,'/')!==false ? $ip : (ipv4($ip) ? "$ip/32" : "$ip/128"); } function wgState($vtun, $state, $type=0) { - global $t1; + global $t1, $etc; $tmp = '/tmp/wg-quick.tmp'; exec("timeout $t1 wg-quick $state $vtun 2>$tmp"); - $table = exec("grep -Pom1 'fwmark \K[\d]+' $tmp"); - delete_file($tmp); if ($type==8) { // make VPN tunneled access for Docker containers only - $route = exec("grep -Pom1 '^Address=\K.+$' /etc/wireguard/$vtun.conf"); + $table = exec("grep -Pom1 'fwmark \K[\d]+' $tmp"); + $route = exec("grep -Pom1 '^Address=\K.+$' $etc/$vtun.conf"); sleep(3); - // remove default route and set local route instead exec("ip -4 route flush table $table"); exec("ip -4 route add $route dev $vtun table $table"); } + delete_file($tmp); } function status($vtun) { return in_array($vtun,explode(" ",exec("wg show interfaces"))); @@ -81,23 +80,30 @@ function normalize(&$id) { global $normalize; $id = $normalize[strtolower($id)]; } +function dockerNet($vtun) { + return empty(exec("docker network ls --filter name='$vtun' --format='{{.Name}}'")); +} function addDocker($vtun) { global $dockerd, $dockernet; - // create a docker network for the WG tunnel, containers can select this network for communication - if ($dockerd && !exec("docker network ls --filter name='$vtun' --format='{{.Name}}'")) { + $error = false; + if ($dockerd && dockerNet($vtun)) { $index = substr($vtun,2)+200; $network = "$dockernet.$index.0/24"; exec("docker network create $vtun --subnet=$network 2>/dev/null"); + $error = dockerNet($vtun); } + return $error; } function delDocker($vtun) { global $dockerd, $dockernet; - // delete the docker network, containers using this network need to be reconfigured - if ($dockerd && exec("docker network ls --filter name='$vtun' --format='{{.Name}}'")) { + $error = false; + if ($dockerd && !dockerNet($vtun)) { $index = substr($vtun,2)+200; $network = "$dockernet.$index.0/24"; exec("docker network rm $vtun 2>/dev/null"); + $error = !dockerNet($vtun); } + return $error; } function delPeer($vtun, $id='') { global $etc,$name; @@ -382,11 +388,14 @@ case 'addtunnel': case 'deltunnel': $vtun = $_POST['#vtun']; $name = $_POST['#name']; - wgState($vtun,'down'); - delete_file("$etc/$vtun.conf","$etc/$vtun.cfg"); - delPeer($vtun); - delDocker($vtun); - autostart('off',$vtun); + $error = delDocker($vtun); + if (!$error) { + wgState($vtun,'down'); + delete_file("$etc/$vtun.conf","$etc/$vtun.cfg"); + delPeer($vtun); + autostart('off',$vtun); + } + echo $error ? 1 : 0; break; case 'import': $name = $_POST['#name']; From d4003464ee722e3061ae2073f2e1b9809fdcdcb3 Mon Sep 17 00:00:00 2001 From: bergware Date: Thu, 14 Apr 2022 09:55:25 +0200 Subject: [PATCH 2/6] WireGuard update --- plugins/dynamix/include/update.wireguard.php | 2 -- 1 file changed, 2 deletions(-) diff --git a/plugins/dynamix/include/update.wireguard.php b/plugins/dynamix/include/update.wireguard.php index 80c0d1d3f..be092654d 100644 --- a/plugins/dynamix/include/update.wireguard.php +++ b/plugins/dynamix/include/update.wireguard.php @@ -98,8 +98,6 @@ function delDocker($vtun) { global $dockerd, $dockernet; $error = false; if ($dockerd && !dockerNet($vtun)) { - $index = substr($vtun,2)+200; - $network = "$dockernet.$index.0/24"; exec("docker network rm $vtun 2>/dev/null"); $error = !dockerNet($vtun); } From 7473d46d02122f66dcb4895bcb1aa604de97e3db Mon Sep 17 00:00:00 2001 From: bergware Date: Thu, 14 Apr 2022 09:57:04 +0200 Subject: [PATCH 3/6] WireGuard update --- plugins/dynamix/include/update.wireguard.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/dynamix/include/update.wireguard.php b/plugins/dynamix/include/update.wireguard.php index be092654d..61c116616 100644 --- a/plugins/dynamix/include/update.wireguard.php +++ b/plugins/dynamix/include/update.wireguard.php @@ -95,7 +95,7 @@ function addDocker($vtun) { return $error; } function delDocker($vtun) { - global $dockerd, $dockernet; + global $dockerd; $error = false; if ($dockerd && !dockerNet($vtun)) { exec("docker network rm $vtun 2>/dev/null"); From 95e919545a145474ad2033563c08f2e800804116 Mon Sep 17 00:00:00 2001 From: bergware Date: Thu, 14 Apr 2022 10:39:58 +0200 Subject: [PATCH 4/6] Minor code updates --- plugins/dynamix/WG0.page | 21 ++++++++++---------- plugins/dynamix/WGX.page | 2 +- plugins/dynamix/include/update.wireguard.php | 20 +++++++++---------- 3 files changed, 21 insertions(+), 22 deletions(-) diff --git a/plugins/dynamix/WG0.page b/plugins/dynamix/WG0.page index 5ca2fc98a..bfc7b67cb 100644 --- a/plugins/dynamix/WG0.page +++ b/plugins/dynamix/WG0.page @@ -37,10 +37,10 @@ if (count($filter)) { elseif (strpos($network,':')!==false && !in_array($network,$subnets6)) $subnets6[] = $network; } } -$subnets = implode(', ',$subnets); -$hosts = implode(', ',$hosts); -$subnets6 = implode(', ',$subnets6); -$hosts6 = implode(', ',$hosts6); +$subnets = implode(',',$subnets); +$hosts = implode(',',$hosts); +$subnets6 = implode(',',$subnets6); +$hosts6 = implode(',',$hosts6); function ifname($eth,$new) { return str_replace('eth',$new,$eth); @@ -54,7 +54,7 @@ function iflink($eth) { function concat($array) { return implode(',',array_map(function($v){return "'$v'";},$array)); } -function readConf(&$peer_wg, &$wg, $vtun) { +function readConf(&$peer_wg,&$wg,$vtun) { global $etc,$netbase,$netpool,$netbase6,$netpool6,$validIP4,$validIP6; $conf = "$etc/$vtun.conf"; $cfg = "$etc/$vtun.cfg"; @@ -123,7 +123,7 @@ function readConf(&$peer_wg, &$wg, $vtun) { $netbase6[$vtun] = $netpool6[$vtun]; } foreach ($peer_wg as $i) if ($wg["TYPE:$i"]>=7) {$vpn = $wg["TYPE:$i"]; break;} - return [$conf, $cfg, $file, $vpn]; + return [$conf,$cfg,$file,$vpn]; } $public = $nginx['NGINX_WANFQDN']; $active = (array)explode(' ',exec('wg show interfaces')); @@ -177,7 +177,7 @@ $netpool6['wg0'] = 'fc00:253:0:0::'; $netport['wg0'] = 51820; // read current configuration -[$conf_wg0, $cfg_wg0, $this_wg0, $vpn_wg0] = readConf($peer_wg0, $wg0, 'wg0'); +[$conf_wg0,$cfg_wg0,$this_wg0,$vpn_wg0] = readConf($peer_wg0,$wg0,'wg0'); // gather IPv4 and IPv6 addresses for available interfaces $endpoints = []; @@ -190,7 +190,7 @@ while (isset($$eth)) { // remove obsolete tunnels foreach (glob("$docroot/webGui/WG[1-9]*.page",GLOB_NOSORT) as $wgX) { - if (!in_array(strtolower(basename($wgX,'.page')), $vtuns)) { + if (!in_array(strtolower(basename($wgX,'.page')),$vtuns)) { unlink($wgX); $build = true; } @@ -202,7 +202,7 @@ foreach ($vtuns as $wgX) { if (!file_exists($file)) { $X = filter_var($wgX,FILTER_SANITIZE_NUMBER_INT); $nnn = 100 + $X; - copy($template, $file); + copy($template,$file); exec("sed -i 's/parentname:nnn/VPNmanager:$nnn/;s/XXX/$X/g;s/wgX/$wgX/g' $file"); chmod($file,0644); $build = true; @@ -386,10 +386,9 @@ function prepareSettings(form,vtun) { postdown.val(postdown.val().replace(//,listen)); } postup = form.find('input[name="PostUp:0:1"]'); - postdown = form.find('input[name="PostDown:0:1"]'); postup.val(postup.val().replace(//,vtun)); + postdown = form.find('input[name="PostDown:0:1"]'); postdown.val(postdown.val().replace(//,vtun)); - postup = form.find('input[name="PostUp:0:2"]'); postdown = form.find('input[name="PostDown:0:2"]'); var drop = form.find('input[name="DROP:0"]').val(); diff --git a/plugins/dynamix/WGX.page b/plugins/dynamix/WGX.page index 4afcd254f..442bb4940 100644 --- a/plugins/dynamix/WGX.page +++ b/plugins/dynamix/WGX.page @@ -24,7 +24,7 @@ $netpool6['wgX'] = str_replace(':0:0:',':XXX:0:',$netpool6['wg0']); $netport['wgX'] = $netport['wg0']+XXX; // read current configuration -[$conf_wgX, $cfg_wgX, $this_wgX, $vpn_wgX] = readConf($peer_wgX, $wgX, 'wgX'); +[$conf_wgX,$cfg_wgX,$this_wgX,$vpn_wgX] = readConf($peer_wgX,$wgX,'wgX'); ?>