BastionGuard::WireguardBackend Class Reference

#include <WireguardBackend.hpp>

Public Member Functions
	WireguardBackend (std::string iface="wg0")
bool	tooling_available (std::string *missing=nullptr) const
bool	load_from_conf (const std::string &conf_path, std::string *err=nullptr)
bool	load_from_params (const WgConfigParams &p, std::string *err=nullptr)
bool	has_spec () const
std::string	configured_endpoint () const
std::optional< WgKeyPair >	generate_keys () const
OpResult	connect ()
OpResult	disconnect ()
WgStatus	status () const
std::optional< std::string >	public_ip () const
OpResult	killswitch_enable ()
OpResult	killswitch_disable ()
bool	killswitch_active () const
const std::string &	interface_name () const

Private Member Functions
OpResult	run (const std::vector< std::string > &argv, bool privileged) const
OpResult	run_with_stdin (const std::vector< std::string > &argv, const std::string &stdin_data, bool privileged) const
std::string	build_wg_setconf_text () const

Private Attributes
std::string	iface_
WgTunnelSpec	spec_

Detailed Description

Definition at line 95 of file WireguardBackend.hpp.

Constructor & Destructor Documentation

WireguardBackend()

BastionGuard::WireguardBackend::WireguardBackend ( std::string iface = "wg0" )

explicit

Definition at line 27 of file WireguardBackend.cpp.

    : iface_(std::move(iface)) {}

References iface_.

Member Function Documentation

build_wg_setconf_text()

std::string BastionGuard::WireguardBackend::build_wg_setconf_text ( ) const

private

Definition at line 371 of file WireguardBackend.cpp.

                                                        {
    std::ostringstream os;
    os << "[Interface]\n";
    os << "PrivateKey = " << spec_.private_key << "\n";
    if (!spec_.listen_port.empty()) os << "ListenPort = " << spec_.listen_port << "\n";
    for (const auto& p : spec_.peers) {
        os << "\n[Peer]\n";
        os << "PublicKey = " << p.public_key << "\n";
        if (!p.preshared_key.empty())
            os << "PresharedKey = " << p.preshared_key << "\n";
        if (!p.endpoint.empty())
            os << "Endpoint = " << p.endpoint << "\n";
        if (!p.allowed_ips.empty())
            os << "AllowedIPs = " << p.allowed_ips << "\n";
        if (!p.persistent_keepalive.empty())
            os << "PersistentKeepalive = " << p.persistent_keepalive << "\n";
    }
    return os.str();
}

References BastionGuard::WgTunnelSpec::listen_port, BastionGuard::WgTunnelSpec::peers, BastionGuard::WgTunnelSpec::private_key, and spec_.

Referenced by connect().

configured_endpoint()

std::string BastionGuard::WireguardBackend::configured_endpoint ( ) const

inline

Definition at line 115 of file WireguardBackend.hpp.

                                          {
        return spec_.peers.empty() ? std::string{} : spec_.peers[0].endpoint;
    }

References BastionGuard::WgTunnelSpec::peers, and spec_.

connect()

OpResult BastionGuard::WireguardBackend::connect

(

)

Definition at line 404 of file WireguardBackend.cpp.

                                   {
    OpResult res;
    std::string validation_error;
    if (!validate_spec_(spec_, &validation_error) || !valid_iface_(iface_)) {
        res.ok = false;
        res.exit_code = -1;
        res.output = validation_error.empty() ? "Interfaccia WireGuard non valida." : validation_error;
        return res;
    }
 
    auto fail = [](const std::string& step, const OpResult& r) {
        OpResult out = r;
        out.ok = false;
        out.output = step + (r.output.empty() ? std::string{} : ": " + r.output);
        return out;
    };
 
    // Cleanup residue from an interrupted previous connection. Errors here are harmless.
    run({"ip", "link", "delete", "dev", iface_}, true);
 
    OpResult r = run({"ip", "link", "add", "dev", iface_, "type", "wireguard"}, true);
    if (!r.ok) return fail("ip link add", r);
 
    const std::string wg_text = build_wg_setconf_text();
    r = run_with_stdin({"wg", "setconf", iface_, "/dev/stdin"}, wg_text, true);
    if (!r.ok) {
        run({"ip", "link", "delete", "dev", iface_}, true);
        return fail("wg setconf", r);
    }
 
    if (spec_.mtu > 0) {
        r = run({"ip", "link", "set", "dev", iface_, "mtu", std::to_string(spec_.mtu)}, true);
        if (!r.ok) return fail("ip link mtu", r);
    }
 
    for (const auto& a : spec_.addresses) {
        const std::string fam = (a.find(':') != std::string::npos) ? "-6" : "-4";
        r = run({"ip", fam, "address", "add", a, "dev", iface_}, true);
        if (!r.ok) return fail("ip address add", r);
    }
 
    r = run({"ip", "link", "set", "dev", iface_, "up"}, true);
    if (!r.ok) return fail("ip link up", r);
 
    if (needs_default_route_(spec_)) {
        // These may already exist after a previous interrupted run; preserve the
        // old `|| true` semantics by intentionally ignoring duplicate errors.
        run({"ip", "-4", "route", "add", "default", "dev", iface_, "table", "51820"}, true);
        run({"ip", "-4", "rule", "add", "not", "from", "all", "fwmark", "0x51820",
             "lookup", "51820", "priority", "32764"}, true);
        run({"ip", "-4", "rule", "add", "table", "main", "suppress_prefixlength", "0",
             "priority", "32765"}, true);
        run({"wg", "set", iface_, "fwmark", "0x51820"}, true);
        run({"sysctl", "-q", "net.ipv4.conf.all.src_valid_mark=1"}, true);
    } else {
        for (const auto& peer : spec_.peers) {
            for (const auto& cidr : split_csv_(peer.allowed_ips)) {
                if (cidr == "0.0.0.0/0" || cidr == "::/0") continue;
                const std::string fam = (cidr.find(':') != std::string::npos) ? "-6" : "-4";
                run({"ip", fam, "route", "add", cidr, "dev", iface_}, true);
            }
        }
    }
 
    if (!spec_.dns.empty()) {
        static const std::string bak = "/etc/resolv.conf.bastionguard.bak";
        if (!fs::exists(bak)) {
            run({"cp", "-a", "--no-dereference", "--", "/etc/resolv.conf", bak}, true);
        }
 
        std::ostringstream dns_text;
        for (const auto& ns : spec_.dns)
            dns_text << "nameserver " << ns << "\n";
 
        r = run_with_stdin({"tee", "/etc/resolv.conf"}, dns_text.str(), true);
        if (!r.ok) return fail("aggiornamento DNS", r);
    }
 
    res.ok = true;
    res.exit_code = 0;
    res.output = "Tunnel WireGuard attivato.";
    return res;
}

References BastionGuard::WgTunnelSpec::addresses, build_wg_setconf_text(), BastionGuard::WgTunnelSpec::dns, BastionGuard::OpResult::exit_code, iface_, BastionGuard::WgTunnelSpec::mtu, BastionGuard::needs_default_route_(), BastionGuard::OpResult::ok, BastionGuard::OpResult::output, BastionGuard::WgTunnelSpec::peers, run(), run_with_stdin(), spec_, BastionGuard::split_csv_(), BastionGuard::valid_iface_(), and BastionGuard::validate_spec_().

disconnect()

OpResult BastionGuard::WireguardBackend::disconnect

(

)

Definition at line 491 of file WireguardBackend.cpp.

                                      {
    static const std::string bak = "/etc/resolv.conf.bastionguard.bak";
 
    if (fs::exists(bak)) {
        run({"rm", "-f", "--", "/etc/resolv.conf"}, true);
        run({"cp", "-a", "--no-dereference", "--", bak, "/etc/resolv.conf"}, true);
        run({"rm", "-f", "--", bak}, true);
    }
 
    run({"ip", "-4", "rule", "del", "table", "main", "suppress_prefixlength", "0",
         "priority", "32765"}, true);
    run({"ip", "-4", "rule", "del", "not", "from", "all", "fwmark", "0x51820",
         "lookup", "51820", "priority", "32764"}, true);
    run({"ip", "-4", "route", "flush", "table", "51820"}, true);
    run({"ip", "link", "delete", "dev", iface_}, true);
 
    OpResult check = run({"ip", "link", "show", iface_}, false);
    OpResult res;
    res.ok = !check.ok;
    res.exit_code = res.ok ? 0 : 1;
    res.output = res.ok ? "Tunnel WireGuard disattivato." : "Interfaccia WireGuard ancora presente.";
    return res;
}

References iface_, BastionGuard::OpResult::ok, and run().

generate_keys()

std::optional< WgKeyPair > BastionGuard::WireguardBackend::generate_keys

(

)

const

Definition at line 356 of file WireguardBackend.cpp.

                                                             {
    OpResult gen = run({"wg", "genkey"}, false);
    if (!gen.ok) return std::nullopt;
    std::string priv = strip_(gen.output);
    if (priv.empty()) return std::nullopt;
    OpResult pub = run_with_stdin({"wg", "pubkey"}, priv + "\n", false);
    if (!pub.ok) return std::nullopt;
    std::string pk = strip_(pub.output);
    if (pk.empty()) return std::nullopt;
    return WgKeyPair{priv, pk};
}

References BastionGuard::OpResult::ok, BastionGuard::OpResult::output, run(), run_with_stdin(), and BastionGuard::strip_().

has_spec()

bool BastionGuard::WireguardBackend::has_spec ( ) const

inline

Definition at line 111 of file WireguardBackend.hpp.

{ return spec_.valid(); }

References spec_, and BastionGuard::WgTunnelSpec::valid().

interface_name()

const std::string & BastionGuard::WireguardBackend::interface_name ( ) const

inline

Definition at line 137 of file WireguardBackend.hpp.

{ return iface_; }

References iface_.

killswitch_active()

bool BastionGuard::WireguardBackend::killswitch_active

(

)

const

Definition at line 618 of file WireguardBackend.cpp.

                                               {
    return run({"nft", "list", "table", "inet", kKsTable}, true).ok;
}

References BastionGuard::kKsTable, and run().

killswitch_disable()

OpResult BastionGuard::WireguardBackend::killswitch_disable

(

)

Definition at line 608 of file WireguardBackend.cpp.

                                              {
    OpResult r = run({"nft", "delete", "table", "inet", kKsTable}, true);
    if (!r.ok) {
        // An already absent table is equivalent to a disabled kill-switch.
        r.ok = true;
        r.exit_code = 0;
    }
    return r;
}

References BastionGuard::kKsTable, and run().

killswitch_enable()

OpResult BastionGuard::WireguardBackend::killswitch_enable

(

)

Definition at line 570 of file WireguardBackend.cpp.

                                             {
    if (!valid_iface_(iface_))
        return OpResult{false, -1, "Interfaccia WireGuard non valida."};
 
    WgStatus st = status();
    std::string endpoint_rule;
    if (!st.endpoint.empty()) {
        std::string host;
        if (st.endpoint.front() == '[') {
            auto close = st.endpoint.find(']');
            if (close != std::string::npos) host = st.endpoint.substr(1, close - 1);
        } else {
            auto pos = st.endpoint.rfind(':');
            if (pos != std::string::npos) host = st.endpoint.substr(0, pos);
        }
 
        struct in_addr a4 {};
        struct in6_addr a6 {};
        if (::inet_pton(AF_INET, host.c_str(), &a4) == 1)
            endpoint_rule = "    ip daddr " + host + " accept\n";
        else if (::inet_pton(AF_INET6, host.c_str(), &a6) == 1)
            endpoint_rule = "    ip6 daddr " + host + " accept\n";
    }
 
    std::ostringstream rules;
    rules << "table inet " << kKsTable << " {\n"
          << "  chain out {\n"
          << "    type filter hook output priority 0; policy drop;\n"
          << "    oifname lo accept\n"
          << "    oifname \"" << iface_ << "\" accept\n"
          << endpoint_rule
          << "    meta l4proto udp accept\n"
          << "  }\n"
          << "}\n";
 
    return run_with_stdin({"nft", "-f", "-"}, rules.str(), true);
}

References AF_INET, AF_INET6, BastionGuard::WgStatus::endpoint, iface_, BastionGuard::kKsTable, run_with_stdin(), status(), and BastionGuard::valid_iface_().

load_from_conf()

bool BastionGuard::WireguardBackend::load_from_conf	(	const std::string &	conf_path,
		std::string *	err = nullptr )

Definition at line 266 of file WireguardBackend.cpp.

                                                      {
    std::ifstream in(conf_path);
    if (!in) { if (err) *err = "Impossibile aprire: " + conf_path; return false; }
 
    WgTunnelSpec sp;
    enum class Section { None, Interface, Peer } sec = Section::None;
    WgPeer cur_peer;
 
    auto flush_peer = [&]() {
        if (!cur_peer.public_key.empty() || !cur_peer.endpoint.empty()) {
            sp.peers.push_back(cur_peer);
            cur_peer = {};
        }
    };
 
    std::string line;
    while (std::getline(in, line)) {
        std::string t = strip_(line);
        if (t.empty() || t[0] == '#' || t[0] == ';') continue;
 
        if (t.front() == '[' && t.back() == ']') {
            std::string name = t.substr(1, t.size() - 2);
            // normalizza
            for (auto& c : name) c = (char)std::tolower((unsigned char)c);
            if (name == "interface") { flush_peer(); sec = Section::Interface; }
            else if (name == "peer") { flush_peer(); sec = Section::Peer; }
            else sec = Section::None;
            continue;
        }
 
        // key = value (con qualunque spaziatura)
        size_t eq = t.find('=');
        if (eq == std::string::npos) continue;
        std::string k = strip_(t.substr(0, eq));
        std::string v = strip_(t.substr(eq + 1));
        std::string kl = k;
        for (auto& c : kl) c = (char)std::tolower((unsigned char)c);
 
        if (sec == Section::Interface) {
            if      (kl == "privatekey") sp.private_key = v;
            else if (kl == "address")    sp.addresses = split_csv_(v);
            else if (kl == "dns")        sp.dns       = split_csv_(v);
            else if (kl == "listenport") sp.listen_port = v;
            else if (kl == "mtu")        sp.mtu = std::atoi(v.c_str());
            // PostUp/PostDown/Table/SaveConfig: IGNORATI (sono cose di wg-quick)
        } else if (sec == Section::Peer) {
            if      (kl == "publickey")           cur_peer.public_key = v;
            else if (kl == "presharedkey")        cur_peer.preshared_key = v;
            else if (kl == "endpoint")            cur_peer.endpoint = v;
            else if (kl == "allowedips")          cur_peer.allowed_ips = v;
            else if (kl == "persistentkeepalive") cur_peer.persistent_keepalive = v;
        }
    }
    flush_peer();
 
    if (!validate_spec_(sp, err)) return false;
    spec_ = std::move(sp);
    return true;
}

References BastionGuard::WgTunnelSpec::addresses, BastionGuard::WgPeer::allowed_ips, BastionGuard::WgTunnelSpec::dns, BastionGuard::WgPeer::endpoint, BastionGuard::WgTunnelSpec::listen_port, BastionGuard::WgTunnelSpec::mtu, BastionGuard::WgTunnelSpec::peers, BastionGuard::WgPeer::persistent_keepalive, BastionGuard::WgPeer::preshared_key, BastionGuard::WgTunnelSpec::private_key, BastionGuard::WgPeer::public_key, spec_, BastionGuard::split_csv_(), BastionGuard::strip_(), and BastionGuard::validate_spec_().

load_from_params()

bool BastionGuard::WireguardBackend::load_from_params	(	const WgConfigParams &	p,
		std::string *	err = nullptr )

Definition at line 327 of file WireguardBackend.cpp.

                                                        {
    if (p.private_key.empty() || p.server_public_key.empty() ||
        p.endpoint.empty() || p.address.empty()) {
        if (err) *err = "Campi obbligatori mancanti.";
        return false;
    }
    WgTunnelSpec sp;
    sp.private_key = p.private_key;
    sp.addresses   = split_csv_(p.address);
    if (!p.dns.empty()) sp.dns = split_csv_(p.dns);
    sp.listen_port = p.listen_port;
 
    WgPeer peer;
    peer.public_key  = p.server_public_key;
    peer.endpoint    = p.endpoint;
    peer.allowed_ips = p.allowed_ips.empty() ? std::string("0.0.0.0/0, ::/0")
                                              : p.allowed_ips;
    peer.persistent_keepalive = p.persistent_keepalive;
    sp.peers.push_back(peer);
 
    if (!validate_spec_(sp, err)) return false;
    spec_ = std::move(sp);
    return true;
}

References BastionGuard::WgConfigParams::address, BastionGuard::WgTunnelSpec::addresses, BastionGuard::WgConfigParams::allowed_ips, BastionGuard::WgPeer::allowed_ips, BastionGuard::WgConfigParams::dns, BastionGuard::WgTunnelSpec::dns, BastionGuard::WgConfigParams::endpoint, BastionGuard::WgPeer::endpoint, BastionGuard::WgConfigParams::listen_port, BastionGuard::WgTunnelSpec::listen_port, BastionGuard::WgTunnelSpec::peers, BastionGuard::WgConfigParams::persistent_keepalive, BastionGuard::WgPeer::persistent_keepalive, BastionGuard::WgConfigParams::private_key, BastionGuard::WgTunnelSpec::private_key, BastionGuard::WgPeer::public_key, BastionGuard::WgConfigParams::server_public_key, spec_, BastionGuard::split_csv_(), and BastionGuard::validate_spec_().

public_ip()

std::optional< std::string > BastionGuard::WireguardBackend::public_ip

(

)

const

Definition at line 545 of file WireguardBackend.cpp.

                                                         {
    // Proviamo più servizi: se uno è lento/bloccato, passiamo al successivo.
    static const char* endpoints[] = {
        "https://api.ipify.org",
        "https://ifconfig.me/ip",
        "https://icanhazip.com",
        "https://ipinfo.io/ip",
    };
    for (const char* url : endpoints) {
        OpResult r = run({"curl", "-s", "-4", "--max-time", "10", url}, false);
        if (r.ok) {
            std::string ip = strip_(r.output);
            // sanity: deve assomigliare a un IPv4
            if (!ip.empty() && ip.find_first_not_of("0123456789.") == std::string::npos)
                return ip;
        }
    }
    return std::nullopt;
}

References run(), and BastionGuard::strip_().

run()

OpResult BastionGuard::WireguardBackend::run ( const std::vector< std::string > & argv, bool privileged ) const

private

Definition at line 33 of file WireguardBackend.cpp.

                                                      {
    OpResult res;
    std::vector<std::string> full;
    if (privileged) full.push_back("pkexec");
    full.insert(full.end(), argv.begin(), argv.end());
 
    std::string out, err;
    int exit_status = 0;
    try {
        Glib::spawn_sync("", full, Glib::SpawnFlags::SEARCH_PATH,
                         {}, &out, &err, &exit_status);
    } catch (const Glib::Error& e) {
        res.ok = false; res.exit_code = -1;
        res.output = std::string("spawn error: ") + e.what();
        return res;
    }
    res.exit_code = exit_status;
    res.ok = (exit_status == 0);
    res.output = out;
    if (!err.empty()) { if (!res.output.empty()) res.output += "\n"; res.output += err; }
    return res;
}

References BastionGuard::OpResult::exit_code, BastionGuard::OpResult::ok, and BastionGuard::OpResult::output.

Referenced by connect(), disconnect(), generate_keys(), killswitch_active(), killswitch_disable(), public_ip(), and status().

run_with_stdin()

OpResult BastionGuard::WireguardBackend::run_with_stdin ( const std::vector< std::string > & argv, const std::string & stdin_data, bool privileged ) const

private

Definition at line 57 of file WireguardBackend.cpp.

                                                                 {
    OpResult res;
    std::vector<std::string> full;
    if (privileged) full.push_back("pkexec");
    full.insert(full.end(), argv.begin(), argv.end());
 
    std::vector<char*> c_argv;
    c_argv.reserve(full.size() + 1);
    for (auto& s : full) c_argv.push_back(const_cast<char*>(s.c_str()));
    c_argv.push_back(nullptr);
 
    int in_pipe[2], out_pipe[2];
    if (pipe(in_pipe) != 0 || pipe(out_pipe) != 0) {
        res.ok = false; res.output = "pipe() fallita"; return res;
    }
    pid_t pid = fork();
    if (pid < 0) { res.ok = false; res.output = "fork() fallita"; return res; }
    if (pid == 0) {
        dup2(in_pipe[0], STDIN_FILENO);
        dup2(out_pipe[1], STDOUT_FILENO);
        dup2(out_pipe[1], STDERR_FILENO);
        close(in_pipe[0]); close(in_pipe[1]);
        close(out_pipe[0]); close(out_pipe[1]);
        execvp(c_argv[0], c_argv.data());
        _exit(127);
    }
    close(in_pipe[0]); close(out_pipe[1]);
    size_t w = 0;
    while (w < stdin_data.size()) {
        ssize_t n = write(in_pipe[1], stdin_data.data() + w, stdin_data.size() - w);
        if (n <= 0) break;
        w += (size_t)n;
    }
    close(in_pipe[1]);
 
    std::string output; char buf[4096]; ssize_t n;
    while ((n = read(out_pipe[0], buf, sizeof(buf))) > 0)
        output.append(buf, (size_t)n);
    close(out_pipe[0]);
 
    int status = 0; waitpid(pid, &status, 0);
    res.output = output;
    if (WIFEXITED(status)) { res.exit_code = WEXITSTATUS(status); res.ok = (res.exit_code == 0); }
    else { res.exit_code = -1; res.ok = false; }
    return res;
}

References BastionGuard::OpResult::exit_code, BastionGuard::OpResult::ok, BastionGuard::OpResult::output, and status().

Referenced by connect(), generate_keys(), and killswitch_enable().

status()

WgStatus BastionGuard::WireguardBackend::status

(

)

const

Definition at line 518 of file WireguardBackend.cpp.

                                        {
    WgStatus st; st.interface = iface_;
 
    // Rilevamento "up/down" primario SENZA privilegi: l'esistenza
    // dell'interfaccia wg0 con stato UP è leggibile da `ip link show`,
    // che non richiede root (a differenza di `wg show` su molti sistemi).
    OpResult link = run({"ip", "link", "show", iface_}, false);
    if (!link.ok) { st.up = false; return st; }   // interfaccia assente
    st.up = true;
 
    // Dettagli (endpoint, handshake) da `wg show`: utile ma non essenziale,
    // e può richiedere privilegi. Proviamo senza, poi con pkexec solo se
    // l'output sembra negato. Se fallisce, lasciamo st.up=true comunque.
    OpResult r = run({"wg", "show", iface_}, false);
    if (!r.ok) return st;   // niente dettagli, ma il tunnel è su
    std::istringstream iss(r.output);
    std::string line;
    while (std::getline(iss, line)) {
        std::string t = strip_(line);
        if (t.rfind("endpoint:", 0) == 0)
            st.endpoint = strip_(t.substr(9));
        else if (t.rfind("latest handshake:", 0) == 0)
            st.last_handshake = strip_(t.substr(17));
    }
    return st;
}

References BastionGuard::WgStatus::endpoint, iface_, BastionGuard::WgStatus::interface, BastionGuard::WgStatus::last_handshake, BastionGuard::OpResult::ok, run(), BastionGuard::strip_(), and BastionGuard::WgStatus::up.

Referenced by killswitch_enable(), and run_with_stdin().

tooling_available()

bool BastionGuard::WireguardBackend::tooling_available

(

std::string *

missing = nullptr

)

const

Definition at line 125 of file WireguardBackend.cpp.

                                                                 {
    if (!in_path_("wg"))  { if (missing) *missing = "wg";  return false; }
    if (!in_path_("ip"))  { if (missing) *missing = "ip";  return false; }
    return true;
}

References BastionGuard::in_path_().

Member Data Documentation

iface_

std::string BastionGuard::WireguardBackend::iface_

private

Definition at line 140 of file WireguardBackend.hpp.

Referenced by connect(), disconnect(), interface_name(), killswitch_enable(), status(), and WireguardBackend().

spec_

WgTunnelSpec BastionGuard::WireguardBackend::spec_

private

Definition at line 141 of file WireguardBackend.hpp.

Referenced by build_wg_setconf_text(), configured_endpoint(), connect(), has_spec(), load_from_conf(), and load_from_params().

---

The documentation for this class was generated from the following files:

• BastionGuard/src/vpn/WireguardBackend.hpp
• BastionGuard/src/vpn/WireguardBackend.cpp