From: Jason A. Donenfeld Date: Fri, 27 Dec 2019 14:41:12 +0000 (+0100) Subject: wireguard: bump to 20191226 X-Git-Tag: v1.5.0-20200110~2 X-Git-Url: https://git.librecmc.org/?p=librecmc%2Flibrecmc.git;a=commitdiff_plain;h=fa92165a8af890f111922cf68bb01f8281cb75af wireguard: bump to 20191226 As announced on the mailing list, WireGuard will be in Linux 5.6. As a result, the wg(8) tool, used by OpenWRT in the same manner as ip(8), is moving to its own wireguard-tools repo. Meanwhile, the out-of-tree kernel module for kernels 3.10 - 5.5 moved to its own wireguard-linux- compat repo. Yesterday, releases were cut out of these repos, so this commit bumps packages to match. Since wg(8) and the compat kernel module are versioned and released separately, we create a wireguard-tools Makefile to contain the source for the new tools repo. Later, when OpenWRT moves permanently to Linux 5.6, we'll drop the original module package, leaving only the tools. So this commit shuffles the build definition around a bit but is basically the same idea as before. Signed-off-by: Jason A. Donenfeld --- diff --git a/package/network/services/wireguard/Makefile b/package/network/services/wireguard/Makefile index 2849361733..c379b712dd 100644 --- a/package/network/services/wireguard/Makefile +++ b/package/network/services/wireguard/Makefile @@ -1,5 +1,5 @@ # -# Copyright (C) 2016-2018 Jason A. Donenfeld +# Copyright (C) 2016-2019 Jason A. Donenfeld # Copyright (C) 2016 Baptiste Jonglez # Copyright (C) 2016-2017 Dan Luedtke # @@ -11,17 +11,17 @@ include $(INCLUDE_DIR)/kernel.mk PKG_NAME:=wireguard -PKG_VERSION:=0.0.20191219 +PKG_VERSION:=0.0.20191226 PKG_RELEASE:=1 -PKG_SOURCE:=WireGuard-$(PKG_VERSION).tar.xz -PKG_SOURCE_URL:=https://git.zx2c4.com/WireGuard/snapshot/ -PKG_HASH:=5aba6f0c38e97faa0b155623ba594bb0e4bd5e29deacd8d5ed8bda8d8283b0e7 +PKG_SOURCE:=wireguard-linux-compat-$(PKG_VERSION).tar.xz +PKG_SOURCE_URL:=https://git.zx2c4.com/wireguard-linux-compat/snapshot/ +PKG_HASH:=7c0e576459c6337bcdea692bdbec561719a15da207dc739e0e3e60ff821a5491 -PKG_LICENSE:=GPL-2.0 Apache-2.0 +PKG_LICENSE:=GPL-2.0 PKG_LICENSE_FILES:=COPYING -PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/WireGuard-$(PKG_VERSION) +PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/wireguard-linux-compat-$(PKG_VERSION) PKG_BUILD_PARALLEL:=1 PKG_USE_MIPS16:=0 @@ -56,13 +56,8 @@ endef include $(INCLUDE_DIR)/kernel-defaults.mk include $(INCLUDE_DIR)/package-defaults.mk -# Used by Build/Compile/Default -MAKE_PATH:=src/tools -MAKE_VARS += PLATFORM=linux - define Build/Compile $(MAKE) $(KERNEL_MAKEOPTS) M="$(PKG_BUILD_DIR)/src" modules - $(call Build/Compile/Default) endef define Package/wireguard/install @@ -73,27 +68,6 @@ define Package/wireguard/description $(call Package/wireguard/Default/description) endef -define Package/wireguard-tools - $(call Package/wireguard/Default) - TITLE:=WireGuard userspace control program (wg) - DEPENDS:=+libmnl +ip -endef - -define Package/wireguard-tools/description - $(call Package/wireguard/Default/description) - - This package provides the userspace control program for WireGuard, - `wg(8)`, a netifd protocol helper, and a re-resolve watchdog script. -endef - -define Package/wireguard-tools/install - $(INSTALL_DIR) $(1)/usr/bin/ - $(INSTALL_BIN) $(PKG_BUILD_DIR)/src/tools/wg $(1)/usr/bin/ - $(INSTALL_BIN) ./files/wireguard_watchdog $(1)/usr/bin/ - $(INSTALL_DIR) $(1)/lib/netifd/proto/ - $(INSTALL_BIN) ./files/wireguard.sh $(1)/lib/netifd/proto/ -endef - define KernelPackage/wireguard SECTION:=kernel CATEGORY:=Kernel modules @@ -111,5 +85,4 @@ define KernelPackage/wireguard/description endef $(eval $(call BuildPackage,wireguard)) -$(eval $(call BuildPackage,wireguard-tools)) $(eval $(call KernelPackage,wireguard)) diff --git a/package/network/services/wireguard/files/wireguard.sh b/package/network/services/wireguard/files/wireguard.sh deleted file mode 100644 index 4c811c6ba9..0000000000 --- a/package/network/services/wireguard/files/wireguard.sh +++ /dev/null @@ -1,185 +0,0 @@ -#!/bin/sh -# Copyright 2016-2017 Dan Luedtke -# Licensed to the public under the Apache License 2.0. - -WG=/usr/bin/wg -if [ ! -x $WG ]; then - logger -t "wireguard" "error: missing wireguard-tools (${WG})" - exit 0 -fi - -[ -n "$INCLUDE_ONLY" ] || { - . /lib/functions.sh - . ../netifd-proto.sh - init_proto "$@" -} - -proto_wireguard_init_config() { - proto_config_add_string "private_key" - proto_config_add_int "listen_port" - proto_config_add_int "mtu" - proto_config_add_string "fwmark" - available=1 - no_proto_task=1 -} - -proto_wireguard_setup_peer() { - local peer_config="$1" - - local public_key - local preshared_key - local allowed_ips - local route_allowed_ips - local endpoint_host - local endpoint_port - local persistent_keepalive - - config_get public_key "${peer_config}" "public_key" - config_get preshared_key "${peer_config}" "preshared_key" - config_get allowed_ips "${peer_config}" "allowed_ips" - config_get_bool route_allowed_ips "${peer_config}" "route_allowed_ips" 0 - config_get endpoint_host "${peer_config}" "endpoint_host" - config_get endpoint_port "${peer_config}" "endpoint_port" - config_get persistent_keepalive "${peer_config}" "persistent_keepalive" - - echo "[Peer]" >> "${wg_cfg}" - echo "PublicKey=${public_key}" >> "${wg_cfg}" - if [ "${preshared_key}" ]; then - echo "PresharedKey=${preshared_key}" >> "${wg_cfg}" - fi - for allowed_ip in $allowed_ips; do - echo "AllowedIPs=${allowed_ip}" >> "${wg_cfg}" - done - if [ "${endpoint_host}" ]; then - case "${endpoint_host}" in - *:*) - endpoint="[${endpoint_host}]" - ;; - *) - endpoint="${endpoint_host}" - ;; - esac - if [ "${endpoint_port}" ]; then - endpoint="${endpoint}:${endpoint_port}" - else - endpoint="${endpoint}:51820" - fi - echo "Endpoint=${endpoint}" >> "${wg_cfg}" - fi - if [ "${persistent_keepalive}" ]; then - echo "PersistentKeepalive=${persistent_keepalive}" >> "${wg_cfg}" - fi - - if [ ${route_allowed_ips} -ne 0 ]; then - for allowed_ip in ${allowed_ips}; do - case "${allowed_ip}" in - *:*/*) - proto_add_ipv6_route "${allowed_ip%%/*}" "${allowed_ip##*/}" - ;; - *.*/*) - proto_add_ipv4_route "${allowed_ip%%/*}" "${allowed_ip##*/}" - ;; - *:*) - proto_add_ipv6_route "${allowed_ip%%/*}" "128" - ;; - *.*) - proto_add_ipv4_route "${allowed_ip%%/*}" "32" - ;; - esac - done - fi -} - -proto_wireguard_setup() { - local config="$1" - local wg_dir="/tmp/wireguard" - local wg_cfg="${wg_dir}/${config}" - - local private_key - local listen_port - local mtu - - config_load network - config_get private_key "${config}" "private_key" - config_get listen_port "${config}" "listen_port" - config_get addresses "${config}" "addresses" - config_get mtu "${config}" "mtu" - config_get fwmark "${config}" "fwmark" - config_get ip6prefix "${config}" "ip6prefix" - config_get nohostroute "${config}" "nohostroute" - - ip link del dev "${config}" 2>/dev/null - ip link add dev "${config}" type wireguard - - if [ "${mtu}" ]; then - ip link set mtu "${mtu}" dev "${config}" - fi - - proto_init_update "${config}" 1 - - umask 077 - mkdir -p "${wg_dir}" - echo "[Interface]" > "${wg_cfg}" - echo "PrivateKey=${private_key}" >> "${wg_cfg}" - if [ "${listen_port}" ]; then - echo "ListenPort=${listen_port}" >> "${wg_cfg}" - fi - if [ "${fwmark}" ]; then - echo "FwMark=${fwmark}" >> "${wg_cfg}" - fi - config_foreach proto_wireguard_setup_peer "wireguard_${config}" - - # apply configuration file - ${WG} setconf ${config} "${wg_cfg}" - WG_RETURN=$? - - rm -f "${wg_cfg}" - - if [ ${WG_RETURN} -ne 0 ]; then - sleep 5 - proto_setup_failed "${config}" - exit 1 - fi - - for address in ${addresses}; do - case "${address}" in - *:*/*) - proto_add_ipv6_address "${address%%/*}" "${address##*/}" - ;; - *.*/*) - proto_add_ipv4_address "${address%%/*}" "${address##*/}" - ;; - *:*) - proto_add_ipv6_address "${address%%/*}" "128" - ;; - *.*) - proto_add_ipv4_address "${address%%/*}" "32" - ;; - esac - done - - for prefix in ${ip6prefix}; do - proto_add_ipv6_prefix "$prefix" - done - - # endpoint dependency - if [ "${nohostroute}" != "1" ]; then - wg show "${config}" endpoints | \ - sed -E 's/\[?([0-9.:a-f]+)\]?:([0-9]+)/\1 \2/' | \ - while IFS=$'\t ' read -r key address port; do - [ -n "${port}" ] || continue - proto_add_host_dependency "${config}" "${address}" - done - fi - - proto_send_update "${config}" -} - -proto_wireguard_teardown() { - local config="$1" - ip link del dev "${config}" >/dev/null 2>&1 -} - -[ -n "$INCLUDE_ONLY" ] || { - add_protocol wireguard -} diff --git a/package/network/services/wireguard/files/wireguard_watchdog b/package/network/services/wireguard/files/wireguard_watchdog deleted file mode 100644 index 5fbbeafec1..0000000000 --- a/package/network/services/wireguard/files/wireguard_watchdog +++ /dev/null @@ -1,60 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: GPL-2.0 -# -# Copyright (C) 2018 Aleksandr V. Piskunov . -# Copyright (C) 2015-2018 Jason A. Donenfeld . All Rights Reserved. -# -# This watchdog script tries to re-resolve hostnames for inactive WireGuard peers. -# Use it for peers with a frequently changing dynamic IP. -# persistent_keepalive must be set, recommended value is 25 seconds. -# -# Run this script from cron every minute: -# echo '* * * * * /usr/bin/wireguard_watchdog' >> /etc/crontabs/root - - -. /lib/functions.sh - -check_peer_activity() { - local cfg=$1 - local iface=$2 - local public_key - local endpoint_host - local endpoint_port - local persistent_keepalive - local last_handshake - local idle_seconds - - config_get public_key "${cfg}" "public_key" - config_get endpoint_host "${cfg}" "endpoint_host" - config_get endpoint_port "${cfg}" "endpoint_port" - persistent_keepalive=`wg show ${iface} persistent-keepalive | grep ${public_key} | awk '{print $2}'` - - # only process peers with endpoints and keepalive set - [ -z ${endpoint_host} ] && return 0; - [ -z ${persistent_keepalive} -o ${persistent_keepalive} = "off" ] && return 0; - - # skip IP addresses - # check taken from packages/net/ddns-scripts/files/dynamic_dns_functions.sh - local IPV4_REGEX="[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}" - local IPV6_REGEX="\(\([0-9A-Fa-f]\{1,4\}:\)\{1,\}\)\(\([0-9A-Fa-f]\{1,4\}\)\{0,1\}\)\(\(:[0-9A-Fa-f]\{1,4\}\)\{1,\}\)" - local IPV4=$(echo ${endpoint_host} | grep -m 1 -o "$IPV4_REGEX$") # do not detect ip in 0.0.0.0.example.com - local IPV6=$(echo ${endpoint_host} | grep -m 1 -o "$IPV6_REGEX") - [ -n "${IPV4}" -o -n "${IPV6}" ] && return 0; - - # re-resolve endpoint hostname if not responding for too long - last_handshake=`wg show ${iface} latest-handshakes | grep ${public_key} | awk '{print $2}'` - [ -z ${last_handshake} ] && return 0; - idle_seconds=$((`date +%s`-${last_handshake})) - [ ${idle_seconds} -lt 150 ] && return 0; - logger -t "wireguard_monitor" "${iface} endpoint ${endpoint_host}:${endpoint_port} is not responding for ${idle_seconds} seconds, trying to re-resolve hostname" - wg set ${iface} peer ${public_key} endpoint "${endpoint_host}:${endpoint_port}" -} - -# query ubus for all active wireguard interfaces -wg_ifaces=`ubus -S call network.interface dump | jsonfilter -e '@.interface[@.up=true]' | jsonfilter -a -e '@[@.proto="wireguard"].interface' | tr "\n" " "` - -# check every peer in every active wireguard interface -config_load network -for iface in $wg_ifaces; do - config_foreach check_peer_activity "wireguard_${iface}" "${iface}" -done diff --git a/package/network/utils/wireguard-tools/Makefile b/package/network/utils/wireguard-tools/Makefile new file mode 100644 index 0000000000..2f6d307094 --- /dev/null +++ b/package/network/utils/wireguard-tools/Makefile @@ -0,0 +1,54 @@ +# +# Copyright (C) 2016-2019 Jason A. Donenfeld +# Copyright (C) 2016 Baptiste Jonglez +# Copyright (C) 2016-2017 Dan Luedtke +# +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. + +include $(TOPDIR)/rules.mk +include $(INCLUDE_DIR)/kernel.mk + +PKG_NAME:=wireguard-tools + +PKG_VERSION:=1.0.20191226 +PKG_RELEASE:=1 + +PKG_SOURCE:=wireguard-tools-$(PKG_VERSION).tar.xz +PKG_SOURCE_URL:=https://git.zx2c4.com/wireguard-tools/snapshot/ +PKG_HASH:=aa8af0fdc9872d369d8c890a84dbc2a2466b55795dccd5b47721b2d97644b04f + +PKG_LICENSE:=GPL-2.0 +PKG_LICENSE_FILES:=COPYING + +PKG_BUILD_PARALLEL:=1 +PKG_USE_MIPS16:=0 + +include $(INCLUDE_DIR)/package.mk +include $(INCLUDE_DIR)/package-defaults.mk + +MAKE_PATH:=src +MAKE_VARS += PLATFORM=linux + +define Package/wireguard-tools + $(call Package/wireguard/Default) + TITLE:=WireGuard userspace control program (wg) + DEPENDS:=+libmnl +ip +endef + +define Package/wireguard-tools/description + $(call Package/wireguard/Default/description) + + This package provides the userspace control program for WireGuard, + `wg(8)`, a netifd protocol helper, and a re-resolve watchdog script. +endef + +define Package/wireguard-tools/install + $(INSTALL_DIR) $(1)/usr/bin/ + $(INSTALL_BIN) $(PKG_BUILD_DIR)/src/wg $(1)/usr/bin/ + $(INSTALL_BIN) ./files/wireguard_watchdog $(1)/usr/bin/ + $(INSTALL_DIR) $(1)/lib/netifd/proto/ + $(INSTALL_BIN) ./files/wireguard.sh $(1)/lib/netifd/proto/ +endef + +$(eval $(call BuildPackage,wireguard-tools)) diff --git a/package/network/utils/wireguard-tools/files/wireguard.sh b/package/network/utils/wireguard-tools/files/wireguard.sh new file mode 100644 index 0000000000..4c811c6ba9 --- /dev/null +++ b/package/network/utils/wireguard-tools/files/wireguard.sh @@ -0,0 +1,185 @@ +#!/bin/sh +# Copyright 2016-2017 Dan Luedtke +# Licensed to the public under the Apache License 2.0. + +WG=/usr/bin/wg +if [ ! -x $WG ]; then + logger -t "wireguard" "error: missing wireguard-tools (${WG})" + exit 0 +fi + +[ -n "$INCLUDE_ONLY" ] || { + . /lib/functions.sh + . ../netifd-proto.sh + init_proto "$@" +} + +proto_wireguard_init_config() { + proto_config_add_string "private_key" + proto_config_add_int "listen_port" + proto_config_add_int "mtu" + proto_config_add_string "fwmark" + available=1 + no_proto_task=1 +} + +proto_wireguard_setup_peer() { + local peer_config="$1" + + local public_key + local preshared_key + local allowed_ips + local route_allowed_ips + local endpoint_host + local endpoint_port + local persistent_keepalive + + config_get public_key "${peer_config}" "public_key" + config_get preshared_key "${peer_config}" "preshared_key" + config_get allowed_ips "${peer_config}" "allowed_ips" + config_get_bool route_allowed_ips "${peer_config}" "route_allowed_ips" 0 + config_get endpoint_host "${peer_config}" "endpoint_host" + config_get endpoint_port "${peer_config}" "endpoint_port" + config_get persistent_keepalive "${peer_config}" "persistent_keepalive" + + echo "[Peer]" >> "${wg_cfg}" + echo "PublicKey=${public_key}" >> "${wg_cfg}" + if [ "${preshared_key}" ]; then + echo "PresharedKey=${preshared_key}" >> "${wg_cfg}" + fi + for allowed_ip in $allowed_ips; do + echo "AllowedIPs=${allowed_ip}" >> "${wg_cfg}" + done + if [ "${endpoint_host}" ]; then + case "${endpoint_host}" in + *:*) + endpoint="[${endpoint_host}]" + ;; + *) + endpoint="${endpoint_host}" + ;; + esac + if [ "${endpoint_port}" ]; then + endpoint="${endpoint}:${endpoint_port}" + else + endpoint="${endpoint}:51820" + fi + echo "Endpoint=${endpoint}" >> "${wg_cfg}" + fi + if [ "${persistent_keepalive}" ]; then + echo "PersistentKeepalive=${persistent_keepalive}" >> "${wg_cfg}" + fi + + if [ ${route_allowed_ips} -ne 0 ]; then + for allowed_ip in ${allowed_ips}; do + case "${allowed_ip}" in + *:*/*) + proto_add_ipv6_route "${allowed_ip%%/*}" "${allowed_ip##*/}" + ;; + *.*/*) + proto_add_ipv4_route "${allowed_ip%%/*}" "${allowed_ip##*/}" + ;; + *:*) + proto_add_ipv6_route "${allowed_ip%%/*}" "128" + ;; + *.*) + proto_add_ipv4_route "${allowed_ip%%/*}" "32" + ;; + esac + done + fi +} + +proto_wireguard_setup() { + local config="$1" + local wg_dir="/tmp/wireguard" + local wg_cfg="${wg_dir}/${config}" + + local private_key + local listen_port + local mtu + + config_load network + config_get private_key "${config}" "private_key" + config_get listen_port "${config}" "listen_port" + config_get addresses "${config}" "addresses" + config_get mtu "${config}" "mtu" + config_get fwmark "${config}" "fwmark" + config_get ip6prefix "${config}" "ip6prefix" + config_get nohostroute "${config}" "nohostroute" + + ip link del dev "${config}" 2>/dev/null + ip link add dev "${config}" type wireguard + + if [ "${mtu}" ]; then + ip link set mtu "${mtu}" dev "${config}" + fi + + proto_init_update "${config}" 1 + + umask 077 + mkdir -p "${wg_dir}" + echo "[Interface]" > "${wg_cfg}" + echo "PrivateKey=${private_key}" >> "${wg_cfg}" + if [ "${listen_port}" ]; then + echo "ListenPort=${listen_port}" >> "${wg_cfg}" + fi + if [ "${fwmark}" ]; then + echo "FwMark=${fwmark}" >> "${wg_cfg}" + fi + config_foreach proto_wireguard_setup_peer "wireguard_${config}" + + # apply configuration file + ${WG} setconf ${config} "${wg_cfg}" + WG_RETURN=$? + + rm -f "${wg_cfg}" + + if [ ${WG_RETURN} -ne 0 ]; then + sleep 5 + proto_setup_failed "${config}" + exit 1 + fi + + for address in ${addresses}; do + case "${address}" in + *:*/*) + proto_add_ipv6_address "${address%%/*}" "${address##*/}" + ;; + *.*/*) + proto_add_ipv4_address "${address%%/*}" "${address##*/}" + ;; + *:*) + proto_add_ipv6_address "${address%%/*}" "128" + ;; + *.*) + proto_add_ipv4_address "${address%%/*}" "32" + ;; + esac + done + + for prefix in ${ip6prefix}; do + proto_add_ipv6_prefix "$prefix" + done + + # endpoint dependency + if [ "${nohostroute}" != "1" ]; then + wg show "${config}" endpoints | \ + sed -E 's/\[?([0-9.:a-f]+)\]?:([0-9]+)/\1 \2/' | \ + while IFS=$'\t ' read -r key address port; do + [ -n "${port}" ] || continue + proto_add_host_dependency "${config}" "${address}" + done + fi + + proto_send_update "${config}" +} + +proto_wireguard_teardown() { + local config="$1" + ip link del dev "${config}" >/dev/null 2>&1 +} + +[ -n "$INCLUDE_ONLY" ] || { + add_protocol wireguard +} diff --git a/package/network/utils/wireguard-tools/files/wireguard_watchdog b/package/network/utils/wireguard-tools/files/wireguard_watchdog new file mode 100644 index 0000000000..5fbbeafec1 --- /dev/null +++ b/package/network/utils/wireguard-tools/files/wireguard_watchdog @@ -0,0 +1,60 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0 +# +# Copyright (C) 2018 Aleksandr V. Piskunov . +# Copyright (C) 2015-2018 Jason A. Donenfeld . All Rights Reserved. +# +# This watchdog script tries to re-resolve hostnames for inactive WireGuard peers. +# Use it for peers with a frequently changing dynamic IP. +# persistent_keepalive must be set, recommended value is 25 seconds. +# +# Run this script from cron every minute: +# echo '* * * * * /usr/bin/wireguard_watchdog' >> /etc/crontabs/root + + +. /lib/functions.sh + +check_peer_activity() { + local cfg=$1 + local iface=$2 + local public_key + local endpoint_host + local endpoint_port + local persistent_keepalive + local last_handshake + local idle_seconds + + config_get public_key "${cfg}" "public_key" + config_get endpoint_host "${cfg}" "endpoint_host" + config_get endpoint_port "${cfg}" "endpoint_port" + persistent_keepalive=`wg show ${iface} persistent-keepalive | grep ${public_key} | awk '{print $2}'` + + # only process peers with endpoints and keepalive set + [ -z ${endpoint_host} ] && return 0; + [ -z ${persistent_keepalive} -o ${persistent_keepalive} = "off" ] && return 0; + + # skip IP addresses + # check taken from packages/net/ddns-scripts/files/dynamic_dns_functions.sh + local IPV4_REGEX="[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}" + local IPV6_REGEX="\(\([0-9A-Fa-f]\{1,4\}:\)\{1,\}\)\(\([0-9A-Fa-f]\{1,4\}\)\{0,1\}\)\(\(:[0-9A-Fa-f]\{1,4\}\)\{1,\}\)" + local IPV4=$(echo ${endpoint_host} | grep -m 1 -o "$IPV4_REGEX$") # do not detect ip in 0.0.0.0.example.com + local IPV6=$(echo ${endpoint_host} | grep -m 1 -o "$IPV6_REGEX") + [ -n "${IPV4}" -o -n "${IPV6}" ] && return 0; + + # re-resolve endpoint hostname if not responding for too long + last_handshake=`wg show ${iface} latest-handshakes | grep ${public_key} | awk '{print $2}'` + [ -z ${last_handshake} ] && return 0; + idle_seconds=$((`date +%s`-${last_handshake})) + [ ${idle_seconds} -lt 150 ] && return 0; + logger -t "wireguard_monitor" "${iface} endpoint ${endpoint_host}:${endpoint_port} is not responding for ${idle_seconds} seconds, trying to re-resolve hostname" + wg set ${iface} peer ${public_key} endpoint "${endpoint_host}:${endpoint_port}" +} + +# query ubus for all active wireguard interfaces +wg_ifaces=`ubus -S call network.interface dump | jsonfilter -e '@.interface[@.up=true]' | jsonfilter -a -e '@[@.proto="wireguard"].interface' | tr "\n" " "` + +# check every peer in every active wireguard interface +config_load network +for iface in $wg_ifaces; do + config_foreach check_peer_activity "wireguard_${iface}" "${iface}" +done