]> Git — Sourcephile - julm/julm-nix.git/blob - nixos/modules/services/networking/wireguard.nix
home-manager: overwrite files
[julm/julm-nix.git] / nixos / modules / services / networking / wireguard.nix
1 { config, lib, options, pkgs, ... }:
2 with lib;
3 let
4 cfg = config.networking.wireguard;
5 opt = options.networking.wireguard;
6 interfaceOpts = { config, ... }: {
7 options = {
8 peers = mkOption {
9 type = with types; listOf (submodule peerOpts);
10 };
11 peersAnnouncing = {
12 enable = mkEnableOption ''
13 announcing of peers' endpoints.
14 '';
15 listenPort = mkOption {
16 type = types.port;
17 defaultText = "<option>networking.wireguard.listenPort</option> or 51820 if null";
18 description = ''
19 TCP port on which to listen for peers queries for other peers' endpoints.
20
21 <warning><para>
22 This exposes the public key and current (or last known) endpoint address of all the peers
23 configured in the WireGuard interface, to all the peers,
24 and to any host connected to the peers or announcing peer
25 able to query the WireGuard interface
26 by spoofing the allowedIPs of any peer.
27 </para></warning>
28 '';
29 };
30 };
31 };
32 config = {
33 peersAnnouncing = {
34 listenPort = mkDefault (if config.listenPort == null then 51820 else config.listenPort);
35 };
36 };
37 };
38 peerOpts = { config, ... }: {
39 options = {
40 endpointsUpdater = {
41 enable = mkEnableOption ''
42 receiving the enpoint of other peers from a periodic TCP connection.
43 That connection is meant to be to a peer using <option>networking.wireguard.peersAnnouncing.enable</option>.
44
45 This is especially useful to punch-through non-symmetric NATs
46 effectively establishing peer-to-peer connectivity:
47 the peers initiate a Wireguard connection to the announcing peer,
48 then use that Wireguard tunnel to query the endpoints of the other peers
49 to establish Wireguard tunnels to them,
50 using UDP hole punching when both peers are behind non-symmetric NATs.
51
52 Note that it can also work for two peers behind the same NAT
53 if that NAT can reflect (to its internal network) connections
54 from its internal network to its external IP address,
55 which may require to set persistentKeepalive as low as 1
56 and/or redirecting at least one host's WireGuard port, eg. with UPnP.
57 '';
58 addr = mkOption {
59 type = types.str;
60 defaultText = "address of the first item of the peer's <option>allowedIPs</option>";
61 description = ''
62 Address at which to contact the announcing peer,
63 configured on the announcing peer's <option>networking.wireguard.ips</option>.
64 '';
65 };
66 port = mkOption {
67 type = types.port;
68 defaultText = "port of the peer's endpoint";
69 description = ''
70 TCP port on which to contact the peer announcing other peers.
71 This is configured on the announcing peer's <option>networking.wireguard.peersAnnouncing.listenPort</option>.
72 '';
73 };
74 refreshSeconds = mkOption {
75 type = with types; int;
76 example = 120;
77 default = 60;
78 description = ''
79 Time to wait between two successive queries of the endpoints known by the peer.
80 '';
81 };
82 };
83 };
84 config = {
85 endpointsUpdater = {
86 addr = mkDefault (head (builtins.match "^\([^/]*\).*$" (head (config.allowedIPs))));
87 port = mkDefault (toInt (head (builtins.match "^.*:\([0-9]*\)$" config.endpoint)));
88 };
89 };
90 };
91
92 keyToUnitName = replaceStrings
93 [ "/" "-" " " "+" "=" ]
94 [ "-" "\\x2d" "\\x20" "\\x2b" "\\x3d" ];
95
96 peerUnitServiceName = interfaceName: publicKey: dynamicRefreshEnabled:
97 let
98 unitName = keyToUnitName publicKey;
99 refreshSuffix = optionalString dynamicRefreshEnabled "-refresh";
100 in
101 "wireguard-${interfaceName}-peer-${unitName}${refreshSuffix}";
102
103 # See:
104 # - systemd-analyze security wireguard-${iface}-peers-announcing@
105 # - systemd-analyze security wireguard-${iface}-endpoints-updater-${public_key}.service
106 # Note that PrivateUsers=true would be too restrictive wrt. capabilities.
107 peerUpdateSecurity = {
108 IPAddressDeny = "any";
109 # For running wg(1)
110 AmbientCapabilities = [ "CAP_NET_ADMIN" ];
111 CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
112 RestrictNamespaces = true;
113 DynamicUser = true;
114 NoNewPrivileges = true;
115 PrivateDevices = true;
116 ProtectClock = true;
117 ProtectControlGroups = true;
118 ProtectHome = true;
119 ProtectKernelLogs = true;
120 ProtectKernelModules = true;
121 ProtectKernelTunables = true;
122 ProtectProc = "invisible";
123 SystemCallArchitectures = "native";
124 # Remove (likely) unused groups from the basic @system-service group
125 SystemCallFilter = [
126 "@system-service"
127 "~@aio"
128 "~@chown"
129 "~@keyring"
130 "~@privileged"
131 "~@memlock"
132 "~@resources"
133 "~@setuid"
134 ];
135 RestrictRealtime = true;
136 LockPersonality = true;
137 MemoryDenyWriteExecute = true;
138 UMask = 0077;
139 ProtectHostname = true;
140 ProcSubset = "pid";
141 };
142
143 generatePeersAnnouncingSocket = name: values:
144 nameValuePair "wireguard-${name}-peers-announcing"
145 {
146 enable = values.peersAnnouncing.enable;
147 listenStreams = [ (toString values.peersAnnouncing.listenPort) ];
148 socketConfig.Accept = true;
149 # Basic firewalling restricting answers to peers
150 # querying an internal IP address of the announcing peer.
151 # Note that IPv4 addresses can be spoofed using other interfaces unless
152 # sysctl net.ipv4.conf.${name}.rp_filter=1
153 socketConfig.BindToDevice = name;
154 socketConfig.IPAddressAllow = map (peer: peer.allowedIPs) values.peers;
155 socketConfig.IPAddressDeny = "any";
156 socketConfig.MaxConnectionsPerSource = 1;
157 socketConfig.ReusePort = true;
158 wantedBy = [ "sockets.target" ];
159 };
160
161 generatePeersAnnouncingUnit = name: values:
162 nameValuePair "wireguard-${name}-peers-announcing@"
163 {
164 description = "WireGuard Peers Announcing - ${name}";
165 requires = [ "wireguard-${name}.service" ];
166 after = [ "wireguard-${name}.service" ];
167
168 serviceConfig = mkMerge [
169 peerUpdateSecurity
170 {
171 Type = "simple";
172 ExecStart = "${pkgs.wireguard-tools}/bin/wg show '${name}' endpoints";
173 StandardInput = "null";
174 StandardOutput = "socket";
175 RestrictAddressFamilies = "";
176 }
177 (mkIf (values.interfaceNamespace != null)
178 { NetworkNamespacePath = "/var/run/netns/${values.interfaceNamespace}"; })
179 ];
180 };
181
182 generateEndpointsUpdaterUnit = { interfaceName, interfaceCfg, peer }:
183 let
184 dynamicRefreshEnabled = peer.dynamicEndpointRefreshSeconds != 0;
185 peerService = peerUnitServiceName interfaceName peer.publicKey dynamicRefreshEnabled;
186 in
187 nameValuePair "wireguard-${interfaceName}-endpoints-updater-${keyToUnitName peer.publicKey}"
188 {
189 description = "WireGuard ${interfaceName} Endpoints Updater - ${peer.publicKey}";
190 requires = [ "${peerService}.service" ];
191 after = [ "${peerService}.service" ];
192 wantedBy = [ "${peerService}.service" ];
193 path = with pkgs; [ wireguard-tools ];
194
195 unitConfig = {
196 StartLimitIntervalSec = 0;
197 };
198 serviceConfig = mkMerge [
199 peerUpdateSecurity
200 {
201 Type = "simple";
202 IPAddressAllow = [ peer.endpointsUpdater.addr ];
203 RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_NETLINK" ];
204 Restart = "on-failure";
205 }
206 (mkIf (interfaceCfg.interfaceNamespace != null)
207 { NetworkNamespacePath = "/var/run/netns/${interfaceCfg.interfaceNamespace}"; })
208 ];
209
210 # Query the peer announcing other peers
211 # for setting the current endpoint of all configured peers
212 # (but the announcing peer).
213 # Note that socat is used instead of libressl's netcat
214 # (which would require MemoryDenyWriteExecute=true to load libtls.so)
215 # or netcat-gnu (which does not work on ARM and has last been released in 2004).
216 script = ''
217 wait="${toString peer.endpointsUpdater.refreshSeconds}"
218 declare -A configured_keys
219 configured_keys=(${concatMapStringsSep " " (p:
220 optionalString (p.publicKey != peer.publicKey) "[${p.publicKey}]=set")
221 interfaceCfg.peers})
222
223 while true; do
224 # Set stdin to socat's stdout
225 exec < <(exec ${pkgs.socat}/bin/socat STDOUT \
226 "TCP:${with peer.endpointsUpdater; addr+":"+toString port}")
227
228 # Update the endpoint of each configured peer
229 while read -t "$wait" -n 128 -r public_key endpoint x; do
230 if [ "$endpoint" != "(none)" -a "''${configured_keys[$public_key]}" ]; then
231 wg set "${interfaceName}" peer "$public_key" endpoint "$endpoint"
232 fi;
233 done
234
235 sleep "$wait"
236 done
237 '';
238 };
239
240 all_peers = flatten
241 (mapAttrsToList
242 (interfaceName: interfaceCfg:
243 map (peer: { inherit interfaceName interfaceCfg peer; }) interfaceCfg.peers
244 )
245 cfg.interfaces);
246 in
247 {
248 options.networking.wireguard = {
249 interfaces = mkOption {
250 type = with types; attrsOf (submodule interfaceOpts);
251 };
252 };
253 config = {
254 systemd.sockets =
255 mapAttrs' generatePeersAnnouncingSocket cfg.interfaces;
256
257 systemd.services =
258 (mapAttrs' generatePeersAnnouncingUnit cfg.interfaces)
259 // (listToAttrs (map generateEndpointsUpdaterUnit
260 (filter ({ peer, ... }: peer.endpointsUpdater.enable) all_peers)));
261 };
262 }