translate_wg_conf

#!/usr/bin/env perl
# Copyright (c) 2022-2023 Ashlen <eurydice@riseup.net>
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

# Background information:
#
# Protocol: https://www.wireguard.com/protocol/
#
# Relevant upstream man pages (details configuration file options as well):
# https://www.man7.org/linux/man-pages/man8/wg-quick.8.html
# https://www.man7.org/linux/man-pages/man8/wg.8.html

use v5.36;
use strict;
use warnings;
use autodie;

use File::Basename qw(fileparse);
use Getopt::Std;
use MIME::Base64 qw(decoded_base64_length);
use Scalar::Util qw(looks_like_number);

# External modules should be separated from modules included with Perl.
use Config::Std;
use Net::IP qw(ip_get_version ip_splitprefix);

if ( $^O eq 'openbsd' ) {
	use OpenBSD::Pledge;
	use OpenBSD::Unveil;

	sub pledge_or_die { pledge(@_) or die "Pledge failed: $!"; }

	sub unveil_or_die {
		my $file = shift or die "Unveil failed: $!";
		my $perms = shift or die "Unveil failed: $!";
		unveil( $file, $perms ) or die "Unveil failed: $!";
	}

	pledge_or_die(qw(stdio rpath flock unveil));
}

sub usage {
	my $program_name = fileparse $0;
	die <<EOF;
$program_name [-hr] [-m mtu] [-t rtable] wireguard_config
EOF
}

# $ip can be an IPv4 or IPv6 address.
# $type is optional and exists to validate the version.
sub check_if_valid_ip {
	my $ip = shift or return;
	my $type = shift;

	# ip_get_version returns undef if it's unable to determine the
	# version. On a related note, this substitution strips the prefix if
	# it's present, otherwise ip_get_version will return undef.
	my $ip_type = ip_get_version( $ip =~ s|/ [0-9]+ \z||rx )
		or die "Failed to retrieve IP version for '$ip'.\n";

	if ( defined $type ) {
		if ( ( $type != 4 ) and ( $type != 6 ) ) {
			die "Expected IP type of '4' or '6'. Received: '$type'\n";
		}
		$ip_type eq $type
			or die "'$ip_type' doesn't match given type ('$type')\n";
	}

	return $ip;
}

our ( $opt_h, $opt_m, $opt_r, $opt_t );
getopts 'hm:rt:';

if ( $^O eq 'openbsd' ) {
	my %unveils = map { $_, 'r' } @INC, $ARGV[0];
	while ( my ( $path, $perms ) = each %unveils ) {
		unveil_or_die( $path, $perms );
	}

	pledge_or_die(qw(stdio rpath flock));
}

usage if $opt_h;

if ( defined $opt_t ) {
	if ( !looks_like_number($opt_t)
		or $opt_t < 0
		or $opt_t > 255 )
	{
		die "Provide an integer between 0-255 for rtable(4).\n";
	}
}

# Numbers are taken from sys/net/if_wg.c:
# if (ifr->ifr_mtu <= 0 || ifr->ifr_mtu > 9000)
#     ret = EINVAL;
if ( defined $opt_m ) {
	if ( !looks_like_number($opt_m)
		or $opt_m <= 0
		or $opt_m > 9000 )
	{
		die "Provide an integer between 1-9000 for the MTU.\n";
	}
}

my $wg_file = shift or die "Provide a WireGuard file to convert.\n";

read_config $wg_file => my %wg_properties
	or die "Parsing error: $!";

my ( $endpoint_ip, $endpoint_port ) = split ':', $wg_properties{Peer}{Endpoint};
my @local_addresses = split ',', $wg_properties{Interface}{Address};
my @allowed_addresses = split ',', $wg_properties{Peer}{AllowedIPs};

# TODO: is this range perhaps too permissive/wide?
if ( !looks_like_number $endpoint_port
	or $endpoint_port < 1
	or $endpoint_port > 65535 )
{
	die <<EOF;
Expected: endpoint port between 1-65535.
Received: $endpoint_port
EOF
}

# Keys should always be 44 bytes in length when encoded in base64
# and 32 bytes in length when decoded from base64.
decoded_base64_length $wg_properties{Interface}{PrivateKey} == 32
	or die "Failed to base64 decode private key to a 32 byte string.\n";
decoded_base64_length $wg_properties{Peer}{PublicKey} == 32
	or die "Failed to base64 decode public key to a 32 byte string.\n";

check_if_valid_ip $endpoint_ip or die "Invalid IP: $endpoint_ip\n";
check_if_valid_ip $wg_properties{Interface}{DNS}
	or die "Invalid IP: $wg_properties{Interface}{DNS}\n";

# Initialize an empty array reference at
# $wg_properties{Peer}{AllowedIPs}. Extract each valid IP from
# @allowed_addresses and push them onto the array reference.
$wg_properties{Peer}{AllowedIPs} = [];
push @{ $wg_properties{Peer}{AllowedIPs} },
	grep { check_if_valid_ip($_) } @allowed_addresses;

# Same principle as above, but separate the IP address from its prefix
# first.
$wg_properties{Interface}{Address} = [];
push @{ $wg_properties{Interface}{Address} }, map { ( ip_splitprefix($_) )[0] }
	grep { check_if_valid_ip($_) } @local_addresses;

$wg_properties{Peer}{Endpoint} = {
	IP => $endpoint_ip,
	Port => $endpoint_port,
};

my $hostname_if = <<EOF;
wgkey $wg_properties{Interface}{PrivateKey}
wgpeer $wg_properties{Peer}{PublicKey} \\
	wgendpoint $wg_properties{Peer}{Endpoint}{IP} $wg_properties{Peer}{Endpoint}{Port} \\
EOF

# This for loop allows us to handle multiple IP addresses in AllowedIPs.
my $count = 0;
for my $ip ( @{ $wg_properties{Peer}{AllowedIPs} } ) {
	$count++;

	if ( $count < scalar @{ $wg_properties{Peer}{AllowedIPs} } ) {
		$hostname_if .= "\t" . "wgaip $ip \\";
		$hostname_if .= "\n";
	}
	else {
		$hostname_if .= "\t" . "wgaip $ip\n";
		last;
	}
}

if ($opt_m) {
	$hostname_if .= "mtu $opt_m\n";
}

if ($opt_t) {
	$hostname_if .= "wgrtable $opt_t\n";
}

# Add default routes based on the first viable IPv4 and IPv6 addresses
# extracted from the array reference.
if ($opt_r) {
	my ( $ipv4_route, $ipv6_route );
	my ( $ipv4_route_found, $ipv6_route_found ) = ( 0, 0 );

	while ( my $ip = shift @{ $wg_properties{Interface}{Address} } ) {
		my $ip_version = ip_get_version $ip;

		if ( $ip_version == 4 ) {
			$hostname_if .= "inet $ip\n";
			if ( $ipv4_route_found != 1 ) {
				$ipv4_route = "!/sbin/route -qn add -inet default -iface $ip\n";
				$ipv4_route_found++;
			}
		}
		elsif ( $ip_version == 6 ) {
			$hostname_if .= "inet6 $ip\n";
			if ( $ipv6_route_found != 1 ) {
				$ipv6_route = "!/sbin/route -qn add -inet6 default -iface $ip\n";
				$ipv6_route_found++;
			}
		}
	}
	$hostname_if .= $ipv4_route if defined $ipv4_route;
	$hostname_if .= $ipv6_route if defined $ipv6_route;
}

print $hostname_if;