mirror of
https://github.com/ben-grande/qusal.git
synced 2024-12-14 18:34:34 -05:00
011a71a36d
Editorconfig can only act based on file extension and path, not attributes, it remains a mean only for multiple collaborators to use the same configuration on their editor. When it is too restrictive, such as not considering the file syntax, use a lint tool for the specific file type instead of trusting editorconfig. Changes were made to increase readability.
86 lines
2.2 KiB
Bash
Executable File
86 lines
2.2 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
# SPDX-FileCopyrightText: 2022 unman <unman@thirdeyesecurity.org>
|
|
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
set -eu
|
|
|
|
test "$(id -u)" = "0" || exec sudo "$0" "$@"
|
|
|
|
usage(){
|
|
echo "Usage: ${0##*/} [QUBE]"
|
|
exit "${1:-1}"
|
|
}
|
|
|
|
case "${1-}" in
|
|
-h|--help) usage 0;;
|
|
-*) usage 1;;
|
|
"") qube="sys-wireguard";;
|
|
*) qube="${1}";;
|
|
esac
|
|
|
|
if ! qvm-check -q -- "$qube" >/dev/null 2>&1; then
|
|
echo "Qube '$qube' doesn't exist" >&2
|
|
usage 1
|
|
fi
|
|
|
|
user_conf="/home/user/wireguard.conf"
|
|
system_conf="/etc/wireguard/wireguard.conf"
|
|
|
|
qvm-run "$qube" -- "test -f ${user_conf}" || {
|
|
echo "File '${user_conf}' was not found" >&2
|
|
if qvm-check -q --running -- "$qube" >/dev/null 2>&1; then
|
|
qvm-pause --verbose -- "$qube"
|
|
fi
|
|
echo "Firewalling $qube to drop all connections"
|
|
qvm-firewall --verbose -- "$qube" reset
|
|
qvm-firewall --verbose -- "$qube" del --rule-no 0
|
|
qvm-firewall --verbose -- "$qube" add drop
|
|
if qvm-check -q --paused -- "$qube" >/dev/null 2>&1; then
|
|
qvm-unpause --verbose -- "$qube"
|
|
fi
|
|
exit 1
|
|
}
|
|
|
|
qvm-run -u root "$qube" -- "cp ${user_conf} ${system_conf}"
|
|
|
|
## TOFU
|
|
# shellcheck disable=SC2016
|
|
endpoint="$(qvm-run -p -u root "$qube" -- awk '/Endpoint/{print $3}' \
|
|
"${system_conf}")"
|
|
if echo "${endpoint}" | grep -qF "["; then
|
|
ip="${ip##[\[]}"
|
|
ip="${ip%%\]*}"
|
|
port="${endpoint##*:}"
|
|
else
|
|
ip="${endpoint%%:*}"
|
|
port="${endpoint##*:}"
|
|
fi
|
|
|
|
if test -z "$ip" || test -z "$port";then
|
|
echo "Endpoint (IP:Port) not found: ${system_conf}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if qvm-check -q --running -- "$qube" >/dev/null 2>&1; then
|
|
qvm-pause --verbose -- "$qube"
|
|
fi
|
|
|
|
echo "Firewalling $qube to reach only '$ip:$port'"
|
|
qvm-firewall --verbose -- "$qube" reset
|
|
qvm-firewall --verbose -- "$qube" del --rule-no 0
|
|
qvm-firewall --verbose -- "$qube" add accept dsthost="$ip" dstports="$port" \
|
|
proto=udp
|
|
qvm-firewall --verbose -- "$qube" add accept dsthost="$ip" dstports="$port" \
|
|
proto=tcp
|
|
qvm-firewall --verbose -- "$qube" add drop
|
|
|
|
if qvm-check -q --paused -- "$qube" >/dev/null 2>&1; then
|
|
qvm-unpause --verbose -- "$qube"
|
|
fi
|
|
|
|
qvm-run -u root "$qube" -- "systemctl restart wg-quick@wireguard"
|
|
qvm-run -u root "$qube" -- "/rw/config/network-hooks.d/50-sys-wireguard"
|