mirror of
https://github.com/amnezia-vpn/amnezia-client.git
synced 2026-06-01 08:02:14 +03:00
Compare commits
1 Commits
checking-L
...
user-check
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
adaea28627 |
@@ -2,7 +2,7 @@ cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)
|
|||||||
|
|
||||||
set(PROJECT AmneziaVPN)
|
set(PROJECT AmneziaVPN)
|
||||||
|
|
||||||
project(${PROJECT} VERSION 4.8.5.0
|
project(${PROJECT} VERSION 4.8.4.3
|
||||||
DESCRIPTION "AmneziaVPN"
|
DESCRIPTION "AmneziaVPN"
|
||||||
HOMEPAGE_URL "https://amnezia.org/"
|
HOMEPAGE_URL "https://amnezia.org/"
|
||||||
)
|
)
|
||||||
@@ -11,7 +11,7 @@ string(TIMESTAMP CURRENT_DATE "%Y-%m-%d")
|
|||||||
set(RELEASE_DATE "${CURRENT_DATE}")
|
set(RELEASE_DATE "${CURRENT_DATE}")
|
||||||
|
|
||||||
set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
|
set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
|
||||||
set(APP_ANDROID_VERSION_CODE 2082)
|
set(APP_ANDROID_VERSION_CODE 2080)
|
||||||
|
|
||||||
if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
|
if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
|
||||||
set(MZ_PLATFORM_NAME "linux")
|
set(MZ_PLATFORM_NAME "linux")
|
||||||
|
|||||||
@@ -35,10 +35,6 @@ WireguardConfigurator::WireguardConfigurator(std::shared_ptr<Settings> settings,
|
|||||||
|
|
||||||
m_protocolName = m_isAwg ? config_key::awg : config_key::wireguard;
|
m_protocolName = m_isAwg ? config_key::awg : config_key::wireguard;
|
||||||
m_defaultPort = m_isAwg ? protocols::wireguard::defaultPort : protocols::awg::defaultPort;
|
m_defaultPort = m_isAwg ? protocols::wireguard::defaultPort : protocols::awg::defaultPort;
|
||||||
|
|
||||||
m_interfaceName = m_isAwg ? protocols::awg::interfaceName : protocols::wireguard::interfaceName;
|
|
||||||
m_wgBinaryName = m_isAwg ? protocols::awg::wgBinaryName : protocols::wireguard::wgBinaryName;
|
|
||||||
m_wgQuickBinaryName = m_isAwg ? protocols::awg::wgQuickBinaryName : protocols::wireguard::wgQuickBinaryName;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
WireguardConfigurator::ConnectionData WireguardConfigurator::genClientKeys()
|
WireguardConfigurator::ConnectionData WireguardConfigurator::genClientKeys()
|
||||||
@@ -107,20 +103,6 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
|
|||||||
return connData;
|
return connData;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (container == DockerContainer::Awg) {
|
|
||||||
if (m_serverController->isNewAwgContainer(credentials)) {
|
|
||||||
m_serverConfigPath = amnezia::protocols::awg::serverConfigPath;
|
|
||||||
m_interfaceName = protocols::awg::interfaceName;
|
|
||||||
m_wgBinaryName = protocols::awg::wgBinaryName;
|
|
||||||
m_wgQuickBinaryName = protocols::awg::wgQuickBinaryName;
|
|
||||||
} else {
|
|
||||||
m_serverConfigPath = "/opt/amnezia/awg/wg0.conf";
|
|
||||||
m_interfaceName = protocols::wireguard::interfaceName;
|
|
||||||
m_wgBinaryName = protocols::wireguard::wgBinaryName;
|
|
||||||
m_wgQuickBinaryName = protocols::wireguard::wgQuickBinaryName;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
QString getIpsScript = QString("cat %1 | grep AllowedIPs").arg(m_serverConfigPath);
|
QString getIpsScript = QString("cat %1 | grep AllowedIPs").arg(m_serverConfigPath);
|
||||||
QString stdOut;
|
QString stdOut;
|
||||||
auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
|
auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
|
||||||
@@ -186,8 +168,8 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
|
|||||||
return connData;
|
return connData;
|
||||||
}
|
}
|
||||||
|
|
||||||
QString script = QString("sudo docker exec -i $CONTAINER_NAME bash -c '%4 syncconf %2 <(%3 strip %1)'")
|
QString script = QString("sudo docker exec -i $CONTAINER_NAME bash -c 'wg syncconf wg0 <(wg-quick strip %1)'")
|
||||||
.arg(m_serverConfigPath, m_interfaceName, m_wgQuickBinaryName, m_wgBinaryName);
|
.arg(m_serverConfigPath);
|
||||||
|
|
||||||
errorCode = m_serverController->runScript(
|
errorCode = m_serverController->runScript(
|
||||||
credentials,
|
credentials,
|
||||||
|
|||||||
@@ -49,9 +49,6 @@ private:
|
|||||||
amnezia::ProtocolScriptType m_configTemplate;
|
amnezia::ProtocolScriptType m_configTemplate;
|
||||||
QString m_protocolName;
|
QString m_protocolName;
|
||||||
QString m_defaultPort;
|
QString m_defaultPort;
|
||||||
QString m_interfaceName;
|
|
||||||
QString m_wgBinaryName;
|
|
||||||
QString m_wgQuickBinaryName;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
#endif // WIREGUARD_CONFIGURATOR_H
|
#endif // WIREGUARD_CONFIGURATOR_H
|
||||||
|
|||||||
@@ -1,6 +1,5 @@
|
|||||||
#include "coreController.h"
|
#include "coreController.h"
|
||||||
|
|
||||||
#include <QDirIterator>
|
|
||||||
#include <QTranslator>
|
#include <QTranslator>
|
||||||
|
|
||||||
#if defined(Q_OS_ANDROID)
|
#if defined(Q_OS_ANDROID)
|
||||||
@@ -239,23 +238,7 @@ void CoreController::updateTranslator(const QLocale &locale)
|
|||||||
QCoreApplication::removeTranslator(m_translator.get());
|
QCoreApplication::removeTranslator(m_translator.get());
|
||||||
}
|
}
|
||||||
|
|
||||||
QStringList availableTranslations;
|
QString strFileName = QString(":/translations/amneziavpn") + QLatin1String("_") + locale.name() + ".qm";
|
||||||
QDirIterator it(":/translations", QStringList("amneziavpn_*.qm"), QDir::Files);
|
|
||||||
while (it.hasNext()) {
|
|
||||||
availableTranslations << it.next();
|
|
||||||
}
|
|
||||||
|
|
||||||
// This code allow to load translation for the language only, without country code
|
|
||||||
const QString lang = locale.name().split("_").first();
|
|
||||||
const QString translationFilePrefix = QString(":/translations/amneziavpn_") + lang;
|
|
||||||
QString strFileName = QString(":/translations/amneziavpn_%1.qm").arg(locale.name());
|
|
||||||
for (const QString &translation : availableTranslations) {
|
|
||||||
if (translation.contains(translationFilePrefix)) {
|
|
||||||
strFileName = translation;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (m_translator->load(strFileName)) {
|
if (m_translator->load(strFileName)) {
|
||||||
if (QCoreApplication::installTranslator(m_translator.get())) {
|
if (QCoreApplication::installTranslator(m_translator.get())) {
|
||||||
m_settings->setAppLanguage(locale);
|
m_settings->setAppLanguage(locale);
|
||||||
|
|||||||
@@ -407,18 +407,6 @@ ErrorCode ServerController::installDockerWorker(const ServerCredentials &credent
|
|||||||
cbReadStdOut, cbReadStdErr);
|
cbReadStdOut, cbReadStdErr);
|
||||||
|
|
||||||
qDebug().noquote() << "ServerController::installDockerWorker" << stdOut;
|
qDebug().noquote() << "ServerController::installDockerWorker" << stdOut;
|
||||||
if (container == DockerContainer::Awg) {
|
|
||||||
QRegularExpression regex(R"(Linux\s+(\d+)\.(\d+)[^\d]*)");
|
|
||||||
QRegularExpressionMatch match = regex.match(stdOut);
|
|
||||||
if (match.hasMatch()) {
|
|
||||||
int majorVersion = match.captured(1).toInt();
|
|
||||||
int minorVersion = match.captured(2).toInt();
|
|
||||||
|
|
||||||
if (majorVersion < 4 || (majorVersion == 4 && minorVersion < 14)) {
|
|
||||||
return ErrorCode::ServerLinuxKernelTooOld;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (stdOut.contains("lock"))
|
if (stdOut.contains("lock"))
|
||||||
return ErrorCode::ServerPacketManagerError;
|
return ErrorCode::ServerPacketManagerError;
|
||||||
if (stdOut.contains("command not found"))
|
if (stdOut.contains("command not found"))
|
||||||
@@ -721,7 +709,7 @@ ErrorCode ServerController::isServerPortBusy(const ServerCredentials &credential
|
|||||||
QString transportProto = containerConfig.value(config_key::transport_proto).toString(defaultTransportProto);
|
QString transportProto = containerConfig.value(config_key::transport_proto).toString(defaultTransportProto);
|
||||||
|
|
||||||
// TODO reimplement with netstat
|
// TODO reimplement with netstat
|
||||||
QString script = QString("which lsof > /dev/null 2>&1 || true && sudo lsof -i -P -n 2>/dev/null | grep -E ':%1 ").arg(port);
|
QString script = QString("which lsof &>/dev/null || true && sudo lsof -i -P -n 2>/dev/null | grep -E ':%1 ").arg(port);
|
||||||
for (auto &port : fixedPorts) {
|
for (auto &port : fixedPorts) {
|
||||||
script = script.append("|:%1").arg(port);
|
script = script.append("|:%1").arg(port);
|
||||||
}
|
}
|
||||||
@@ -783,7 +771,7 @@ ErrorCode ServerController::isUserInSudo(const ServerCredentials &credentials, D
|
|||||||
ErrorCode error = runScript(credentials, replaceVars(scriptData, genVarsForScript(credentials)), cbReadStdOut, cbReadStdErr);
|
ErrorCode error = runScript(credentials, replaceVars(scriptData, genVarsForScript(credentials)), cbReadStdOut, cbReadStdErr);
|
||||||
|
|
||||||
if (credentials.userName != "root" && stdOut.contains("sudo:") && !stdOut.contains("uname:") && stdOut.contains("not found"))
|
if (credentials.userName != "root" && stdOut.contains("sudo:") && !stdOut.contains("uname:") && stdOut.contains("not found"))
|
||||||
return ErrorCode::ServerSudoPackageIsNotPreinstalled;
|
return ErrorCode::SudoPackageIsNotPreinstalled;
|
||||||
if (credentials.userName != "root" && !stdOut.contains("sudo") && !stdOut.contains("wheel"))
|
if (credentials.userName != "root" && !stdOut.contains("sudo") && !stdOut.contains("wheel"))
|
||||||
return ErrorCode::ServerUserNotInSudo;
|
return ErrorCode::ServerUserNotInSudo;
|
||||||
if (stdOut.contains("can't cd to") || stdOut.contains("Permission denied") || stdOut.contains("No such file or directory"))
|
if (stdOut.contains("can't cd to") || stdOut.contains("Permission denied") || stdOut.contains("No such file or directory"))
|
||||||
@@ -855,24 +843,3 @@ ErrorCode ServerController::getDecryptedPrivateKey(const ServerCredentials &cred
|
|||||||
auto error = m_sshClient.getDecryptedPrivateKey(credentials, decryptedPrivateKey, callback);
|
auto error = m_sshClient.getDecryptedPrivateKey(credentials, decryptedPrivateKey, callback);
|
||||||
return error;
|
return error;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool ServerController::isNewAwgContainer(const ServerCredentials &credentials)
|
|
||||||
{
|
|
||||||
QString stdOut;
|
|
||||||
auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
|
|
||||||
stdOut += data + "\n";
|
|
||||||
return ErrorCode::NoError;
|
|
||||||
};
|
|
||||||
|
|
||||||
auto cbReadStdErr = [&](const QString &data, libssh::Client &) {
|
|
||||||
stdOut += data + "\n";
|
|
||||||
return ErrorCode::NoError;
|
|
||||||
};
|
|
||||||
|
|
||||||
QString script = QString("sudo docker exec -i $CONTAINER_NAME bash -c 'type awg'");
|
|
||||||
|
|
||||||
runScript(credentials, replaceVars(script, genVarsForScript(credentials, DockerContainer::Awg)), cbReadStdOut, cbReadStdErr);
|
|
||||||
|
|
||||||
return stdOut.contains("/usr/bin/awg");
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -57,8 +57,6 @@ public:
|
|||||||
ErrorCode getDecryptedPrivateKey(const ServerCredentials &credentials, QString &decryptedPrivateKey,
|
ErrorCode getDecryptedPrivateKey(const ServerCredentials &credentials, QString &decryptedPrivateKey,
|
||||||
const std::function<QString()> &callback);
|
const std::function<QString()> &callback);
|
||||||
|
|
||||||
bool isNewAwgContainer(const ServerCredentials &credentials);
|
|
||||||
|
|
||||||
private:
|
private:
|
||||||
ErrorCode installDockerWorker(const ServerCredentials &credentials, DockerContainer container);
|
ErrorCode installDockerWorker(const ServerCredentials &credentials, DockerContainer container);
|
||||||
ErrorCode prepareHostWorker(const ServerCredentials &credentials, DockerContainer container, const QJsonObject &config = QJsonObject());
|
ErrorCode prepareHostWorker(const ServerCredentials &credentials, DockerContainer container, const QJsonObject &config = QJsonObject());
|
||||||
|
|||||||
@@ -54,11 +54,10 @@ namespace amnezia
|
|||||||
ServerCancelInstallation = 204,
|
ServerCancelInstallation = 204,
|
||||||
ServerUserNotInSudo = 205,
|
ServerUserNotInSudo = 205,
|
||||||
ServerPacketManagerError = 206,
|
ServerPacketManagerError = 206,
|
||||||
ServerSudoPackageIsNotPreinstalled = 207,
|
SudoPackageIsNotPreinstalled = 207,
|
||||||
ServerUserDirectoryNotAccessible = 208,
|
ServerUserDirectoryNotAccessible = 208,
|
||||||
ServerUserNotAllowedInSudoers = 209,
|
ServerUserNotAllowedInSudoers = 209,
|
||||||
ServerUserPasswordRequired = 210,
|
ServerUserPasswordRequired = 210,
|
||||||
ServerLinuxKernelTooOld = 211,
|
|
||||||
|
|
||||||
// Ssh connection errors
|
// Ssh connection errors
|
||||||
SshRequestDeniedError = 300,
|
SshRequestDeniedError = 300,
|
||||||
|
|||||||
@@ -22,11 +22,10 @@ QString errorString(ErrorCode code) {
|
|||||||
case(ErrorCode::ServerCancelInstallation): errorMessage = QObject::tr("Installation canceled by user"); break;
|
case(ErrorCode::ServerCancelInstallation): errorMessage = QObject::tr("Installation canceled by user"); break;
|
||||||
case(ErrorCode::ServerUserNotInSudo): errorMessage = QObject::tr("The user is not a member of the sudo group"); break;
|
case(ErrorCode::ServerUserNotInSudo): errorMessage = QObject::tr("The user is not a member of the sudo group"); break;
|
||||||
case(ErrorCode::ServerPacketManagerError): errorMessage = QObject::tr("Server error: Package manager error"); break;
|
case(ErrorCode::ServerPacketManagerError): errorMessage = QObject::tr("Server error: Package manager error"); break;
|
||||||
case(ErrorCode::ServerSudoPackageIsNotPreinstalled): errorMessage = QObject::tr("The sudo package is not pre-installed on the server"); break;
|
case(ErrorCode::SudoPackageIsNotPreinstalled): errorMessage = QObject::tr("The sudo package is not pre-installed"); break;
|
||||||
case(ErrorCode::ServerUserDirectoryNotAccessible): errorMessage = QObject::tr("The server user's home directory is not accessible"); break;
|
case(ErrorCode::ServerUserDirectoryNotAccessible): errorMessage = QObject::tr("The server user's home directory is not accessible"); break;
|
||||||
case(ErrorCode::ServerUserNotAllowedInSudoers): errorMessage = QObject::tr("Action not allowed in sudoers"); break;
|
case(ErrorCode::ServerUserNotAllowedInSudoers): errorMessage = QObject::tr("Action not allowed in sudoers"); break;
|
||||||
case(ErrorCode::ServerUserPasswordRequired): errorMessage = QObject::tr("The user's password is required"); break;
|
case(ErrorCode::ServerUserPasswordRequired): errorMessage = QObject::tr("The user's password is required"); break;
|
||||||
case(ErrorCode::ServerLinuxKernelTooOld): errorMessage = QObject::tr("Server error: Linux kernel is too old"); break;
|
|
||||||
|
|
||||||
// Libssh errors
|
// Libssh errors
|
||||||
case(ErrorCode::SshRequestDeniedError): errorMessage = QObject::tr("SSH request was denied"); break;
|
case(ErrorCode::SshRequestDeniedError): errorMessage = QObject::tr("SSH request was denied"); break;
|
||||||
|
|||||||
@@ -186,9 +186,6 @@ namespace amnezia
|
|||||||
constexpr char serverPublicKeyPath[] = "/opt/amnezia/wireguard/wireguard_server_public_key.key";
|
constexpr char serverPublicKeyPath[] = "/opt/amnezia/wireguard/wireguard_server_public_key.key";
|
||||||
constexpr char serverPskKeyPath[] = "/opt/amnezia/wireguard/wireguard_psk.key";
|
constexpr char serverPskKeyPath[] = "/opt/amnezia/wireguard/wireguard_psk.key";
|
||||||
|
|
||||||
constexpr char interfaceName[] = "wg0";
|
|
||||||
constexpr char wgBinaryName[] = "wg";
|
|
||||||
constexpr char wgQuickBinaryName[] = "wg-quick";
|
|
||||||
}
|
}
|
||||||
|
|
||||||
namespace sftp
|
namespace sftp
|
||||||
@@ -206,7 +203,7 @@ namespace amnezia
|
|||||||
constexpr char defaultMtu[] = "1376";
|
constexpr char defaultMtu[] = "1376";
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
constexpr char serverConfigPath[] = "/opt/amnezia/awg/awg0.conf";
|
constexpr char serverConfigPath[] = "/opt/amnezia/awg/wg0.conf";
|
||||||
constexpr char serverPublicKeyPath[] = "/opt/amnezia/awg/wireguard_server_public_key.key";
|
constexpr char serverPublicKeyPath[] = "/opt/amnezia/awg/wireguard_server_public_key.key";
|
||||||
constexpr char serverPskKeyPath[] = "/opt/amnezia/awg/wireguard_psk.key";
|
constexpr char serverPskKeyPath[] = "/opt/amnezia/awg/wireguard_psk.key";
|
||||||
|
|
||||||
@@ -219,10 +216,6 @@ namespace amnezia
|
|||||||
constexpr char defaultResponsePacketMagicHeader[] = "3288052141";
|
constexpr char defaultResponsePacketMagicHeader[] = "3288052141";
|
||||||
constexpr char defaultTransportPacketMagicHeader[] = "2528465083";
|
constexpr char defaultTransportPacketMagicHeader[] = "2528465083";
|
||||||
constexpr char defaultUnderloadPacketMagicHeader[] = "1766607858";
|
constexpr char defaultUnderloadPacketMagicHeader[] = "1766607858";
|
||||||
|
|
||||||
constexpr char interfaceName[] = "awg0";
|
|
||||||
constexpr char wgBinaryName[] = "awg";
|
|
||||||
constexpr char wgQuickBinaryName[] = "awg-quick";
|
|
||||||
}
|
}
|
||||||
|
|
||||||
namespace socks5Proxy
|
namespace socks5Proxy
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
FROM amneziavpn/amneziawg-go:latest
|
FROM amneziavpn/amnezia-wg:latest
|
||||||
|
|
||||||
LABEL maintainer="AmneziaVPN"
|
LABEL maintainer="AmneziaVPN"
|
||||||
|
|
||||||
|
|||||||
@@ -1,15 +1,15 @@
|
|||||||
mkdir -p /opt/amnezia/awg
|
mkdir -p /opt/amnezia/awg
|
||||||
cd /opt/amnezia/awg
|
cd /opt/amnezia/awg
|
||||||
WIREGUARD_SERVER_PRIVATE_KEY=$(awg genkey)
|
WIREGUARD_SERVER_PRIVATE_KEY=$(wg genkey)
|
||||||
echo $WIREGUARD_SERVER_PRIVATE_KEY > /opt/amnezia/awg/wireguard_server_private_key.key
|
echo $WIREGUARD_SERVER_PRIVATE_KEY > /opt/amnezia/awg/wireguard_server_private_key.key
|
||||||
|
|
||||||
WIREGUARD_SERVER_PUBLIC_KEY=$(echo $WIREGUARD_SERVER_PRIVATE_KEY | awg pubkey)
|
WIREGUARD_SERVER_PUBLIC_KEY=$(echo $WIREGUARD_SERVER_PRIVATE_KEY | wg pubkey)
|
||||||
echo $WIREGUARD_SERVER_PUBLIC_KEY > /opt/amnezia/awg/wireguard_server_public_key.key
|
echo $WIREGUARD_SERVER_PUBLIC_KEY > /opt/amnezia/awg/wireguard_server_public_key.key
|
||||||
|
|
||||||
WIREGUARD_PSK=$(awg genpsk)
|
WIREGUARD_PSK=$(wg genpsk)
|
||||||
echo $WIREGUARD_PSK > /opt/amnezia/awg/wireguard_psk.key
|
echo $WIREGUARD_PSK > /opt/amnezia/awg/wireguard_psk.key
|
||||||
|
|
||||||
cat > /opt/amnezia/awg/awg0.conf <<EOF
|
cat > /opt/amnezia/awg/wg0.conf <<EOF
|
||||||
[Interface]
|
[Interface]
|
||||||
PrivateKey = $WIREGUARD_SERVER_PRIVATE_KEY
|
PrivateKey = $WIREGUARD_SERVER_PRIVATE_KEY
|
||||||
Address = $AWG_SUBNET_IP/$WIREGUARD_SUBNET_CIDR
|
Address = $AWG_SUBNET_IP/$WIREGUARD_SUBNET_CIDR
|
||||||
|
|||||||
@@ -6,19 +6,19 @@ echo "Container startup"
|
|||||||
#ifconfig eth0:0 $SERVER_IP_ADDRESS netmask 255.255.255.255 up
|
#ifconfig eth0:0 $SERVER_IP_ADDRESS netmask 255.255.255.255 up
|
||||||
|
|
||||||
# kill daemons in case of restart
|
# kill daemons in case of restart
|
||||||
awg-quick down /opt/amnezia/awg/awg0.conf
|
wg-quick down /opt/amnezia/awg/wg0.conf
|
||||||
|
|
||||||
# start daemons if configured
|
# start daemons if configured
|
||||||
if [ -f /opt/amnezia/awg/awg0.conf ]; then (awg-quick up /opt/amnezia/awg/awg0.conf); fi
|
if [ -f /opt/amnezia/awg/wg0.conf ]; then (wg-quick up /opt/amnezia/awg/wg0.conf); fi
|
||||||
|
|
||||||
# Allow traffic on the TUN interface.
|
# Allow traffic on the TUN interface.
|
||||||
iptables -A INPUT -i awg0 -j ACCEPT
|
iptables -A INPUT -i wg0 -j ACCEPT
|
||||||
iptables -A FORWARD -i awg0 -j ACCEPT
|
iptables -A FORWARD -i wg0 -j ACCEPT
|
||||||
iptables -A OUTPUT -o awg0 -j ACCEPT
|
iptables -A OUTPUT -o wg0 -j ACCEPT
|
||||||
|
|
||||||
# Allow forwarding traffic only from the VPN.
|
# Allow forwarding traffic only from the VPN.
|
||||||
iptables -A FORWARD -i awg0 -o eth0 -s $AWG_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -j ACCEPT
|
iptables -A FORWARD -i wg0 -o eth0 -s $AWG_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -j ACCEPT
|
||||||
iptables -A FORWARD -i awg0 -o eth1 -s $AWG_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -j ACCEPT
|
iptables -A FORWARD -i wg0 -o eth1 -s $AWG_SUBNET_IP/$WIREGUARD_SUBNET_CIDR -j ACCEPT
|
||||||
|
|
||||||
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||||
|
|
||||||
|
|||||||
@@ -7,7 +7,6 @@ fi;\
|
|||||||
CUR_USER=$(whoami 2>/dev/null || echo $HOME | sed 's/.*\///');\
|
CUR_USER=$(whoami 2>/dev/null || echo $HOME | sed 's/.*\///');\
|
||||||
echo $LANG | grep -qE '^(en_US.UTF-8|C.UTF-8|C)$' || export LC_ALL=C;\
|
echo $LANG | grep -qE '^(en_US.UTF-8|C.UTF-8|C)$' || export LC_ALL=C;\
|
||||||
sudo -K;\
|
sudo -K;\
|
||||||
cd ~;\
|
|
||||||
if [ "$CUR_USER" = "root" ] || ( groups "$CUR_USER" | grep -E '\<(sudo|wheel)\>' ); then \
|
if [ "$CUR_USER" = "root" ] || ( groups "$CUR_USER" | grep -E '\<(sudo|wheel)\>' ); then \
|
||||||
sudo -nu $CUR_USER $pm $opt > /dev/null; sudo -n $pm $opt > /dev/null;\
|
sudo -nu $CUR_USER $pm $opt > /dev/null; sudo -n $pm $opt > /dev/null;\
|
||||||
fi
|
fi
|
||||||
|
|||||||
@@ -20,5 +20,4 @@ if [ "$(systemctl is-active docker)" != "active" ]; then \
|
|||||||
sleep 5; sudo systemctl start docker; sleep 5;\
|
sleep 5; sudo systemctl start docker; sleep 5;\
|
||||||
fi;\
|
fi;\
|
||||||
if ! command -v sudo > /dev/null 2>&1; then echo "Failed to install sudo, command not found"; exit 1; fi;\
|
if ! command -v sudo > /dev/null 2>&1; then echo "Failed to install sudo, command not found"; exit 1; fi;\
|
||||||
docker --version;\
|
docker --version
|
||||||
uname -sr
|
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
CUR_USER=$(whoami 2>/dev/null || echo $HOME | sed 's/.*\///');\
|
CUR_USER=$(whoami 2>/dev/null || echo ~ | sed 's/.*\///');\
|
||||||
sudo mkdir -p $DOCKERFILE_FOLDER;\
|
sudo mkdir -p $DOCKERFILE_FOLDER;\
|
||||||
sudo chown $CUR_USER $DOCKERFILE_FOLDER;\
|
sudo chown $CUR_USER $DOCKERFILE_FOLDER;\
|
||||||
if ! sudo docker network ls | grep -q amnezia-dns-net; then sudo docker network create \
|
if ! sudo docker network ls | grep -q amnezia-dns-net; then sudo docker network create \
|
||||||
|
|||||||
@@ -19,7 +19,7 @@ namespace
|
|||||||
constexpr char cloak[] = "cloak";
|
constexpr char cloak[] = "cloak";
|
||||||
constexpr char awg[] = "awg";
|
constexpr char awg[] = "awg";
|
||||||
|
|
||||||
constexpr char apiEndpoint[] = "api_endpoint";
|
constexpr char apiEdnpoint[] = "api_endpoint";
|
||||||
constexpr char accessToken[] = "api_key";
|
constexpr char accessToken[] = "api_key";
|
||||||
constexpr char certificate[] = "certificate";
|
constexpr char certificate[] = "certificate";
|
||||||
constexpr char publicKey[] = "public_key";
|
constexpr char publicKey[] = "public_key";
|
||||||
@@ -251,6 +251,7 @@ bool ApiConfigsController::updateServiceFromGateway(const int serverIndex, const
|
|||||||
|
|
||||||
newServerConfig.insert(configKey::apiConfig, newApiConfig);
|
newServerConfig.insert(configKey::apiConfig, newApiConfig);
|
||||||
newServerConfig.insert(configKey::authData, authData);
|
newServerConfig.insert(configKey::authData, authData);
|
||||||
|
// newServerConfig.insert(
|
||||||
|
|
||||||
m_serversModel->editServer(newServerConfig, serverIndex);
|
m_serversModel->editServer(newServerConfig, serverIndex);
|
||||||
if (reloadServiceConfig) {
|
if (reloadServiceConfig) {
|
||||||
@@ -269,37 +270,54 @@ bool ApiConfigsController::updateServiceFromGateway(const int serverIndex, const
|
|||||||
|
|
||||||
bool ApiConfigsController::updateServiceFromTelegram(const int serverIndex)
|
bool ApiConfigsController::updateServiceFromTelegram(const int serverIndex)
|
||||||
{
|
{
|
||||||
|
auto serverConfig = m_serversModel->getServerConfig(serverIndex);
|
||||||
|
auto installationUuid = m_settings->getInstallationUuid(true);
|
||||||
|
|
||||||
#ifdef Q_OS_IOS
|
#ifdef Q_OS_IOS
|
||||||
IosController::Instance()->requestInetAccess();
|
IosController::Instance()->requestInetAccess();
|
||||||
QThread::msleep(10);
|
QThread::msleep(10);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
GatewayController gatewayController(m_settings->getGatewayEndpoint(), m_settings->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs);
|
if (serverConfig.value(config_key::configVersion).toInt()) {
|
||||||
|
QNetworkRequest request;
|
||||||
|
request.setTransferTimeout(apiDefs::requestTimeoutMsecs);
|
||||||
|
request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
|
||||||
|
request.setRawHeader("Authorization", "Api-Key " + serverConfig.value(configKey::accessToken).toString().toUtf8());
|
||||||
|
QString endpoint = serverConfig.value(configKey::apiEdnpoint).toString();
|
||||||
|
request.setUrl(endpoint);
|
||||||
|
|
||||||
auto serverConfig = m_serversModel->getServerConfig(serverIndex);
|
QString protocol = serverConfig.value(configKey::protocol).toString();
|
||||||
auto installationUuid = m_settings->getInstallationUuid(true);
|
|
||||||
|
|
||||||
QString serviceProtocol = serverConfig.value(configKey::protocol).toString();
|
ApiPayloadData apiPayloadData = generateApiPayloadData(protocol);
|
||||||
ApiPayloadData apiPayloadData = generateApiPayloadData(serviceProtocol);
|
|
||||||
|
|
||||||
QJsonObject apiPayload = fillApiPayload(serviceProtocol, apiPayloadData);
|
QJsonObject apiPayload = fillApiPayload(protocol, apiPayloadData);
|
||||||
apiPayload[configKey::uuid] = installationUuid;
|
apiPayload[configKey::uuid] = installationUuid;
|
||||||
apiPayload[configKey::accessToken] = serverConfig.value(configKey::accessToken).toString();
|
|
||||||
apiPayload[configKey::apiEndpoint] = serverConfig.value(configKey::apiEndpoint).toString();
|
|
||||||
|
|
||||||
QByteArray responseBody;
|
QByteArray requestBody = QJsonDocument(apiPayload).toJson();
|
||||||
ErrorCode errorCode = gatewayController.post(QString("%1v1/proxy_config"), apiPayload, responseBody);
|
|
||||||
|
|
||||||
if (errorCode == ErrorCode::NoError) {
|
QNetworkReply *reply = amnApp->networkManager()->post(request, requestBody);
|
||||||
fillServerConfig(serviceProtocol, apiPayloadData, responseBody, serverConfig);
|
|
||||||
|
|
||||||
|
QEventLoop wait;
|
||||||
|
connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
|
||||||
|
|
||||||
|
QList<QSslError> sslErrors;
|
||||||
|
connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
|
||||||
|
wait.exec();
|
||||||
|
|
||||||
|
auto errorCode = apiUtils::checkNetworkReplyErrors(sslErrors, reply);
|
||||||
|
if (errorCode != ErrorCode::NoError) {
|
||||||
|
reply->deleteLater();
|
||||||
|
emit errorOccurred(errorCode);
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
auto apiResponseBody = reply->readAll();
|
||||||
|
reply->deleteLater();
|
||||||
|
fillServerConfig(protocol, apiPayloadData, apiResponseBody, serverConfig);
|
||||||
m_serversModel->editServer(serverConfig, serverIndex);
|
m_serversModel->editServer(serverConfig, serverIndex);
|
||||||
emit updateServerFromApiFinished();
|
emit updateServerFromApiFinished();
|
||||||
return true;
|
|
||||||
} else {
|
|
||||||
emit errorOccurred(errorCode);
|
|
||||||
return false;
|
|
||||||
}
|
}
|
||||||
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool ApiConfigsController::deactivateDevice()
|
bool ApiConfigsController::deactivateDevice()
|
||||||
|
|||||||
@@ -370,17 +370,8 @@ ErrorCode InstallController::getAlreadyInstalledContainers(const ServerCredentia
|
|||||||
containerConfig.insert(config_key::transport_proto, transportProto);
|
containerConfig.insert(config_key::transport_proto, transportProto);
|
||||||
|
|
||||||
if (protocol == Proto::Awg) {
|
if (protocol == Proto::Awg) {
|
||||||
QString serverConfigPath;
|
|
||||||
if (container == DockerContainer::Awg) {
|
|
||||||
if (serverController->isNewAwgContainer(credentials)) {
|
|
||||||
serverConfigPath = amnezia::protocols::awg::serverConfigPath;
|
|
||||||
} else {
|
|
||||||
serverConfigPath = "/opt/amnezia/awg/wg0.conf";
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
QString serverConfig = serverController->getTextFileFromContainer(container, credentials,
|
QString serverConfig = serverController->getTextFileFromContainer(container, credentials,
|
||||||
serverConfigPath, errorCode);
|
protocols::awg::serverConfigPath, errorCode);
|
||||||
|
|
||||||
QMap<QString, QString> serverConfigMap;
|
QMap<QString, QString> serverConfigMap;
|
||||||
auto serverConfigLines = serverConfig.split("\n");
|
auto serverConfigLines = serverConfig.split("\n");
|
||||||
|
|||||||
@@ -209,8 +209,7 @@ ErrorCode ClientManagementModel::getWireGuardClients(const DockerContainer conta
|
|||||||
{
|
{
|
||||||
ErrorCode error = ErrorCode::NoError;
|
ErrorCode error = ErrorCode::NoError;
|
||||||
|
|
||||||
const QString wireGuardConfigFile =
|
const QString wireGuardConfigFile = QString("opt/amnezia/%1/wg0.conf").arg(container == DockerContainer::WireGuard ? "wireguard" : "awg");
|
||||||
DockerContainer::WireGuard ? amnezia::protocols::wireguard::serverConfigPath : amnezia::protocols::awg::serverConfigPath;
|
|
||||||
const QString wireguardConfigString = serverController->getTextFileFromContainer(container, credentials, wireGuardConfigFile, error);
|
const QString wireguardConfigString = serverController->getTextFileFromContainer(container, credentials, wireGuardConfigFile, error);
|
||||||
if (error != ErrorCode::NoError) {
|
if (error != ErrorCode::NoError) {
|
||||||
logger.error() << "Failed to get the wg conf file from the server";
|
logger.error() << "Failed to get the wg conf file from the server";
|
||||||
@@ -737,17 +736,8 @@ ErrorCode ClientManagementModel::revokeWireGuard(const int row, const DockerCont
|
|||||||
{
|
{
|
||||||
ErrorCode error = ErrorCode::NoError;
|
ErrorCode error = ErrorCode::NoError;
|
||||||
|
|
||||||
QString wireGuardConfigFile;
|
const QString wireGuardConfigFile =
|
||||||
if (container == DockerContainer::Awg) {
|
QString("/opt/amnezia/%1/wg0.conf").arg(container == DockerContainer::WireGuard ? "wireguard" : "awg");
|
||||||
if (serverController->isNewAwgContainer(credentials)) {
|
|
||||||
wireGuardConfigFile = amnezia::protocols::awg::serverConfigPath;
|
|
||||||
} else {
|
|
||||||
wireGuardConfigFile = "/opt/amnezia/awg/wg0.conf";
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
wireGuardConfigFile = amnezia::protocols::wireguard::serverConfigPath;
|
|
||||||
}
|
|
||||||
|
|
||||||
const QString wireguardConfigString = serverController->getTextFileFromContainer(container, credentials, wireGuardConfigFile, error);
|
const QString wireguardConfigString = serverController->getTextFileFromContainer(container, credentials, wireGuardConfigFile, error);
|
||||||
if (error != ErrorCode::NoError) {
|
if (error != ErrorCode::NoError) {
|
||||||
logger.error() << "Failed to get the wg conf file from the server";
|
logger.error() << "Failed to get the wg conf file from the server";
|
||||||
@@ -790,11 +780,7 @@ ErrorCode ClientManagementModel::revokeWireGuard(const int row, const DockerCont
|
|||||||
return error;
|
return error;
|
||||||
}
|
}
|
||||||
|
|
||||||
QString interfaceName = DockerContainer::WireGuard ? protocols::wireguard::interfaceName : protocols::awg::interfaceName;
|
const QString script = "sudo docker exec -i $CONTAINER_NAME bash -c 'wg syncconf wg0 <(wg-quick strip %1)'";
|
||||||
QString wgBinaryName = DockerContainer::WireGuard ? protocols::wireguard::wgBinaryName : protocols::awg::wgBinaryName;
|
|
||||||
QString wgQuickBinaryName = DockerContainer::WireGuard ? protocols::wireguard::wgQuickBinaryName : protocols::awg::wgQuickBinaryName;
|
|
||||||
QString script = QString("sudo docker exec -i $CONTAINER_NAME bash -c '%4 syncconf %2 <(%3 strip %1)'")
|
|
||||||
.arg(wireGuardConfigFile, interfaceName, wgQuickBinaryName, wgBinaryName);
|
|
||||||
error = serverController->runScript(
|
error = serverController->runScript(
|
||||||
credentials,
|
credentials,
|
||||||
serverController->replaceVars(script.arg(wireGuardConfigFile), serverController->genVarsForScript(credentials, container)));
|
serverController->replaceVars(script.arg(wireGuardConfigFile), serverController->genVarsForScript(credentials, container)));
|
||||||
|
|||||||
Reference in New Issue
Block a user