diff --git a/app/css/custom.php b/app/css/custom.php index f6b18318..2b5b0f8f 100644 --- a/app/css/custom.php +++ b/app/css/custom.php @@ -52,6 +52,10 @@ body { font-weight: 500; } +.sidebar-light hr.sidebar-divider { + padding-top: 0.5rem; +} + .card .card-header { border-color: ; color: #fff; diff --git a/app/css/hackernews.css b/app/css/hackernews.css index 71dbbd27..2cfd5ca1 100644 --- a/app/css/hackernews.css +++ b/app/css/hackernews.css @@ -66,6 +66,9 @@ h5.card-title { font-family: Verdana, Geneva, sans-serif; } +.sidebar-light hr.sidebar-divider { + padding-top: 0.5rem; +} ul.nav-tabs, .nav-tabs .nav-link { background-color: #f6f6ef; @@ -145,6 +148,7 @@ ul.nav-tabs, .nav-tabs .nav-link { .info-item-xs { font-size: 0.7rem; margin-left: 0.3rem; + line-height: 1.5em; } .info-item-wifi { @@ -181,6 +185,10 @@ ul.nav-tabs, .nav-tabs .nav-link { } } +.fas.fa-circle { + font-size: 0.5rem; +} + .logoutput { width:100%; height:300px; diff --git a/config/config.php b/config/config.php index 6a28b70e..122b1f94 100755 --- a/config/config.php +++ b/config/config.php @@ -21,6 +21,7 @@ define('RASPI_WPA_CTRL_INTERFACE', '/var/run/wpa_supplicant'); define('RASPI_OPENVPN_CLIENT_CONFIG', '/etc/openvpn/client/client.conf'); define('RASPI_OPENVPN_CLIENT_LOGIN', '/etc/openvpn/client/login.conf'); define('RASPI_OPENVPN_SERVER_CONFIG', '/etc/openvpn/server/server.conf'); +define('RASPI_WIREGUARD_CONFIG', '/etc/wireguard/wg0.conf'); define('RASPI_TORPROXY_CONFIG', '/etc/tor/torrc'); define('RASPI_LIGHTTPD_CONFIG', '/etc/lighttpd/lighttpd.conf'); define('RASPI_ACCESS_CHECK_IP', '1.1.1.1'); @@ -36,6 +37,7 @@ define('RASPI_NETWORK_ENABLED', true); define('RASPI_DHCP_ENABLED', true); define('RASPI_ADBLOCK_ENABLED', false); define('RASPI_OPENVPN_ENABLED', false); +define('RASPI_WIREGUARD_ENABLED', false); define('RASPI_TORPROXY_ENABLED', false); define('RASPI_CONFAUTH_ENABLED', true); define('RASPI_CHANGETHEME_ENABLED', true); diff --git a/dist/raspap/css/fonts/RaspAP.eot b/dist/raspap/css/fonts/RaspAP.eot new file mode 100755 index 00000000..d77690f6 Binary files /dev/null and b/dist/raspap/css/fonts/RaspAP.eot differ diff --git a/dist/raspap/css/fonts/RaspAP.svg b/dist/raspap/css/fonts/RaspAP.svg new file mode 100755 index 00000000..27920e40 --- /dev/null +++ b/dist/raspap/css/fonts/RaspAP.svg @@ -0,0 +1,12 @@ + + + +Generated by IcoMoon + + + + + + + + \ No newline at end of file diff --git a/dist/raspap/css/fonts/RaspAP.ttf b/dist/raspap/css/fonts/RaspAP.ttf new file mode 100755 index 00000000..11221442 Binary files /dev/null and b/dist/raspap/css/fonts/RaspAP.ttf differ diff --git a/dist/raspap/css/fonts/RaspAP.woff b/dist/raspap/css/fonts/RaspAP.woff new file mode 100755 index 00000000..875f0253 Binary files /dev/null and b/dist/raspap/css/fonts/RaspAP.woff differ diff --git a/dist/raspap/css/style.css b/dist/raspap/css/style.css new file mode 100644 index 00000000..45305ca1 --- /dev/null +++ b/dist/raspap/css/style.css @@ -0,0 +1,54 @@ + /*! + * RaspAP-Brands Brand Icons - https://raspap.com + * License - https://github.com/billz/RaspAP-Brands-webgui/blob/master/LICENSE + */ +@font-face { + font-family: 'RaspAP'; + src: url('fonts/RaspAP.eot?e76qs3'); + src: url('fonts/RaspAP.eot?e76qs3#iefix') format('embedded-opentype'), + url('fonts/RaspAP.ttf?e76qs3') format('truetype'), + url('fonts/RaspAP.woff?e76qs3') format('woff'), + url('fonts/RaspAP.svg?e76qs3#RaspAP') format('svg'); + font-weight: normal; + font-style: normal; + font-display: block; +} + +[class^="ra-"], [class*=" ra-"] { + /* use !important to prevent issues with browser extensions that change ..webfonts */ + font-family: 'RaspAP' !important; + speak: none; + font-style: normal; + font-weight: normal; + font-variant: normal; + text-transform: none; + line-height: 1; + + /* Better Font Rendering =========== */ + -webkit-font-smoothing: antialiased; + -moz-osx-font-smoothing: grayscale; +} + +.ra-wireguard:before { + font-size: 1.2rem; + content: "\e900"; + color: #d1d3e2; + vertical-align: middle; +} + +.card-header .ra-wireguard:before { + color: #fff; +} + +.sidebar .nav-item.active .nav-link +span.ra-wireguard:before { + color: #6e707e; +} + +.ra-raspap:before { + font-size: 4.35rem; + content: "\e901"; + color: #d8224c; + margin-left: 0.1em; +} + diff --git a/includes/defaults.php b/includes/defaults.php index c4559c6b..8ff08134 100755 --- a/includes/defaults.php +++ b/includes/defaults.php @@ -26,6 +26,7 @@ $defaults = [ 'RASPI_OPENVPN_CLIENT_CONFIG' => '/etc/openvpn/client/client.conf', 'RASPI_OPENVPN_CLIENT_LOGIN' => '/etc/openvpn/client/login.conf', 'RASPI_OPENVPN_SERVER_CONFIG' => '/etc/openvpn/server/server.conf', + 'RASPI_WIREGUARD_CONFIG' => '/etc/wireguard/wg0.conf', 'RASPI_TORPROXY_CONFIG' => '/etc/tor/torrc', 'RASPI_LIGHTTPD_CONFIG' => '/etc/lighttpd/lighttpd.conf', 'RASPI_ACCESS_CHECK_IP' => '1.1.1.1', @@ -38,6 +39,7 @@ $defaults = [ 'RASPI_DHCP_ENABLED' => true, 'RASPI_ADBLOCK_ENABLED' => false, 'RASPI_OPENVPN_ENABLED' => false, + 'RASPI_WIREGUARD_ENABLED' => false, 'RASPI_TORPROXY_ENABLED' => false, 'RASPI_CONFAUTH_ENABLED' => true, 'RASPI_CHANGETHEME_ENABLED' => true, diff --git a/includes/functions.php b/includes/functions.php index 1304d61f..4a9e77bb 100755 --- a/includes/functions.php +++ b/includes/functions.php @@ -452,6 +452,33 @@ function getBridgedState() return $arrHostapdConf['BridgedEnable']; } +/** + * Validates the format of a CIDR notation string + * + * @param string $cidr + * @return bool + */ +function validateCidr($cidr) +{ + $parts = explode('/', $cidr); + if(count($parts) != 2) { + return false; + } + $ip = $parts[0]; + $netmask = intval($parts[1]); + + if($netmask < 0) { + return false; + } + if(filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) { + return $netmask <= 32; + } + if(filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) { + return $netmask <= 128; + } + return false; +} + // Validates a host or FQDN function validate_host($host) { return preg_match('/^([a-z\d](-*[a-z\d])*)(\.([a-z\d](-*[a-z\d])*))*$/i', $host); diff --git a/includes/wireguard.php b/includes/wireguard.php new file mode 100644 index 00000000..84956b89 --- /dev/null +++ b/includes/wireguard.php @@ -0,0 +1,136 @@ + 5 || !is_numeric($_POST['wg_port'])) { + $status->addMessage('Invalid value for port number', 'danger'); + $good_input = false; + } + } + if (isset($_POST['wg_ipaddress'])) { + if (!validateCidr($_POST['wg_ipaddress'])) { + $status->addMessage('Invalid value for IP address', 'danger'); + $good_input = false; + } + } + if (isset($_POST['wg_endpoint']) && strlen(trim($_POST['wg_endpoint']) >0 )) { + if (!validateCidr($_POST['wg_endpoint'])) { + $status->addMessage('Invalid value for endpoint address', 'danger'); + $good_input = false; + } + } + if (isset($_POST['wg_allowedips'])) { + if (!validateCidr($_POST['wg_allowedips'])) { + $status->addMessage('Invalid value for allowed IPs', 'danger'); + $good_input = false; + } + } + if (isset($_POST['wg_pkeepalive']) && strlen(trim($_POST['wg_pkeepalive']) >0 )) { + if (strlen($_POST['wg_pkeepalive']) > 4 || !is_numeric($_POST['wg_pkeepalive'])) { + $status->addMessage('Invalid value for persistent keepalive', 'danger'); + $good_input = false; + } + } + // Save settings + if ($good_input) { + $config[] = '[Interface]'; + $config[] = 'Address = '.$_POST['wg_ipaddress']; + $config[] = 'ListenPort = '.$_POST['wg_port']; + $config[] = ''; + $config[] = 'PrivateKey = '.$_POST['wg_privkey']; + $config[] = 'PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE'; + $config[] = 'PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE'; + $config[] = ''; + $config[] = '[Peer]'; + $config[] = 'PublicKey = '.$_POST['wg_pubkey']; + if ($_POST['wg_endpoint'] !== '') { + $config[] = 'Endpoint = '.trim($_POST['wg_endpoint']); + } + $config[] = 'AllowedIPs = '.$_POST['wg_allowedips']; + if ($_POST['wg_pkeepalive'] !== '') { + $config[] = 'PersistentKeepalive = '.trim($_POST['wg_pkeepalive']); + } + $config[] = ''; + $config = join(PHP_EOL, $config); + + file_put_contents("/tmp/wgdata", $config); + system('sudo cp /tmp/wgdata '.RASPI_WIREGUARD_CONFIG, $return); + + // handle log option + if ($_POST['wg_log'] == "1") { + exec("sudo /bin/systemctl status wg-quick@wg0 | sudo tee /tmp/wireguard.log > /dev/null"); + } + foreach ($return as $line) { + $status->addMessage($line, 'info'); + } + if ($return == 0) { + $status->addMessage('Wireguard configuration updated successfully', 'success'); + } else { + $status->addMessage('Wireguard configuration failed to be updated.', 'danger'); + } + } + + } elseif (isset($_POST['startwg'])) { + $status->addMessage('Attempting to start WireGuard', 'info'); + exec('sudo /usr/bin/wg-quick up wg0', $return); + foreach ($return as $line) { + $status->addMessage($line, 'info'); + } + } elseif (isset($_POST['stopwg'])) { + $status->addMessage('Attempting to stop WireGuard', 'info'); + exec('sudo /usr/bin/wg-quick down wg0', $return); + foreach ($return as $line) { + $status->addMessage($line, 'info'); + } + } + } + + // fetch wg config + exec('sudo cat '. RASPI_WIREGUARD_CONFIG, $return); + $conf = ParseConfig($return); + $wg_port = $conf['ListenPort']; + $wg_ipaddress = $conf['Address']; + $wg_pubkey = $conf['PublicKey']; + $wg_privkey = $conf['PrivateKey']; + $wg_endpoint = $conf['Endpoint']; + $wg_allowedips = $conf['AllowedIPs']; + $wg_pkeepalive = $conf['PersistentKeepalive']; + + // fetch service status + exec('pidof wg-crypt-wg0 | wc -l', $wgstatus); + $serviceStatus = $wgstatus[0] == 0 ? "down" : "up"; + $wg_state = ($wgstatus[0] > 0); + + echo renderTemplate( + "wireguard", compact( + "status", + "wg_state", + "serviceStatus", + "wg_log", + "endpoint_enable", + "peer_id", + "wg_port", + "wg_ipaddress", + "wg_pubkey", + "wg_privkey", + "wg_endpoint", + "wg_allowedips", + "wg_pkeepalive" + ) + ); +} + diff --git a/index.php b/index.php index 8c702885..93abb732 100755 --- a/index.php +++ b/index.php @@ -45,6 +45,7 @@ require_once 'includes/themes.php'; require_once 'includes/data_usage.php'; require_once 'includes/about.php'; require_once 'includes/openvpn.php'; +require_once 'includes/wireguard.php'; require_once 'includes/torproxy.php'; $output = $return = 0; @@ -81,6 +82,9 @@ $bridgedEnabled = getBridgedState(); + + + @@ -160,6 +164,11 @@ $bridgedEnabled = getBridgedState();
  • +
    • + + +
  • +
    • @@ -253,6 +262,9 @@ $bridgedEnabled = getBridgedState(); case "openvpn_conf": DisplayOpenVPNConfig(); break; + case "wg_conf": + DisplayWireGuardConfig(); + break; case "torproxy_conf": DisplayTorProxyConfig(); break; diff --git a/installers/common.sh b/installers/common.sh index 7fddc414..9c55a9f0 100755 --- a/installers/common.sh +++ b/installers/common.sh @@ -262,6 +262,43 @@ function _prompt_install_openvpn() { fi } +# Prompt to install WireGuard +function _prompt_install_wireguard() { + _install_log "Configure WireGuard support" + echo -n "Install WireGuard and enable VPN tunnel configuration? [Y/n]: " + if [ "$assume_yes" == 0 ]; then + read answer < /dev/tty + if [ "$answer" != "${answer#[Nn]}" ]; then + echo -e + else + _install_wireguard + fi + elif [ "$wg_option" == 1 ]; then + _install_wireguard + else + echo "(Skipped)" + fi +} + +# Install Wireguard from the Debian unstable distro +function _install_wireguard() { + _install_log "Configure WireGuard support" + echo "Installing WireGuard from Debian unstable distro" + echo "Adding Debian distro" + echo "deb http://deb.debian.org/debian/ unstable main" | sudo tee --append /etc/apt/sources.list.d/unstable.list || _install_status 1 "Unable to append to sources.list" + sudo apt-get install dirmngr || _install_status 1 "Unable to install dirmngr" + echo "Adding Debian distro keys" + sudo wget -q -O - https://ftp-master.debian.org/keys/archive-key-$(lsb_release -sr).asc | sudo apt-key add - || _install_status 1 "Unable to add keys" + printf 'Package: *\nPin: release a=unstable\nPin-Priority: 150\n' | sudo tee --append /etc/apt/preferences.d/limit-unstable || _install_status 1 "Unable to append to preferences.d" + echo "Installing WireGuard" + sudo apt-get update && sudo apt-get install $apt_option wireguard || _install_status 1 "Unable to install wireguard" + echo "Enabling wg-quick@wg0" + sudo systemctl enable wg-quick@wg0 || _install_status 1 "Failed to enable wg-quick service" + echo "Enabling WireGuard management option" + sudo sed -i "s/\('RASPI_WIREGUARD_ENABLED', \)false/\1true/g" "$webroot_dir/includes/config.php" || _install_status 1 "Unable to modify config.php" + _install_status 0 +} + # Install openvpn and enable client configuration option function _install_openvpn() { _install_log "Installing OpenVPN and enabling client configuration" @@ -568,6 +605,7 @@ function _install_raspap() { _configure_networking _prompt_install_adblock _prompt_install_openvpn + _prompt_install_wireguard _patch_system_files _install_complete } diff --git a/installers/raspap.sudoers b/installers/raspap.sudoers index ae42393c..a6e313ff 100644 --- a/installers/raspap.sudoers +++ b/installers/raspap.sudoers @@ -35,7 +35,15 @@ www-data ALL=(ALL) NOPASSWD:/etc/raspap/lighttpd/configport.sh www-data ALL=(ALL) NOPASSWD:/etc/raspap/openvpn/configauth.sh www-data ALL=(ALL) NOPASSWD:/bin/chmod o+r /tmp/hostapd.log www-data ALL=(ALL) NOPASSWD:/bin/chmod o+r /tmp/dnsmasq.log +www-data ALL=(ALL) NOPASSWD:/bin/chmod o+r /tmp/wireguard.log www-data ALL=(ALL) NOPASSWD:/bin/cp /tmp/dnsmasqdata /etc/dnsmasq.d/090_adblock.conf www-data ALL=(ALL) NOPASSWD:/bin/cp /tmp/dnsmasq_custom /etc/raspap/adblock/custom.txt +www-data ALL=(ALL) NOPASSWD:/bin/cp /tmp/wgdata /etc/wireguard/wg0.conf www-data ALL=(ALL) NOPASSWD:/etc/raspap/adblock/update_blocklist.sh +www-data ALL=(ALL) NOPASSWD:/usr/bin/tee /tmp/wireguard.log +www-data ALL=(ALL) NOPASSWD:/bin/systemctl status wg-quick@wg0 +www-data ALL=(ALL) NOPASSWD:/usr/bin/wg-quick up wg0 +www-data ALL=(ALL) NOPASSWD:/usr/bin/wg-quick down wg0 +www-data ALL=(ALL) NOPASSWD:/usr/bin/wg +www-data ALL=(ALL) NOPASSWD:/bin/cat /etc/wireguard/wg0.conf diff --git a/installers/raspbian.sh b/installers/raspbian.sh index bc8c5aab..e9cbb136 100755 --- a/installers/raspbian.sh +++ b/installers/raspbian.sh @@ -14,6 +14,8 @@ # Used with -y, --yes, sets OpenVPN install option (0=no install) # -a, --adblock # Used with -y, --yes, sets Adblock install option (0=no install) +# -w, --wireguard +# Used with -y, --yes, sets WireGuard install option (0=no install) # -r, --repo, --repository # Overrides the default GitHub repo (billz/raspap-webgui) # -b, --branch @@ -42,6 +44,7 @@ assume_yes=0 upgrade=0 ovpn_option=1 adblock_option=1 +wg_option=1 # Define colors readonly ANSI_RED="\033[0;31m" @@ -61,6 +64,7 @@ Usage: raspbian.sh [OPTION]\n -c, --cert, --certificate\n\tInstalls an SSL certificate for lighttpd -o, --openvpn \n\tUsed with -y, --yes, sets OpenVPN install option (0=no install) -a, --adblock \n\tUsed with -y, --yes, sets Adblock install option (0=no install) +-w, --wireguard \n\tUsed with -y, --yes, sets WireGuard install option (0=no install) -r, --repo, --repository \n\tOverrides the default GitHub repo (billz/raspap-webgui) -b, --branch \n\tOverrides the default git branch (master) -h, --help\n\tOutputs usage notes and exits @@ -84,6 +88,10 @@ while :; do adblock_option="$2" shift ;; + -w|--wireguard) + wg_option="$2" + shift + ;; -c|--cert|--certificate) install_cert=1 ;; diff --git a/templates/wg/general.php b/templates/wg/general.php new file mode 100644 index 00000000..aa1de796 --- /dev/null +++ b/templates/wg/general.php @@ -0,0 +1,47 @@ + +
    +
    +
    +

    +
    + +
    + aria-describedby="tunnel-description"> + +
    +

    + +

    +
    +
    +
    + + +
    +
    + +
    +
    + +
    +
    + +
    + + +
    +
    +
    + + +
    +
    + + +
    +
    + +
    +
    +
    + diff --git a/templates/wg/logging.php b/templates/wg/logging.php new file mode 100644 index 00000000..c9cb4185 --- /dev/null +++ b/templates/wg/logging.php @@ -0,0 +1,19 @@ + +
    +
    +
    +

    +
    + aria-describedby="wg_log"> + +
    +

    + '.htmlspecialchars($log, ENT_QUOTES).''; + ?> +
    +
    +
    + diff --git a/templates/wg/peers.php b/templates/wg/peers.php new file mode 100644 index 00000000..16337a08 --- /dev/null +++ b/templates/wg/peers.php @@ -0,0 +1,54 @@ + +
    + +
    +
    +

    +
    + + +
    + aria-describedby="endpoint-description"> + +
    +
    + +
    +
    + + +
    +
    + +
    +
    + + +
    +
    + +
    +
    + + +
    +
    + +
    +
    + +
    +
    + +
    + + +
    +
    +
    + + +
    +
    +
    + diff --git a/templates/wireguard.php b/templates/wireguard.php new file mode 100644 index 00000000..3ead09c7 --- /dev/null +++ b/templates/wireguard.php @@ -0,0 +1,53 @@ + + + "> + + "> + + "> + + + + +
    +
    +
    +
    +
    +
    + +
    +
    + +
    +
    +
    +
    + showMessages(); ?> +
    + + +
      +
      • +
      • +
      • +
    + + +
    + + + +
    + + +
    +
    +
    +
    +
    +
    +