feat: Enhanced UAPI, full CLI, wg-quick in pure Python, and wg-daemon#25
Open
radawson wants to merge 7 commits intocmusatyalab:mainfrom
Open
feat: Enhanced UAPI, full CLI, wg-quick in pure Python, and wg-daemon#25radawson wants to merge 7 commits intocmusatyalab:mainfrom
radawson wants to merge 7 commits intocmusatyalab:mainfrom
Conversation
- sync_config() on WireguardDevice / UAPI / Netlink backends - _resolve_endpoint() with WG_ENDPOINT_RESOLUTION_RETRIES support - IPv6 bracket notation for UAPI and config endpoints - _split_comma_list() filters empty entries - FwMark hex parsing (int(value, 0)) - Preshared key sent as hex to UAPI - Full wg set CLI with _parse_set_args() - wg addconf merging new config onto running config - wg syncconf using diff-based sync_config() - wg show with dump, field filtering, WG_HIDE_KEYS - wg_quick.py: up()/down() via pyroute2 netlink (interface create/delete, address, route, fwmark rules, DNS) - CLI up/down subcommands
- test_cli_commands: 21 tests for _parse_set_args and SHOW_FIELDS - test_config_parsing: 27 tests for _parse_endpoint, _split_comma_list, IPv6, FwMark hex, AllowedIPs, Table/SaveConfig, round-trips - test_uapi_protocol: 11 tests for _build_peer_uapi, set_config, sync_config, _resolve_endpoint with IPv6 and hostname - test_wg_quick: 11 tests for _find_config, _resolve_table, _collect_allowed_networks, up/down error conditions - Fix PermissionError in _find_config for /etc/wireguard access
…losure - Updated the up() function to use a context manager for opening the WireGuard configuration file, ensuring proper closure of file handles. - Added a new test case in test_wg_quick.py to verify that configuration file handles are closed after use in the up() function.
- Introduced a new `wg-daemon` command in `pyproject.toml` for managing the WireGuard Tools Daemon. - Implemented the `WgDaemonClient` class for IPC over a Unix socket, allowing commands like `up`, `down`, `show`, `set_peer`, and `remove_peer`. - Added a `wg-daemon.service` file for systemd integration, enabling easy management of the daemon. - Enhanced the CLI with improved argument parsing for the `show` command, allowing for flexible input. - Added comprehensive tests for the daemon and its client to ensure robust functionality and error handling. - Updated existing tests to accommodate new features and ensure compatibility.
…n of zero value - Modified the `set_` function to ensure that an explicit zero value for `fwmark` is preserved when the user requests "fwmark off" or "0". - Added a new test case in `TestSetCommand` to verify that the `fwmark` value remains zero when set to these tokens, ensuring correct behavior in CLI command parsing.
- Updated README.md to clarify installation instructions and expand on CLI commands, including `wg-py` and `wg-daemon`. - Introduced new ARCHITECTURE.md file detailing module purposes, layer diagrams, and backend selection logic. - Added CHANGELOG.md to document significant changes and enhancements in the library. - Created DAEMON.md for comprehensive guidance on the `wg-daemon`, including its purpose, protocol, commands, and systemd setup. - Developed INTEGRATION.md to serve as a developer guide for using the library, covering installation, key generation, configuration file handling, and device operations.
- Added comprehensive docstrings to key modules including `wireguard_tools`, `daemon_client`, `daemon`, `wg_quick`, and `wireguard_config`, detailing their functionalities and usage. - Improved method-level documentation for clarity on parameters, return types, and exceptions. - Updated the `__init__.py` files to provide module-level documentation for better understanding of the package structure and public API. - Enhanced comments and type hints throughout the codebase to improve maintainability and readability.
Member
|
Overall comments without looking at the details.
From the summary it looks like there are a lot of useful improvements here as well, but... simply not going to merge a PR that changes just about every single file and touches over 5000 lines just to get a few valuable nuggets. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR extends wireguard-tools with several significant enhancements developed while building a WireGuard management GUI. All changes are backward-compatible with the existing API.
Core library fixes
_parse_endpoint()properly handles[::1]:51820bracket notation throughout config parsing, UAPI serialization, and wgconfig output_split_comma_list()filters empty entries from inputs like"10.0.0.0/24,"or"a,,b"that previously causedValueErrorin downstream parsersint(value, 0)for FwMark parsing accepts both0x1234and decimal formatsvalue.lower() == "true"instead ofvalue == "true"UAPI backend (
wireguard_uapi.py)WG_ENDPOINT_RESOLUTION_RETRIESsupport (matching Cwg(8)behavior)endpoint=lines (bracket notation)set_config()/sync_config():set_configdoes atomic replace (replace_peers=true);sync_configdiffs against running state and applies only changes (removes absent peers, skips unchanged ones)_build_peer_uapi()and_send_uapi_set()helpers to reduce duplicationNetlink backend (
wireguard_netlink.py)_apply_config(); bothset_configandsync_configdelegate to itDevice abstraction (
wireguard_device.py)sync_config()with a default implementation that falls back toset_config()CLI (
cli.py) — fullwg(8)paritywg set: Complex argument parser (_parse_set_args) supportingpeer,endpoint,allowed-ips,preshared-key,persistent-keepalive,remove, and incremental allowed-ipswg addconfandwg syncconfsubcommandswg showenhancements:dumpformat, per-field filtering,interfacesmode,WG_HIDE_KEYSsupportwg-py up/wg-py downsubcommandsPure Python
wg-quick(wg_quick.py) — new moduleup()anddown()functions implementingwg-quick(8)usingpyroute2for netlink-based interface, address, route, and fwmark rule managementresolvconfTable = auto|off|<number>routing logic with catch-all AllowedIPs detectionPrivileged daemon (
daemon.py,daemon_client.py) — new moduleswg-daemon) enabling privilege separation: run the daemon as root while clients (e.g., a web GUI) connect unprivilegedup,down,show,set_peer,remove_peer,list_devicesWgDaemonClientclass for easy IPC from any Python consumercontrib/wg-daemon.serviceTests — 67 new tests
test_cli_commands.py(21):_parse_set_argsandshowfield coveragetest_config_parsing.py(26): endpoint parsing, comma lists, IPv6 roundtrip, FwMark hex, Table/SaveConfigtest_uapi_protocol.py(12): peer UAPI serialization, set/sync config, endpoint resolutiontest_wg_quick.py(11): config resolution, table routing, network collection, up/down guardstest_daemon.py(15): full protocol coverage with mocked privileged operationsTest plan
pytest tests/ -v), 1 pre-existing skippyroute2,attrs,segno