27 lines
932 B
Bash
Executable file
27 lines
932 B
Bash
Executable file
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
IFS=$'\n\t'
|
|
|
|
fail() { printf '%s\n' "policy helper: $*" >&2; exit 78; }
|
|
|
|
[[ ${EUID:-$(id -u)} -eq 0 ]] || fail "root is required"
|
|
action="${1:-}"
|
|
case "$action" in
|
|
link-connect)
|
|
[[ $# -eq 6 ]] || fail "invalid link-connect argument count"
|
|
;;
|
|
link-disconnect)
|
|
[[ $# -eq 5 ]] || fail "invalid link-disconnect argument count"
|
|
;;
|
|
*) fail "unsupported action" ;;
|
|
esac
|
|
|
|
node_pattern='^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$'
|
|
[[ "$2" =~ $node_pattern && "$3" =~ $node_pattern ]] || fail "invalid node id"
|
|
[[ "$4" == "tcp" || "$4" == "udp" ]] || fail "invalid protocol"
|
|
[[ "$5" =~ ^[0-9]+$ ]] && (( 10#$5 >= 1 && 10#$5 <= 65535 )) || fail "invalid port"
|
|
if [[ "$action" == "link-connect" ]]; then
|
|
[[ "$6" =~ ^[0-9]+$ ]] && (( 10#$6 >= 1 && 10#$6 <= 10080 )) || fail "invalid TTL"
|
|
fi
|
|
|
|
fail "WireGuard/nftables data-plane configuration is not installed yet"
|