Replace WireGuard prototype with native host service and scoped access

network/native.py

@@ -0,0 +1,235 @@
+"""Native host WireGuard, fixed Unix RPC and address-bound Deck access gateways.
+No wg-quick hooks, default route replacement, DNS changes or Docker operations.
+"""
+import argparse
+import http.client
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import ipaddress
+import json
+import os
+from pathlib import Path
+import secrets
+import selectors
+import signal
+import socket
+import socketserver
+import struct
+import subprocess
+import threading
+import time
+from network.config import parse_config, wireguard_text
+from network.policy import Policy
+
+INTERFACE='wgdeck0'
+TABLE='51826'
+PRIORITIES={4:'12126',6:'12127'}
+ENV={'PATH':'/usr/sbin:/usr/bin:/sbin:/bin','LANG':'C.UTF-8'}
+
+def run(args,check=True):
+ r=subprocess.run(args,capture_output=True,text=True,timeout=15,env=ENV)
+ if check and r.returncode:raise ValueError('WireGuard-Systemaktion fehlgeschlagen ('+' '.join(args)+'); Verbindung und Hostzustand prüfen.')
+ return r.stdout.strip()
+
+def save(path,value):
+ temp=path.with_suffix('.tmp');fd=os.open(temp,os.O_WRONLY|os.O_CREAT|os.O_TRUNC,0o600)
+ with os.fdopen(fd,'w') as f:json.dump(value,f);f.flush();os.fsync(f.fileno())
+ temp.replace(path)
+
+class Manager:
+ def __init__(self,state,policy):
+  self.root=Path(state);self.root.mkdir(mode=0o700,exist_ok=True);self.settings=policy
+  self.lock=threading.RLock();self.listeners=[];self.enabled=False;self.error=None
+  self.policy=Policy(mode=self.read('mode.json','lan'),persist=lambda v:save(self.root/'mode.json',v))
+  token=self.root/'proxy-token'
+  if not token.exists():token.write_text(secrets.token_hex(32));token.chmod(0o600)
+  self.token=token.read_text().strip()
+  self.reconcile()
+ def read(self,name,default=None):
+  p=self.root/name
+  return json.loads(p.read_text()) if p.exists() else default
+ def config(self):
+  text=self.read('config.json')
+  return parse_config(text,native=True) if text else None
+ def connected(self):
+  if not self.enabled:return False,0
+  raw=run(['wg','show',INTERFACE,'latest-handshakes'],False)
+  latest=max((int(l.split()[1]) for l in raw.splitlines() if len(l.split())==2),default=0)
+  return latest>0 and 0<=time.time()-latest<180,latest
+ def status(self,ingress='management'):
+  connected,latest=self.connected();c=self.config()
+  return dict(installed=True,install_supported=False,backend='native-systemd',interface=INTERFACE,enabled=self.enabled,configured=bool(c),state='connected' if connected else 'connecting' if self.enabled else 'disabled',latest_handshake=latest,ingress=ingress,lan_url='http://'+self.settings['lan_address']+':'+str(self.settings['gui_port']),tunnel_url='http://'+c['address']+':'+str(self.settings['gui_port']) if c else None,warnings=c['warnings'] if c else [],error=self.error,**self.policy.status())
+ def connect(self):
+  if self.enabled:return
+  c=self.config()
+  if not c:raise ValueError('Zuerst eine WireGuard-Konfiguration importieren.')
+  existing=json.loads(run(['ip','-j','address','show']))
+  if any(ipaddress.ip_interface(a).ip==ipaddress.ip_address(v['local']) for a in c['addresses'] for d in existing for v in d.get('addr_info',[])):
+   raise ValueError('Tunnel-IP ist bereits auf diesem Host aktiv. Alten Tunnel zuerst kontrolliert deaktivieren.')
+  if run(['ip','link','show',INTERFACE],False):raise ValueError('Schnittstelle wgdeck0 ist bereits belegt.')
+  for version in (4,6):
+   if run(['ip','-'+str(version),'route','show','table',TABLE],False) or any(line.split(':',1)[0].strip()==PRIORITIES[version] for line in run(['ip','-'+str(version),'rule','show']).splitlines()):raise ValueError('Reservierte Routingtabelle oder Regelpriorität ist bereits belegt.')
+  try:
+   run(['ip','link','add',INTERFACE,'type','wireguard']);self.enabled=True
+   temp=self.root/'setconf.conf';fd=os.open(temp,os.O_CREAT|os.O_EXCL|os.O_WRONLY,0o600)
+   try:
+    with os.fdopen(fd,'w') as f:f.write(wireguard_text(c))
+    run(['wg','setconf',INTERFACE,str(temp)])
+   finally:temp.unlink(missing_ok=True)
+   run(['ip','link','set',INTERFACE,'mtu',str(c['mtu']),'up'])
+   for address in c['addresses']:
+    a=ipaddress.ip_interface(address);version=str(a.version)
+    run(['ip','-'+version,'address','add',str(a.ip)+('/32' if a.version==4 else '/128'),'dev',INTERFACE])
+    for network in c['allowed_ips']:
+     if ipaddress.ip_network(network).version==a.version:run(['ip','-'+version,'route','add',network,'dev',INTERFACE,'table',TABLE])
+    run(['ip','-'+version,'rule','add','priority',PRIORITIES[a.version],'from',str(a.ip)+('/32' if a.version==4 else '/128'),'lookup',TABLE])
+   self.reconcile();save(self.root/'enabled.json',True);self.error=None
+  except Exception:
+   self.disconnect();raise
+ def disconnect(self,persist=True):
+  if self.enabled:
+   self.enabled=False;self.reconcile()
+   for version in (4,6):
+    run(['ip','-'+str(version),'rule','del','priority',PRIORITIES[version],'lookup',TABLE],False)
+    run(['ip','-'+str(version),'route','flush','table',TABLE],False)
+   run(['ip','link','del',INTERFACE],False)
+  if persist:save(self.root/'enabled.json',False)
+ def reconcile(self):
+  # LAN never uses 0.0.0.0; API and applications keep their loopback upstream.
+  desired={(self.settings['lan_address'],p,'lan') for p in self.settings['ports']}
+  if self.enabled:
+   c=self.config();desired|={(str(ipaddress.ip_interface(a).ip),p,'tunnel') for a in c['addresses'] for p in self.settings['ports']}
+  present={(s.bind_address,s.port,s.ingress) for s in self.listeners}
+  added=[]
+  try:
+   for address,port,ingress in sorted(desired-present):
+    cls=GUI if port==self.settings['gui_port'] else Relay
+    server=Listener(address,port,ingress,cls,self)
+    threading.Thread(target=server.serve_forever,daemon=True).start();added.append(server)
+  except Exception:
+   for s in added:s.shutdown();s.server_close()
+   raise ValueError('Netzwerkport ist belegt; bestehende Listener bleiben unverändert.') from None
+  self.listeners+=added
+  for s in self.listeners[:]:
+   if (s.bind_address,s.port,s.ingress) not in desired:
+    s.shutdown();s.server_close();self.listeners.remove(s)
+ def dispatch(self,data):
+  action=data.get('action');ingress='management'
+  if secrets.compare_digest(str(data.get('proxy_token','')),self.token) and data.get('ingress') in ('lan','tunnel'):ingress=data['ingress']
+  with self.lock:
+   if action=='status':return self.status(ingress)
+   if action=='import':
+    if self.enabled or self.policy.mode!='lan' or self.policy.pending:raise ValueError('Import nur bei deaktiviertem Tunnel im bestätigten lokalen Modus.')
+    text=data.get('config');parse_config(text,native=True);save(self.root/'config.json',text)
+   elif action=='connect':self.connect()
+   elif action=='disconnect':self.disconnect()
+   elif action=='mode':self.policy.propose(data.get('mode'),self.connected()[0])
+   elif action=='confirm':self.policy.confirm(data.get('trial_id'),ingress)
+   elif action=='cancel':self.policy.cancel()
+   elif action=='delete':
+    if self.enabled or self.policy.mode!='lan' or self.policy.pending:raise ValueError('Tunnel zuerst deaktivieren und lokalen Modus bestätigen.')
+    (self.root/'config.json').unlink(missing_ok=True)
+   elif action=='backup-export':return dict(config=self.read('config.json'),enabled=self.enabled,mode=self.policy.mode)
+   elif action=='backup-restore':
+    b=data.get('backup',{})
+    if set(b)!={'config','enabled','mode'} or type(b['enabled']) is not bool or b['mode'] not in Policy.MODES:raise ValueError('Ungültiger Netzwerkstand.')
+    if self.enabled or self.policy.mode!='lan':raise ValueError('Restore benötigt deaktivierten Tunnel im lokalen Modus.')
+    if b['config']:parse_config(b['config'],native=True);save(self.root/'config.json',b['config'])
+    if b['enabled']:self.connect()
+    if b['mode']!='lan':self.policy.propose(b['mode'],self.connected()[0])
+   else:raise ValueError('Unbekannte Netzwerkaktion.')
+   return self.status(ingress)
+
+class Listener(socketserver.ThreadingTCPServer):
+ allow_reuse_address=True;daemon_threads=True
+ def __init__(self,address,port,ingress,handler,manager):
+  self.address_family=socket.AF_INET6 if ':' in address else socket.AF_INET
+  self.bind_address=address;self.port=port;self.ingress=ingress;self.manager=manager
+  super().__init__((address,port),handler,bind_and_activate=False)
+  try:
+   device=INTERFACE if ingress=='tunnel' else manager.settings.get('lan_interface')
+   if device:self.socket.setsockopt(socket.SOL_SOCKET,socket.SO_BINDTODEVICE,device.encode()+b'\0')
+   self.server_bind();self.server_activate()
+  except Exception:self.server_close();raise
+ def allowed(self):
+  with self.manager.lock:return self.manager.policy.allowed(self.ingress)
+
+class Relay(socketserver.BaseRequestHandler):
+ def handle(self):
+  if not self.server.allowed():return
+  try:
+   with socket.create_connection(('127.0.0.1',self.server.port),timeout=5) as upstream,selectors.DefaultSelector() as sel:
+    self.request.setblocking(False);upstream.setblocking(False)
+    sel.register(self.request,selectors.EVENT_READ,upstream);sel.register(upstream,selectors.EVENT_READ,self.request)
+    while self.server.allowed():
+     for key,_ in sel.select(1):
+      data=key.fileobj.recv(65536)
+      if not data:return
+      # Bounded blocking send: preserve streaming and WebSocket bytes unchanged.
+      dst=key.data;dst.settimeout(10);dst.sendall(data);dst.setblocking(False)
+  except (OSError,ValueError):pass
+
+class GUI(BaseHTTPRequestHandler):
+ protocol_version='HTTP/1.1'
+ def log_message(self,*args):pass
+ def do_GET(self):self.forward()
+ def do_POST(self):self.forward()
+ def do_HEAD(self):self.forward()
+ def forward(self):
+  if not self.server.allowed():self.send_error(403,'Network access disabled');return
+  expected=('['+self.server.bind_address+']' if ':' in self.server.bind_address else self.server.bind_address)+':'+str(self.server.port)
+  if self.headers.get('Host')!=expected:self.send_error(403,'Host rejected');return
+  try:
+   if self.headers.get('Transfer-Encoding'):raise ValueError()
+   length=int(self.headers.get('Content-Length','0'))
+   if not 0<=length<=64*1024*1024:raise ValueError()
+   self.connection.settimeout(30)
+   body=self.rfile.read(length) if length else None
+   if body is not None and len(body)!=length:raise ValueError()
+   headers={k:v for k,v in self.headers.items() if k.lower() not in ('connection','x-deck-proxy','x-deck-ingress','transfer-encoding')}
+   headers.update({'X-Deck-Proxy':self.server.manager.token,'X-Deck-Ingress':self.server.ingress,'Connection':'close'})
+   conn=http.client.HTTPConnection('127.0.0.1',self.server.port,timeout=120)
+   try:
+    conn.request(self.command,self.path,body,headers);response=conn.getresponse();self.send_response(response.status)
+    for k,v in response.getheaders():
+     if k.lower() not in ('connection','transfer-encoding','server','date'):self.send_header(k,v)
+    self.send_header('Connection','close');self.end_headers();self.close_connection=True
+    if self.command!='HEAD':
+     while chunk:=response.read(65536):self.wfile.write(chunk)
+   finally:conn.close()
+  except (OSError,ValueError,http.client.HTTPException):self.close_connection=True
+
+class RPC(socketserver.StreamRequestHandler):
+ def handle(self):
+  self.connection.settimeout(30)
+  try:
+   _,uid,_=struct.unpack('3i',self.connection.getsockopt(socket.SOL_SOCKET,socket.SO_PEERCRED,12))
+   if uid not in (0,self.server.client_uid):raise ValueError('Client nicht freigegeben.')
+   raw=self.rfile.readline(32769)
+   if len(raw)>32768:raise ValueError('Anfrage zu groß.')
+   data=json.loads(raw)
+   if not isinstance(data,dict):raise ValueError('Ungültige Anfrage.')
+   result=self.server.manager.dispatch(data)
+  except Exception as e:result={'error':str(e) if isinstance(e,ValueError) else 'Nativer Netzwerkdienst nicht verfügbar.'}
+  self.wfile.write(json.dumps(result).encode()+b'\n')
+
+class Server(socketserver.ThreadingUnixStreamServer):daemon_threads=True
+
+def main():
+ p=argparse.ArgumentParser();p.add_argument('--client-uid',type=int,required=True);p.add_argument('--client-gid',type=int,required=True);p.add_argument('--state',default='/var/lib/athena-deck-network');args=p.parse_args()
+ root=Path(args.state);policy=json.loads((root/'policy.json').read_text())
+ manager=Manager(root,policy)
+ runtime=Path('/run/athena-deck-network');runtime.mkdir(exist_ok=True)
+ token=runtime/'proxy-token';token.write_text(manager.token);os.chown(token,0,args.client_gid);token.chmod(0o640)
+ sock=runtime/'control.sock';sock.unlink(missing_ok=True)
+ with Server(str(sock),RPC) as server:
+  os.chown(sock,0,args.client_gid);sock.chmod(0o660);server.client_uid=args.client_uid;server.manager=manager
+  # enabled is persisted only on explicit successful activation; native service owns recovery.
+  if manager.read('enabled.json',False):
+   try:manager.connect()
+   except Exception:manager.error='Gespeicherter Tunnel konnte nicht aktiviert werden; Hostzustand prüfen.'
+  signal.signal(signal.SIGTERM,lambda *_:threading.Thread(target=server.shutdown,daemon=True).start())
+  try:server.serve_forever()
+  finally:
+   manager.disconnect(persist=False)
+   for listener in manager.listeners:listener.shutdown();listener.server_close()
+if __name__=='__main__':main()