better wg call

Author: ipitio

debian/control

@@ -4,7 +4,7 @@ Homepage: https://github.com/ipitio/closure
 Standards-Version: 3.9.2
 
 Package: closure
-Version: 1.6.16
+Version: 1.6.17
 Maintainer: ipitio <[email protected]>
 Depends: curl, flatpak, gpg, hostapd, isc-dhcp-server, iw, macchanger, netplan.io, network-manager, net-tools, qrencode, rfkill, wireguard, wireless-tools, wget
 Recommends: containerd.io, docker-ce, docker-ce-cli, docker-buildx-plugin, docker-compose-plugin

init.sh

@@ -160,7 +160,7 @@ else
     echo "grep -qP '\d+' <<<\"\$SSH_CLIENT\" || sudo $active_path $CLS_STARTUP_ARGS" | sudo tee -a /home/"$CLS_ACTIVE_USER"/.profile >/dev/null
 fi
 
-if $CLS_DOCKER; then
+if [ "$CLS_DOCKER" = "true" ]; then
     sudo mkdir -p /etc/docker
     echo '{
     "ipv6": true,

lib.sh

@@ -46,12 +46,15 @@ sudo() {
     fi
 }
 
+# shellcheck disable=SC2120
 wg() {
-    if $CLS_DOCKER; then
-        sudo docker exec wireguard wg "$@"
-    else
-        command wg "$@"
-    fi
+    sudo bash <<EOF
+if [ "$CLS_DOCKER" = "true" ]; then
+    docker exec wireguard wg ${@@Q}
+else
+    command wg ${@@Q}
+fi
+EOF
 }
 
 get_local_iface() {
@@ -64,6 +67,7 @@ get_local_ip() {
     ip r | grep -q '^default via' || sudo ip r add default via "$(nmcli dev show "$CLS_LOCAL_IFACE" | grep -oP '((?<=GATEWAY:)[^-]*|/0.*?= [^,]+)' | grep -oE '[^ ]+$' | head -n1)" dev "$CLS_LOCAL_IFACE" &>/dev/null
     CLS_GATEWAY=$(ip r | grep -oP '^default via \K\S+')
     CLS_LOCAL_IP=$(ip a show "$CLS_LOCAL_IFACE" | grep -oP 'inet \K\S+' | cut -d/ -f1)
+    wg | grep -oE 'endpoint: [^:]+' | grep -oE '\S+$' | while read -r endpoint; do route -n | grep -q "$endpoint" || sudo route add -net "$endpoint" netmask 255.255.255.255 gw "$CLS_GATEWAY" &>/dev/null; done
 }
 
 restart_isc() {

start.sh

@@ -20,7 +20,7 @@ if ! ${CLS_WG_ONLY:-false}; then
     if [ -n "$WIFI" ]; then
         WIFI=${WIFI//\"/\\\"}
 
-        if $ADD; then
+        if [ "$ADD" = "true" ]; then
             ! $PORTAL || jq "(. | select([\"$WIFI\"]) | .[\"$WIFI\"]) = \"$MAC\"" config/wifis.json | sudo tee config/new.wifis.json
             [[ ! -f config/new.wifis.json || ! -s config/new.wifis.json ]] || sudo mv -f config/new.wifis.json config/wifis.json
             wpa_ssid=".network.wifis.[\"$CLS_WIFACE\"].access-points.[\"$WIFI\"]"
@@ -70,7 +70,7 @@ if ! ${CLS_WG_ONLY:-false}; then
     eval "start_hostapd ${*@Q}" &
 fi
 
-if $CLS_DOCKER; then
+if [ "$CLS_DOCKER" = "true" ]; then
     sudo systemctl enable --now docker
 
     for table in nat filter; do
@@ -82,7 +82,7 @@ if $CLS_DOCKER; then
 else
     sudo sysctl -w net.ipv4.ip_forward=0
     sudo sysctl -w net.ipv6.conf.all.forwarding=0
-    for iface in $(sudo wg | grep -oP '(?<=interface: ).+'); do sudo wg-quick down "$iface"; done
+    for iface in $(wg | grep -oP '(?<=interface: ).+'); do sudo wg-quick down "$iface"; done
 fi
 
 eval "cast pre-up ${*@Q}"
@@ -104,17 +104,11 @@ eval "cast pre-up ${*@Q}"
         get_local_ip
 
         if ! ip rule show table 7 2>/dev/null | grep -qP '0x55' || ! ip route show table 7 2>/dev/null | grep -q default; then
-            ip route show table 7 2>/dev/null | grep -q default || sudo ip route add default via "$(ip r | grep -oP 'default via \K\S+')" dev "$CLS_LOCAL_IFACE" table 7 &>/dev/null
+            ip route show table 7 2>/dev/null | grep -q default || sudo ip route add default via "$CLS_GATEWAY" dev "$CLS_LOCAL_IFACE" table 7 &>/dev/null
             ip rule show table 7 2>/dev/null | grep -qP '0x55' || sudo ip rule add fwmark 0x55 table 7 &>/dev/null
             sudo ip route flush cache
         fi
 
-        if [ -n "$CLS_EXTERN_IFACE" ] && [[ "$CLS_TYPE_NODE" =~ (hub|saah) ]] && ip a show "$CLS_EXTERN_IFACE" | grep -q UP; then
-            sudo wg | grep -oE 'endpoint: [^:]+' | grep -oE '\S+$' | while read -r endpoint; do
-                route -n | grep -q "$endpoint" || sudo route add -net "$endpoint" netmask 255.255.255.255 gw "$(ip r | grep -oP 'default via \K\S+')" &>/dev/null
-            done
-        fi
-
         if ! is_ip "$SERVERURL"; then
             core_ip_now=$(get_server_ip)
 
@@ -133,7 +127,7 @@ eval "cast pre-up ${*@Q}"
     exec sudo CLS_WG_ONLY=false bash restart.sh ${@@Q}
 ) &
 
-if $CLS_DOCKER; then
+if [ "$CLS_DOCKER" = "true" ]; then
     sudo systemctl stop isc-dhcp-server
 
     # prod starts wg

wireguard/add.sh

@@ -18,7 +18,7 @@ if ! grep -q "$1" <<<"$PEERS"; then
     PEERS="$new_peers"
     sudo mv -f wireguard/config/wg_confs/"$CLS_INTERN_IFACE".conf wireguard/config/wg_confs/"$CLS_INTERN_IFACE".conf.bak
 
-    if $CLS_DOCKER; then
+    if [ "$CLS_DOCKER" = "true" ]; then
         sudo CLS_WG_ONLY=true bash restart.sh ${@@Q}
     else
         bash wireguard/etc/run