You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
350 lines
7.8 KiB
350 lines
7.8 KiB
12 months ago
|
package cluster
|
||
1 year ago
|
|
||
1 year ago
|
import (
|
||
1 year ago
|
"fmt"
|
||
1 year ago
|
"io/fs"
|
||
1 year ago
|
"net/netip"
|
||
|
|
||
|
"git.jpi.io/amery/jpictl/pkg/wireguard"
|
||
|
)
|
||
1 year ago
|
|
||
1 year ago
|
const (
|
||
|
// MaxZoneID indicates the highest ID allowed for a Zone
|
||
|
MaxZoneID = 0xf
|
||
|
// MaxNodeID indicates the highest Machine ID allowed within a Zone
|
||
|
MaxNodeID = 0xff - 1
|
||
1 year ago
|
// RingsCount indicates how many wireguard rings we have
|
||
|
RingsCount = 2
|
||
1 year ago
|
// RingZeroPort is the port wireguard uses for ring0
|
||
|
RingZeroPort = 51800
|
||
|
// RingOnePort is the port wireguard uses for ring1
|
||
|
RingOnePort = 51810
|
||
1 year ago
|
)
|
||
|
|
||
1 year ago
|
// RingInfo contains represents the Wireguard endpoint details
|
||
|
// for a Machine on a particular ring
|
||
|
type RingInfo struct {
|
||
12 months ago
|
Ring int
|
||
|
Enabled bool
|
||
|
Keys wireguard.KeyPair
|
||
1 year ago
|
}
|
||
|
|
||
1 year ago
|
// Merge attempts to combine two RingInfo structs
|
||
|
func (ri *RingInfo) Merge(alter *RingInfo) error {
|
||
|
switch {
|
||
1 year ago
|
case alter == nil:
|
||
|
return nil
|
||
1 year ago
|
case ri.Ring != alter.Ring:
|
||
|
// different ring
|
||
|
return fmt.Errorf("invalid %s: %v ≠ %v", "ring", ri.Ring, alter.Ring)
|
||
1 year ago
|
case ri.Enabled && !alter.Enabled:
|
||
|
// can't disable via Merge
|
||
|
return fmt.Errorf("invalid %s: %v → %v", "enabled", ri.Enabled, alter.Enabled)
|
||
1 year ago
|
case !canMergeKeyPairs(ri.Keys, alter.Keys):
|
||
|
// incompatible keypairs
|
||
|
return fmt.Errorf("invalid %s: %s ≠ %s", "keys", ri.Keys, alter.Keys)
|
||
|
}
|
||
|
|
||
1 year ago
|
return ri.unsafeMerge(alter)
|
||
|
}
|
||
|
|
||
|
func (ri *RingInfo) unsafeMerge(alter *RingInfo) error {
|
||
|
// enable via Merge
|
||
|
if alter.Enabled {
|
||
|
ri.Enabled = true
|
||
|
}
|
||
|
|
||
1 year ago
|
// fill the gaps on our keypair
|
||
|
if ri.Keys.PrivateKey.IsZero() {
|
||
|
ri.Keys.PrivateKey = alter.Keys.PrivateKey
|
||
|
}
|
||
|
if ri.Keys.PublicKey.IsZero() {
|
||
|
ri.Keys.PublicKey = alter.Keys.PublicKey
|
||
1 year ago
|
}
|
||
|
|
||
|
return nil
|
||
|
}
|
||
|
|
||
1 year ago
|
func canMergeKeyPairs(p1, p2 wireguard.KeyPair) bool {
|
||
1 year ago
|
switch {
|
||
|
case !p1.PrivateKey.IsZero() && !p2.PrivateKey.IsZero() && !p1.PrivateKey.Equal(p2.PrivateKey):
|
||
|
return false
|
||
|
case !p1.PublicKey.IsZero() && !p2.PublicKey.IsZero() && !p1.PublicKey.Equal(p2.PublicKey):
|
||
|
return false
|
||
|
default:
|
||
|
return true
|
||
|
}
|
||
|
}
|
||
|
|
||
1 year ago
|
// RingAddressEncoder provides encoder/decoder access for a particular
|
||
|
// Wireguard ring
|
||
|
type RingAddressEncoder struct {
|
||
|
ID int
|
||
1 year ago
|
Port uint16
|
||
1 year ago
|
Encode func(zoneID, nodeID int) (netip.Addr, bool)
|
||
|
Decode func(addr netip.Addr) (zoneID, nodeID int, ok bool)
|
||
|
}
|
||
|
|
||
|
var (
|
||
|
// RingZero is a wg0 address encoder/decoder
|
||
|
RingZero = RingAddressEncoder{
|
||
|
ID: 0,
|
||
1 year ago
|
Port: RingZeroPort,
|
||
1 year ago
|
Decode: ParseRingZeroAddress,
|
||
|
Encode: RingZeroAddress,
|
||
|
}
|
||
|
// RingOne is a wg1 address encoder/decoder
|
||
|
RingOne = RingAddressEncoder{
|
||
|
ID: 1,
|
||
1 year ago
|
Port: RingOnePort,
|
||
1 year ago
|
Decode: ParseRingOneAddress,
|
||
|
Encode: RingOneAddress,
|
||
|
}
|
||
|
// Rings provides indexed access to the ring address encoders
|
||
|
Rings = [RingsCount]RingAddressEncoder{
|
||
|
RingZero,
|
||
|
RingOne,
|
||
|
}
|
||
1 year ago
|
)
|
||
|
|
||
|
// ValidZoneID checks if the given zoneID is a valid 4 bit zone number.
|
||
|
//
|
||
|
// 0 is reserved, and only allowed when composing CIDRs.
|
||
|
func ValidZoneID(zoneID int) bool {
|
||
|
switch {
|
||
|
case zoneID < 0 || zoneID > MaxZoneID:
|
||
|
return false
|
||
|
default:
|
||
|
return true
|
||
|
}
|
||
|
}
|
||
|
|
||
|
// ValidNodeID checks if the given nodeID is a valid 8 bit number.
|
||
|
// nodeID is unique within a Zone.
|
||
|
// 0 is reserved, and only allowed when composing CIDRs.
|
||
|
func ValidNodeID(nodeID int) bool {
|
||
|
switch {
|
||
|
case nodeID < 0 || nodeID > MaxNodeID:
|
||
|
return false
|
||
|
default:
|
||
|
return true
|
||
|
}
|
||
|
}
|
||
|
|
||
1 year ago
|
// ParseRingZeroAddress extracts zone and node ID from a wg0 [netip.Addr]
|
||
1 year ago
|
// wg0 addresses are of the form `10.0.{{zoneID}}.{{nodeID}}`
|
||
1 year ago
|
func ParseRingZeroAddress(addr netip.Addr) (zoneID int, nodeID int, ok bool) {
|
||
|
if addr.IsValid() {
|
||
|
a4 := addr.As4()
|
||
|
|
||
|
if a4[0] == 10 && a4[1] == 0 {
|
||
|
return int(a4[2]), int(a4[3]), true
|
||
|
}
|
||
|
}
|
||
|
return 0, 0, false
|
||
|
}
|
||
|
|
||
|
// RingZeroAddress returns a wg0 IP address
|
||
1 year ago
|
func RingZeroAddress(zoneID, nodeID int) (netip.Addr, bool) {
|
||
|
switch {
|
||
|
case !ValidZoneID(zoneID) || !ValidNodeID(nodeID):
|
||
|
return netip.Addr{}, false
|
||
|
default:
|
||
|
a4 := [4]uint8{10, 0, uint8(zoneID), uint8(nodeID)}
|
||
|
return netip.AddrFrom4(a4), true
|
||
|
}
|
||
1 year ago
|
}
|
||
|
|
||
|
// ParseRingOneAddress extracts zone and node ID from a wg1 [netip.Addr]
|
||
1 year ago
|
// wg1 addresses are of the form `10.{{zoneID << 4}}.{{nodeID}}`
|
||
1 year ago
|
func ParseRingOneAddress(addr netip.Addr) (zoneID int, nodeID int, ok bool) {
|
||
|
if addr.IsValid() {
|
||
|
a4 := addr.As4()
|
||
|
|
||
|
if a4[0] == 10 && a4[2] == 0 {
|
||
|
zoneID = int(a4[1] >> 4)
|
||
|
nodeID = int(a4[3])
|
||
|
return zoneID, nodeID, true
|
||
|
}
|
||
|
}
|
||
|
return 0, 0, false
|
||
|
}
|
||
|
|
||
|
// RingOneAddress returns a wg1 IP address
|
||
1 year ago
|
func RingOneAddress(zoneID, nodeID int) (netip.Addr, bool) {
|
||
|
switch {
|
||
|
case !ValidZoneID(zoneID) || !ValidNodeID(nodeID):
|
||
|
return netip.Addr{}, false
|
||
|
default:
|
||
1 year ago
|
a4 := [4]uint8{10, uint8(zoneID << 4), 0, uint8(nodeID)}
|
||
1 year ago
|
return netip.AddrFrom4(a4), true
|
||
|
}
|
||
1 year ago
|
}
|
||
1 year ago
|
|
||
|
var (
|
||
|
_ MachineIterator = (*Ring)(nil)
|
||
|
_ ZoneIterator = (*Ring)(nil)
|
||
|
)
|
||
|
|
||
|
// A Ring describes all peers on a ring
|
||
|
type Ring struct {
|
||
|
RingAddressEncoder
|
||
|
ZoneIterator
|
||
|
|
||
|
Peers []*RingPeer
|
||
|
}
|
||
|
|
||
|
// AddPeer adds a [Machine] to the ring
|
||
|
func (r *Ring) AddPeer(p *Machine) bool {
|
||
|
ri, ok := p.getRingInfo(r.ID)
|
||
|
if !ok {
|
||
|
return false
|
||
|
}
|
||
|
|
||
|
nodeID := p.ID
|
||
|
zoneID := p.Zone()
|
||
|
addr, _ := r.Encode(zoneID, nodeID)
|
||
|
|
||
|
rp := &RingPeer{
|
||
|
Node: p,
|
||
|
Address: addr,
|
||
|
PrivateKey: ri.Keys.PrivateKey,
|
||
|
PeerConfig: wireguard.PeerConfig{
|
||
1 year ago
|
Name: fmt.Sprintf("%s-%v", p.Name, r.ID),
|
||
1 year ago
|
PublicKey: ri.Keys.PublicKey,
|
||
|
Endpoint: wireguard.EndpointAddress{
|
||
|
Host: p.FullName(),
|
||
|
Port: r.Port,
|
||
|
},
|
||
|
},
|
||
|
}
|
||
|
|
||
|
switch {
|
||
|
case r.ID == 0:
|
||
|
r.setRingZeroAllowedIPs(rp)
|
||
|
case p.IsGateway():
|
||
|
r.setRingOneGatewayAllowedIPs(rp)
|
||
|
default:
|
||
|
r.setRingOneNodeAllowedIPs(rp)
|
||
|
}
|
||
|
|
||
|
r.Peers = append(r.Peers, rp)
|
||
|
return true
|
||
|
}
|
||
|
|
||
|
func (r *Ring) setRingZeroAllowedIPs(rp *RingPeer) {
|
||
|
zoneID, _, _ := r.Decode(rp.Address)
|
||
|
|
||
|
// everyone on ring0 is a gateway to ring1
|
||
|
addr, _ := RingOneAddress(zoneID, 0)
|
||
|
rp.AllowCIDR(addr, 12)
|
||
|
|
||
|
// peer
|
||
|
rp.AllowCIDR(rp.Address, 32)
|
||
|
}
|
||
|
|
||
|
func (r *Ring) setRingOneGatewayAllowedIPs(rp *RingPeer) {
|
||
|
zoneID, _, _ := r.Decode(rp.Address)
|
||
|
|
||
|
// peer
|
||
|
rp.AllowCIDR(rp.Address, 32)
|
||
|
|
||
|
// ring1 gateways connect to all other ring1 networks
|
||
|
r.ForEachZone(func(z *Zone) bool {
|
||
|
if z.ID != zoneID {
|
||
|
addr, _ := r.Encode(z.ID, 0)
|
||
|
rp.AllowCIDR(addr, 12)
|
||
|
}
|
||
|
return false
|
||
|
})
|
||
|
|
||
|
// ring1 gateways also connect to all ring0 addresses
|
||
|
r.ForEachZone(func(z *Zone) bool {
|
||
|
z.ForEachMachine(func(p *Machine) bool {
|
||
|
if p.IsGateway() {
|
||
|
addr, _ := RingZeroAddress(z.ID, p.ID)
|
||
|
rp.AllowCIDR(addr, 32)
|
||
|
}
|
||
|
return false
|
||
|
})
|
||
|
return false
|
||
|
})
|
||
|
}
|
||
|
|
||
|
func (*Ring) setRingOneNodeAllowedIPs(rp *RingPeer) {
|
||
|
// only to the peer itself
|
||
|
rp.AllowCIDR(rp.Address, 32)
|
||
|
}
|
||
|
|
||
|
// ForEachMachine calls a function for each Machine in the ring
|
||
|
// until instructed to terminate the loop
|
||
|
func (r *Ring) ForEachMachine(fn func(*Machine) bool) {
|
||
|
for _, pp := range r.Peers {
|
||
|
if fn(pp.Node) {
|
||
|
return
|
||
|
}
|
||
|
}
|
||
|
}
|
||
|
|
||
|
// ExportConfig builds a wgN.conf for the specified machine on the ring
|
||
|
func (r *Ring) ExportConfig(p *Machine) (*wireguard.Config, error) {
|
||
|
var found bool
|
||
|
|
||
|
out := &wireguard.Config{
|
||
|
Interface: wireguard.InterfaceConfig{
|
||
|
ListenPort: r.Port,
|
||
|
},
|
||
|
}
|
||
|
|
||
|
for _, pp := range r.Peers {
|
||
|
switch {
|
||
|
case pp.Node == p:
|
||
|
// current
|
||
|
found = true
|
||
1 year ago
|
out.Interface.Name = pp.PeerConfig.Name
|
||
1 year ago
|
out.Interface.Address = pp.Address
|
||
|
out.Interface.PrivateKey = pp.PrivateKey
|
||
|
default:
|
||
|
// peer
|
||
|
pc := pp.PeerConfig
|
||
|
out.Peer = append(out.Peer, pc)
|
||
|
}
|
||
|
}
|
||
|
|
||
|
if !found {
|
||
|
return nil, fs.ErrNotExist
|
||
|
}
|
||
|
|
||
|
return out, nil
|
||
|
}
|
||
|
|
||
|
// A RingPeer is a node on a [Ring]
|
||
|
type RingPeer struct {
|
||
|
Node *Machine
|
||
|
|
||
|
Address netip.Addr
|
||
|
PrivateKey wireguard.PrivateKey
|
||
|
PeerConfig wireguard.PeerConfig
|
||
|
}
|
||
|
|
||
|
// AllowCIDR allows an IP range via this peer
|
||
|
func (rp *RingPeer) AllowCIDR(addr netip.Addr, bits int) {
|
||
|
cidr := netip.PrefixFrom(addr, bits)
|
||
|
rp.PeerConfig.AllowedIPs = append(rp.PeerConfig.AllowedIPs, cidr)
|
||
|
}
|
||
|
|
||
|
// NewRing composes a new Ring for Wireguard setup
|
||
|
func NewRing(z ZoneIterator, m MachineIterator, ring int) (*Ring, error) {
|
||
|
r := &Ring{
|
||
|
RingAddressEncoder: Rings[ring],
|
||
|
ZoneIterator: z,
|
||
|
}
|
||
|
|
||
|
m.ForEachMachine(func(p *Machine) bool {
|
||
|
r.AddPeer(p)
|
||
|
return false
|
||
|
})
|
||
|
|
||
|
return r, nil
|
||
|
}
|