|
|
|
|
@ -4,28 +4,86 @@ import (
|
|
|
|
|
"fmt" |
|
|
|
|
"io/fs" |
|
|
|
|
"net/netip" |
|
|
|
|
"strconv" |
|
|
|
|
|
|
|
|
|
"git.jpi.io/amery/jpictl/pkg/rings" |
|
|
|
|
"git.jpi.io/amery/jpictl/pkg/wireguard" |
|
|
|
|
) |
|
|
|
|
|
|
|
|
|
const ( |
|
|
|
|
// RingsCount indicates how many wireguard rings we have
|
|
|
|
|
RingsCount = 2 |
|
|
|
|
// RingZeroPort is the port wireguard uses for ring0
|
|
|
|
|
RingZeroPort = 51800 |
|
|
|
|
// RingOnePort is the port wireguard uses for ring1
|
|
|
|
|
RingOnePort = 51810 |
|
|
|
|
) |
|
|
|
|
|
|
|
|
|
// WireguardInterfaceID represents the number in the `wg%v`
|
|
|
|
|
// interface name.
|
|
|
|
|
type WireguardInterfaceID uint |
|
|
|
|
|
|
|
|
|
// AsWireguardInterfaceID returns the [WireguardInterfaceID] for
|
|
|
|
|
// a valid [rings.RingID].
|
|
|
|
|
func AsWireguardInterfaceID(ring rings.RingID) (WireguardInterfaceID, error) { |
|
|
|
|
switch ring { |
|
|
|
|
case rings.RingZeroID: |
|
|
|
|
return 0, nil |
|
|
|
|
case rings.RingOneID: |
|
|
|
|
return 1, nil |
|
|
|
|
default: |
|
|
|
|
return 0, ErrInvalidRing(ring) |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// MustWireguardInterfaceID returns the [WireguardInterfaceID] for
|
|
|
|
|
// a valid [rings.RingID], and panics if it's not.
|
|
|
|
|
func MustWireguardInterfaceID(ring rings.RingID) WireguardInterfaceID { |
|
|
|
|
id, err := AsWireguardInterfaceID(ring) |
|
|
|
|
if err != nil { |
|
|
|
|
panic(err) |
|
|
|
|
} |
|
|
|
|
return id |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// RingID tells the [rings.RingID] of the [WireguardInterfaceID].
|
|
|
|
|
func (wi WireguardInterfaceID) RingID() rings.RingID { |
|
|
|
|
return rings.RingID(wi + 1) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// PubFile returns "wgN.pub"
|
|
|
|
|
func (wi WireguardInterfaceID) PubFile() string { |
|
|
|
|
return fmt.Sprintf("wg%v.pub", wi) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// KeyFile returns "wgN.key"
|
|
|
|
|
func (wi WireguardInterfaceID) KeyFile() string { |
|
|
|
|
return fmt.Sprintf("wg%v.key", wi) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// ConfFile returns "wgN.conf"
|
|
|
|
|
func (wi WireguardInterfaceID) ConfFile() string { |
|
|
|
|
return fmt.Sprintf("wg%v.conf", wi) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// Files returns all wgN.ext file names.
|
|
|
|
|
func (wi WireguardInterfaceID) Files() (keyFile, pubFile, confFile string) { |
|
|
|
|
prefix := "wg" + strconv.Itoa(int(wi)) |
|
|
|
|
|
|
|
|
|
return prefix + ".key", prefix + ".pub", prefix + ".conf" |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// RingInfo contains represents the Wireguard endpoint details
|
|
|
|
|
// for a Machine on a particular ring
|
|
|
|
|
type RingInfo struct { |
|
|
|
|
Ring int |
|
|
|
|
Ring WireguardInterfaceID |
|
|
|
|
Enabled bool |
|
|
|
|
Keys wireguard.KeyPair |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// RingID returns the [rings.RingID] for this [RingInfo].
|
|
|
|
|
func (ri *RingInfo) RingID() rings.RingID { |
|
|
|
|
return rings.RingID(ri.Ring + 1) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// Merge attempts to combine two RingInfo structs
|
|
|
|
|
func (ri *RingInfo) Merge(alter *RingInfo) error { |
|
|
|
|
switch { |
|
|
|
|
@ -51,7 +109,7 @@ func (ri *RingInfo) unsafeMerge(alter *RingInfo) error {
|
|
|
|
|
ri.Enabled = true |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// fill the gaps on our keypair
|
|
|
|
|
// fill the gaps on our key pair
|
|
|
|
|
if ri.Keys.PrivateKey.IsZero() { |
|
|
|
|
ri.Keys.PrivateKey = alter.Keys.PrivateKey |
|
|
|
|
} |
|
|
|
|
@ -76,100 +134,34 @@ func canMergeKeyPairs(p1, p2 wireguard.KeyPair) bool {
|
|
|
|
|
// RingAddressEncoder provides encoder/decoder access for a particular
|
|
|
|
|
// Wireguard ring
|
|
|
|
|
type RingAddressEncoder struct { |
|
|
|
|
ID int |
|
|
|
|
ID rings.RingID |
|
|
|
|
Port uint16 |
|
|
|
|
Encode func(zoneID rings.ZoneID, nodeID rings.NodeID) (netip.Addr, bool) |
|
|
|
|
Decode func(addr netip.Addr) (zoneID rings.ZoneID, nodeID rings.NodeID, ok bool) |
|
|
|
|
Encode func(rings.RegionID, rings.ZoneID, rings.NodeID) (netip.Addr, error) |
|
|
|
|
Decode func(addr netip.Addr) (rings.RegionID, rings.ZoneID, rings.NodeID, bool) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
var ( |
|
|
|
|
// RingZero is a wg0 address encoder/decoder
|
|
|
|
|
RingZero = RingAddressEncoder{ |
|
|
|
|
ID: 0, |
|
|
|
|
ID: rings.RingZeroID, |
|
|
|
|
Port: RingZeroPort, |
|
|
|
|
Decode: ParseRingZeroAddress, |
|
|
|
|
Encode: RingZeroAddress, |
|
|
|
|
Decode: rings.DecodeRingZeroAddress, |
|
|
|
|
Encode: rings.RingZeroAddress, |
|
|
|
|
} |
|
|
|
|
// RingOne is a wg1 address encoder/decoder
|
|
|
|
|
RingOne = RingAddressEncoder{ |
|
|
|
|
ID: 1, |
|
|
|
|
ID: rings.RingOneID, |
|
|
|
|
Port: RingOnePort, |
|
|
|
|
Decode: ParseRingOneAddress, |
|
|
|
|
Encode: RingOneAddress, |
|
|
|
|
Decode: rings.DecodeRingOneAddress, |
|
|
|
|
Encode: rings.RingOneAddress, |
|
|
|
|
} |
|
|
|
|
// Rings provides indexed access to the ring address encoders
|
|
|
|
|
Rings = [RingsCount]RingAddressEncoder{ |
|
|
|
|
Rings = []RingAddressEncoder{ |
|
|
|
|
RingZero, |
|
|
|
|
RingOne, |
|
|
|
|
} |
|
|
|
|
) |
|
|
|
|
|
|
|
|
|
// ValidZoneID checks if the given zoneID is a valid 4 bit zone number.
|
|
|
|
|
//
|
|
|
|
|
// 0 is reserved, and only allowed when composing CIDRs.
|
|
|
|
|
func ValidZoneID(zoneID rings.ZoneID) bool { |
|
|
|
|
return zoneID == 0 || zoneID.Valid() |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// ValidNodeID checks if the given nodeID is a valid 8 bit number.
|
|
|
|
|
// nodeID is unique within a Zone.
|
|
|
|
|
// 0 is reserved, and only allowed when composing CIDRs.
|
|
|
|
|
func ValidNodeID(nodeID rings.NodeID) bool { |
|
|
|
|
return nodeID == 0 || nodeID.Valid() |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// ParseRingZeroAddress extracts zone and node ID from a wg0 [netip.Addr]
|
|
|
|
|
// wg0 addresses are of the form `10.0.{{zoneID}}.{{nodeID}}`
|
|
|
|
|
func ParseRingZeroAddress(addr netip.Addr) (zoneID rings.ZoneID, nodeID rings.NodeID, ok bool) { |
|
|
|
|
if addr.IsValid() { |
|
|
|
|
a4 := addr.As4() |
|
|
|
|
|
|
|
|
|
if a4[0] == 10 && a4[1] == 0 { |
|
|
|
|
zoneID = rings.ZoneID(a4[2]) |
|
|
|
|
nodeID = rings.NodeID(a4[3]) |
|
|
|
|
return zoneID, nodeID, true |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
return 0, 0, false |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// RingZeroAddress returns a wg0 IP address
|
|
|
|
|
func RingZeroAddress(zoneID rings.ZoneID, nodeID rings.NodeID) (netip.Addr, bool) { |
|
|
|
|
switch { |
|
|
|
|
case !ValidZoneID(zoneID) || !ValidNodeID(nodeID): |
|
|
|
|
return netip.Addr{}, false |
|
|
|
|
default: |
|
|
|
|
a4 := [4]uint8{10, 0, uint8(zoneID), uint8(nodeID)} |
|
|
|
|
return netip.AddrFrom4(a4), true |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// ParseRingOneAddress extracts zone and node ID from a wg1 [netip.Addr]
|
|
|
|
|
// wg1 addresses are of the form `10.{{zoneID << 4}}.{{nodeID}}`
|
|
|
|
|
func ParseRingOneAddress(addr netip.Addr) (zoneID rings.ZoneID, nodeID rings.NodeID, ok bool) { |
|
|
|
|
if addr.IsValid() { |
|
|
|
|
a4 := addr.As4() |
|
|
|
|
|
|
|
|
|
if a4[0] == 10 && a4[2] == 0 { |
|
|
|
|
zoneID = rings.ZoneID(a4[1] >> 4) |
|
|
|
|
nodeID = rings.NodeID(a4[3]) |
|
|
|
|
return zoneID, nodeID, true |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
return 0, 0, false |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// RingOneAddress returns a wg1 IP address
|
|
|
|
|
func RingOneAddress(zoneID rings.ZoneID, nodeID rings.NodeID) (netip.Addr, bool) { |
|
|
|
|
switch { |
|
|
|
|
case !ValidZoneID(zoneID) || !ValidNodeID(nodeID): |
|
|
|
|
return netip.Addr{}, false |
|
|
|
|
default: |
|
|
|
|
a4 := [4]uint8{10, uint8(zoneID << 4), 0, uint8(nodeID)} |
|
|
|
|
return netip.AddrFrom4(a4), true |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
var ( |
|
|
|
|
_ MachineIterator = (*Ring)(nil) |
|
|
|
|
_ ZoneIterator = (*Ring)(nil) |
|
|
|
|
@ -192,14 +184,15 @@ func (r *Ring) AddPeer(p *Machine) bool {
|
|
|
|
|
|
|
|
|
|
nodeID := p.ID |
|
|
|
|
zoneID := p.Zone() |
|
|
|
|
addr, _ := r.Encode(zoneID, nodeID) |
|
|
|
|
regionID := p.Region() |
|
|
|
|
addr, _ := r.Encode(regionID, zoneID, nodeID) |
|
|
|
|
|
|
|
|
|
rp := &RingPeer{ |
|
|
|
|
Node: p, |
|
|
|
|
Address: addr, |
|
|
|
|
PrivateKey: ri.Keys.PrivateKey, |
|
|
|
|
PeerConfig: wireguard.PeerConfig{ |
|
|
|
|
Name: fmt.Sprintf("%s-%v", p.Name, r.ID), |
|
|
|
|
Name: fmt.Sprintf("%s-%v", p.Name, ri.Ring), |
|
|
|
|
PublicKey: ri.Keys.PublicKey, |
|
|
|
|
Endpoint: wireguard.EndpointAddress{ |
|
|
|
|
Host: p.FullName(), |
|
|
|
|
@ -222,27 +215,27 @@ func (r *Ring) AddPeer(p *Machine) bool {
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
func (r *Ring) setRingZeroAllowedIPs(rp *RingPeer) { |
|
|
|
|
zoneID, _, _ := r.Decode(rp.Address) |
|
|
|
|
regionID, zoneID, _, _ := r.Decode(rp.Address) |
|
|
|
|
|
|
|
|
|
// everyone on ring0 is a gateway to ring1
|
|
|
|
|
addr, _ := RingOneAddress(zoneID, 0) |
|
|
|
|
rp.AllowCIDR(addr, 12) |
|
|
|
|
subnet, _ := rings.RingOnePrefix(regionID, zoneID) |
|
|
|
|
rp.AllowSubnet(subnet) |
|
|
|
|
|
|
|
|
|
// peer
|
|
|
|
|
rp.AllowCIDR(rp.Address, 32) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
func (r *Ring) setRingOneGatewayAllowedIPs(rp *RingPeer) { |
|
|
|
|
zoneID, _, _ := r.Decode(rp.Address) |
|
|
|
|
regionID, zoneID, _, _ := r.Decode(rp.Address) |
|
|
|
|
|
|
|
|
|
// peer
|
|
|
|
|
rp.AllowCIDR(rp.Address, 32) |
|
|
|
|
|
|
|
|
|
// ring1 gateways connect to all other ring1 networks
|
|
|
|
|
r.ForEachZone(func(z *Zone) bool { |
|
|
|
|
if z.ID != zoneID { |
|
|
|
|
addr, _ := r.Encode(z.ID, 0) |
|
|
|
|
rp.AllowCIDR(addr, 12) |
|
|
|
|
if !z.Is(regionID, zoneID) { |
|
|
|
|
subnet := z.RingOnePrefix() |
|
|
|
|
rp.AllowSubnet(subnet) |
|
|
|
|
} |
|
|
|
|
return false |
|
|
|
|
}) |
|
|
|
|
@ -251,7 +244,7 @@ func (r *Ring) setRingOneGatewayAllowedIPs(rp *RingPeer) {
|
|
|
|
|
r.ForEachZone(func(z *Zone) bool { |
|
|
|
|
z.ForEachMachine(func(p *Machine) bool { |
|
|
|
|
if p.IsGateway() { |
|
|
|
|
addr, _ := RingZeroAddress(z.ID, p.ID) |
|
|
|
|
addr, _ := p.RingZeroAddress() |
|
|
|
|
rp.AllowCIDR(addr, 32) |
|
|
|
|
} |
|
|
|
|
return false |
|
|
|
|
@ -318,15 +311,29 @@ type RingPeer struct {
|
|
|
|
|
|
|
|
|
|
// AllowCIDR allows an IP range via this peer
|
|
|
|
|
func (rp *RingPeer) AllowCIDR(addr netip.Addr, bits int) { |
|
|
|
|
cidr := netip.PrefixFrom(addr, bits) |
|
|
|
|
rp.PeerConfig.AllowedIPs = append(rp.PeerConfig.AllowedIPs, cidr) |
|
|
|
|
rp.AllowSubnet(netip.PrefixFrom(addr, bits)) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// AllowSubnet allows an IP range via this peer
|
|
|
|
|
func (rp *RingPeer) AllowSubnet(subnet netip.Prefix) { |
|
|
|
|
rp.PeerConfig.AllowedIPs = append(rp.PeerConfig.AllowedIPs, subnet) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// NewRing composes a new Ring for Wireguard setup
|
|
|
|
|
func NewRing(z ZoneIterator, m MachineIterator, ring int) (*Ring, error) { |
|
|
|
|
r := &Ring{ |
|
|
|
|
RingAddressEncoder: Rings[ring], |
|
|
|
|
ZoneIterator: z, |
|
|
|
|
func NewRing(z ZoneIterator, m MachineIterator, ringID rings.RingID) (*Ring, error) { |
|
|
|
|
var r *Ring |
|
|
|
|
for _, ring := range Rings { |
|
|
|
|
if ringID == ring.ID { |
|
|
|
|
r = &Ring{ |
|
|
|
|
RingAddressEncoder: ring, |
|
|
|
|
ZoneIterator: z, |
|
|
|
|
} |
|
|
|
|
break |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if r == nil { |
|
|
|
|
return nil, ErrInvalidRing(ringID) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
m.ForEachMachine(func(p *Machine) bool { |
|
|
|
|
|
