cluster: migrate to using pkg/rings for Addresses [WIP]
Signed-off-by: Alejandro Mery <amery@jpi.io>
This commit is contained in:
+44
-95
@@ -5,13 +5,13 @@ import (
|
||||
"io/fs"
|
||||
"net/netip"
|
||||
|
||||
"darvaza.org/core"
|
||||
|
||||
"git.jpi.io/amery/jpictl/pkg/rings"
|
||||
"git.jpi.io/amery/jpictl/pkg/wireguard"
|
||||
)
|
||||
|
||||
const (
|
||||
// RingsCount indicates how many wireguard rings we have
|
||||
RingsCount = 2
|
||||
// RingZeroPort is the port wireguard uses for ring0
|
||||
RingZeroPort = 51800
|
||||
// RingOnePort is the port wireguard uses for ring1
|
||||
@@ -21,7 +21,7 @@ const (
|
||||
// RingInfo contains represents the Wireguard endpoint details
|
||||
// for a Machine on a particular ring
|
||||
type RingInfo struct {
|
||||
Ring int
|
||||
Ring rings.RingID
|
||||
Enabled bool
|
||||
Keys wireguard.KeyPair
|
||||
}
|
||||
@@ -51,7 +51,7 @@ func (ri *RingInfo) unsafeMerge(alter *RingInfo) error {
|
||||
ri.Enabled = true
|
||||
}
|
||||
|
||||
// fill the gaps on our keypair
|
||||
// fill the gaps on our key pair
|
||||
if ri.Keys.PrivateKey.IsZero() {
|
||||
ri.Keys.PrivateKey = alter.Keys.PrivateKey
|
||||
}
|
||||
@@ -76,100 +76,34 @@ func canMergeKeyPairs(p1, p2 wireguard.KeyPair) bool {
|
||||
// RingAddressEncoder provides encoder/decoder access for a particular
|
||||
// Wireguard ring
|
||||
type RingAddressEncoder struct {
|
||||
ID int
|
||||
ID rings.RingID
|
||||
Port uint16
|
||||
Encode func(zoneID rings.ZoneID, nodeID rings.NodeID) (netip.Addr, bool)
|
||||
Decode func(addr netip.Addr) (zoneID rings.ZoneID, nodeID rings.NodeID, ok bool)
|
||||
Encode func(rings.RegionID, rings.ZoneID, rings.NodeID) (netip.Addr, error)
|
||||
Decode func(addr netip.Addr) (rings.RegionID, rings.ZoneID, rings.NodeID, bool)
|
||||
}
|
||||
|
||||
var (
|
||||
// RingZero is a wg0 address encoder/decoder
|
||||
RingZero = RingAddressEncoder{
|
||||
ID: 0,
|
||||
ID: rings.RingZeroID,
|
||||
Port: RingZeroPort,
|
||||
Decode: ParseRingZeroAddress,
|
||||
Encode: RingZeroAddress,
|
||||
Decode: rings.DecodeRingZeroAddress,
|
||||
Encode: rings.RingZeroAddress,
|
||||
}
|
||||
// RingOne is a wg1 address encoder/decoder
|
||||
RingOne = RingAddressEncoder{
|
||||
ID: 1,
|
||||
ID: rings.RingOneID,
|
||||
Port: RingOnePort,
|
||||
Decode: ParseRingOneAddress,
|
||||
Encode: RingOneAddress,
|
||||
Decode: rings.DecodeRingOneAddress,
|
||||
Encode: rings.RingOneAddress,
|
||||
}
|
||||
// Rings provides indexed access to the ring address encoders
|
||||
Rings = [RingsCount]RingAddressEncoder{
|
||||
Rings = []RingAddressEncoder{
|
||||
RingZero,
|
||||
RingOne,
|
||||
}
|
||||
)
|
||||
|
||||
// ValidZoneID checks if the given zoneID is a valid 4 bit zone number.
|
||||
//
|
||||
// 0 is reserved, and only allowed when composing CIDRs.
|
||||
func ValidZoneID(zoneID rings.ZoneID) bool {
|
||||
return zoneID == 0 || zoneID.Valid()
|
||||
}
|
||||
|
||||
// ValidNodeID checks if the given nodeID is a valid 8 bit number.
|
||||
// nodeID is unique within a Zone.
|
||||
// 0 is reserved, and only allowed when composing CIDRs.
|
||||
func ValidNodeID(nodeID rings.NodeID) bool {
|
||||
return nodeID == 0 || nodeID.Valid()
|
||||
}
|
||||
|
||||
// ParseRingZeroAddress extracts zone and node ID from a wg0 [netip.Addr]
|
||||
// wg0 addresses are of the form `10.0.{{zoneID}}.{{nodeID}}`
|
||||
func ParseRingZeroAddress(addr netip.Addr) (zoneID rings.ZoneID, nodeID rings.NodeID, ok bool) {
|
||||
if addr.IsValid() {
|
||||
a4 := addr.As4()
|
||||
|
||||
if a4[0] == 10 && a4[1] == 0 {
|
||||
zoneID = rings.ZoneID(a4[2])
|
||||
nodeID = rings.NodeID(a4[3])
|
||||
return zoneID, nodeID, true
|
||||
}
|
||||
}
|
||||
return 0, 0, false
|
||||
}
|
||||
|
||||
// RingZeroAddress returns a wg0 IP address
|
||||
func RingZeroAddress(zoneID rings.ZoneID, nodeID rings.NodeID) (netip.Addr, bool) {
|
||||
switch {
|
||||
case !ValidZoneID(zoneID) || !ValidNodeID(nodeID):
|
||||
return netip.Addr{}, false
|
||||
default:
|
||||
a4 := [4]uint8{10, 0, uint8(zoneID), uint8(nodeID)}
|
||||
return netip.AddrFrom4(a4), true
|
||||
}
|
||||
}
|
||||
|
||||
// ParseRingOneAddress extracts zone and node ID from a wg1 [netip.Addr]
|
||||
// wg1 addresses are of the form `10.{{zoneID << 4}}.{{nodeID}}`
|
||||
func ParseRingOneAddress(addr netip.Addr) (zoneID rings.ZoneID, nodeID rings.NodeID, ok bool) {
|
||||
if addr.IsValid() {
|
||||
a4 := addr.As4()
|
||||
|
||||
if a4[0] == 10 && a4[2] == 0 {
|
||||
zoneID = rings.ZoneID(a4[1] >> 4)
|
||||
nodeID = rings.NodeID(a4[3])
|
||||
return zoneID, nodeID, true
|
||||
}
|
||||
}
|
||||
return 0, 0, false
|
||||
}
|
||||
|
||||
// RingOneAddress returns a wg1 IP address
|
||||
func RingOneAddress(zoneID rings.ZoneID, nodeID rings.NodeID) (netip.Addr, bool) {
|
||||
switch {
|
||||
case !ValidZoneID(zoneID) || !ValidNodeID(nodeID):
|
||||
return netip.Addr{}, false
|
||||
default:
|
||||
a4 := [4]uint8{10, uint8(zoneID << 4), 0, uint8(nodeID)}
|
||||
return netip.AddrFrom4(a4), true
|
||||
}
|
||||
}
|
||||
|
||||
var (
|
||||
_ MachineIterator = (*Ring)(nil)
|
||||
_ ZoneIterator = (*Ring)(nil)
|
||||
@@ -192,7 +126,8 @@ func (r *Ring) AddPeer(p *Machine) bool {
|
||||
|
||||
nodeID := p.ID
|
||||
zoneID := p.Zone()
|
||||
addr, _ := r.Encode(zoneID, nodeID)
|
||||
regionID := p.Region()
|
||||
addr, _ := r.Encode(regionID, zoneID, nodeID)
|
||||
|
||||
rp := &RingPeer{
|
||||
Node: p,
|
||||
@@ -222,27 +157,27 @@ func (r *Ring) AddPeer(p *Machine) bool {
|
||||
}
|
||||
|
||||
func (r *Ring) setRingZeroAllowedIPs(rp *RingPeer) {
|
||||
zoneID, _, _ := r.Decode(rp.Address)
|
||||
regionID, zoneID, _, _ := r.Decode(rp.Address)
|
||||
|
||||
// everyone on ring0 is a gateway to ring1
|
||||
addr, _ := RingOneAddress(zoneID, 0)
|
||||
rp.AllowCIDR(addr, 12)
|
||||
subnet, _ := rings.RingOnePrefix(regionID, zoneID)
|
||||
rp.AllowSubnet(subnet)
|
||||
|
||||
// peer
|
||||
rp.AllowCIDR(rp.Address, 32)
|
||||
}
|
||||
|
||||
func (r *Ring) setRingOneGatewayAllowedIPs(rp *RingPeer) {
|
||||
zoneID, _, _ := r.Decode(rp.Address)
|
||||
regionID, zoneID, _, _ := r.Decode(rp.Address)
|
||||
|
||||
// peer
|
||||
rp.AllowCIDR(rp.Address, 32)
|
||||
|
||||
// ring1 gateways connect to all other ring1 networks
|
||||
r.ForEachZone(func(z *Zone) bool {
|
||||
if z.ID != zoneID {
|
||||
addr, _ := r.Encode(z.ID, 0)
|
||||
rp.AllowCIDR(addr, 12)
|
||||
if !z.Is(regionID, zoneID) {
|
||||
subnet := z.RingOnePrefix()
|
||||
rp.AllowSubnet(subnet)
|
||||
}
|
||||
return false
|
||||
})
|
||||
@@ -251,7 +186,7 @@ func (r *Ring) setRingOneGatewayAllowedIPs(rp *RingPeer) {
|
||||
r.ForEachZone(func(z *Zone) bool {
|
||||
z.ForEachMachine(func(p *Machine) bool {
|
||||
if p.IsGateway() {
|
||||
addr, _ := RingZeroAddress(z.ID, p.ID)
|
||||
addr, _ := p.RingZeroAddress()
|
||||
rp.AllowCIDR(addr, 32)
|
||||
}
|
||||
return false
|
||||
@@ -318,15 +253,29 @@ type RingPeer struct {
|
||||
|
||||
// AllowCIDR allows an IP range via this peer
|
||||
func (rp *RingPeer) AllowCIDR(addr netip.Addr, bits int) {
|
||||
cidr := netip.PrefixFrom(addr, bits)
|
||||
rp.PeerConfig.AllowedIPs = append(rp.PeerConfig.AllowedIPs, cidr)
|
||||
rp.AllowSubnet(netip.PrefixFrom(addr, bits))
|
||||
}
|
||||
|
||||
// AllowSubnet allows an IP range via this peer
|
||||
func (rp *RingPeer) AllowSubnet(subnet netip.Prefix) {
|
||||
rp.PeerConfig.AllowedIPs = append(rp.PeerConfig.AllowedIPs, subnet)
|
||||
}
|
||||
|
||||
// NewRing composes a new Ring for Wireguard setup
|
||||
func NewRing(z ZoneIterator, m MachineIterator, ring int) (*Ring, error) {
|
||||
r := &Ring{
|
||||
RingAddressEncoder: Rings[ring],
|
||||
ZoneIterator: z,
|
||||
func NewRing(z ZoneIterator, m MachineIterator, ringID rings.RingID) (*Ring, error) {
|
||||
var r *Ring
|
||||
for _, ring := range Rings {
|
||||
if ring.ID == ringID {
|
||||
r = &Ring{
|
||||
RingAddressEncoder: ring,
|
||||
ZoneIterator: z,
|
||||
}
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if r == nil {
|
||||
return nil, core.QuietWrap(fs.ErrInvalid, "invalid ring (%v)", ringID)
|
||||
}
|
||||
|
||||
m.ForEachMachine(func(p *Machine) bool {
|
||||
|
||||
Reference in New Issue
Block a user