Compare commits
8 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
1d304ab0c4
|
|||
|
f747e4d8d5
|
|||
| ff3feb49f2 | |||
| b0356c7ebb | |||
| 08da69f7aa | |||
| 6e3bb24b36 | |||
| 9810f5c6c1 | |||
| 8948b6702a |
@@ -10,7 +10,7 @@ TOOLSDIR := $(CURDIR)/pkg/tools
|
|||||||
TMPDIR ?= $(CURDIR)/.tmp
|
TMPDIR ?= $(CURDIR)/.tmp
|
||||||
OUTDIR ?= $(TMPDIR)
|
OUTDIR ?= $(TMPDIR)
|
||||||
|
|
||||||
GOLANGCI_LINT_VERSION ?= v1.59.1
|
GOLANGCI_LINT_VERSION ?= v1.60.0
|
||||||
REVIVE_VERSION ?= v1.3.7
|
REVIVE_VERSION ?= v1.3.7
|
||||||
|
|
||||||
GOLANGCI_LINT_URL ?= github.com/golangci/golangci-lint/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)
|
GOLANGCI_LINT_URL ?= github.com/golangci/golangci-lint/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)
|
||||||
|
|||||||
+2
-2
@@ -163,9 +163,9 @@ var dnsAddCmd = &cobra.Command{
|
|||||||
addr, err := core.ParseAddr(s)
|
addr, err := core.ParseAddr(s)
|
||||||
switch {
|
switch {
|
||||||
case err != nil:
|
case err != nil:
|
||||||
return core.Wrap(err, s)
|
return core.Wrap(err, "cannot parse address %q", s)
|
||||||
case !addr.IsValid(), addr.IsUnspecified(), addr.IsPrivate(), addr.IsMulticast():
|
case !addr.IsValid(), addr.IsUnspecified(), addr.IsPrivate(), addr.IsMulticast():
|
||||||
return core.Wrap(core.ErrInvalid, s)
|
return core.Wrap(core.ErrInvalid, "address %q is invalid", s)
|
||||||
default:
|
default:
|
||||||
addrs = append(addrs, addr)
|
addrs = append(addrs, addr)
|
||||||
}
|
}
|
||||||
|
|||||||
+1
-1
@@ -108,7 +108,7 @@ func (*inventory) renderRingOneZone(out *tools.LazyBuffer, r *cluster.Region, z
|
|||||||
z.ForEachMachine(func(m *cluster.Machine) bool {
|
z.ForEachMachine(func(m *cluster.Machine) bool {
|
||||||
addr := m.RingOneAddress()
|
addr := m.RingOneAddress()
|
||||||
cidr := netip.PrefixFrom(addr, 32)
|
cidr := netip.PrefixFrom(addr, 32)
|
||||||
_ = out.Printf("%s\t\t%s-%v\n", cidr, m.Name, 1)
|
_ = out.Printf("%s\t\t%s\n", cidr, m.Name)
|
||||||
return false
|
return false
|
||||||
})
|
})
|
||||||
return nil
|
return nil
|
||||||
|
|||||||
@@ -54,7 +54,7 @@ func loadGlobalConfField(cfg *GlobalConfig, field basic.Field) error {
|
|||||||
err := cfg.FSID.UnmarshalText([]byte(field.Value))
|
err := cfg.FSID.UnmarshalText([]byte(field.Value))
|
||||||
switch {
|
switch {
|
||||||
case err != nil:
|
case err != nil:
|
||||||
return core.Wrap(err, field.Key)
|
return core.Wrap(err, "unmarshal failed on field %q", field.Key)
|
||||||
default:
|
default:
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
@@ -64,7 +64,7 @@ func loadGlobalConfField(cfg *GlobalConfig, field basic.Field) error {
|
|||||||
var addr netip.Addr
|
var addr netip.Addr
|
||||||
|
|
||||||
if err := addr.UnmarshalText([]byte(s)); err != nil {
|
if err := addr.UnmarshalText([]byte(s)); err != nil {
|
||||||
return core.Wrap(err, field.Key)
|
return core.Wrap(err, "unmarshal failed on field %q", field.Key)
|
||||||
}
|
}
|
||||||
|
|
||||||
cfg.MonitorsAddr = append(cfg.MonitorsAddr, addr)
|
cfg.MonitorsAddr = append(cfg.MonitorsAddr, addr)
|
||||||
@@ -83,7 +83,7 @@ func loadGlobalConfField(cfg *GlobalConfig, field basic.Field) error {
|
|||||||
err := cfg.ClusterNetwork.UnmarshalText([]byte(field.Value))
|
err := cfg.ClusterNetwork.UnmarshalText([]byte(field.Value))
|
||||||
switch {
|
switch {
|
||||||
case err != nil:
|
case err != nil:
|
||||||
return core.Wrap(err, field.Key)
|
return core.Wrap(err, "unmarshal failed on field %q", field.Key)
|
||||||
default:
|
default:
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -51,7 +51,7 @@ func (m *Cluster) scanDirectory(opts *ScanOptions) error {
|
|||||||
ok, err := m.scanSubdirectory(opts, e.Name())
|
ok, err := m.scanSubdirectory(opts, e.Name())
|
||||||
switch {
|
switch {
|
||||||
case err != nil:
|
case err != nil:
|
||||||
return core.Wrap(err, e.Name())
|
return core.Wrap(err, "cannot scan directory %q", e.Name())
|
||||||
case !ok:
|
case !ok:
|
||||||
m.warn(nil).
|
m.warn(nil).
|
||||||
WithField("zone", e.Name()).
|
WithField("zone", e.Name()).
|
||||||
@@ -220,7 +220,7 @@ func (z *Zone) loadRegions() error {
|
|||||||
// parsed
|
// parsed
|
||||||
err = z.appendRegions(regions...)
|
err = z.appendRegions(regions...)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
err = core.Wrap(err, filename)
|
err = core.Wrap(err, "cannot append region from file %q", filename)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -247,7 +247,7 @@ func (z *Zone) loadClusterToken() error {
|
|||||||
|
|
||||||
err = z.zones.setRegionClusterToken(z.Name, token)
|
err = z.zones.setRegionClusterToken(z.Name, token)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
err = core.Wrap(err, filename)
|
err = core.Wrap(err, "wrong cluster token in file %q", filename)
|
||||||
}
|
}
|
||||||
|
|
||||||
return err
|
return err
|
||||||
|
|||||||
@@ -25,5 +25,5 @@ var (
|
|||||||
// ErrInvalidRing returns an error indicating the [rings.RingID]
|
// ErrInvalidRing returns an error indicating the [rings.RingID]
|
||||||
// can't be used for the intended purpose
|
// can't be used for the intended purpose
|
||||||
func ErrInvalidRing(ringID rings.RingID) error {
|
func ErrInvalidRing(ringID rings.RingID) error {
|
||||||
return core.QuietWrap(fs.ErrInvalid, "invalid ring %v", ringID)
|
return core.QuietWrap(fs.ErrInvalid, "invalid ring %v", ringID-1)
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -36,7 +36,7 @@ func (m *Machine) GetWireguardKeys(ringID rings.RingID) (wireguard.KeyPair, erro
|
|||||||
out.PrivateKey, err = wireguard.PrivateKeyFromBase64(string(data))
|
out.PrivateKey, err = wireguard.PrivateKeyFromBase64(string(data))
|
||||||
if err != nil {
|
if err != nil {
|
||||||
// bad key
|
// bad key
|
||||||
err = core.Wrap(err, keyFile)
|
err = core.Wrap(err, "bad private key in file %q", keyFile)
|
||||||
return out, err
|
return out, err
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -52,7 +52,7 @@ func (m *Machine) GetWireguardKeys(ringID rings.RingID) (wireguard.KeyPair, erro
|
|||||||
out.PublicKey, err = wireguard.PublicKeyFromBase64(string(data))
|
out.PublicKey, err = wireguard.PublicKeyFromBase64(string(data))
|
||||||
if err != nil {
|
if err != nil {
|
||||||
// bad key
|
// bad key
|
||||||
err = core.Wrap(err, pubFile)
|
err = core.Wrap(err, "bad public key in %q", pubFile)
|
||||||
return out, err
|
return out, err
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -227,10 +227,10 @@ func (m *Machine) applyWireguardPeerConfig(ring rings.RingID,
|
|||||||
switch {
|
switch {
|
||||||
case !found:
|
case !found:
|
||||||
// unknown
|
// unknown
|
||||||
return core.Wrap(ErrUnknownNode, pc.Endpoint.Host)
|
return core.Wrap(ErrUnknownNode, "peer %q not found", pc.Endpoint.Host)
|
||||||
case ring == 1 && m.zone != peer.zone:
|
case ring == 1 && m.zone != peer.zone:
|
||||||
// invalid zone
|
// invalid zone
|
||||||
return core.Wrap(ErrInvalidNode, peer.Name)
|
return core.Wrap(ErrInvalidNode, "peer %q invalid zone", peer.Name)
|
||||||
default:
|
default:
|
||||||
// apply RingInfo
|
// apply RingInfo
|
||||||
ri := &RingInfo{
|
ri := &RingInfo{
|
||||||
|
|||||||
@@ -36,12 +36,12 @@ func (m *Machine) UpdatePublicAddresses() error {
|
|||||||
|
|
||||||
func (m *Machine) init() error {
|
func (m *Machine) init() error {
|
||||||
if err := m.setID(); err != nil {
|
if err := m.setID(); err != nil {
|
||||||
return core.Wrap(err, m.Name)
|
return core.Wrap(err, "cannot set ID for machine %q", m.Name)
|
||||||
}
|
}
|
||||||
|
|
||||||
for _, ring := range Rings {
|
for _, ring := range Rings {
|
||||||
if err := m.tryReadWireguardKeys(ring.ID); err != nil {
|
if err := m.tryReadWireguardKeys(ring.ID); err != nil {
|
||||||
return core.Wrap(err, m.Name)
|
return core.Wrap(err, "cannot read keys for machine %q", m.Name)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
+5
-59
@@ -27,8 +27,6 @@ func AsWireguardInterfaceID(ring rings.RingID) (WireguardInterfaceID, error) {
|
|||||||
switch ring {
|
switch ring {
|
||||||
case rings.RingZeroID:
|
case rings.RingZeroID:
|
||||||
return 0, nil
|
return 0, nil
|
||||||
case rings.RingOneID:
|
|
||||||
return 1, nil
|
|
||||||
default:
|
default:
|
||||||
return 0, ErrInvalidRing(ring)
|
return 0, ErrInvalidRing(ring)
|
||||||
}
|
}
|
||||||
@@ -148,17 +146,9 @@ var (
|
|||||||
Decode: rings.DecodeRingZeroAddress,
|
Decode: rings.DecodeRingZeroAddress,
|
||||||
Encode: rings.RingZeroAddress,
|
Encode: rings.RingZeroAddress,
|
||||||
}
|
}
|
||||||
// RingOne is a wg1 address encoder/decoder
|
|
||||||
RingOne = RingAddressEncoder{
|
|
||||||
ID: rings.RingOneID,
|
|
||||||
Port: RingOnePort,
|
|
||||||
Decode: rings.DecodeRingOneAddress,
|
|
||||||
Encode: rings.RingOneAddress,
|
|
||||||
}
|
|
||||||
// Rings provides indexed access to the ring address encoders
|
// Rings provides indexed access to the ring address encoders
|
||||||
Rings = []RingAddressEncoder{
|
Rings = []RingAddressEncoder{
|
||||||
RingZero,
|
RingZero,
|
||||||
RingOne,
|
|
||||||
}
|
}
|
||||||
)
|
)
|
||||||
|
|
||||||
@@ -201,61 +191,17 @@ func (r *Ring) AddPeer(p *Machine) bool {
|
|||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
switch {
|
r.setRingZeroAllowedIPs(rp)
|
||||||
case r.ID == rings.RingZeroID:
|
|
||||||
r.setRingZeroAllowedIPs(rp)
|
|
||||||
case p.IsGateway():
|
|
||||||
r.setRingOneGatewayAllowedIPs(rp)
|
|
||||||
default:
|
|
||||||
r.setRingOneNodeAllowedIPs(rp)
|
|
||||||
}
|
|
||||||
|
|
||||||
r.Peers = append(r.Peers, rp)
|
r.Peers = append(r.Peers, rp)
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
|
|
||||||
func (r *Ring) setRingZeroAllowedIPs(rp *RingPeer) {
|
func (*Ring) setRingZeroAllowedIPs(rp *RingPeer) {
|
||||||
regionID, zoneID, _, _ := r.Decode(rp.Address)
|
// ring0 peer
|
||||||
|
|
||||||
// everyone on ring0 is a gateway to ring1
|
|
||||||
subnet, _ := rings.RingOnePrefix(regionID, zoneID)
|
|
||||||
rp.AllowSubnet(subnet)
|
|
||||||
|
|
||||||
// peer
|
|
||||||
rp.AllowCIDR(rp.Address, 32)
|
|
||||||
}
|
|
||||||
|
|
||||||
func (r *Ring) setRingOneGatewayAllowedIPs(rp *RingPeer) {
|
|
||||||
regionID, zoneID, _, _ := r.Decode(rp.Address)
|
|
||||||
|
|
||||||
// peer
|
|
||||||
rp.AllowCIDR(rp.Address, 32)
|
rp.AllowCIDR(rp.Address, 32)
|
||||||
|
|
||||||
// ring1 gateways connect to all other ring1 networks
|
// everyone on ring0 has a leg on ring1
|
||||||
r.ForEachZone(func(z *Zone) bool {
|
rp.AllowCIDR(rp.Node.RingOneAddress(), 32)
|
||||||
if !z.Is(regionID, zoneID) {
|
|
||||||
subnet := z.RingOnePrefix()
|
|
||||||
rp.AllowSubnet(subnet)
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
})
|
|
||||||
|
|
||||||
// ring1 gateways also connect to all ring0 addresses
|
|
||||||
r.ForEachZone(func(z *Zone) bool {
|
|
||||||
z.ForEachMachine(func(p *Machine) bool {
|
|
||||||
if p.IsGateway() {
|
|
||||||
addr, _ := p.RingZeroAddress()
|
|
||||||
rp.AllowCIDR(addr, 32)
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
})
|
|
||||||
return false
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
func (*Ring) setRingOneNodeAllowedIPs(rp *RingPeer) {
|
|
||||||
// only to the peer itself
|
|
||||||
rp.AllowCIDR(rp.Address, 32)
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// ForEachMachine calls a function for each Machine in the ring
|
// ForEachMachine calls a function for each Machine in the ring
|
||||||
|
|||||||
@@ -82,13 +82,6 @@ func (m *Cluster) WriteWireguardConfig(ring rings.RingID) error {
|
|||||||
switch ring {
|
switch ring {
|
||||||
case rings.RingZeroID:
|
case rings.RingZeroID:
|
||||||
return writeWireguardConfig(m, m, ring)
|
return writeWireguardConfig(m, m, ring)
|
||||||
case rings.RingOneID:
|
|
||||||
var err error
|
|
||||||
m.ForEachZone(func(z *Zone) bool {
|
|
||||||
err = writeWireguardConfig(m, z, ring)
|
|
||||||
return err != nil
|
|
||||||
})
|
|
||||||
return err
|
|
||||||
default:
|
default:
|
||||||
return ErrInvalidRing(ring)
|
return ErrInvalidRing(ring)
|
||||||
}
|
}
|
||||||
@@ -97,10 +90,12 @@ func (m *Cluster) WriteWireguardConfig(ring rings.RingID) error {
|
|||||||
// WriteWireguardConfig rewrites all wgN.conf on all machines
|
// WriteWireguardConfig rewrites all wgN.conf on all machines
|
||||||
// on the Zone attached to that ring
|
// on the Zone attached to that ring
|
||||||
func (z *Zone) WriteWireguardConfig(ring rings.RingID) error {
|
func (z *Zone) WriteWireguardConfig(ring rings.RingID) error {
|
||||||
if ring == rings.RingZeroID || ring == rings.RingOneID {
|
switch ring {
|
||||||
|
case rings.RingZeroID:
|
||||||
return writeWireguardConfig(z.zones, z.zones, ring)
|
return writeWireguardConfig(z.zones, z.zones, ring)
|
||||||
|
default:
|
||||||
|
return ErrInvalidRing(ring)
|
||||||
}
|
}
|
||||||
return ErrInvalidRing(ring)
|
|
||||||
}
|
}
|
||||||
|
|
||||||
func writeWireguardConfig(z ZoneIterator, m MachineIterator, ring rings.RingID) error {
|
func writeWireguardConfig(z ZoneIterator, m MachineIterator, ring rings.RingID) error {
|
||||||
@@ -161,13 +156,6 @@ func (m *Cluster) SyncWireguardConfig(ring rings.RingID) error {
|
|||||||
switch ring {
|
switch ring {
|
||||||
case rings.RingZeroID:
|
case rings.RingZeroID:
|
||||||
return syncWireguardConfig(m, m, ring)
|
return syncWireguardConfig(m, m, ring)
|
||||||
case rings.RingOneID:
|
|
||||||
var err error
|
|
||||||
m.ForEachZone(func(z *Zone) bool {
|
|
||||||
err = syncWireguardConfig(m, z, ring)
|
|
||||||
return err != nil
|
|
||||||
})
|
|
||||||
return err
|
|
||||||
default:
|
default:
|
||||||
return ErrInvalidRing(ring)
|
return ErrInvalidRing(ring)
|
||||||
}
|
}
|
||||||
@@ -179,8 +167,6 @@ func (z *Zone) SyncWireguardConfig(ring rings.RingID) error {
|
|||||||
switch ring {
|
switch ring {
|
||||||
case rings.RingZeroID:
|
case rings.RingZeroID:
|
||||||
return syncWireguardConfig(z.zones, z.zones, ring)
|
return syncWireguardConfig(z.zones, z.zones, ring)
|
||||||
case rings.RingOneID:
|
|
||||||
return syncWireguardConfig(z.zones, z, ring)
|
|
||||||
default:
|
default:
|
||||||
return ErrInvalidRing(ring)
|
return ErrInvalidRing(ring)
|
||||||
}
|
}
|
||||||
|
|||||||
+1
-1
@@ -30,7 +30,7 @@ type ManagerOption func(*Manager) error
|
|||||||
|
|
||||||
func newErrorManagerOption(err error, hint string) ManagerOption {
|
func newErrorManagerOption(err error, hint string) ManagerOption {
|
||||||
return func(*Manager) error {
|
return func(*Manager) error {
|
||||||
return core.Wrap(err, hint)
|
return core.Wrap(err, "%q", hint)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -65,7 +65,7 @@ func loadInterfaceConfField(cfg *InterfaceConfig, field basic.Field) error {
|
|||||||
err := cfg.Address.UnmarshalText([]byte(field.Value))
|
err := cfg.Address.UnmarshalText([]byte(field.Value))
|
||||||
switch {
|
switch {
|
||||||
case err != nil:
|
case err != nil:
|
||||||
return core.Wrap(err, field.Key)
|
return core.Wrap(err, "unmarshal failed on field %q", field.Key)
|
||||||
default:
|
default:
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
@@ -77,7 +77,7 @@ func loadInterfaceConfField(cfg *InterfaceConfig, field basic.Field) error {
|
|||||||
err := cfg.PrivateKey.UnmarshalText([]byte(field.Value))
|
err := cfg.PrivateKey.UnmarshalText([]byte(field.Value))
|
||||||
switch {
|
switch {
|
||||||
case err != nil:
|
case err != nil:
|
||||||
return core.Wrap(err, field.Key)
|
return core.Wrap(err, "unmarshal failed on field %q", field.Key)
|
||||||
default:
|
default:
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
@@ -89,7 +89,7 @@ func loadInterfaceConfField(cfg *InterfaceConfig, field basic.Field) error {
|
|||||||
u64, err := strconv.ParseUint(field.Value, 10, 16)
|
u64, err := strconv.ParseUint(field.Value, 10, 16)
|
||||||
switch {
|
switch {
|
||||||
case err != nil:
|
case err != nil:
|
||||||
return core.Wrap(err, field.Key)
|
return core.Wrap(err, "field %q is not an integer", field.Key)
|
||||||
case u64 == 0:
|
case u64 == 0:
|
||||||
return core.Wrap(fs.ErrInvalid, "invalid %q value", field.Key)
|
return core.Wrap(fs.ErrInvalid, "invalid %q value", field.Key)
|
||||||
default:
|
default:
|
||||||
@@ -117,7 +117,7 @@ func loadPeerConfField(cfg *PeerConfig, field basic.Field) error {
|
|||||||
err := cfg.PublicKey.UnmarshalText([]byte(field.Value))
|
err := cfg.PublicKey.UnmarshalText([]byte(field.Value))
|
||||||
switch {
|
switch {
|
||||||
case err != nil:
|
case err != nil:
|
||||||
return core.Wrap(err, field.Key)
|
return core.Wrap(err, "unmarshal failed on field %q", field.Key)
|
||||||
default:
|
default:
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
@@ -129,7 +129,7 @@ func loadPeerConfField(cfg *PeerConfig, field basic.Field) error {
|
|||||||
err := cfg.Endpoint.UnmarshalText([]byte(field.Value))
|
err := cfg.Endpoint.UnmarshalText([]byte(field.Value))
|
||||||
switch {
|
switch {
|
||||||
case err != nil:
|
case err != nil:
|
||||||
return core.Wrap(err, field.Key)
|
return core.Wrap(err, "unmarshal failed on field %q", field.Key)
|
||||||
default:
|
default:
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
@@ -137,7 +137,7 @@ func loadPeerConfField(cfg *PeerConfig, field basic.Field) error {
|
|||||||
s, err := parseAllowedIPs(field.Value)
|
s, err := parseAllowedIPs(field.Value)
|
||||||
switch {
|
switch {
|
||||||
case err != nil:
|
case err != nil:
|
||||||
return core.Wrap(err, field.Key)
|
return core.Wrap(err, "%q is not an IP", field.Key)
|
||||||
case len(s) > 0:
|
case len(s) > 0:
|
||||||
cfg.AllowedIPs = append(cfg.AllowedIPs, s...)
|
cfg.AllowedIPs = append(cfg.AllowedIPs, s...)
|
||||||
return nil
|
return nil
|
||||||
|
|||||||
Reference in New Issue
Block a user