package zones import ( "fmt" "net/netip" "git.jpi.io/amery/jpictl/pkg/wireguard" ) const ( // MaxZoneID indicates the highest ID allowed for a Zone MaxZoneID = 0xf // MaxNodeID indicates the highest Machine ID allowed within a Zone MaxNodeID = 0xff - 1 // RingsCount indicates how many wireguard rings we have RingsCount = 2 // RingZeroPort is the port wireguard uses for ring0 RingZeroPort = 51800 // RingOnePort is the port wireguard uses for ring1 RingOnePort = 51810 ) // RingInfo contains represents the Wireguard endpoint details // for a Machine on a particular ring type RingInfo struct { Ring int `toml:"ring"` Enabled bool `toml:"enabled,omitempty"` Keys wireguard.KeyPair `toml:"keys,omitempty"` } // Merge attempts to combine two RingInfo structs func (ri *RingInfo) Merge(alter *RingInfo) error { switch { case alter == nil: return nil case ri.Ring != alter.Ring: // different ring return fmt.Errorf("invalid %s: %v ≠ %v", "ring", ri.Ring, alter.Ring) case ri.Enabled && !alter.Enabled: // can't disable via Merge return fmt.Errorf("invalid %s: %v → %v", "enabled", ri.Enabled, alter.Enabled) case !canMergeKeyPairs(ri.Keys, alter.Keys): // incompatible keypairs return fmt.Errorf("invalid %s: %s ≠ %s", "keys", ri.Keys, alter.Keys) } return ri.unsafeMerge(alter) } func (ri *RingInfo) unsafeMerge(alter *RingInfo) error { // enable via Merge if alter.Enabled { ri.Enabled = true } // fill the gaps on our keypair if ri.Keys.PrivateKey.IsZero() { ri.Keys.PrivateKey = alter.Keys.PrivateKey } if ri.Keys.PublicKey.IsZero() { ri.Keys.PublicKey = alter.Keys.PublicKey } return nil } func canMergeKeyPairs(p1, p2 wireguard.KeyPair) bool { switch { case !p1.PrivateKey.IsZero() && !p2.PrivateKey.IsZero() && !p1.PrivateKey.Equal(p2.PrivateKey): return false case !p1.PublicKey.IsZero() && !p2.PublicKey.IsZero() && !p1.PublicKey.Equal(p2.PublicKey): return false default: return true } } // RingAddressEncoder provides encoder/decoder access for a particular // Wireguard ring type RingAddressEncoder struct { ID int Port uint16 Encode func(zoneID, nodeID int) (netip.Addr, bool) Decode func(addr netip.Addr) (zoneID, nodeID int, ok bool) } var ( // RingZero is a wg0 address encoder/decoder RingZero = RingAddressEncoder{ ID: 0, Port: RingZeroPort, Decode: ParseRingZeroAddress, Encode: RingZeroAddress, } // RingOne is a wg1 address encoder/decoder RingOne = RingAddressEncoder{ ID: 1, Port: RingOnePort, Decode: ParseRingOneAddress, Encode: RingOneAddress, } // Rings provides indexed access to the ring address encoders Rings = [RingsCount]RingAddressEncoder{ RingZero, RingOne, } ) // ValidZoneID checks if the given zoneID is a valid 4 bit zone number. // // 0 is reserved, and only allowed when composing CIDRs. func ValidZoneID(zoneID int) bool { switch { case zoneID < 0 || zoneID > MaxZoneID: return false default: return true } } // ValidNodeID checks if the given nodeID is a valid 8 bit number. // nodeID is unique within a Zone. // 0 is reserved, and only allowed when composing CIDRs. func ValidNodeID(nodeID int) bool { switch { case nodeID < 0 || nodeID > MaxNodeID: return false default: return true } } // ParseRingZeroAddress extracts zone and node ID from a wg0 [netip.Addr] // wg0 addresses are of the form `10.0.{{zoneID}}.{{nodeID}}` func ParseRingZeroAddress(addr netip.Addr) (zoneID int, nodeID int, ok bool) { if addr.IsValid() { a4 := addr.As4() if a4[0] == 10 && a4[1] == 0 { return int(a4[2]), int(a4[3]), true } } return 0, 0, false } // RingZeroAddress returns a wg0 IP address func RingZeroAddress(zoneID, nodeID int) (netip.Addr, bool) { switch { case !ValidZoneID(zoneID) || !ValidNodeID(nodeID): return netip.Addr{}, false default: a4 := [4]uint8{10, 0, uint8(zoneID), uint8(nodeID)} return netip.AddrFrom4(a4), true } } // ParseRingOneAddress extracts zone and node ID from a wg1 [netip.Addr] // wg1 addresses are of the form `10.{{zoneID << 4}}.{{nodeID}}` func ParseRingOneAddress(addr netip.Addr) (zoneID int, nodeID int, ok bool) { if addr.IsValid() { a4 := addr.As4() if a4[0] == 10 && a4[2] == 0 { zoneID = int(a4[1] >> 4) nodeID = int(a4[3]) return zoneID, nodeID, true } } return 0, 0, false } // RingOneAddress returns a wg1 IP address func RingOneAddress(zoneID, nodeID int) (netip.Addr, bool) { switch { case !ValidZoneID(zoneID) || !ValidNodeID(nodeID): return netip.Addr{}, false default: a4 := [4]uint8{10, uint8(zoneID << 4), 0, uint8(nodeID)} return netip.AddrFrom4(a4), true } }