package zones import ( "fmt" "io/fs" "net/netip" "git.jpi.io/amery/jpictl/pkg/wireguard" ) const ( // MaxZoneID indicates the highest ID allowed for a Zone MaxZoneID = 0xf // MaxNodeID indicates the highest Machine ID allowed within a Zone MaxNodeID = 0xff - 1 // RingsCount indicates how many wireguard rings we have RingsCount = 2 // RingZeroPort is the port wireguard uses for ring0 RingZeroPort = 51800 // RingOnePort is the port wireguard uses for ring1 RingOnePort = 51810 ) // RingInfo contains represents the Wireguard endpoint details // for a Machine on a particular ring type RingInfo struct { Ring int `toml:"ring"` Enabled bool `toml:"enabled,omitempty"` Keys wireguard.KeyPair `toml:"keys,omitempty"` } // Merge attempts to combine two RingInfo structs func (ri *RingInfo) Merge(alter *RingInfo) error { switch { case alter == nil: return nil case ri.Ring != alter.Ring: // different ring return fmt.Errorf("invalid %s: %v ≠ %v", "ring", ri.Ring, alter.Ring) case ri.Enabled && !alter.Enabled: // can't disable via Merge return fmt.Errorf("invalid %s: %v → %v", "enabled", ri.Enabled, alter.Enabled) case !canMergeKeyPairs(ri.Keys, alter.Keys): // incompatible keypairs return fmt.Errorf("invalid %s: %s ≠ %s", "keys", ri.Keys, alter.Keys) } return ri.unsafeMerge(alter) } func (ri *RingInfo) unsafeMerge(alter *RingInfo) error { // enable via Merge if alter.Enabled { ri.Enabled = true } // fill the gaps on our keypair if ri.Keys.PrivateKey.IsZero() { ri.Keys.PrivateKey = alter.Keys.PrivateKey } if ri.Keys.PublicKey.IsZero() { ri.Keys.PublicKey = alter.Keys.PublicKey } return nil } func canMergeKeyPairs(p1, p2 wireguard.KeyPair) bool { switch { case !p1.PrivateKey.IsZero() && !p2.PrivateKey.IsZero() && !p1.PrivateKey.Equal(p2.PrivateKey): return false case !p1.PublicKey.IsZero() && !p2.PublicKey.IsZero() && !p1.PublicKey.Equal(p2.PublicKey): return false default: return true } } // RingAddressEncoder provides encoder/decoder access for a particular // Wireguard ring type RingAddressEncoder struct { ID int Port uint16 Encode func(zoneID, nodeID int) (netip.Addr, bool) Decode func(addr netip.Addr) (zoneID, nodeID int, ok bool) } var ( // RingZero is a wg0 address encoder/decoder RingZero = RingAddressEncoder{ ID: 0, Port: RingZeroPort, Decode: ParseRingZeroAddress, Encode: RingZeroAddress, } // RingOne is a wg1 address encoder/decoder RingOne = RingAddressEncoder{ ID: 1, Port: RingOnePort, Decode: ParseRingOneAddress, Encode: RingOneAddress, } // Rings provides indexed access to the ring address encoders Rings = [RingsCount]RingAddressEncoder{ RingZero, RingOne, } ) // ValidZoneID checks if the given zoneID is a valid 4 bit zone number. // // 0 is reserved, and only allowed when composing CIDRs. func ValidZoneID(zoneID int) bool { switch { case zoneID < 0 || zoneID > MaxZoneID: return false default: return true } } // ValidNodeID checks if the given nodeID is a valid 8 bit number. // nodeID is unique within a Zone. // 0 is reserved, and only allowed when composing CIDRs. func ValidNodeID(nodeID int) bool { switch { case nodeID < 0 || nodeID > MaxNodeID: return false default: return true } } // ParseRingZeroAddress extracts zone and node ID from a wg0 [netip.Addr] // wg0 addresses are of the form `10.0.{{zoneID}}.{{nodeID}}` func ParseRingZeroAddress(addr netip.Addr) (zoneID int, nodeID int, ok bool) { if addr.IsValid() { a4 := addr.As4() if a4[0] == 10 && a4[1] == 0 { return int(a4[2]), int(a4[3]), true } } return 0, 0, false } // RingZeroAddress returns a wg0 IP address func RingZeroAddress(zoneID, nodeID int) (netip.Addr, bool) { switch { case !ValidZoneID(zoneID) || !ValidNodeID(nodeID): return netip.Addr{}, false default: a4 := [4]uint8{10, 0, uint8(zoneID), uint8(nodeID)} return netip.AddrFrom4(a4), true } } // ParseRingOneAddress extracts zone and node ID from a wg1 [netip.Addr] // wg1 addresses are of the form `10.{{zoneID << 4}}.{{nodeID}}` func ParseRingOneAddress(addr netip.Addr) (zoneID int, nodeID int, ok bool) { if addr.IsValid() { a4 := addr.As4() if a4[0] == 10 && a4[2] == 0 { zoneID = int(a4[1] >> 4) nodeID = int(a4[3]) return zoneID, nodeID, true } } return 0, 0, false } // RingOneAddress returns a wg1 IP address func RingOneAddress(zoneID, nodeID int) (netip.Addr, bool) { switch { case !ValidZoneID(zoneID) || !ValidNodeID(nodeID): return netip.Addr{}, false default: a4 := [4]uint8{10, uint8(zoneID << 4), 0, uint8(nodeID)} return netip.AddrFrom4(a4), true } } var ( _ MachineIterator = (*Ring)(nil) _ ZoneIterator = (*Ring)(nil) ) // A Ring describes all peers on a ring type Ring struct { RingAddressEncoder ZoneIterator Peers []*RingPeer } // AddPeer adds a [Machine] to the ring func (r *Ring) AddPeer(p *Machine) bool { ri, ok := p.getRingInfo(r.ID) if !ok { return false } nodeID := p.ID zoneID := p.Zone() addr, _ := r.Encode(zoneID, nodeID) rp := &RingPeer{ Node: p, Address: addr, PrivateKey: ri.Keys.PrivateKey, PeerConfig: wireguard.PeerConfig{ PublicKey: ri.Keys.PublicKey, Endpoint: wireguard.EndpointAddress{ Host: p.FullName(), Port: r.Port, }, }, } switch { case r.ID == 0: r.setRingZeroAllowedIPs(rp) case p.IsGateway(): r.setRingOneGatewayAllowedIPs(rp) default: r.setRingOneNodeAllowedIPs(rp) } r.Peers = append(r.Peers, rp) return true } func (r *Ring) setRingZeroAllowedIPs(rp *RingPeer) { zoneID, _, _ := r.Decode(rp.Address) // everyone on ring0 is a gateway to ring1 addr, _ := RingOneAddress(zoneID, 0) rp.AllowCIDR(addr, 12) // peer rp.AllowCIDR(rp.Address, 32) } func (r *Ring) setRingOneGatewayAllowedIPs(rp *RingPeer) { zoneID, _, _ := r.Decode(rp.Address) // peer rp.AllowCIDR(rp.Address, 32) // ring1 gateways connect to all other ring1 networks r.ForEachZone(func(z *Zone) bool { if z.ID != zoneID { addr, _ := r.Encode(z.ID, 0) rp.AllowCIDR(addr, 12) } return false }) // ring1 gateways also connect to all ring0 addresses r.ForEachZone(func(z *Zone) bool { z.ForEachMachine(func(p *Machine) bool { if p.IsGateway() { addr, _ := RingZeroAddress(z.ID, p.ID) rp.AllowCIDR(addr, 32) } return false }) return false }) } func (*Ring) setRingOneNodeAllowedIPs(rp *RingPeer) { // only to the peer itself rp.AllowCIDR(rp.Address, 32) } // ForEachMachine calls a function for each Machine in the ring // until instructed to terminate the loop func (r *Ring) ForEachMachine(fn func(*Machine) bool) { for _, pp := range r.Peers { if fn(pp.Node) { return } } } // ExportConfig builds a wgN.conf for the specified machine on the ring func (r *Ring) ExportConfig(p *Machine) (*wireguard.Config, error) { var found bool out := &wireguard.Config{ Interface: wireguard.InterfaceConfig{ ListenPort: r.Port, }, } for _, pp := range r.Peers { switch { case pp.Node == p: // current found = true out.Interface.Address = pp.Address out.Interface.PrivateKey = pp.PrivateKey default: // peer pc := pp.PeerConfig out.Peer = append(out.Peer, pc) } } if !found { return nil, fs.ErrNotExist } return out, nil } // A RingPeer is a node on a [Ring] type RingPeer struct { Node *Machine Address netip.Addr PrivateKey wireguard.PrivateKey PeerConfig wireguard.PeerConfig } // AllowCIDR allows an IP range via this peer func (rp *RingPeer) AllowCIDR(addr netip.Addr, bits int) { cidr := netip.PrefixFrom(addr, bits) rp.PeerConfig.AllowedIPs = append(rp.PeerConfig.AllowedIPs, cidr) } // NewRing composes a new Ring for Wireguard setup func NewRing(z ZoneIterator, m MachineIterator, ring int) (*Ring, error) { r := &Ring{ RingAddressEncoder: Rings[ring], ZoneIterator: z, } m.ForEachMachine(func(p *Machine) bool { r.AddPeer(p) return false }) return r, nil }