[PATCH pve-network v2 14/25] fabrics: wireguard: implement wireguard key auto-generation

[Stefan Hanreich <s.hanreich@proxmox.com>]

Add additional logic to the existing fabrics API endpoints that
automatically create / delete keypairs for wireguard interfaces in
/etc/wireguard/proxmox. This is accomplished by proxying create /
update / delete API calls for internal wireguard nodes to the
respective node and handling the wireguard key generation there. After
generating the key, it is stored alongside the user-defined
configuration in the section config. This allows for easy access to
the public key of other nodes while being able to store the generated
wireguard keypairs locally on each node without involving pmxcfs.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 .../API2/Network/SDN/Fabrics/FabricNode.pm    | 129 +++++++++++++++++-
 1 file changed, 123 insertions(+), 6 deletions(-)

diff --git a/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm b/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm
index 000e4c3..f6483d5 100644
--- a/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm
+++ b/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm
@@ -3,11 +3,13 @@ package PVE::API2::Network::SDN::Fabrics::FabricNode;
 use strict;
 use warnings;
 
-use PVE::JSONSchema qw(get_standard_option);
-use PVE::Tools qw(extract_param);
+use PVE::JSONSchema qw(get_standard_option parse_property_string);
+use PVE::Tools qw(extract_param run_command);
 
 use PVE::Network::SDN;
 use PVE::Network::SDN::Fabrics;
+use PVE::Network::SDN::WireGuard;
+use PVE::RS::SDN::Fabrics;
 
 use PVE::RESTHandler;
 use base qw(PVE::RESTHandler);
@@ -131,9 +133,20 @@ __PACKAGE__->register_method({
     },
 });
 
+my sub is_internal_wireguard_node {
+    my ($node) = @_;
+    return $node->{protocol} eq 'wireguard' && $node->{role} eq 'internal';
+}
+
 __PACKAGE__->register_method({
     name => 'add_node',
     path => '',
+    proxyto_callback => sub {
+        my ($rpcenv, $proxyto, $param) = @_;
+
+        return $param->{node_id} if is_internal_wireguard_node($param);
+        return 'localhost';
+    },
     method => 'POST',
     description => 'Add a node',
     protected => 1,
@@ -162,8 +175,36 @@ __PACKAGE__->register_method({
                 my $digest = extract_param($param, 'digest');
                 PVE::Tools::assert_if_modified($config->digest(), $digest) if $digest;
 
-                $config->add_node($param);
-                PVE::Network::SDN::Fabrics::write_config($config);
+                if (is_internal_wireguard_node($param) && $param->{interfaces}) {
+                    my @parsed_interfaces = map {
+                        PVE::RS::SDN::Fabrics::parse_wireguard_create_interface($_)
+                    } $param->{interfaces}->@*;
+
+                    my @interfaces;
+                    for my $interface (@parsed_interfaces) {
+                        $interface->{public_key} =
+                            PVE::Network::SDN::WireGuard::create_wireguard_keypair(
+                                $interface->{name});
+                        push @interfaces,
+                            PVE::RS::SDN::Fabrics::print_wireguard_interface($interface);
+                    }
+
+                    $param->{interfaces} = \@interfaces;
+                    $config->add_node($param);
+
+                    eval { PVE::Network::SDN::Fabrics::write_config($config) };
+                    if (my $err = $@) {
+                        for my $interface (@parsed_interfaces) {
+                            PVE::Network::SDN::WireGuard::delete_wireguard_keypair(
+                                $interface->{name});
+                        }
+
+                        die $err;
+                    }
+                } else {
+                    $config->add_node($param);
+                    PVE::Network::SDN::Fabrics::write_config($config);
+                }
             },
             "adding node failed",
             $lock_token,
@@ -174,6 +215,15 @@ __PACKAGE__->register_method({
 __PACKAGE__->register_method({
     name => 'update_node',
     path => '{node_id}',
+    proxyto_callback => sub {
+        my ($rpcenv, $proxyto, $param) = @_;
+
+        my $config = PVE::Network::SDN::Fabrics::config();
+        my $old_node = $config->get_node($param->{fabric_id}, $param->{node_id});
+
+        return $old_node->{node_id} if is_internal_wireguard_node($old_node);
+        return 'localhost';
+    },
     method => 'PUT',
     description => 'Update a node',
     protected => 1,
@@ -205,8 +255,55 @@ __PACKAGE__->register_method({
                 my $digest = extract_param($param, 'digest');
                 PVE::Tools::assert_if_modified($config->digest(), $digest) if $digest;
 
-                $config->update_node($fabric_id, $node_id, $param);
-                PVE::Network::SDN::Fabrics::write_config($config);
+                my $old_node = $config->get_node($fabric_id, $node_id);
+
+                # required so rust can parse the proper wireguard node
+                # variant
+                $param->{role} = $old_node->{role} if $old_node->{protocol} eq 'wireguard';
+
+                if (is_internal_wireguard_node($param)) {
+                    my %new_interfaces = map {
+                        my $interface =
+                            PVE::RS::SDN::Fabrics::parse_wireguard_create_interface($_);
+                        $interface->{name} => $interface
+                    } $param->{interfaces}->@*;
+
+                    my %old_interfaces = map {
+                        my $interface = PVE::RS::SDN::Fabrics::parse_wireguard_interface($_);
+                        $interface->{name} => $interface
+                    } $old_node->{interfaces}->@*;
+
+                    my @interfaces;
+                    for my $interface_name (keys %new_interfaces) {
+                        my $interface = $new_interfaces{$interface_name};
+                        $interface->{public_key} =
+                            PVE::Network::SDN::WireGuard::create_wireguard_keypair($interface_name)
+                            if !exists($old_interfaces{$interface_name});
+                        push @interfaces,
+                            PVE::RS::SDN::Fabrics::print_wireguard_interface($interface);
+                    }
+                    $param->{interfaces} = \@interfaces;
+
+                    $config->update_node($fabric_id, $node_id, $param);
+                    eval { PVE::Network::SDN::Fabrics::write_config($config); };
+
+                    if (my $err = $@) {
+                        for my $interface (values %new_interfaces) {
+                            PVE::Network::SDN::WireGuard::delete_wireguard_keypair(
+                                $interface->{name});
+                        }
+
+                        die $err;
+                    }
+
+                    for my $interface_name (keys %old_interfaces) {
+                        PVE::Network::SDN::WireGuard::delete_wireguard_keypair($interface_name)
+                            if !exists($new_interfaces{$interface_name});
+                    }
+                } else {
+                    $config->update_node($fabric_id, $node_id, $param);
+                    PVE::Network::SDN::Fabrics::write_config($config);
+                }
             },
             "updating node failed",
             $lock_token,
@@ -220,6 +317,15 @@ __PACKAGE__->register_method({
     method => 'DELETE',
     description => 'Add a node',
     protected => 1,
+    proxyto_callback => sub {
+        my ($rpcenv, $proxyto, $param) = @_;
+
+        my $config = PVE::Network::SDN::Fabrics::config();
+        my $old_node = $config->get_node($param->{fabric_id}, $param->{node_id});
+
+        return $old_node->{node_id} if is_internal_wireguard_node($old_node);
+        return 'localhost';
+    },
     permissions => {
         check => [
             'and',
@@ -251,8 +357,19 @@ __PACKAGE__->register_method({
                 my $digest = extract_param($param, 'digest');
                 PVE::Tools::assert_if_modified($config->digest(), $digest) if $digest;
 
+                my $old_node = $config->get_node($fabric_id, $node_id);
+
                 $config->delete_node($fabric_id, $node_id);
                 PVE::Network::SDN::Fabrics::write_config($config);
+
+                if (is_internal_wireguard_node($old_node)) {
+                    for my $interface_string ($old_node->{interfaces}->@*) {
+                        my $interface =
+                            PVE::RS::SDN::Fabrics::parse_wireguard_interface($interface_string);
+                        PVE::Network::SDN::WireGuard::delete_wireguard_keypair(
+                            $interface->{name});
+                    }
+                }
             },
             "deleting node failed",
             $lock_token,
-- 
2.47.3