[PATCH proxmox-ve-rs v4 10/31] ve-config: wireguard: add private keys section config

[Stefan Hanreich <s.hanreich@proxmox.com>]

This section configuration file acts as the key storage for all nodes
in all wireguard fabrics. This is possible, because interface names
are required to be unique for a node across all fabrics (since they
will be created with the respective name).

There is also a helper struct, that can be used for further parsing
the section config format into a more structured version. This struct
can be used for performing CRUD operations, and will be exposed to
perl via pve-rs.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 .../section_config/protocol/wireguard.rs      | 224 ++++++++++++++++++
 1 file changed, 224 insertions(+)

diff --git a/proxmox-ve-config/src/sdn/fabric/section_config/protocol/wireguard.rs b/proxmox-ve-config/src/sdn/fabric/section_config/protocol/wireguard.rs
index 8ad24c4..e885ef8 100644
--- a/proxmox-ve-config/src/sdn/fabric/section_config/protocol/wireguard.rs
+++ b/proxmox-ve-config/src/sdn/fabric/section_config/protocol/wireguard.rs
@@ -499,3 +499,227 @@ pub struct WireGuardInterfaceCreateProperties {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub(crate) ip6_ll: Option<bool>,
 }
+
+pub mod private_keys {
+    use std::collections::btree_map::Entry;
+    use std::collections::{BTreeMap, HashMap, HashSet};
+
+    use anyhow::Error;
+    use serde::{Deserialize, Serialize};
+
+    use proxmox_schema::{api, ApiStringFormat, PropertyString};
+    use proxmox_section_config::typed::SectionConfigData;
+    use proxmox_wireguard::{PrivateKey, PublicKey};
+
+    use crate::sdn::fabric::section_config::{
+        node::{Node, NodeId, NODE_ID_FORMAT},
+        protocol::wireguard::{WireGuardInterfaceName, WireGuardNode},
+    };
+    use crate::sdn::fabric::FabricConfig;
+
+    #[api()]
+    #[derive(Clone, Debug, Serialize, Deserialize, Hash)]
+    /// A private key for a wireguard interface
+    pub struct InterfacePrivateKey {
+        name: WireGuardInterfaceName,
+        key: PrivateKey,
+    }
+
+    impl InterfacePrivateKey {
+        pub fn new(name: WireGuardInterfaceName, key: PrivateKey) -> Self {
+            Self { name, key }
+        }
+    }
+
+    #[api(
+        properties: {
+            private_keys: {
+                type: Array,
+                description: "A list of private keys for this node.",
+                items: {
+                    type: String,
+                    description: "A private key for a wireguard interface.",
+                    format: &ApiStringFormat::PropertyString(&InterfacePrivateKey::API_SCHEMA),
+                }
+            }
+        }
+    )]
+    #[derive(Clone, Debug, Serialize, Deserialize, Hash)]
+    /// The private keys for a node in a wireguard fabric.
+    pub struct NodePrivateKeysSection {
+        private_keys: Vec<PropertyString<InterfacePrivateKey>>,
+    }
+
+    impl FromIterator<InterfacePrivateKey> for NodePrivateKeysSection {
+        fn from_iter<T: IntoIterator<Item = InterfacePrivateKey>>(iter: T) -> Self {
+            Self {
+                private_keys: iter.into_iter().map(PropertyString::new).collect(),
+            }
+        }
+    }
+
+    #[api(
+        "id-property": "id",
+        "id-schema": {
+            type: String,
+            description: "Route Map Section ID",
+            format: &NODE_ID_FORMAT,
+        },
+        "type-key": "type",
+    )]
+    #[derive(Clone, Debug, Serialize, Deserialize, Hash)]
+    /// The private key config for wireguard.
+    #[serde(tag = "type", rename_all = "kebab-case")]
+    pub enum FabricPrivateKeysSectionConfig {
+        /// Private keys for a node.
+        Node(NodePrivateKeysSection),
+    }
+
+    impl From<NodePrivateKeysSection> for FabricPrivateKeysSectionConfig {
+        fn from(value: NodePrivateKeysSection) -> Self {
+            Self::Node(value)
+        }
+    }
+
+    #[derive(Clone, Debug, Serialize, Deserialize, Hash)]
+    pub struct WireGuardPrivateKeys(
+        pub(crate) BTreeMap<NodeId, BTreeMap<WireGuardInterfaceName, PrivateKey>>,
+    );
+
+    impl WireGuardPrivateKeys {
+        /// Creates a Private key for the given (node, interface) if it doesn't exist - then
+        /// returns the public key of the stored private key.
+        pub fn upsert(
+            &mut self,
+            node: NodeId,
+            interface: WireGuardInterfaceName,
+        ) -> Result<PublicKey, anyhow::Error> {
+            Ok(match self.0.entry(node).or_default().entry(interface) {
+                Entry::Vacant(vacant_entry) => {
+                    let private_key = PrivateKey::generate()?;
+                    let public_key = private_key.public_key();
+
+                    vacant_entry.insert(private_key);
+                    public_key
+                }
+                Entry::Occupied(occupied_entry) => occupied_entry.get().public_key(),
+            })
+        }
+
+        /// Removes a private key.
+        pub fn remove(
+            &mut self,
+            node: &NodeId,
+            interface: &WireGuardInterfaceName,
+        ) -> Option<PrivateKey> {
+            self.0.get_mut(node)?.remove(interface)
+        }
+
+        /// Return a private key.
+        pub fn get(
+            &self,
+            node: &NodeId,
+            interface: &WireGuardInterfaceName,
+        ) -> Option<&PrivateKey> {
+            self.0.get(node)?.get(interface)
+        }
+
+        /// Removes all entries in the private key configuration that do not exist in the given [`FabricConfig`].
+        pub fn cleanup(&mut self, fabric_config: &FabricConfig) -> Result<(), Error> {
+            let mut private_keys_nodes = HashSet::new();
+            let mut private_keys_interfaces = HashSet::new();
+
+            let mut fabric_config_nodes = HashSet::new();
+            let mut fabric_config_interfaces = HashSet::new();
+
+            for (node_id, node) in fabric_config.all_nodes() {
+                let Node::WireGuard(node) = node else {
+                    continue;
+                };
+
+                let WireGuardNode::Internal(node) = node.properties() else {
+                    continue;
+                };
+
+                fabric_config_nodes.insert(node_id.clone());
+
+                fabric_config_interfaces.extend(
+                    node.interfaces()
+                        .map(|interface| (node_id.clone(), interface.name().clone())),
+                );
+            }
+
+            for (node_id, interfaces) in &self.0 {
+                private_keys_nodes.insert(node_id.clone());
+
+                private_keys_interfaces.extend(
+                    interfaces
+                        .keys()
+                        .map(|interface_name| (node_id.clone(), interface_name.clone())),
+                );
+            }
+
+            for node_id in private_keys_nodes.difference(&fabric_config_nodes) {
+                self.0.remove(node_id);
+            }
+
+            for (node_id, interface_id) in
+                private_keys_interfaces.difference(&fabric_config_interfaces)
+            {
+                self.remove(node_id, interface_id);
+            }
+
+            Ok(())
+        }
+    }
+
+    impl From<WireGuardPrivateKeys> for SectionConfigData<FabricPrivateKeysSectionConfig> {
+        fn from(value: WireGuardPrivateKeys) -> Self {
+            let mut data = HashMap::new();
+
+            for (node_id, interfaces) in value.0.into_iter() {
+                data.insert(
+                    node_id.to_string(),
+                    NodePrivateKeysSection::from_iter(
+                        interfaces
+                            .into_iter()
+                            .map(|(name, key)| InterfacePrivateKey::new(name, key)),
+                    )
+                    .into(),
+                );
+            }
+
+            Self::from(data)
+        }
+    }
+
+    impl TryFrom<SectionConfigData<FabricPrivateKeysSectionConfig>> for WireGuardPrivateKeys {
+        type Error = anyhow::Error;
+
+        fn try_from(
+            value: SectionConfigData<FabricPrivateKeysSectionConfig>,
+        ) -> Result<Self, Self::Error> {
+            let mut data = BTreeMap::new();
+
+            for (section_id, FabricPrivateKeysSectionConfig::Node(node)) in value {
+                let node_id = NodeId::from_string(section_id)?;
+
+                let interfaces: &mut BTreeMap<WireGuardInterfaceName, PrivateKey> =
+                    data.entry(node_id.clone()).or_default();
+
+                for interface in node.private_keys {
+                    let interface = interface.into_inner();
+
+                    if interfaces
+                        .insert(interface.name.clone(), interface.key)
+                        .is_some()
+                    {
+                        anyhow::bail!("duplicate interface {} for node {node_id}", interface.name);
+                    }
+                }
+            }
+
+            Ok(Self(data))
+        }
+    }
+}
-- 
2.47.3