[PATCH proxmox-perl-rs v4 16/31] pve-rs: sdn: wireguard: add private keys module

[Stefan Hanreich <s.hanreich@proxmox.com>]

This exposes the implementation of the WireGuard private key storage
to Perl. It can be used to create / delete and list the private keys
stored in the section config file under /etc/pve/priv/wg-keys.cfg.

It also provides a helper method that can be used for cleaning up the
private keys file. It removes all private keys from the section config
that are no longer contained in the fabric config. This can be used
for cleaning up the auto-generated WireGuard private keys when
applying the SDN configuration.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 pve-rs/Cargo.toml                    |   1 +
 pve-rs/Makefile                      |   1 +
 pve-rs/src/bindings/sdn/mod.rs       |   1 +
 pve-rs/src/bindings/sdn/wireguard.rs | 103 +++++++++++++++++++++++++++
 4 files changed, 106 insertions(+)
 create mode 100644 pve-rs/src/bindings/sdn/wireguard.rs

diff --git a/pve-rs/Cargo.toml b/pve-rs/Cargo.toml
index c92d822..3065f9b 100644
--- a/pve-rs/Cargo.toml
+++ b/pve-rs/Cargo.toml
@@ -50,6 +50,7 @@ proxmox-sys = "1"
 proxmox-tfa = { version = "6.0.3", features = ["api"] }
 proxmox-time = "2"
 proxmox-ve-config = { version = "0.6", features = [ "frr" ] }
+proxmox-wireguard = { version = "0.1" }
 
 # [patch.crates-io]
 # pbs-api-types = { path = "../../proxmox/pbs-api-types" }
diff --git a/pve-rs/Makefile b/pve-rs/Makefile
index 25642cd..d458293 100644
--- a/pve-rs/Makefile
+++ b/pve-rs/Makefile
@@ -34,6 +34,7 @@ PERLMOD_PACKAGES := \
 	  PVE::RS::SDN::Fabrics \
 	  PVE::RS::SDN::PrefixLists \
 	  PVE::RS::SDN::RouteMaps \
+	  PVE::RS::SDN::WireGuard::PrivateKeys \
 	  PVE::RS::SDN \
 	  PVE::RS::TFA
 
diff --git a/pve-rs/src/bindings/sdn/mod.rs b/pve-rs/src/bindings/sdn/mod.rs
index c6361c3..0776ebb 100644
--- a/pve-rs/src/bindings/sdn/mod.rs
+++ b/pve-rs/src/bindings/sdn/mod.rs
@@ -1,6 +1,7 @@
 pub(crate) mod fabrics;
 pub(crate) mod prefix_lists;
 pub(crate) mod route_maps;
+pub(crate) mod wireguard;
 
 #[perlmod::package(name = "PVE::RS::SDN", lib = "pve_rs")]
 pub mod pve_rs_sdn {
diff --git a/pve-rs/src/bindings/sdn/wireguard.rs b/pve-rs/src/bindings/sdn/wireguard.rs
new file mode 100644
index 0000000..ba1ad3f
--- /dev/null
+++ b/pve-rs/src/bindings/sdn/wireguard.rs
@@ -0,0 +1,103 @@
+#[perlmod::package(name = "PVE::RS::SDN::WireGuard::PrivateKeys", lib = "pve_rs")]
+pub mod pve_rs_sdn_wireguard {
+    //! The `PVE::RS::SDN::WireGuard` package.
+    //!
+    //! This provides an abstraction for the WireGuard private key storage
+
+    use std::{ops::Deref, sync::Mutex};
+
+    use anyhow::Error;
+    use proxmox_section_config::typed::{ApiSectionDataEntry, SectionConfigData};
+    use proxmox_wireguard::PublicKey;
+    use serde::{Deserialize, Serialize};
+
+    use perlmod::Value;
+    use proxmox_ve_config::sdn::fabric::section_config::{
+        node::NodeId,
+        protocol::wireguard::{
+            private_keys::{FabricPrivateKeysSectionConfig, WireGuardPrivateKeys},
+            WireGuardInterfaceName,
+        },
+    };
+
+    use crate::bindings::pve_rs_sdn_fabrics::PerlFabricConfig;
+
+    /// A WireGuard private key config instance.
+    #[derive(Serialize, Deserialize)]
+    pub struct PerlWireguardPrivateKeyConfig {
+        /// The fabric config instance
+        pub private_keys: Mutex<WireGuardPrivateKeys>,
+    }
+
+    /// Class method: Parse the raw configuration from `/etc/pve/priv/wg-keys.cfg`.
+    #[export]
+    pub fn config(#[raw] class: Value, raw_config: &[u8]) -> Result<perlmod::Value, Error> {
+        let raw_config = std::str::from_utf8(raw_config)?;
+        let config =
+            FabricPrivateKeysSectionConfig::parse_section_config("wg-keys.cfg", raw_config)?;
+
+        Ok(
+            perlmod::instantiate_magic!(&class, MAGIC => Box::new(PerlWireguardPrivateKeyConfig {
+                private_keys: Mutex::new(config.try_into()?),
+            })),
+        )
+    }
+
+    /// Method: Convert the configuration into the section config string.
+    ///
+    /// Used for writing `/etc/pve/priv/wg-keys.cfg`
+    #[export]
+    pub fn to_raw(#[try_from_ref] this: &PerlWireguardPrivateKeyConfig) -> Result<String, Error> {
+        let private_keys = this.private_keys.lock().unwrap();
+
+        let raw_config: SectionConfigData<FabricPrivateKeysSectionConfig> =
+            private_keys.deref().clone().into();
+
+        FabricPrivateKeysSectionConfig::write_section_config("wg-keys.cfg", &raw_config)
+    }
+
+    /// Method: Create a WireGuard key, if it doesn't exist.
+    ///
+    /// Returns the public key of the created / existing private key.
+    #[export]
+    pub fn upsert(
+        #[try_from_ref] this: &PerlWireguardPrivateKeyConfig,
+        node: NodeId,
+        interface: WireGuardInterfaceName,
+    ) -> Result<PublicKey, Error> {
+        this.private_keys.lock().unwrap().upsert(node, interface)
+    }
+
+    /// Method: Delete a WireGuard private key.
+    #[export]
+    pub fn delete(
+        #[try_from_ref] this: &PerlWireguardPrivateKeyConfig,
+        node: NodeId,
+        interface: WireGuardInterfaceName,
+    ) -> Result<(), Error> {
+        this.private_keys
+            .lock()
+            .unwrap()
+            .remove(&node, &interface)
+            .map(|_| ())
+            .ok_or_else(|| {
+                anyhow::anyhow!(
+                    "could not find private_key for node {node} and interface {interface}"
+                )
+            })
+    }
+
+    #[export]
+    /// Method: Deletes all private keys from `this` that do not exist in the `fabric_config`.
+    pub fn cleanup(
+        #[try_from_ref] this: &PerlWireguardPrivateKeyConfig,
+        #[try_from_ref] fabric_config: &PerlFabricConfig,
+    ) -> Result<(), Error> {
+        let mut private_key_config = this.private_keys.lock().unwrap();
+        let fabric_config = fabric_config.fabric_config.lock().unwrap();
+
+        private_key_config.cleanup(&fabric_config)
+    }
+
+    perlmod::declare_magic!(Box<PerlWireguardPrivateKeyConfig> : &PerlWireguardPrivateKeyConfig as "PVE::RS::SDN::WireGuard::Config");
+}
-- 
2.47.3