From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id BDCAC1FF13C for ; Thu, 19 Feb 2026 16:06:29 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 865591A93C; Thu, 19 Feb 2026 16:07:27 +0100 (CET) From: Stefan Hanreich To: pve-devel@lists.proxmox.com Subject: [PATCH pve-network 3/3] fabrics: wireguard: implement wireguard key auto-generation Date: Thu, 19 Feb 2026 15:56:33 +0100 Message-ID: <20260219145649.441418-17-s.hanreich@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260219145649.441418-1-s.hanreich@proxmox.com> References: <20260219145649.441418-1-s.hanreich@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.177 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Message-ID-Hash: T7BA7FPPAPTF73FKLFNFDZPTIXNGUFVM X-Message-ID-Hash: T7BA7FPPAPTF73FKLFNFDZPTIXNGUFVM X-MailFrom: hoan@cray.proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Add additional logic to the existing fabrics API endpoints that automatically create / delete keypairs for wireguard interfaces in /etc/wireguard/proxmox. This is accomplished by proxying create / update / delete API calls for internal wireguard nodes to the respective node and handling the wireguard key generation there. After generating the key, it is stored alongside the user-defined configuration in the section config. This allows for easy access to the public key of other nodes while being able to store the generated wireguard keypairs locally on each node without involving pmxcfs. Signed-off-by: Stefan Hanreich --- .../API2/Network/SDN/Fabrics/FabricNode.pm | 129 +++++++++++++++++- 1 file changed, 123 insertions(+), 6 deletions(-) diff --git a/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm b/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm index 000e4c3..f6483d5 100644 --- a/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm +++ b/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm @@ -3,11 +3,13 @@ package PVE::API2::Network::SDN::Fabrics::FabricNode; use strict; use warnings; -use PVE::JSONSchema qw(get_standard_option); -use PVE::Tools qw(extract_param); +use PVE::JSONSchema qw(get_standard_option parse_property_string); +use PVE::Tools qw(extract_param run_command); use PVE::Network::SDN; use PVE::Network::SDN::Fabrics; +use PVE::Network::SDN::WireGuard; +use PVE::RS::SDN::Fabrics; use PVE::RESTHandler; use base qw(PVE::RESTHandler); @@ -131,9 +133,20 @@ __PACKAGE__->register_method({ }, }); +my sub is_internal_wireguard_node { + my ($node) = @_; + return $node->{protocol} eq 'wireguard' && $node->{role} eq 'internal'; +} + __PACKAGE__->register_method({ name => 'add_node', path => '', + proxyto_callback => sub { + my ($rpcenv, $proxyto, $param) = @_; + + return $param->{node_id} if is_internal_wireguard_node($param); + return 'localhost'; + }, method => 'POST', description => 'Add a node', protected => 1, @@ -162,8 +175,36 @@ __PACKAGE__->register_method({ my $digest = extract_param($param, 'digest'); PVE::Tools::assert_if_modified($config->digest(), $digest) if $digest; - $config->add_node($param); - PVE::Network::SDN::Fabrics::write_config($config); + if (is_internal_wireguard_node($param) && $param->{interfaces}) { + my @parsed_interfaces = map { + PVE::RS::SDN::Fabrics::parse_wireguard_create_interface($_) + } $param->{interfaces}->@*; + + my @interfaces; + for my $interface (@parsed_interfaces) { + $interface->{public_key} = + PVE::Network::SDN::WireGuard::create_wireguard_keypair( + $interface->{name}); + push @interfaces, + PVE::RS::SDN::Fabrics::print_wireguard_interface($interface); + } + + $param->{interfaces} = \@interfaces; + $config->add_node($param); + + eval { PVE::Network::SDN::Fabrics::write_config($config) }; + if (my $err = $@) { + for my $interface (@parsed_interfaces) { + PVE::Network::SDN::WireGuard::delete_wireguard_keypair( + $interface->{name}); + } + + die $err; + } + } else { + $config->add_node($param); + PVE::Network::SDN::Fabrics::write_config($config); + } }, "adding node failed", $lock_token, @@ -174,6 +215,15 @@ __PACKAGE__->register_method({ __PACKAGE__->register_method({ name => 'update_node', path => '{node_id}', + proxyto_callback => sub { + my ($rpcenv, $proxyto, $param) = @_; + + my $config = PVE::Network::SDN::Fabrics::config(); + my $old_node = $config->get_node($param->{fabric_id}, $param->{node_id}); + + return $old_node->{node_id} if is_internal_wireguard_node($old_node); + return 'localhost'; + }, method => 'PUT', description => 'Update a node', protected => 1, @@ -205,8 +255,55 @@ __PACKAGE__->register_method({ my $digest = extract_param($param, 'digest'); PVE::Tools::assert_if_modified($config->digest(), $digest) if $digest; - $config->update_node($fabric_id, $node_id, $param); - PVE::Network::SDN::Fabrics::write_config($config); + my $old_node = $config->get_node($fabric_id, $node_id); + + # required so rust can parse the proper wireguard node + # variant + $param->{role} = $old_node->{role} if $old_node->{protocol} eq 'wireguard'; + + if (is_internal_wireguard_node($param)) { + my %new_interfaces = map { + my $interface = + PVE::RS::SDN::Fabrics::parse_wireguard_create_interface($_); + $interface->{name} => $interface + } $param->{interfaces}->@*; + + my %old_interfaces = map { + my $interface = PVE::RS::SDN::Fabrics::parse_wireguard_interface($_); + $interface->{name} => $interface + } $old_node->{interfaces}->@*; + + my @interfaces; + for my $interface_name (keys %new_interfaces) { + my $interface = $new_interfaces{$interface_name}; + $interface->{public_key} = + PVE::Network::SDN::WireGuard::create_wireguard_keypair($interface_name) + if !exists($old_interfaces{$interface_name}); + push @interfaces, + PVE::RS::SDN::Fabrics::print_wireguard_interface($interface); + } + $param->{interfaces} = \@interfaces; + + $config->update_node($fabric_id, $node_id, $param); + eval { PVE::Network::SDN::Fabrics::write_config($config); }; + + if (my $err = $@) { + for my $interface (values %new_interfaces) { + PVE::Network::SDN::WireGuard::delete_wireguard_keypair( + $interface->{name}); + } + + die $err; + } + + for my $interface_name (keys %old_interfaces) { + PVE::Network::SDN::WireGuard::delete_wireguard_keypair($interface_name) + if !exists($new_interfaces{$interface_name}); + } + } else { + $config->update_node($fabric_id, $node_id, $param); + PVE::Network::SDN::Fabrics::write_config($config); + } }, "updating node failed", $lock_token, @@ -220,6 +317,15 @@ __PACKAGE__->register_method({ method => 'DELETE', description => 'Add a node', protected => 1, + proxyto_callback => sub { + my ($rpcenv, $proxyto, $param) = @_; + + my $config = PVE::Network::SDN::Fabrics::config(); + my $old_node = $config->get_node($param->{fabric_id}, $param->{node_id}); + + return $old_node->{node_id} if is_internal_wireguard_node($old_node); + return 'localhost'; + }, permissions => { check => [ 'and', @@ -251,8 +357,19 @@ __PACKAGE__->register_method({ my $digest = extract_param($param, 'digest'); PVE::Tools::assert_if_modified($config->digest(), $digest) if $digest; + my $old_node = $config->get_node($fabric_id, $node_id); + $config->delete_node($fabric_id, $node_id); PVE::Network::SDN::Fabrics::write_config($config); + + if (is_internal_wireguard_node($old_node)) { + for my $interface_string ($old_node->{interfaces}->@*) { + my $interface = + PVE::RS::SDN::Fabrics::parse_wireguard_interface($interface_string); + PVE::Network::SDN::WireGuard::delete_wireguard_keypair( + $interface->{name}); + } + } }, "deleting node failed", $lock_token, -- 2.47.3