Рефакторинг под прод: nsenter-first транспорт, drift-aware reconcile, hardening daemon/lock/reboot/swap, расширенный status и build-скрипт

traffic_core/src/wg.rs

@@ -1,26 +1,39 @@
 use std::net::Ipv4Addr;
 
-use crate::{config, docker::run_capture};
+use crate::{
+    config,
+    netns::{DockerExecTransport, NsTransport, NsenterTransport, nsenter_available},
+};
 
 #[derive(Debug, Clone)]
 pub struct Peer {
     pub ipv4: Ipv4Addr,
 }
 
-pub fn discover_peers(container: &str, peer_cidr: &str) -> anyhow::Result<Vec<Peer>> {
-    let primary = run_capture(&[
-        "docker",
-        "exec",
-        container,
-        "sh",
-        "-c",
-        "wg show all allowed-ips 2>/dev/null",
-    ])
-    .unwrap_or_default();
+pub fn discover_peers(pid: u32, container: &str, peer_cidr: &str) -> anyhow::Result<Vec<Peer>> {
+    let boxed: Box<dyn NsTransport> = if nsenter_available() {
+        Box::new(NsenterTransport { pid })
+    } else {
+        Box::new(DockerExecTransport {
+            container: container.to_string(),
+        })
+    };
+
+    discover_peers_with_transport(boxed.as_ref(), peer_cidr)
+}
+
+pub fn discover_peers_with_transport(
+    transport: &dyn NsTransport,
+    peer_cidr: &str,
+) -> anyhow::Result<Vec<Peer>> {
+    let primary = transport
+        .run(&["sh", "-c", "wg show all allowed-ips 2>/dev/null"])
+        .unwrap_or_default();
 
     let mut peers = parse_allowed_ips(&primary, peer_cidr)?;
     if peers.is_empty() {
-        let fallback = run_capture(&["docker", "exec", container, "sh", "-c", "wg show 2>/dev/null"])
+        let fallback = transport
+            .run(&["sh", "-c", "wg show 2>/dev/null"])
             .unwrap_or_default();
         peers = parse_fallback_wg_show(&fallback, peer_cidr)?;
     }
@@ -89,5 +102,29 @@ mod tests {
         let peers = parse_allowed_ips(raw, "10.8.1.0/24").expect("parse");
         assert_eq!(peers.len(), 2);
     }
+
+    #[test]
+    fn parse_fallback() {
+        let raw = "allowed ips: 10.8.1.4/32, 10.8.1.5/32\nallowed ips: 192.168.0.1/32";
+        let peers = parse_fallback_wg_show(raw, "10.8.1.0/24").expect("parse");
+        assert_eq!(peers.len(), 2);
+    }
+
+    #[test]
+    fn cidr_filtering_keeps_only_target_subnet() {
+        let raw = "wg0 key1 10.8.1.10/32\nwg0 key2 10.9.1.2/32";
+        let peers = parse_allowed_ips(raw, "10.8.1.0/24").expect("parse");
+        assert_eq!(peers.len(), 1);
+        assert_eq!(peers[0].ipv4.to_string(), "10.8.1.10");
+    }
+
+    #[test]
+    fn lexicographic_sorting_parity() {
+        let raw = "wg0 key1 10.8.1.2/32\nwg0 key2 10.8.1.10/32";
+        let mut peers = parse_allowed_ips(raw, "10.8.1.0/24").expect("parse");
+        peers.sort_by_key(|p| p.ipv4.to_string());
+        assert_eq!(peers[0].ipv4.to_string(), "10.8.1.10");
+        assert_eq!(peers[1].ipv4.to_string(), "10.8.1.2");
+    }
 }