130 lines
3.9 KiB
Rust
130 lines
3.9 KiB
Rust
use std::net::Ipv4Addr;
|
|
|
|
use crate::{
|
|
config,
|
|
netns::{DockerExecTransport, NsTransport, NsenterTransport, nsenter_available},
|
|
};
|
|
|
|
#[derive(Debug, Clone)]
|
|
pub struct Peer {
|
|
pub ipv4: Ipv4Addr,
|
|
}
|
|
|
|
pub fn discover_peers(pid: u32, container: &str, peer_cidr: &str) -> anyhow::Result<Vec<Peer>> {
|
|
let boxed: Box<dyn NsTransport> = if nsenter_available() {
|
|
Box::new(NsenterTransport { pid })
|
|
} else {
|
|
Box::new(DockerExecTransport {
|
|
container: container.to_string(),
|
|
})
|
|
};
|
|
|
|
discover_peers_with_transport(boxed.as_ref(), peer_cidr)
|
|
}
|
|
|
|
pub fn discover_peers_with_transport(
|
|
transport: &dyn NsTransport,
|
|
peer_cidr: &str,
|
|
) -> anyhow::Result<Vec<Peer>> {
|
|
let primary = transport
|
|
.run(&["wg", "show", "all", "allowed-ips"])
|
|
.map_err(|e| anyhow::anyhow!("wg show all allowed-ips failed: {e}"))?;
|
|
|
|
let mut peers = parse_allowed_ips(&primary, peer_cidr)?;
|
|
if peers.is_empty() {
|
|
let fallback = transport
|
|
.run(&["wg", "show"])
|
|
.map_err(|e| anyhow::anyhow!("wg show fallback failed: {e}"))?;
|
|
peers = parse_fallback_wg_show(&fallback, peer_cidr)?;
|
|
}
|
|
|
|
peers.sort_by_key(|p| p.ipv4.to_string());
|
|
peers.dedup_by_key(|p| p.ipv4);
|
|
Ok(peers)
|
|
}
|
|
|
|
fn parse_allowed_ips(raw: &str, peer_cidr: &str) -> anyhow::Result<Vec<Peer>> {
|
|
let mut out = Vec::new();
|
|
for line in raw.lines() {
|
|
let cols: Vec<&str> = line.split_whitespace().collect();
|
|
if cols.len() < 3 {
|
|
continue;
|
|
}
|
|
for tok in cols[2].split(',') {
|
|
let tok = tok.trim();
|
|
if let Some((ip, pfx)) = tok.split_once('/') {
|
|
if pfx != "32" {
|
|
continue;
|
|
}
|
|
if let Ok(v4) = ip.parse::<Ipv4Addr>() {
|
|
if config::ip_in_cidr(v4, peer_cidr)? {
|
|
out.push(Peer { ipv4: v4 });
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
Ok(out)
|
|
}
|
|
|
|
fn parse_fallback_wg_show(raw: &str, peer_cidr: &str) -> anyhow::Result<Vec<Peer>> {
|
|
let mut out = Vec::new();
|
|
for line in raw.lines() {
|
|
let t = line.trim();
|
|
if !t.starts_with("allowed ips:") {
|
|
continue;
|
|
}
|
|
let rest = t.trim_start_matches("allowed ips:").trim();
|
|
for tok in rest.split(',') {
|
|
let tok = tok.trim();
|
|
if let Some((ip, pfx)) = tok.split_once('/') {
|
|
if pfx != "32" {
|
|
continue;
|
|
}
|
|
if let Ok(v4) = ip.parse::<Ipv4Addr>() {
|
|
if config::ip_in_cidr(v4, peer_cidr)? {
|
|
out.push(Peer { ipv4: v4 });
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
Ok(out)
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn parse_primary() {
|
|
let raw = "wg0 key1 10.8.1.10/32\nwg0 key2 10.8.1.2/32";
|
|
let peers = parse_allowed_ips(raw, "10.8.1.0/24").expect("parse");
|
|
assert_eq!(peers.len(), 2);
|
|
}
|
|
|
|
#[test]
|
|
fn parse_fallback() {
|
|
let raw = "allowed ips: 10.8.1.4/32, 10.8.1.5/32\nallowed ips: 192.168.0.1/32";
|
|
let peers = parse_fallback_wg_show(raw, "10.8.1.0/24").expect("parse");
|
|
assert_eq!(peers.len(), 2);
|
|
}
|
|
|
|
#[test]
|
|
fn cidr_filtering_keeps_only_target_subnet() {
|
|
let raw = "wg0 key1 10.8.1.10/32\nwg0 key2 10.9.1.2/32";
|
|
let peers = parse_allowed_ips(raw, "10.8.1.0/24").expect("parse");
|
|
assert_eq!(peers.len(), 1);
|
|
assert_eq!(peers[0].ipv4.to_string(), "10.8.1.10");
|
|
}
|
|
|
|
#[test]
|
|
fn lexicographic_sorting_parity() {
|
|
let raw = "wg0 key1 10.8.1.2/32\nwg0 key2 10.8.1.10/32";
|
|
let mut peers = parse_allowed_ips(raw, "10.8.1.0/24").expect("parse");
|
|
peers.sort_by_key(|p| p.ipv4.to_string());
|
|
assert_eq!(peers[0].ipv4.to_string(), "10.8.1.10");
|
|
assert_eq!(peers[1].ipv4.to_string(), "10.8.1.2");
|
|
}
|
|
}
|