peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-22 01:13:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

confd: add wireguard key dependency tracking

Browse Source 
When keystore keys change, trigger regeneration of wireguard
interfaces that reference them:

 - Asymmetric key change: triggers interfaces using it as private-key
 - Symmetric key change: triggers interfaces using it as preshared-key
   (both at peers bag-level and individual peer-level)
This commit is contained in:
Mattias Walström
2026-05-22 16:20:45 +02:00
parent 9d4d521fa2
commit 555de63fd6
1 changed files with 57 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/confd/src/core.c
+57 -1
View File
@@ -216,6 +216,44 @@ static confd_dependency_t dep_symmetric_keys(struct lyd_node **diff, struct lyd_
}
}
ly_set_free(ifaces, NULL);
ifaces = lydx_find_xpathf(config,
"/ietf-interfaces:interfaces/interface[infix-interfaces:wireguard/peers/preshared-key='%s']", key_name);
if (ifaces && ifaces->count > 0) {
for (i = 0; i < ifaces->count; i++) {
const char *ifname = lydx_get_cattr(ifaces->dnodes[i], "name");
char xpath[256];
snprintf(xpath, sizeof(xpath),
"/ietf-interfaces:interfaces/interface[name='%s']/infix-interfaces:wireguard", ifname);
result = add_dependencies(diff, xpath, key_name);
if (result == CONFD_DEP_ERROR) {
ERROR("Failed to add wireguard to diff for interface %s", ifname);
ly_set_free(ifaces, NULL);
return result;
}
}
}
ly_set_free(ifaces, NULL);
ifaces = lydx_find_xpathf(config,
"/ietf-interfaces:interfaces/interface[infix-interfaces:wireguard/peers/peer/preshared-key='%s']", key_name);
if (ifaces && ifaces->count > 0) {
for (i = 0; i < ifaces->count; i++) {
const char *ifname = lydx_get_cattr(ifaces->dnodes[i], "name");
char xpath[256];
snprintf(xpath, sizeof(xpath),
"/ietf-interfaces:interfaces/interface[name='%s']/infix-interfaces:wireguard", ifname);
result = add_dependencies(diff, xpath, key_name);
if (result == CONFD_DEP_ERROR) {
ERROR("Failed to add wireguard to diff for interface %s", ifname);
ly_set_free(ifaces, NULL);
return result;
}
}
}
ly_set_free(ifaces, NULL);
}
return result;
@@ -229,7 +267,7 @@ static confd_dependency_t dep_asymmetric_keys(struct lyd_node **diff, struct lyd
dkeys = lydx_get_descendant(*diff, "keystore", "asymmetric-keys", "asymmetric-key", NULL);
LYX_LIST_FOR_EACH(dkeys, dkey, "asymmetric-key") {
const char *key_name = lydx_get_cattr(dkey, "name");
struct ly_set *hostkeys;
struct ly_set *hostkeys, *ifaces;
struct lyd_node *webcert;
uint32_t i;
@@ -258,6 +296,24 @@ static confd_dependency_t dep_asymmetric_keys(struct lyd_node **diff, struct lyd
}
}
ifaces = lydx_find_xpathf(config,
"/ietf-interfaces:interfaces/interface[infix-interfaces:wireguard/private-key='%s']", key_name);
if (ifaces && ifaces->count > 0) {
for (i = 0; i < ifaces->count; i++) {
const char *ifname = lydx_get_cattr(ifaces->dnodes[i], "name");
char xpath[256];
snprintf(xpath, sizeof(xpath),
"/ietf-interfaces:interfaces/interface[name='%s']/infix-interfaces:wireguard", ifname);
result = add_dependencies(diff, xpath, key_name);
if (result == CONFD_DEP_ERROR) {
ERROR("Failed to add wireguard to diff for interface %s", ifname);
ly_set_free(ifaces, NULL);
return result;
}
}
}
ly_set_free(ifaces, NULL);
}
return result;