From 70d0ad3c9f37e44a9504a0d7f66e412a3f3bba6f Mon Sep 17 00:00:00 2001 From: Trygve Laugstøl Date: Thu, 7 Jan 2021 12:20:02 +0100 Subject: More Wireguard. Fixing broken myapps too. --- .../src/main/java/io/trygvis/acme/AcmeMyApp.java | 6 -- .../src/main/java/io/trygvis/acme/AcmeOps.java | 4 - .../main/java/io/trygvis/acme/apps/AcmeMyApp.java | 6 ++ .../main/java/io/trygvis/acme/apps/AcmeOps.java | 4 + .../acme/src/main/resources/META-INF/kmodule.xml | 8 +- .../src/main/resources/io/trygvis/acme/acme.drl | 26 ----- .../main/resources/io/trygvis/acme/apps/apps.drl | 33 ++++++ .../main/java/io/trygvis/rules/engine/DbIo.java | 8 +- .../java/io/trygvis/rules/machine/Machine.java | 8 ++ .../main/java/io/trygvis/rules/network/IpCalc.java | 45 -------- .../java/io/trygvis/rules/network/Ipv4Cidr.java | 114 +++++++++++++++++++-- .../java/io/trygvis/rules/network/IpCalcTest.java | 27 ----- .../io/trygvis/rules/network/Ipv4CidrTest.java | 36 +++++++ .../io/trygvis/rules/wireguard/wireguard.drl | 79 +++++++++----- 14 files changed, 259 insertions(+), 145 deletions(-) delete mode 100644 module/acme/src/main/java/io/trygvis/acme/AcmeMyApp.java delete mode 100644 module/acme/src/main/java/io/trygvis/acme/AcmeOps.java create mode 100644 module/acme/src/main/java/io/trygvis/acme/apps/AcmeMyApp.java create mode 100644 module/acme/src/main/java/io/trygvis/acme/apps/AcmeOps.java create mode 100644 module/acme/src/main/resources/io/trygvis/acme/apps/apps.drl delete mode 100644 module/ri-engine/src/test/java/io/trygvis/rules/network/IpCalcTest.java create mode 100644 module/ri-engine/src/test/java/io/trygvis/rules/network/Ipv4CidrTest.java (limited to 'module') diff --git a/module/acme/src/main/java/io/trygvis/acme/AcmeMyApp.java b/module/acme/src/main/java/io/trygvis/acme/AcmeMyApp.java deleted file mode 100644 index dfe374b..0000000 --- a/module/acme/src/main/java/io/trygvis/acme/AcmeMyApp.java +++ /dev/null @@ -1,6 +0,0 @@ -package io.trygvis.acme; - -public class AcmeMyApp { - public String environment; - public String dockerTag; -} diff --git a/module/acme/src/main/java/io/trygvis/acme/AcmeOps.java b/module/acme/src/main/java/io/trygvis/acme/AcmeOps.java deleted file mode 100644 index 844c7f0..0000000 --- a/module/acme/src/main/java/io/trygvis/acme/AcmeOps.java +++ /dev/null @@ -1,4 +0,0 @@ -package io.trygvis.acme; - -public class AcmeOps { -} diff --git a/module/acme/src/main/java/io/trygvis/acme/apps/AcmeMyApp.java b/module/acme/src/main/java/io/trygvis/acme/apps/AcmeMyApp.java new file mode 100644 index 0000000..9371af2 --- /dev/null +++ b/module/acme/src/main/java/io/trygvis/acme/apps/AcmeMyApp.java @@ -0,0 +1,6 @@ +package io.trygvis.acme.apps; + +public class AcmeMyApp { + public String environment; + public String dockerTag; +} diff --git a/module/acme/src/main/java/io/trygvis/acme/apps/AcmeOps.java b/module/acme/src/main/java/io/trygvis/acme/apps/AcmeOps.java new file mode 100644 index 0000000..be9d82b --- /dev/null +++ b/module/acme/src/main/java/io/trygvis/acme/apps/AcmeOps.java @@ -0,0 +1,4 @@ +package io.trygvis.acme.apps; + +public class AcmeOps { +} diff --git a/module/acme/src/main/resources/META-INF/kmodule.xml b/module/acme/src/main/resources/META-INF/kmodule.xml index e86da96..6bcd1db 100644 --- a/module/acme/src/main/resources/META-INF/kmodule.xml +++ b/module/acme/src/main/resources/META-INF/kmodule.xml @@ -3,11 +3,15 @@ xmlns="http://www.drools.org/xsd/kmodule" xsi:schemaLocation="http://www.drools.org/xsd/kmodule https://www.drools.org/xsd/kmodule_7_1.xsd"> - + - + + + + + diff --git a/module/acme/src/main/resources/io/trygvis/acme/acme.drl b/module/acme/src/main/resources/io/trygvis/acme/acme.drl index d978579..66623c3 100644 --- a/module/acme/src/main/resources/io/trygvis/acme/acme.drl +++ b/module/acme/src/main/resources/io/trygvis/acme/acme.drl @@ -11,32 +11,6 @@ declare AcmeServer machine : Machine end -rule "Ops" -when - $ops: AcmeOps() -then - var cluster = new Cluster("acme-ops"); - insert(cluster); - insert(new Container(cluster, "app", "pdb", "postgresql", "11")); - insert(new Container(cluster, "app", "n8n", "n8n", "0.84.1")); -end - -rule "MyApp" -when - $app: AcmeMyApp() -then - var cluster = new Cluster("acme-" + $app.environment); - insert(cluster); - - var tag = $app.dockerTag; - insert(new Container(cluster, "app", "statera", "statera", tag)); - insert(new Container(cluster, "app", "statera-console", "statera-console", tag)); - insert(new Container(cluster, "app", "4tune-web", "4tune-web", tag)); - insert(new Container(cluster, "app", "4tune-api", "4tune-api", tag)); - insert(new Container(cluster, "db", "pdb", "postgresql", "13")); - insert(new Container(cluster, "db", "mdb", "mongodb", "3.2")); -end - rule "Create Acme servers" when $m : Machine(name.startsWith("acme-")) diff --git a/module/acme/src/main/resources/io/trygvis/acme/apps/apps.drl b/module/acme/src/main/resources/io/trygvis/acme/apps/apps.drl new file mode 100644 index 0000000..95f09c8 --- /dev/null +++ b/module/acme/src/main/resources/io/trygvis/acme/apps/apps.drl @@ -0,0 +1,33 @@ +package io.trygvis.acme.apps; + +import io.trygvis.rules.machine.Machine; +import io.trygvis.rules.dba.Cluster; +import io.trygvis.rules.dba.Container; + +dialect "mvel" + +rule "Ops" +when + $ops: AcmeOps() +then + var cluster = new Cluster("acme-ops"); + insert(cluster); + insert(new Container(cluster, "app", "pdb", "postgresql", "11")); + insert(new Container(cluster, "app", "n8n", "n8n", "0.84.1")); +end + +rule "MyApp" +when + $app: AcmeMyApp() +then + var cluster = new Cluster("acme-myapp-" + $app.environment); + insert(cluster); + + var tag = $app.dockerTag; + insert(new Container(cluster, "app", "statera", "statera", tag)); + insert(new Container(cluster, "app", "statera-console", "statera-console", tag)); + insert(new Container(cluster, "app", "4tune-web", "4tune-web", tag)); + insert(new Container(cluster, "app", "4tune-api", "4tune-api", tag)); + insert(new Container(cluster, "db", "pdb", "postgresql", "13")); + insert(new Container(cluster, "db", "mdb", "mongodb", "3.2")); +end diff --git a/module/ri-engine/src/main/java/io/trygvis/rules/engine/DbIo.java b/module/ri-engine/src/main/java/io/trygvis/rules/engine/DbIo.java index 7f946d9..3173109 100644 --- a/module/ri-engine/src/main/java/io/trygvis/rules/engine/DbIo.java +++ b/module/ri-engine/src/main/java/io/trygvis/rules/engine/DbIo.java @@ -2,6 +2,7 @@ package io.trygvis.rules.engine; import ch.qos.logback.core.util.FileUtil; import com.fasterxml.jackson.databind.ObjectMapper; +import com.fasterxml.jackson.databind.SerializationFeature; import com.fasterxml.jackson.databind.type.TypeFactory; import com.fasterxml.jackson.dataformat.yaml.YAMLFactory; import com.fasterxml.jackson.dataformat.yaml.YAMLGenerator; @@ -12,6 +13,7 @@ import org.kie.api.runtime.rule.FactHandle; import java.io.File; import java.io.FileWriter; import java.io.IOException; +import java.lang.reflect.InvocationTargetException; import java.util.*; import java.util.function.Function; @@ -24,6 +26,7 @@ public class DbIo { factory.enable(YAMLGenerator.Feature.USE_NATIVE_TYPE_ID); factory.enable(YAMLGenerator.Feature.USE_NATIVE_OBJECT_ID); mapper = new ObjectMapper(factory); + mapper.disable(SerializationFeature.FAIL_ON_EMPTY_BEANS); var typeFactory = TypeFactory.defaultInstance() .withClassLoader(new AcmeClassLoader(kieBase)); mapper.setTypeFactory(typeFactory); @@ -40,8 +43,11 @@ public class DbIo { try { var type = mapper.getTypeFactory().findClass(object.type); var x = mapper.treeToValue(object.data, type); + if (x == null) { + x = type.getDeclaredConstructor().newInstance(); + } items.add(x); - } catch (ClassNotFoundException e) { + } catch (ClassNotFoundException | NoSuchMethodException | InstantiationException | IllegalAccessException | InvocationTargetException e) { // ignore } } diff --git a/module/ri-engine/src/main/java/io/trygvis/rules/machine/Machine.java b/module/ri-engine/src/main/java/io/trygvis/rules/machine/Machine.java index cc3f2ed..52721e1 100644 --- a/module/ri-engine/src/main/java/io/trygvis/rules/machine/Machine.java +++ b/module/ri-engine/src/main/java/io/trygvis/rules/machine/Machine.java @@ -10,4 +10,12 @@ public class Machine { public Machine(String name) { this.name = name; } + + public String getName() { + return name; + } + + public String getFqdn() { + return fqdn; + } } diff --git a/module/ri-engine/src/main/java/io/trygvis/rules/network/IpCalc.java b/module/ri-engine/src/main/java/io/trygvis/rules/network/IpCalc.java index e40e169..7ec344c 100644 --- a/module/ri-engine/src/main/java/io/trygvis/rules/network/IpCalc.java +++ b/module/ri-engine/src/main/java/io/trygvis/rules/network/IpCalc.java @@ -3,49 +3,4 @@ package io.trygvis.rules.network; import java.util.regex.Pattern; public class IpCalc { - private static final Pattern pattern = Pattern.compile("([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})/([0-9]{1,3})"); - - public static Ipv4Cidr cidr(String cidr) { - var matcher = pattern.matcher(cidr); - if (!matcher.matches()) { - throw new IllegalArgumentException("Not a CIDR: " + cidr); - } - - var b1 = matcher.group(1); - var b2 = matcher.group(2); - var b3 = matcher.group(3); - var b4 = matcher.group(4); - - int network = parse(b1) << 24 | - parse(b2) << 16 | - parse(b3) << 8 | - parse(b4); - -// System.out.printf("network = %x%n", network); - - var l = matcher.group(5); - var bits = Integer.parseInt(l); - var hostBits = 32 - bits; - int size = 1 << hostBits; - - int netmask = (-1 >> hostBits) << hostBits; -// System.out.printf("netmask = %08x%n", netmask); - - int x = network & ~netmask; - - if (x != 0) { - throw new IllegalArgumentException("Not a CIDR: " + cidr); - } - - return new Ipv4Cidr(network, netmask, size, bits); - } - - private static int parse(String s) { - var i = Integer.parseInt(s); - if (i > 255) { - throw new IllegalArgumentException("Not a CIDR"); - } - - return i; - } } diff --git a/module/ri-engine/src/main/java/io/trygvis/rules/network/Ipv4Cidr.java b/module/ri-engine/src/main/java/io/trygvis/rules/network/Ipv4Cidr.java index e69cd02..8e812ef 100644 --- a/module/ri-engine/src/main/java/io/trygvis/rules/network/Ipv4Cidr.java +++ b/module/ri-engine/src/main/java/io/trygvis/rules/network/Ipv4Cidr.java @@ -4,22 +4,35 @@ import com.fasterxml.jackson.core.JsonGenerator; import com.fasterxml.jackson.databind.JsonSerializer; import com.fasterxml.jackson.databind.SerializerProvider; import com.fasterxml.jackson.databind.annotation.JsonSerialize; +import org.checkerframework.checker.nullness.compatqual.NonNullType; +import javax.annotation.Nonnull; import java.io.IOException; import java.util.ArrayList; -import java.util.Collection; +import java.util.List; +import java.util.Objects; +import java.util.regex.Pattern; @JsonSerialize(using = Ipv4Cidr.Serializer.class) -public class Ipv4Cidr { +public class Ipv4Cidr implements Comparable { public final int network; - public final int netmask; - public final int size; public final int bits; - public Ipv4Cidr(int network, int netmask, int size, int bits) { + public Ipv4Cidr(int network, int bits) { + if (bits < 0 || bits > 32) { + throw new IllegalArgumentException("bits must be [0, 32]"); + } + + int hostBits = 32 - bits; + int netmask = (-1 >> hostBits) << hostBits; + + int x = network & ~netmask; + + if (x != 0) { + throw new IllegalArgumentException("The host part of the address must be 0."); + } + this.network = network; - this.netmask = netmask; - this.size = size; this.bits = bits; } @@ -33,7 +46,29 @@ public class Ipv4Cidr { bits); } - public Collection addresses() { + private String formatIpv4(int address) { + return "%d.%d.%d.%d".formatted(address >> 24 & 0xff, address >> 16 & 0xff, address >> 8 & 0xff, address & 0xff); + } + + public List partition(int bits) { + if (bits <= 0 || bits <= this.bits || bits > 32) { + throw new IllegalArgumentException("Invalid new network size"); + } + + var list = new ArrayList(); + + int count = 1 << (bits - this.bits); + for (int i = 0; i < count; i++) { + var network = this.network | (i << (32 - bits)); + + list.add(new Ipv4Cidr(network, bits)); + } + + return list; + } + + public List addresses() { + int size = 1 << 32 - bits; var end = network + size; var addresses = new ArrayList(size); for (int address = network; address < end; address++) { @@ -43,6 +78,69 @@ public class Ipv4Cidr { return addresses; } + @Override + public int compareTo(Ipv4Cidr o) { + if (this == o) { + return 0; + } + + var ret = network - o.network; + if (ret == 0) { + return ret; + } + + return bits - o.bits; + } + + @Override + public boolean equals(Object o) { + if (this == o) return true; + if (o == null || getClass() != o.getClass()) return false; + Ipv4Cidr ipv4Cidr = (Ipv4Cidr) o; + return network == ipv4Cidr.network && bits == ipv4Cidr.bits; + } + + @Override + public int hashCode() { + return Objects.hash(network, bits); + } + + private static final Pattern pattern = Pattern.compile("([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})/([0-9]{1,3})"); + + public static Ipv4Cidr parseCidr(String cidr) { + var matcher = pattern.matcher(cidr); + if (!matcher.matches()) { + throw new IllegalArgumentException("Not a CIDR: " + cidr); + } + + var b1 = matcher.group(1); + var b2 = matcher.group(2); + var b3 = matcher.group(3); + var b4 = matcher.group(4); + + int network = parse(b1) << 24 | + parse(b2) << 16 | + parse(b3) << 8 | + parse(b4); + +// System.out.printf("network = %x%n", network); + + var l = matcher.group(5); + var bits = Integer.parseInt(l); +// System.out.printf("netmask = %08x%n", netmask); + + return new Ipv4Cidr(network, bits); + } + + private static int parse(String s) { + var i = Integer.parseInt(s); + if (i > 255) { + throw new IllegalArgumentException("Not a CIDR"); + } + + return i; + } + public static class Serializer extends JsonSerializer { @Override public void serialize(Ipv4Cidr value, JsonGenerator gen, SerializerProvider serializers) throws IOException { diff --git a/module/ri-engine/src/test/java/io/trygvis/rules/network/IpCalcTest.java b/module/ri-engine/src/test/java/io/trygvis/rules/network/IpCalcTest.java deleted file mode 100644 index e0642d6..0000000 --- a/module/ri-engine/src/test/java/io/trygvis/rules/network/IpCalcTest.java +++ /dev/null @@ -1,27 +0,0 @@ -package io.trygvis.rules.network; - -import org.junit.jupiter.api.Test; -import org.junit.jupiter.params.ParameterizedTest; -import org.junit.jupiter.params.provider.ValueSource; - -import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertThrows; - -class IpCalcTest { - - @Test - public void basic() { - assertThrows(IllegalArgumentException.class, () -> IpCalc.cidr("192.168.1.1/24").addresses()); - assertEquals(256, IpCalc.cidr("192.168.1.0/24").addresses().size()); - assertEquals(128, IpCalc.cidr("192.168.1.128/25").addresses().size()); - } - - @ParameterizedTest - @ValueSource(strings = { - "192.168.1.0/24", - "192.168.1.128/25", - }) - public void testParsing(String s) { - assertEquals(s, IpCalc.cidr(s).toString()); - } -} diff --git a/module/ri-engine/src/test/java/io/trygvis/rules/network/Ipv4CidrTest.java b/module/ri-engine/src/test/java/io/trygvis/rules/network/Ipv4CidrTest.java new file mode 100644 index 0000000..0d9f33e --- /dev/null +++ b/module/ri-engine/src/test/java/io/trygvis/rules/network/Ipv4CidrTest.java @@ -0,0 +1,36 @@ +package io.trygvis.rules.network; + +import org.junit.jupiter.api.Test; +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.ValueSource; + +import static io.trygvis.rules.network.Ipv4Cidr.parseCidr; +import static org.junit.jupiter.api.Assertions.*; + +class Ipv4CidrTest { + + @Test + public void basic() { + assertThrows(IllegalArgumentException.class, () -> parseCidr("192.168.1.1/24").addresses()); + assertEquals(256, parseCidr("192.168.1.0/24").addresses().size()); + assertEquals(128, parseCidr("192.168.1.128/25").addresses().size()); + } + + @ParameterizedTest + @ValueSource(strings = { + "192.168.1.0/24", + "192.168.1.128/25", + }) + public void testParsing(String s) { + assertEquals(s, parseCidr(s).toString()); + } + + @Test + public void partition() { + var children = parseCidr("192.168.1.0/24").partition(26); + assertEquals(1 << 2, children.size()); + for (var cidr : children) { + assertEquals(26, cidr.bits); + } + } +} diff --git a/module/ri-wireguard/src/main/resources/io/trygvis/rules/wireguard/wireguard.drl b/module/ri-wireguard/src/main/resources/io/trygvis/rules/wireguard/wireguard.drl index 06b9bbf..2e4498f 100644 --- a/module/ri-wireguard/src/main/resources/io/trygvis/rules/wireguard/wireguard.drl +++ b/module/ri-wireguard/src/main/resources/io/trygvis/rules/wireguard/wireguard.drl @@ -17,6 +17,7 @@ declare WgNet domain : String linkCidr : String networkCidr : String + networkBits : int end declare WgIpPool @@ -25,14 +26,6 @@ declare WgIpPool cidr : Ipv4Cidr end -rule "Create link network" when - $net : WgNet() - not(Ipv4Cidr(network == IpCalc.cidr($net.linkCidr).network)) -then - insert(new WgIpPool($net.name, "link", IpCalc.cidr($net.linkCidr))) - insert(new WgIpPool($net.name, "network", IpCalc.cidr($net.networkCidr))) -end - declare WgHost name : String net : String @@ -41,6 +34,32 @@ declare WgHost networkIp : String end +declare WgConnection + host : String + to : String +end + +declare WgIpAllocation + host : String + role : String + ip : Ipv4Address +end + +declare WgNetworkAllocation + host : String + role : String + cidr : Ipv4Cidr +end + +rule "Create IP pools" when + $net : WgNet() +// not(Ipv4Cidr(network == Ipv4Cidr.parseCidr($net.linkCidr).network)) +then + System.out.println("Creating main IP pools"); + insert(new WgIpPool($net.name, "link", Ipv4Cidr.parseCidr($net.linkCidr))) + insert(new WgIpPool($net.name, "networks", Ipv4Cidr.parseCidr($net.networkCidr))) +end + rule "WgHost VPN machines" when $machine : Machine() @@ -74,31 +93,21 @@ then insert(DnsEntry.a(fqdn)) end -declare WgConnection - host : String - to : String -end - rule "Connect VPN nodes" salience -1 when $h : WgHost() $other : WgHost(publicName != null, name != $h.name) then + System.out.printf("VPN connection from %s to %s%n", $h.name, $other.name); insert(new WgConnection($h.name, $other.name)) end -declare WgIpAllocation - host : String - role : String - ip : Ipv4Address -end - -rule "Assign IP" +rule "Assign link IP" when $net : WgNet() $host : WgHost(net == $net.name) - $pool : WgIpPool(net == $net.name) + $pool : WgIpPool(net == $net.name, role == "link") not(WgIpAllocation(host == $host.name, role == $pool.role)) $ip : Ipv4Address() from $pool.cidr.addresses() not(WgIpAllocation(ip == $ip)) @@ -107,17 +116,33 @@ then insert(new WgIpAllocation($host.name, $pool.role, $ip)) end +rule "Assign network CIDR" +when + $net : WgNet() + $host : WgHost(net == $net.name) + $network : Ipv4Cidr() from Ipv4Cidr.parseCidr($net.networkCidr).partition($net.networkBits) + not(WgNetworkAllocation(host == $host.name, role == "network")) + not(WgNetworkAllocation(cidr == $network)) +then + System.out.printf("Network CIDR: net=%s, host=%s, network=%s%n", $net.name, $host.name, $network); + insert(new WgNetworkAllocation($host.name, "network", $network)) +end + rule "Generate per-net files" agenda-group "generate" salience 10 when $net : WgNet() + $names : ArrayList() from accumulate(WgHost(net == $net.name, $name: name), collectList($name)) + $hosts : ArrayList() from accumulate(Machine($names contains name, $m: this), collectList($m)) then te.template("wireguard/ansible", "wireguard-" + $net.name + ".yml", Map.of( "net", $net )); - // TODO: Generate hosts file + te.template("wireguard/inventory", "inventory.yml", Map.of( + "hosts", $hosts + )); end rule "Generate per-net, per-host files" @@ -127,10 +152,11 @@ when $net : WgNet() $host : WgHost(net == $net.name) $link : WgIpAllocation(host == $host.name, role == "link") - // Needs to be a sub-cidr of the WgNet network cidr, not a specific IP - $network : WgIpAllocation(host == $host.name, role == "network") + $network : WgNetworkAllocation(host == $host.name, role == "network") + $peerMachines : ArrayList() from accumulate(WgConnection(host == $host.name, $to: to), collectList($to)) + $peers : ArrayList() from accumulate(Machine($peerMachines contains name, $fqdn: fqdn), collectList($fqdn)) then - System.out.printf("%s : %s%n", $net.name, $host.name); + System.out.printf("Generating per-host files: net=%s, host=%s%n", $net.name, $host.name); String output = "host_vars/%s/wireguard.yml".formatted($host.name); @@ -138,6 +164,7 @@ then "net", $net, "host", $host, "link", $link.ip, - "network", "TODO" + "network", $network.cidr, + "peers", $peers )); end -- cgit v1.2.3