64 lines
1.7 KiB
Python
64 lines
1.7 KiB
Python
# tractor: distributed structured concurrency.
|
|
r'''
|
|
Verify `wg` peers declared by tractor's multiaddr parser.
|
|
|
|
`tractor.discovery.parse_wg_maddr()` owns pure parsing and delegates
|
|
all tunnel peeling to `py-multiaddr`. This example keeps only the
|
|
explicit impure probe used by the two-host demo; parsing never shells
|
|
out or verifies local interface state implicitly.
|
|
|
|
The canonical maddr form is:
|
|
|
|
/ip4/10.0.0.1/udp/51820/wg/u<key>/ip4/10.0.11.1/tcp/1616
|
|
\_______ wg bearer ______/\_ key _/\____ tractor ep _____/
|
|
|
|
The kernel owns the bearer socket. A future tractor bindspace may
|
|
provision it through netlink, but only the overlay is an application
|
|
`MsgTransport` endpoint.
|
|
|
|
'''
|
|
from __future__ import annotations
|
|
import subprocess
|
|
|
|
from tractor.discovery import (
|
|
TunnelledAddress,
|
|
WGTunnelSpec,
|
|
)
|
|
|
|
|
|
def verify_wg_peer(
|
|
addr: TunnelledAddress,
|
|
iface: str|None = None,
|
|
) -> bool:
|
|
'''
|
|
Check the outer tunnel's key against one local `wg` iface.
|
|
|
|
IMPURE + explicit by design: neither `parse_wg_maddr()` nor
|
|
`tractor.discovery.parse_maddr()` calls this probe.
|
|
|
|
?TODO, per plan-03 layer B, swap this body for `pyroute2`
|
|
while retaining the explicit verification boundary.
|
|
|
|
'''
|
|
spec = addr.tunnel
|
|
if not isinstance(spec, WGTunnelSpec):
|
|
raise TypeError(
|
|
f'Unsupported tunnel spec: {type(spec)!r}'
|
|
)
|
|
|
|
iface = iface or spec.iface
|
|
|
|
def _wg(*args: str) -> str:
|
|
return subprocess.run(
|
|
['wg', 'show', iface, *args],
|
|
capture_output=True,
|
|
text=True,
|
|
check=True,
|
|
).stdout
|
|
|
|
return (
|
|
spec.peer_pubkey in _wg('peers').split()
|
|
or
|
|
spec.peer_pubkey == _wg('public-key').strip()
|
|
)
|