NAPALM/napalm-opnsense

0 Fork 0

fix: WireGuard peers keep their tunnel key when others come and go (#32) #33

Merged

christianmanivong merged 2 commits from fix/wireguard-stable-keys-32 into main

2026-10-27 09:06:56 +00:00

Author	SHA1	Message	Date
Christian Manivong	eaafa540e5	refactor: WireGuard tunnels are read in their own module (#32 ) driver / lint (pull_request) Successful in 13s Details driver / standard (pull_request) Successful in 14s Details driver / test (3.10) (pull_request) Failing after 6s Details driver / types (pull_request) Successful in 1m2s Details driver / test (3.11) (pull_request) Successful in 1m5s Details driver / test (3.12) (pull_request) Successful in 1m5s Details driver / lowest (pull_request) Successful in 33s Details driver / test (3.13) (pull_request) Successful in 59s Details driver / build (pull_request) Successful in 27s Details driver / security (pull_request) Successful in 1m1s Details CI / driver (pull_request) Failing after 2m25s Details driver / publish (pull_request) Skipped Details get_vpn_tunnels() grew past the quality baseline with the key fix. The WireGuard part is pure parsing of /api/wireguard/service/show, like the listen ports in listening.py, so it moves to wireguard.py and the driver calls it. opnsense.py shrinks from 3125 to 3082 lines.	2026-10-27 10:03:30 +01:00
Christian Manivong	9f45952605	fix: WireGuard peers keep their tunnel key when others come and go (#32 ) driver / lint (pull_request) Successful in 17s Details driver / standard (pull_request) Failing after 17s Details driver / test (3.10) (pull_request) Failing after 3s Details driver / test (3.11) (pull_request) Failing after 6s Details driver / types (pull_request) Successful in 1m2s Details driver / lowest (pull_request) Successful in 59s Details driver / test (3.13) (pull_request) Successful in 1m39s Details driver / test (3.12) (pull_request) Successful in 1m42s Details driver / build (pull_request) Successful in 29s Details driver / security (pull_request) Successful in 1m11s Details CI / driver (pull_request) Failing after 3m12s Details driver / publish (pull_request) Skipped Details get_vpn_tunnels() keyed WireGuard peers with a running counter over the peer rows, so a peer added ahead of an existing one renumbered every peer after it. Whatever a consumer stores per key moved with it: netOrk's site link and tunnel check ended up on a new, offline peer and alarmed while the real tunnel was up. The key is now the interface and the start of the public key, as in napalm-linux, made URL-safe because the key is a path segment. Two peers sharing the prefix get the whole key; a row without a public key keeps its position. IPsec and OpenVPN keys were already stable. Every WireGuard key changes once; netOrk carries its per-tunnel metadata across (netork#1654).	2026-10-27 09:20:30 +01:00