update network peers when new machine added

internal/machine/api/pb/cluster.go

@@ -0,0 +1,49 @@
+package pb
+
+import (
+	"fmt"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// KeyLen is the expected key length for a WireGuard public or private key.
+const KeyLen = 32
+
+func (c *NetworkConfig) Validate() error {
+	if c.Subnet != nil {
+		_, err := c.Subnet.ToPrefix()
+		if err != nil {
+			return status.Errorf(codes.InvalidArgument, "invalid subnet: %v", err)
+		}
+	}
+	if c.ManagementIp != nil {
+		_, err := c.ManagementIp.ToAddr()
+		if err != nil {
+			return status.Errorf(codes.InvalidArgument, "invalid management IP: %v", err)
+		}
+	}
+	for _, ep := range c.Endpoints {
+		if ep == nil {
+			return status.Error(codes.InvalidArgument, "endpoint not set")
+		}
+		_, err := ep.ToAddrPort()
+		if err != nil {
+			return status.Errorf(codes.InvalidArgument, "invalid endpoint: %v", err)
+		}
+	}
+	if c.PublicKey == nil {
+		return status.Error(codes.InvalidArgument, "public key not set")
+	}
+	if len(c.PublicKey) != KeyLen {
+		return status.Errorf(codes.InvalidArgument, "invalid public key length: %d", len(c.PublicKey))
+	}
+
+	return nil
+}
+
+func (r *AddMachineRequest) Validate() error {
+	if r.Network == nil {
+		return fmt.Errorf("network not set")
+	}
+	return r.Network.Validate()
+}

internal/machine/api/pb/common.go

@@ -17,6 +17,9 @@ func (ip *IP) ToAddr() (netip.Addr, error) {
 	if err := addr.UnmarshalBinary(ip.Ip); err != nil {
 		return netip.Addr{}, fmt.Errorf("unmarshal IP: %w", err)
 	}
+	if !addr.IsValid() {
+		return netip.Addr{}, fmt.Errorf("invalid IP")
+	}
 	return addr, nil
 }
 
@@ -45,5 +48,9 @@ func (p *IPPrefix) ToPrefix() (netip.Prefix, error) {
 	if err != nil {
 		return netip.Prefix{}, err
 	}
-	return netip.PrefixFrom(addr, int(p.Bits)), nil
+	prefix := netip.PrefixFrom(addr, int(p.Bits))
+	if !prefix.IsValid() {
+		return netip.Prefix{}, fmt.Errorf("invalid prefix")
+	}
+	return prefix, nil
 }