wgengine,cmd/tailscaled,feature/bird: move BIRD integration to ./feature
The BIRD (BGP) integration previously lived half in cmd/tailscaled (which created a chirp client via a build-tag-gated file on some platforms) and half in wgengine (which carried the client in its Config and toggled the "tailscale" protocol as the node gained or lost primary subnet router duty). Move it all to a new feature/bird package, installed on the engine via the new wgengine.HookNewBird hook, like other feature/* packages. wgengine.Config.BIRDClient (and the wgengine.BIRDClient interface) are replaced by a BIRDSocket path from which the engine constructs the feature's Bird handle at startup. The subnet router overlap detection and protocol toggling move into feature/bird, preserving the previous ordering: state is recomputed before Reconfig's ErrNoChanges early return and applied after the router is configured. tailscaled keeps BIRD support by default on the platforms that previously had it (linux, darwin, freebsd, openbsd) via feature/condregister. Also, add an integration test, as this feature lacked much test coverage previously. Updates #12614 Change-Id: I7866a50779e454c87933b358735f7dcd9e2b126f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick
committed by
Brad Fitzpatrick
Brad Fitzpatrick
parent
9bd62683dd
commit
3d07b5d6e1
@@ -0,0 +1,107 @@
|
||||
// Copyright (c) Tailscale Inc & contributors
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
// Package bird integrates Tailscale with the BIRD Internet Routing
|
||||
// Daemon: it enables the "tailscale" protocol in BIRD while this node
|
||||
// is a primary subnet router and disables it otherwise. The BIRD
|
||||
// client implementation lives in tailscale.com/chirp.
|
||||
package bird
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
|
||||
"tailscale.com/chirp"
|
||||
"tailscale.com/feature"
|
||||
"tailscale.com/tailcfg"
|
||||
"tailscale.com/types/logger"
|
||||
"tailscale.com/types/views"
|
||||
"tailscale.com/wgengine"
|
||||
)
|
||||
|
||||
func init() {
|
||||
feature.Register("bird")
|
||||
wgengine.HookNewBird.Set(newBird)
|
||||
}
|
||||
|
||||
// protocolName is the name of the BIRD protocol that Tailscale enables
|
||||
// while this node is a primary subnet router.
|
||||
const protocolName = "tailscale"
|
||||
|
||||
// bird implements [wgengine.Bird] on top of [chirp.BIRDClient],
|
||||
// tracking the primary subnet router state across engine
|
||||
// reconfigurations. One bird exists per engine.
|
||||
type bird struct {
|
||||
logf logger.Logf
|
||||
client *chirp.BIRDClient
|
||||
|
||||
// The fields below are only accessed from Reconfig and
|
||||
// ReconfigDone, which the engine serializes under its internal
|
||||
// lock.
|
||||
|
||||
// isSubnetRouter is whether the last Reconfig found this node to
|
||||
// be a primary subnet router.
|
||||
isSubnetRouter bool
|
||||
// lastIsSubnetRouter is the primary subnet router state last
|
||||
// successfully applied to BIRD. ReconfigDone compares it against
|
||||
// isSubnetRouter to decide whether to toggle the protocol.
|
||||
lastIsSubnetRouter bool
|
||||
}
|
||||
|
||||
func newBird(logf logger.Logf, socketPath string) (wgengine.Bird, error) {
|
||||
logf("wgengine: connecting to BIRD at %s ...", socketPath)
|
||||
client, err := chirp.New(socketPath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Disable the protocol at start time; ReconfigDone enables it only
|
||||
// once this node becomes a primary subnet router.
|
||||
if err := client.DisableProtocol(protocolName); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &bird{logf: logf, client: client}, nil
|
||||
}
|
||||
|
||||
func (b *bird) Reconfig(self tailcfg.NodeView) (changed bool) {
|
||||
b.isSubnetRouter = false
|
||||
if self.Valid() {
|
||||
b.isSubnetRouter = hasOverlap(self.PrimaryRoutes(), self.Hostinfo().RoutableIPs())
|
||||
b.logf("[v1] Reconfig: hasOverlap(%v, %v) = %v; isSubnetRouter=%v lastIsSubnetRouter=%v",
|
||||
self.PrimaryRoutes(), self.Hostinfo().RoutableIPs(),
|
||||
b.isSubnetRouter, b.isSubnetRouter, b.lastIsSubnetRouter)
|
||||
}
|
||||
return b.isSubnetRouter != b.lastIsSubnetRouter
|
||||
}
|
||||
|
||||
func (b *bird) ReconfigDone() {
|
||||
if b.isSubnetRouter == b.lastIsSubnetRouter {
|
||||
return
|
||||
}
|
||||
b.logf("wgengine: Reconfig: configuring BIRD")
|
||||
var err error
|
||||
if b.isSubnetRouter {
|
||||
err = b.client.EnableProtocol(protocolName)
|
||||
} else {
|
||||
err = b.client.DisableProtocol(protocolName)
|
||||
}
|
||||
if err != nil {
|
||||
// Log but don't fail here; a later Reconfig will retry.
|
||||
b.logf("wgengine: error configuring BIRD: %v", err)
|
||||
return
|
||||
}
|
||||
b.lastIsSubnetRouter = b.isSubnetRouter
|
||||
}
|
||||
|
||||
func (b *bird) Close() {
|
||||
b.client.DisableProtocol(protocolName)
|
||||
b.client.Close()
|
||||
}
|
||||
|
||||
// hasOverlap reports whether any prefix in rips is also present in aips.
|
||||
func hasOverlap(aips, rips views.Slice[netip.Prefix]) bool {
|
||||
for _, aip := range aips.All() {
|
||||
if views.SliceContains(rips, aip) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
@@ -0,0 +1,205 @@
|
||||
// Copyright (c) Tailscale Inc & contributors
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
package bird
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/netip"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/google/go-cmp/cmp/cmpopts"
|
||||
"tailscale.com/feature"
|
||||
"tailscale.com/tailcfg"
|
||||
"tailscale.com/wgengine"
|
||||
)
|
||||
|
||||
// fakeBIRD is a fake BIRD server listening on a unix socket. It speaks
|
||||
// enough of the BIRD CLI wire protocol to satisfy chirp and records the
|
||||
// commands it receives so tests can assert on them.
|
||||
type fakeBIRD struct {
|
||||
ln net.Listener
|
||||
sock string
|
||||
|
||||
mu sync.Mutex
|
||||
calls []string // commands received, e.g. "enable tailscale"
|
||||
enabled bool // whether the "tailscale" protocol is enabled
|
||||
failNext bool // whether to reply to the next command with a runtime error
|
||||
}
|
||||
|
||||
func newFakeBIRD(t *testing.T) *fakeBIRD {
|
||||
t.Helper()
|
||||
sock := filepath.Join(t.TempDir(), "bird.sock")
|
||||
ln, err := net.Listen("unix", sock)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
fb := &fakeBIRD{ln: ln, sock: sock}
|
||||
t.Cleanup(func() { ln.Close() })
|
||||
go fb.listen()
|
||||
return fb
|
||||
}
|
||||
|
||||
func (fb *fakeBIRD) listen() {
|
||||
for {
|
||||
c, err := fb.ln.Accept()
|
||||
if err != nil {
|
||||
if errors.Is(err, net.ErrClosed) {
|
||||
return
|
||||
}
|
||||
panic(err)
|
||||
}
|
||||
go fb.handle(c)
|
||||
}
|
||||
}
|
||||
|
||||
func (fb *fakeBIRD) handle(c net.Conn) {
|
||||
fmt.Fprintln(c, "0001 BIRD 2.0.8 ready.")
|
||||
sc := bufio.NewScanner(c)
|
||||
for sc.Scan() {
|
||||
cmd := sc.Text()
|
||||
var proto string
|
||||
var wantEnabled bool
|
||||
switch {
|
||||
case strings.HasPrefix(cmd, "enable "):
|
||||
proto, wantEnabled = strings.TrimPrefix(cmd, "enable "), true
|
||||
case strings.HasPrefix(cmd, "disable "):
|
||||
proto, wantEnabled = strings.TrimPrefix(cmd, "disable "), false
|
||||
}
|
||||
|
||||
fb.mu.Lock()
|
||||
fb.calls = append(fb.calls, cmd)
|
||||
fail := fb.failNext
|
||||
fb.failNext = false
|
||||
switch {
|
||||
case proto != protocolName:
|
||||
fmt.Fprintln(c, "9001 syntax error, unexpected CF_SYM_UNDEFINED, expecting CF_SYM_KNOWN or TEXT or ALL")
|
||||
case fail:
|
||||
fmt.Fprintln(c, "8001 fake runtime error")
|
||||
case wantEnabled == fb.enabled:
|
||||
fmt.Fprintf(c, "0010-%s: already %s\n0000 \n", proto, verb(wantEnabled))
|
||||
default:
|
||||
fb.enabled = wantEnabled
|
||||
fmt.Fprintf(c, "0011-%s: %s\n0000 \n", proto, verb(wantEnabled))
|
||||
}
|
||||
fb.mu.Unlock()
|
||||
}
|
||||
if err := sc.Err(); err != nil && !errors.Is(err, net.ErrClosed) {
|
||||
panic(err)
|
||||
}
|
||||
}
|
||||
|
||||
func verb(enabled bool) string {
|
||||
if enabled {
|
||||
return "enabled"
|
||||
}
|
||||
return "disabled"
|
||||
}
|
||||
|
||||
// takeCalls returns the commands received since the last call and
|
||||
// resets the record. It is safe to call once the chirp request that
|
||||
// caused them has returned, as chirp waits for each response.
|
||||
func (fb *fakeBIRD) takeCalls() []string {
|
||||
fb.mu.Lock()
|
||||
defer fb.mu.Unlock()
|
||||
calls := fb.calls
|
||||
fb.calls = nil
|
||||
return calls
|
||||
}
|
||||
|
||||
func (fb *fakeBIRD) checkCalls(t *testing.T, want ...string) {
|
||||
t.Helper()
|
||||
if diff := cmp.Diff(fb.takeCalls(), want, cmpopts.EquateEmpty()); diff != "" {
|
||||
t.Errorf("BIRD calls mismatch (-got +want):\n%s", diff)
|
||||
}
|
||||
}
|
||||
|
||||
func node(primaryRoutes, routableIPs []netip.Prefix) tailcfg.NodeView {
|
||||
return (&tailcfg.Node{
|
||||
PrimaryRoutes: primaryRoutes,
|
||||
Hostinfo: (&tailcfg.Hostinfo{RoutableIPs: routableIPs}).View(),
|
||||
}).View()
|
||||
}
|
||||
|
||||
func TestBird(t *testing.T) {
|
||||
if !feature.IsRegistered("bird") {
|
||||
t.Fatal("bird feature not registered")
|
||||
}
|
||||
|
||||
fb := newFakeBIRD(t)
|
||||
newBird, ok := wgengine.HookNewBird.GetOk()
|
||||
if !ok {
|
||||
t.Fatal("HookNewBird not set")
|
||||
}
|
||||
b, err := newBird(t.Logf, fb.sock)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
// Construction disables the protocol.
|
||||
fb.checkCalls(t, "disable tailscale")
|
||||
|
||||
pfx := netip.MustParsePrefix
|
||||
subnetRouter := node(
|
||||
[]netip.Prefix{pfx("192.168.1.0/24")},
|
||||
[]netip.Prefix{pfx("192.168.1.0/24"), pfx("10.0.0.0/8")},
|
||||
)
|
||||
notSubnetRouter := node(
|
||||
[]netip.Prefix{pfx("192.168.2.0/24")},
|
||||
[]netip.Prefix{pfx("192.168.1.0/24")},
|
||||
)
|
||||
|
||||
// An invalid self node is not a subnet router; no state change, no calls.
|
||||
if changed := b.Reconfig(tailcfg.NodeView{}); changed {
|
||||
t.Error("Reconfig(invalid) reported change")
|
||||
}
|
||||
b.ReconfigDone()
|
||||
fb.checkCalls(t)
|
||||
|
||||
// Becoming a primary subnet router enables the protocol.
|
||||
if changed := b.Reconfig(subnetRouter); !changed {
|
||||
t.Error("Reconfig(subnetRouter) reported no change")
|
||||
}
|
||||
b.ReconfigDone()
|
||||
fb.checkCalls(t, "enable tailscale")
|
||||
|
||||
// Reconfig with the same state is a no-op.
|
||||
if changed := b.Reconfig(subnetRouter); changed {
|
||||
t.Error("Reconfig(subnetRouter) again reported change")
|
||||
}
|
||||
b.ReconfigDone()
|
||||
fb.checkCalls(t)
|
||||
|
||||
// A BIRD failure leaves the state unapplied, so the next Reconfig
|
||||
// still reports a change and retries.
|
||||
fb.mu.Lock()
|
||||
fb.failNext = true
|
||||
fb.mu.Unlock()
|
||||
if changed := b.Reconfig(notSubnetRouter); !changed {
|
||||
t.Error("Reconfig(notSubnetRouter) reported no change")
|
||||
}
|
||||
b.ReconfigDone()
|
||||
fb.checkCalls(t, "disable tailscale")
|
||||
if changed := b.Reconfig(notSubnetRouter); !changed {
|
||||
t.Error("Reconfig(notSubnetRouter) retry reported no change")
|
||||
}
|
||||
b.ReconfigDone()
|
||||
fb.checkCalls(t, "disable tailscale")
|
||||
|
||||
// And becoming a subnet router again enables it again.
|
||||
if changed := b.Reconfig(subnetRouter); !changed {
|
||||
t.Error("Reconfig(subnetRouter) reported no change")
|
||||
}
|
||||
b.ReconfigDone()
|
||||
fb.checkCalls(t, "enable tailscale")
|
||||
|
||||
// Close disables the protocol on the way out.
|
||||
b.Close()
|
||||
fb.checkCalls(t, "disable tailscale")
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
// Copyright (c) Tailscale Inc & contributors
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
//go:build !ts_omit_bird && (linux || darwin || freebsd || openbsd)
|
||||
|
||||
package condregister
|
||||
|
||||
import _ "tailscale.com/feature/bird"
|
||||
Reference in New Issue
Block a user