webnet/tailscale
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

wgengine/wgcfg,wgengine,ipn/ipnlocal: remove Peers from wgcfg.Config

Browse Source 
The wireguard-go device now learns its peer set solely from the live
per-peer config source that LocalBackend installs with
Engine.SetPeerConfigFunc, backed by the route manager. Peers are
created lazily on first packet and converged per peer with
Engine.SyncDevicePeer, so the full-peer-list snapshot in wgcfg.Config
and the diff-and-reconfigure machinery around it (wgcfg.Peer,
ReconfigDevice, and the engine's full device sync in
maybeReconfigWireguardLocked) are dead weight: they duplicated state
that the route manager already owns and forced every netmap change to
rebuild and rehash the entire peer list.

Delete the Peers field and the Peer type from wgcfg, along with
ReconfigDevice and maybeReconfigWireguardLocked. Engine.Reconfig no
longer does any device peer work; it only manages the private key,
addresses, and the non-peer subsystems. Full-netmap application converges the device by
syncing exactly the peers whose routes the route manager reports as
changed or removed.

Updates #12542

Change-Id: Ic776e42cfaa5be6b9329b3d381d5cbde17d7078b
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick
2026-07-14 19:57:59 -04:00
committed by Brad Fitzpatrick
parent 87c0d36942
commit 72ca0cae4b
17 changed files with 227 additions and 477 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wgengine/magicsock/magicsock_test.go
+75 -52
View File
@@ -246,50 +246,71 @@ func newMagicStackWithKey(t testing.TB, logf logger.Logf, ln nettype.PacketListe
}
}
// Reconfig applies cfg to the stack's device and tun layer. peers,
// if non-nil, are the tailcfg nodes that cfg was derived from; the
// tun layer's per-peer data-plane attributes (masquerade addresses,
// jailed classification) are derived from them with a real
// [routemanager.RouteManager], exactly as LocalBackend does in
// production, so this helper cannot drift from the production
// derivation. Tests whose hand-built configs carry no such
// attributes may pass nil.
// Reconfig applies cfg and peers to the stack's WireGuard device and
// tun-layer data plane. In production these flow from LocalBackend
// (via [tailscale.com/wgengine.Engine.Reconfig] and the live per-peer
// config source installed with Engine.SetPeerConfigFunc); tests that
// bypass LocalBackend replicate that wiring here, deriving everything
// from a real [routemanager.RouteManager] fed the given peers,
// exactly as LocalBackend does in production, so this helper cannot
// drift from the production derivation.
func (s *magicStack) Reconfig(cfg *wgcfg.Config, peers []tailcfg.NodeView) error {
s.tsTun.SetWGConfig(cfg)
if peers != nil {
rm := routemanager.New(nil)
mut := rm.Begin()
// Mirror the netmap.AllowSubnetRoutes flag the tests pass to
// nmcfg.WGCfg.
mut.SetPrefs(routemanager.Prefs{RouteAll: true})
for _, n := range peers {
mut.UpsertPeer(n)
rm := routemanager.New(nil)
mut := rm.Begin()
// Mirror the netmap.AllowSubnetRoutes flag the tests pass to
// nmcfg.WGCfg.
mut.SetPrefs(routemanager.Prefs{RouteAll: true})
// idByKey stands in for nodeBackend's public-key-to-node-ID
// index, which LocalBackend uses to serve the engine's per-peer
// config source.
idByKey := make(map[key.NodePublic]tailcfg.NodeID, len(peers))
for _, n := range peers {
idByKey[n.Key()] = n.ID()
mut.UpsertPeer(n)
}
mut.Commit()
peerAllowedIPs := func(k key.NodePublic) ([]netip.Prefix, bool) {
id, ok := idByKey[k]
if !ok {
return nil, false
}
mut.Commit()
native4, native6 := tsaddr.FirstTailscaleAddrs(slices.All(cfg.Addresses))
s.tsTun.SetPeerRoutes(native4, native6, rm.Outbound())
return rm.PeerAllowedIPs(id)
}
// In production, LocalBackend installs a PeerByIPPacketFunc via
// Engine.SetPeerByIPPacketFunc. Tests that bypass LocalBackend need
// to install one here for outbound packet routing.
ipToPeer := make(map[netip.Addr]device.NoisePublicKey, len(cfg.Peers))
for _, p := range cfg.Peers {
pk := p.PublicKey.Raw32()
for _, pfx := range p.AllowedIPs {
if pfx.IsSingleIP() {
ipToPeer[pfx.Addr()] = pk
// The tun-layer per-peer route attributes (masquerade, jailed).
native4, native6 := tsaddr.FirstTailscaleAddrs(slices.All(cfg.Addresses))
s.tsTun.SetPeerRoutes(native4, native6, rm.Outbound())
// Outbound packet routing, as LocalBackend's lookupPeerByIP does
// via the outbound table.
s.dev.SetPeerByIPPacketFunc(func(_, dst netip.Addr, _ []byte) (device.NoisePublicKey, bool) {
if pr, ok := rm.Outbound().Lookup(dst); ok {
return pr.Key.Raw32(), true
}
return device.NoisePublicKey{}, false
})
// The live per-peer config source backing lazy peer creation, as
// LocalBackend's peerAllowedIPs does via PeerAllowedIPs, and the
// per-peer device convergence that Engine.SyncDevicePeer does.
s.dev.SetPeerLookupFunc(wgcfg.NewPeerLookupFunc(s.conn.Bind(), s.conn.logf, func(pubk device.NoisePublicKey) ([]netip.Prefix, bool) {
return peerAllowedIPs(key.NodePublicFromRaw32(mem.B(pubk[:])))
}))
s.dev.SetPrivateKey(key.NodePrivateAs[device.NoisePrivateKey](cfg.PrivateKey))
s.dev.RemoveMatchingPeers(func(pk device.NoisePublicKey) bool {
_, ok := peerAllowedIPs(key.NodePublicFromRaw32(mem.B(pk[:])))
return !ok
})
for _, n := range peers {
if peer, ok := s.dev.LookupActivePeer(n.Key().Raw32()); ok {
if ips, ok := peerAllowedIPs(n.Key()); ok {
peer.SetAllowedIPs(ips)
}
}
}
s.dev.SetPeerByIPPacketFunc(func(_, dst netip.Addr, _ []byte) (device.NoisePublicKey, bool) {
pk, ok := ipToPeer[dst]
return pk, ok
})
s.dev.SetPrivateKey(key.NodePrivateAs[device.NoisePrivateKey](cfg.PrivateKey))
return wgcfg.ReconfigDevice(s.dev, cfg, s.conn.logf)
return nil
}
func (s *magicStack) String() string {
@@ -1203,30 +1224,32 @@ func testTwoDevicePing(t *testing.T, d *devices) {
m1cfg := &wgcfg.Config{
PrivateKey: m1.privateKey,
Addresses: []netip.Prefix{netip.MustParsePrefix("1.0.0.1/32")},
Peers: []wgcfg.Peer{
{
PublicKey: m2.privateKey.Public(),
DiscoKey: m2.conn.DiscoPublicKey(),
AllowedIPs: []netip.Prefix{netip.MustParsePrefix("1.0.0.2/32")},
},
},
}
m1peers := nodeViews([]*tailcfg.Node{{
ID: 2,
Key: m2.privateKey.Public(),
DiscoKey: m2.conn.DiscoPublicKey(),
HomeDERP: 1,
Addresses: []netip.Prefix{netip.MustParsePrefix("1.0.0.2/32")},
AllowedIPs: []netip.Prefix{netip.MustParsePrefix("1.0.0.2/32")},
}})
m2cfg := &wgcfg.Config{
PrivateKey: m2.privateKey,
Addresses: []netip.Prefix{netip.MustParsePrefix("1.0.0.2/32")},
Peers: []wgcfg.Peer{
{
PublicKey: m1.privateKey.Public(),
DiscoKey: m1.conn.DiscoPublicKey(),
AllowedIPs: []netip.Prefix{netip.MustParsePrefix("1.0.0.1/32")},
},
},
}
m2peers := nodeViews([]*tailcfg.Node{{
ID: 1,
Key: m1.privateKey.Public(),
DiscoKey: m1.conn.DiscoPublicKey(),
HomeDERP: 1,
Addresses: []netip.Prefix{netip.MustParsePrefix("1.0.0.1/32")},
AllowedIPs: []netip.Prefix{netip.MustParsePrefix("1.0.0.1/32")},
}})
if err := m1.Reconfig(m1cfg, nil); err != nil {
if err := m1.Reconfig(m1cfg, m1peers); err != nil {
t.Fatal(err)
}
if err := m2.Reconfig(m2cfg, nil); err != nil {
if err := m2.Reconfig(m2cfg, m2peers); err != nil {
t.Fatal(err)
}
@@ -1350,7 +1373,7 @@ func testTwoDevicePing(t *testing.T, d *devices) {
t.Run("no-op-dev1-reconfig", func(t *testing.T) {
setT(t)
defer setT(outerT)
if err := m1.Reconfig(m1cfg, nil); err != nil {
if err := m1.Reconfig(m1cfg, m1peers); err != nil {
t.Fatal(err)
}
ping1(t)