wgengine/wgcfg,wgengine,ipn/ipnlocal: remove Peers from wgcfg.Config

The wireguard-go device now learns its peer set solely from the live
per-peer config source that LocalBackend installs with
Engine.SetPeerConfigFunc, backed by the route manager. Peers are
created lazily on first packet and converged per peer with
Engine.SyncDevicePeer, so the full-peer-list snapshot in wgcfg.Config
and the diff-and-reconfigure machinery around it (wgcfg.Peer,
ReconfigDevice, and the engine's full device sync in
maybeReconfigWireguardLocked) are dead weight: they duplicated state
that the route manager already owns and forced every netmap change to
rebuild and rehash the entire peer list.

Delete the Peers field and the Peer type from wgcfg, along with
ReconfigDevice and maybeReconfigWireguardLocked. Engine.Reconfig no
longer does any device peer work; it only manages the private key,
addresses, and the non-peer subsystems. Full-netmap application converges the device by
syncing exactly the peers whose routes the route manager reports as
changed or removed.

Updates #12542

Change-Id: Ic776e42cfaa5be6b9329b3d381d5cbde17d7078b
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

wgengine/wgcfg/device.go

@@ -38,69 +38,3 @@ func NewPeerLookupFunc(bind conn.Bind, logf logger.Logf, allowedIPs func(device.
 		}, true
 	}
 }
-
-// ReconfigDevice replaces the existing device configuration with cfg.
-//
-// Instead of using the UAPI text protocol, it uses the wireguard-go direct API
-// to install a [device.PeerLookupFunc] callback that creates peers on demand.
-//
-// The caller is responsible for:
-//   - calling [device.Device.SetPrivateKey] when the key changes
-//   - installing a [device.PeerByIPPacketFunc] on the device for outbound
-//     packet routing (e.g. via [tailscale.com/wgengine.Engine.SetPeerByIPPacketFunc])
-func ReconfigDevice(d *device.Device, cfg *Config, logf logger.Logf) (err error) {
-	defer func() {
-		if err != nil {
-			logf("wgcfg.Reconfig failed: %v", err)
-		}
-	}()
-
-	// Build peer map: public key → allowed IPs.
-	peers := make(map[device.NoisePublicKey][]netip.Prefix, len(cfg.Peers))
-	for _, p := range cfg.Peers {
-		peers[p.PublicKey.Raw32()] = p.AllowedIPs
-	}
-
-	// Remove peers not in the new config.
-	d.RemoveMatchingPeers(func(pk device.NoisePublicKey) bool {
-		_, exists := peers[pk]
-		return !exists
-	})
-
-	// Update AllowedIPs on any already-active peers whose config may have
-	// changed. Peers that don't exist yet will get the correct AllowedIPs
-	// from PeerLookupFunc when they are lazily created.
-	for pk, allowedIPs := range peers {
-		if peer, ok := d.LookupActivePeer(pk); ok {
-			peer.SetAllowedIPs(allowedIPs)
-		}
-	}
-
-	// Install callback for lazy peer creation (incoming packets).
-	bind := d.Bind()
-	d.SetPeerLookupFunc(func(pubk device.NoisePublicKey) (_ *device.NewPeerConfig, ok bool) {
-		allowedIPs, ok := peers[pubk]
-		if !ok {
-			return nil, false
-		}
-		ep, err := bind.ParseEndpoint(fmt.Sprintf("%x", pubk[:]))
-		if err != nil {
-			logf("wgcfg: failed to parse endpoint for peer %x: %v", pubk[:8], err)
-			return nil, false
-		}
-		return &device.NewPeerConfig{
-			AllowedIPs: allowedIPs,
-			Endpoint:   ep,
-		}, true
-	})
-
-	// RemoveMatchingPeers _again_, now that SetPeerLookupFunc is installed,
-	// lest any removed peers got re-created before the new SetPeerLookupFunc
-	// func was installed.
-	d.RemoveMatchingPeers(func(pk device.NoisePublicKey) bool {
-		_, exists := peers[pk]
-		return !exists
-	})
-
-	return nil
-}