webnet/tailscale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

all: add extra information to serialized endpoints

Browse Source 
magicsock.Conn.ParseEndpoint requires a peer's public key,
disco key, and legacy ip/ports in order to do its job.
We currently accomplish that by:

* adding the public key in our wireguard-go fork
* encoding the disco key as magic hostname
* using a bespoke comma-separated encoding

It's a bit messy.

Instead, switch to something simpler: use a json-encoded struct
containing exactly the information we need, in the form we use it.

Our wireguard-go fork still adds the public key to the
address when it passes it to ParseEndpoint, but now the code
compensating for that is just a couple of simple, well-commented lines.
Once this commit is in, we can remove that part of the fork
and remove the compensating code.

Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
This commit is contained in:
Josh Bleecher Snyder
2021-04-30 16:45:36 -07:00
parent 98cae48e70
commit aacb2107ae
14 changed files with 242 additions and 184 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wgengine/wgcfg/clone.go
+44 -4
View File
@@ -2,12 +2,13 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
// Code generated by tailscale.com/cmd/cloner -type Config,Peer; DO NOT EDIT.
// Code generated by tailscale.com/cmd/cloner -type Config,Peer,Endpoints,IPPortSet; DO NOT EDIT.
package wgcfg
import (
"inet.af/netaddr"
"tailscale.com/tailcfg"
"tailscale.com/types/wgkey"
)
@@ -29,7 +30,7 @@ func (src *Config) Clone() *Config {
}
// A compilation failure here means this code must be regenerated, with command:
// tailscale.com/cmd/cloner -type Config,Peer
// tailscale.com/cmd/cloner -type Config,Peer,Endpoints,IPPortSet
var _ConfigNeedsRegeneration = Config(struct {
Name string
PrivateKey wgkey.Private
@@ -48,14 +49,53 @@ func (src *Peer) Clone() *Peer {
dst := new(Peer)
*dst = *src
dst.AllowedIPs = append(src.AllowedIPs[:0:0], src.AllowedIPs...)
dst.Endpoints = *src.Endpoints.Clone()
return dst
}
// A compilation failure here means this code must be regenerated, with command:
// tailscale.com/cmd/cloner -type Config,Peer
// tailscale.com/cmd/cloner -type Config,Peer,Endpoints,IPPortSet
var _PeerNeedsRegeneration = Peer(struct {
PublicKey wgkey.Key
AllowedIPs []netaddr.IPPrefix
Endpoints string
Endpoints Endpoints
PersistentKeepalive uint16
}{})
// Clone makes a deep copy of Endpoints.
// The result aliases no memory with the original.
func (src *Endpoints) Clone() *Endpoints {
if src == nil {
return nil
}
dst := new(Endpoints)
*dst = *src
dst.IPPorts = *src.IPPorts.Clone()
return dst
}
// A compilation failure here means this code must be regenerated, with command:
// tailscale.com/cmd/cloner -type Config,Peer,Endpoints,IPPortSet
var _EndpointsNeedsRegeneration = Endpoints(struct {
PublicKey wgkey.Key
DiscoKey tailcfg.DiscoKey
IPPorts IPPortSet
}{})
// Clone makes a deep copy of IPPortSet.
// The result aliases no memory with the original.
func (src *IPPortSet) Clone() *IPPortSet {
if src == nil {
return nil
}
dst := new(IPPortSet)
*dst = *src
dst.ipp = append(src.ipp[:0:0], src.ipp...)
return dst
}
// A compilation failure here means this code must be regenerated, with command:
// tailscale.com/cmd/cloner -type Config,Peer,Endpoints,IPPortSet
var _IPPortSetNeedsRegeneration = IPPortSet(struct {
ipp []netaddr.IPPort
}{})
wgengine/wgcfg/config.go
+88 -7
View File
@@ -6,16 +6,15 @@
package wgcfg
import (
"encoding/json"
"strings"
"inet.af/netaddr"
"tailscale.com/tailcfg"
"tailscale.com/types/wgkey"
)
//go:generate go run tailscale.com/cmd/cloner -type=Config,Peer -output=clone.go
// EndpointDiscoSuffix is appended to the hex representation of a peer's discovery key
// and is then the sole wireguard endpoint for peers with a non-zero discovery key.
// This form is then recognize by magicsock's ParseEndpoint.
const EndpointDiscoSuffix = ".disco.tailscale:12345"
//go:generate go run tailscale.com/cmd/cloner -type=Config,Peer,Endpoints,IPPortSet -output=clone.go
// Config is a WireGuard configuration.
// It only supports the set of things Tailscale uses.
@@ -31,10 +30,92 @@ type Config struct {
type Peer struct {
PublicKey wgkey.Key
AllowedIPs []netaddr.IPPrefix
Endpoints string // comma-separated host/port pairs: "1.2.3.4:56,[::]:80"
Endpoints Endpoints
PersistentKeepalive uint16
}
// Endpoints represents the routes to reach a remote node.
// It is serialized and provided to wireguard-go as a conn.Endpoint.
type Endpoints struct {
// PublicKey is the public key for the remote node.
PublicKey wgkey.Key `json:"pk"`
// DiscoKey is the disco key associated with the remote node.
DiscoKey tailcfg.DiscoKey `json:"dk,omitempty"`
// IPPorts is a set of possible ip+ports the remote node can be reached at.
// This is used only for legacy connections to pre-disco (pre-0.100) peers.
IPPorts IPPortSet `json:"ipp,omitempty"`
}
func (e Endpoints) Equal(f Endpoints) bool {
if e.PublicKey != f.PublicKey {
return false
}
if e.DiscoKey != f.DiscoKey {
return false
}
return e.IPPorts.EqualUnordered(f.IPPorts)
}
// IPPortSet is an immutable slice of netaddr.IPPorts.
type IPPortSet struct {
ipp []netaddr.IPPort
}
// NewIPPortSet returns an IPPortSet containing the ports in ipp.
func NewIPPortSet(ipps ...netaddr.IPPort) IPPortSet {
return IPPortSet{ipp: append(ipps[:0:0], ipps...)}
}
// String returns a comma-separated list of all IPPorts in s.
func (s IPPortSet) String() string {
buf := new(strings.Builder)
for i, ipp := range s.ipp {
if i > 0 {
buf.WriteByte(',')
}
buf.WriteString(ipp.String())
}
return buf.String()
}
// IPPorts returns a slice of netaddr.IPPorts containing the IPPorts in s.
func (s IPPortSet) IPPorts() []netaddr.IPPort {
return append(s.ipp[:0:0], s.ipp...)
}
// EqualUnordered reports whether s and t contain the same IPPorts, regardless of order.
func (s IPPortSet) EqualUnordered(t IPPortSet) bool {
if len(s.ipp) != len(t.ipp) {
return false
}
// Check whether the endpoints are the same, regardless of order.
ipps := make(map[netaddr.IPPort]int, len(s.ipp))
for _, ipp := range s.ipp {
ipps[ipp]++
}
for _, ipp := range t.ipp {
ipps[ipp]--
}
for _, n := range ipps {
if n != 0 {
return false
}
}
return true
}
// MarshalJSON marshals s into JSON.
// It is necessary so that IPPortSet's fields can be unexported, to guarantee immutability.
func (s IPPortSet) MarshalJSON() ([]byte, error) {
return json.Marshal(s.ipp)
}
// UnmarshalJSON unmarshals s from JSON.
// It is necessary so that IPPortSet's fields can be unexported, to guarantee immutability.
func (s *IPPortSet) UnmarshalJSON(b []byte) error {
return json.Unmarshal(b, &s.ipp)
}
// PeerWithKey returns the Peer with key k and reports whether it was found.
func (config Config) PeerWithKey(k wgkey.Key) (Peer, bool) {
for _, p := range config.Peers {
wgengine/wgcfg/device_test.go
+5 -4
View File
@@ -10,6 +10,7 @@ import (
"io"
"net"
"os"
"reflect"
"sort"
"strings"
"sync"
@@ -90,7 +91,7 @@ func TestDeviceConfig(t *testing.T) {
t.Errorf("on error, could not IpcGetOperation: %v", err)
}
w.Flush()
t.Errorf("cfg:\n%s\n---- want:\n%s\n---- uapi:\n%s", gotStr, wantStr, buf.String())
t.Errorf("config mismatch:\n---- got:\n%s\n---- want:\n%s\n---- uapi:\n%s", gotStr, wantStr, buf.String())
}
}
@@ -127,7 +128,7 @@ func TestDeviceConfig(t *testing.T) {
})
t.Run("device1 modify peer", func(t *testing.T) {
cfg1.Peers[0].Endpoints = "1.2.3.4:12345"
cfg1.Peers[0].Endpoints.IPPorts = NewIPPortSet(netaddr.MustParseIPPort("1.2.3.4:12345"))
if err := ReconfigDevice(device1, cfg1, t.Logf); err != nil {
t.Fatal(err)
}
@@ -135,7 +136,7 @@ func TestDeviceConfig(t *testing.T) {
})
t.Run("device1 replace endpoint", func(t *testing.T) {
cfg1.Peers[0].Endpoints = "1.1.1.1:123"
cfg1.Peers[0].Endpoints.IPPorts = NewIPPortSet(netaddr.MustParseIPPort("1.1.1.1:123"))
if err := ReconfigDevice(device1, cfg1, t.Logf); err != nil {
t.Fatal(err)
}
@@ -176,7 +177,7 @@ func TestDeviceConfig(t *testing.T) {
}
peersEqual := func(p, q Peer) bool {
return p.PublicKey == q.PublicKey && p.PersistentKeepalive == q.PersistentKeepalive &&
p.Endpoints == q.Endpoints && cidrsEqual(p.AllowedIPs, q.AllowedIPs)
reflect.DeepEqual(p.Endpoints, q.Endpoints) && cidrsEqual(p.AllowedIPs, q.AllowedIPs)
}
if !peersEqual(peer0(origCfg), peer0(newCfg)) {
t.Error("reconfig modified old peer")
wgengine/wgcfg/nmcfg/nmcfg.go
+10 -17
View File
@@ -8,8 +8,6 @@ package nmcfg
import (
"bytes"
"fmt"
"net"
"strconv"
"strings"
"inet.af/netaddr"
@@ -79,17 +77,19 @@ func WGCfg(nm *netmap.NetworkMap, logf logger.Logf, flags netmap.WGConfigFlags,
cpeer.PersistentKeepalive = 25 // seconds
}
if !peer.DiscoKey.IsZero() {
cpeer.Endpoints = fmt.Sprintf("%x.disco.tailscale:12345", peer.DiscoKey[:])
} else {
if err := appendEndpoint(cpeer, peer.DERP); err != nil {
cpeer.Endpoints = wgcfg.Endpoints{PublicKey: wgkey.Key(peer.Key), DiscoKey: peer.DiscoKey}
if peer.DiscoKey.IsZero() {
// Legacy connection. Add IP+port endpoints.
var ipps []netaddr.IPPort
if err := appendEndpoint(cpeer, &ipps, peer.DERP); err != nil {
return nil, err
}
for _, ep := range peer.Endpoints {
if err := appendEndpoint(cpeer, ep); err != nil {
if err := appendEndpoint(cpeer, &ipps, ep); err != nil {
return nil, err
}
}
cpeer.Endpoints.IPPorts = wgcfg.NewIPPortSet(ipps...)
}
didExitNodeWarn := false
for _, allowedIP := range peer.AllowedIPs {
@@ -136,21 +136,14 @@ func WGCfg(nm *netmap.NetworkMap, logf logger.Logf, flags netmap.WGConfigFlags,
return cfg, nil
}
func appendEndpoint(peer *wgcfg.Peer, epStr string) error {
func appendEndpoint(peer *wgcfg.Peer, ipps *[]netaddr.IPPort, epStr string) error {
if epStr == "" {
return nil
}
_, port, err := net.SplitHostPort(epStr)
ipp, err := netaddr.ParseIPPort(epStr)
if err != nil {
return fmt.Errorf("malformed endpoint %q for peer %v", epStr, peer.PublicKey.ShortString())
}
_, err = strconv.ParseUint(port, 10, 16)
if err != nil {
return fmt.Errorf("invalid port in endpoint %q for peer %v", epStr, peer.PublicKey.ShortString())
}
if peer.Endpoints != "" {
peer.Endpoints += ","
}
peer.Endpoints += epStr
*ipps = append(*ipps, ipp)
return nil
}
wgengine/wgcfg/parser.go
+5 -19
View File
@@ -7,6 +7,7 @@ package wgcfg
import (
"bufio"
"encoding/hex"
"encoding/json"
"fmt"
"io"
"net"
@@ -26,21 +27,6 @@ func (e *ParseError) Error() string {
return fmt.Sprintf("%s: %q", e.why, e.offender)
}
func validateEndpoints(s string) error {
if s == "" {
// Otherwise strings.Split of the empty string produces [""].
return nil
}
vals := strings.Split(s, ",")
for _, val := range vals {
_, _, err := parseEndpoint(val)
if err != nil {
return err
}
}
return nil
}
func parseEndpoint(s string) (host string, port uint16, err error) {
i := strings.LastIndexByte(s, ':')
if i < 0 {
@@ -103,6 +89,7 @@ func FromUAPI(r io.Reader) (*Config, error) {
}
key := parts[0]
value := parts[1]
valueBytes := scanner.Bytes()[len(key)+1:]
if key == "public_key" {
if deviceConfig {
@@ -121,7 +108,7 @@ func FromUAPI(r io.Reader) (*Config, error) {
if deviceConfig {
err = cfg.handleDeviceLine(key, value)
} else {
err = cfg.handlePeerLine(peer, key, value)
err = cfg.handlePeerLine(peer, key, value, valueBytes)
}
if err != nil {
return nil, err
@@ -165,14 +152,13 @@ func (cfg *Config) handlePublicKeyLine(value string) (*Peer, error) {
return peer, nil
}
func (cfg *Config) handlePeerLine(peer *Peer, key, value string) error {
func (cfg *Config) handlePeerLine(peer *Peer, key, value string, valueBytes []byte) error {
switch key {
case "endpoint":
err := validateEndpoints(value)
err := json.Unmarshal(valueBytes, &peer.Endpoints)
if err != nil {
return err
}
peer.Endpoints = value
case "persistent_keepalive_interval":
n, err := strconv.ParseUint(value, 10, 16)
if err != nil {
wgengine/wgcfg/parser_test.go
-18
View File
@@ -53,21 +53,3 @@ func TestParseEndpoint(t *testing.T) {
t.Error("Error was expected")
}
}
func TestValidateEndpoints(t *testing.T) {
tests := []struct {
in string
want error
}{
{"", nil},
{"1.2.3.4:5", nil},
{"1.2.3.4:5,6.7.8.9:10", nil},
{",", &ParseError{why: "Missing port from endpoint", offender: ""}},
}
for _, tt := range tests {
got := validateEndpoints(tt.in)
if !reflect.DeepEqual(got, tt.want) {
t.Errorf("%q = %#v (%s); want %#v (%s)", tt.in, got, got, tt.want, tt.want)
}
}
}
wgengine/wgcfg/writer.go
+7 -22
View File
@@ -5,11 +5,10 @@
package wgcfg
import (
"encoding/json"
"fmt"
"io"
"sort"
"strconv"
"strings"
"inet.af/netaddr"
"tailscale.com/types/wgkey"
@@ -53,8 +52,12 @@ func (cfg *Config) ToUAPI(w io.Writer, prev *Config) error {
setPeer(p)
set("protocol_version", "1")
if !endpointsEqual(oldPeer.Endpoints, p.Endpoints) {
set("endpoint", p.Endpoints)
if !oldPeer.Endpoints.Equal(p.Endpoints) {
buf, err := json.Marshal(p.Endpoints)
if err != nil {
return err
}
set("endpoint", string(buf))
}
// TODO: replace_allowed_ips is expensive.
@@ -90,24 +93,6 @@ func (cfg *Config) ToUAPI(w io.Writer, prev *Config) error {
return stickyErr
}
func endpointsEqual(x, y string) bool {
// Cheap comparisons.
if x == y {
return true
}
xs := strings.Split(x, ",")
ys := strings.Split(y, ",")
if len(xs) != len(ys) {
return false
}
// Otherwise, see if they're the same, but out of order.
sort.Strings(xs)
sort.Strings(ys)
x = strings.Join(xs, ",")
y = strings.Join(ys, ",")
return x == y
}
func cidrsEqual(x, y []netaddr.IPPrefix) bool {
// TODO: re-implement using netaddr.IPSet.Equal.
if len(x) != len(y) {