Brad FitzpatrickandBrad Fitzpatrick
72ca0cae4b
The wireguard-go device now learns its peer set solely from the live per-peer config source that LocalBackend installs with Engine.SetPeerConfigFunc, backed by the route manager. Peers are created lazily on first packet and converged per peer with Engine.SyncDevicePeer, so the full-peer-list snapshot in wgcfg.Config and the diff-and-reconfigure machinery around it (wgcfg.Peer, ReconfigDevice, and the engine's full device sync in maybeReconfigWireguardLocked) are dead weight: they duplicated state that the route manager already owns and forced every netmap change to rebuild and rehash the entire peer list. Delete the Peers field and the Peer type from wgcfg, along with ReconfigDevice and maybeReconfigWireguardLocked. Engine.Reconfig no longer does any device peer work; it only manages the private key, addresses, and the non-peer subsystems. Full-netmap application converges the device by syncing exactly the peers whose routes the route manager reports as changed or removed. Updates #12542 Change-Id: Ic776e42cfaa5be6b9329b3d381d5cbde17d7078b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
41 lines
1.2 KiB
Go
41 lines
1.2 KiB
Go
// Copyright (c) Tailscale Inc & contributors
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
package wgcfg
|
|
|
|
import (
|
|
"fmt"
|
|
"net/netip"
|
|
|
|
"github.com/tailscale/wireguard-go/conn"
|
|
"github.com/tailscale/wireguard-go/device"
|
|
"github.com/tailscale/wireguard-go/tun"
|
|
"tailscale.com/types/logger"
|
|
)
|
|
|
|
// NewDevice returns a wireguard-go Device configured for Tailscale use.
|
|
func NewDevice(tunDev tun.Device, bind conn.Bind, logger *device.Logger) *device.Device {
|
|
return device.NewDevice(tunDev, bind, logger)
|
|
}
|
|
|
|
// NewPeerLookupFunc returns a [device.PeerLookupFunc] that lazily
|
|
// creates peers using allowedIPs as the source of each peer's allowed
|
|
// IPs. The peer's endpoint is derived from its public key via bind.
|
|
func NewPeerLookupFunc(bind conn.Bind, logf logger.Logf, allowedIPs func(device.NoisePublicKey) ([]netip.Prefix, bool)) device.PeerLookupFunc {
|
|
return func(pubk device.NoisePublicKey) (_ *device.NewPeerConfig, ok bool) {
|
|
ips, ok := allowedIPs(pubk)
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
ep, err := bind.ParseEndpoint(fmt.Sprintf("%x", pubk[:]))
|
|
if err != nil {
|
|
logf("wgcfg: failed to parse endpoint for peer %x: %v", pubk[:8], err)
|
|
return nil, false
|
|
}
|
|
return &device.NewPeerConfig{
|
|
AllowedIPs: ips,
|
|
Endpoint: ep,
|
|
}, true
|
|
}
|
|
}
|