sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-01 20:41:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Replace the eBPF WireGuard proxy with loopback endpoint addressing

Browse Source
This commit is contained in:
Viktor Liu
2026-08-25 12:27:47 +02:00
parent 7f03a2e86f
commit 2a3b0cec08
23 changed files with 958 additions and 536 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
client/internal/ebpf/ebpf/manager_linux.go
View File

@@ -19,7 +19,6 @@ const (
mapKeyFeatures uint32 = 0
featureFlagWGProxy = 0b00000001
featureFlagDnsForwarder = 0b00000010
)

10
client/internal/ebpf/ebpf/manager_linux_test.go
View File

@@ -4,9 +4,13 @@ import (
"testing"
)
// featureFlagTest stands in for a second feature flag, so the set and unset
// paths can be exercised with more than the one flag the manager defines.
const featureFlagTest = 0b00000001
func TestManager_setFeatureFlag(t *testing.T) {
mgr := GeneralManager{}
mgr.setFeatureFlag(featureFlagWGProxy)
mgr.setFeatureFlag(featureFlagTest)
if mgr.featureFlags != 1 {
t.Errorf("invalid feature state")
}
@@ -19,10 +23,10 @@ func TestManager_setFeatureFlag(t *testing.T) {
func TestManager_unsetFeatureFlag(t *testing.T) {
mgr := GeneralManager{}
mgr.setFeatureFlag(featureFlagWGProxy)
mgr.setFeatureFlag(featureFlagTest)
mgr.setFeatureFlag(featureFlagDnsForwarder)
err := mgr.unsetFeatureFlag(featureFlagWGProxy)
err := mgr.unsetFeatureFlag(featureFlagTest)
if err != nil {
t.Errorf("unexpected error: %s", err)
}

41
client/internal/ebpf/ebpf/wg_proxy_linux.go
View File

@@ -1,41 +0,0 @@
package ebpf
import log "github.com/sirupsen/logrus"
const (
mapKeyProxyPort uint32 = 0
mapKeyWgPort uint32 = 1
)
func (tf *GeneralManager) LoadWgProxy(proxyPort, wgPort int) error {
log.Debugf("load ebpf WG proxy")
tf.lock.Lock()
defer tf.lock.Unlock()
err := tf.loadXdp()
if err != nil {
return err
}
err = tf.bpfObjs.NbWgProxySettingsMap.Put(mapKeyProxyPort, uint16(proxyPort))
if err != nil {
return err
}
err = tf.bpfObjs.NbWgProxySettingsMap.Put(mapKeyWgPort, uint16(wgPort))
if err != nil {
return err
}
tf.setFeatureFlag(featureFlagWGProxy)
err = tf.bpfObjs.NbFeatures.Put(mapKeyFeatures, tf.featureFlags)
if err != nil {
return err
}
return nil
}
func (tf *GeneralManager) FreeWGProxy() error {
log.Debugf("free ebpf WG proxy")
return tf.unsetFeatureFlag(featureFlagWGProxy)
}

4
client/internal/ebpf/manager/manager.go
View File

@@ -2,10 +2,8 @@ package manager
import "net/netip"
// Manager is used to load multiple eBPF programs. E.g., current DNS programs and WireGuard proxy
// Manager is used to load eBPF programs. Currently only the DNS forwarder uses one.
type Manager interface {
LoadDNSFwd(ip netip.Addr, dnsPort int) error
FreeDNSFwd() error
LoadWgProxy(proxyPort, wgPort int) error
FreeWGProxy() error
}

4
client/internal/engine.go
View File

@@ -775,7 +775,7 @@ func (e *Engine) initFirewall() error {
}
// setupWGProxyNoTrack configures connection tracking exclusion for WireGuard proxy traffic.
// This prevents conntrack/MASQUERADE from affecting loopback traffic between WireGuard and the eBPF proxy.
// This prevents conntrack/MASQUERADE from affecting loopback traffic between WireGuard and the proxy.
func (e *Engine) setupWGProxyNoTrack() {
if e.firewall == nil {
return
@@ -786,7 +786,7 @@ func (e *Engine) setupWGProxyNoTrack() {
return
}
if err := e.firewall.SetupEBPFProxyNoTrack(proxyPort, uint16(e.config.WgPort)); err != nil {
if err := e.firewall.SetupWGProxyNoTrack(proxyPort, uint16(e.config.WgPort)); err != nil {
log.Warnf("failed to setup ebpf proxy notrack: %v", err)
}
}