mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-13 17:09:07 +02:00
Zoltan Papp
01185ba353
* [client] Configure the userspace device through its typed API The userspace configurer drove wireguard-go through UAPI text: every write was rendered to the configuration protocol and parsed back, and every read, including the per-second statistics poll, dumped the whole device as text and parsed it again. With 10000 peers a statistics read cost about 16 ms, and clearing one endpoint needed a peer remove and a re-add because the protocol cannot clear an endpoint or drop a single prefix in place. The allowed IP mirror in the configurer existed only to feed those rewrites. The wireguard-go fork now exposes a typed peer API, so the configurer calls the device directly: ConfigurePeer for creates and updates, single-prefix add and remove on the routing table, ClearEndpoint, and accessors for statistics. The mirror, the UAPI rendering and the parsers are gone from the userspace path; the UAPI socket for wg show stays. Clearing an endpoint keeps the peer object, its counters and its allowed IPs, but resets the session and switches the keepalive off until the next endpoint arrives. The watcher expects a fresh handshake after an endpoint reset, and an endpoint-less peer with a keepalive would retry handshakes it cannot send; this is what the remove and re-add provided before. Handshake times now carry nanosecond precision like the kernel path. Measured with 10000 peers against the UAPI implementation: clearing an endpoint drops from 713 ms to 3 ms for all peers, a statistics read from 15 ms to 0.9 ms, a full dump from 18 ms to 4 ms, and single allowed IP changes are 7 to 20 times faster. * [client] Keep the allowed IP mirror kernel-only The userspace configurer no longer uses the allowed IP mirror, so its ensure method and the preshared key config helper had no caller left on Windows and macOS, where the kernel configurer is not compiled, and the unused linter failed there. The mirror and its tests now carry the kernel build tag, the prefix normalizers that both paths share move to common.go, and the preshared key helper moves next to its only caller. * [client] Trim historical references from configurer comments * [client] Keep the endpoint zone in the userspace configurer The UAPI path wrote the endpoint as text, so a link-local IPv6 endpoint reached the device with its zone. The typed path built the address from the IP bytes only and dropped the zone, leaving the device with an unroutable fe80:: address. The activity recorder keeps the zone-less address it always had. * [client] Run the prefix conversion tests on every platform prefixesToIPNets lives in the untagged common.go and the userspace stats path uses it on every platform, but its tests stayed in the kernel-tagged allowedips_test.go, so darwin and windows CI stopped running them. Move them next to the normalizePrefix tests. The round-trip test stays tagged because ipNetsToPrefixes is kernel-only. * [client] Pin wireguard-go to the merged typed peer API The typed peer configuration API landed on master as #23, so the replace no longer needs to point at the PR branch commit.
82 lines
3.2 KiB
Go
82 lines
3.2 KiB
Go
package configurer
|
|
|
|
import (
|
|
"net"
|
|
"net/netip"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestNormalizePrefix(t *testing.T) {
|
|
v4 := netip.MustParsePrefix("10.20.0.0/16")
|
|
v6 := netip.MustParsePrefix("fd00::/64")
|
|
|
|
assert.Equal(t, v4, normalizePrefix(v4), "a plain v4 prefix is unchanged")
|
|
assert.Equal(t, v6, normalizePrefix(v6), "a real v6 prefix is unchanged")
|
|
assert.Equal(t, v4, normalizePrefix(netip.PrefixFrom(netip.AddrFrom16(v4.Addr().As16()), 112)),
|
|
"a mapped prefix under a 128 bit mask becomes plain v4")
|
|
// A prefix shorter than /96 inside the mapped range is a genuine v6 prefix. Unmapping it
|
|
// would pair a v4 address with a v6 sized mask, which is invalid, and the store would then
|
|
// record a zero prefix that can never recreate the allowed IP.
|
|
for _, tc := range []string{"::ffff:0:0/64", "::ffff:1.2.3.4/80", "::ffff:1.2.3.4/95"} {
|
|
got := normalizePrefix(netip.MustParsePrefix(tc))
|
|
assert.True(t, got.IsValid(), "%s must normalize to a valid prefix", tc)
|
|
assert.False(t, got.Addr().Is4(), "%s must stay v6", tc)
|
|
}
|
|
}
|
|
|
|
func TestNormalizePrefixClearsHostBits(t *testing.T) {
|
|
// A device stores a prefix masked, so a caller passing host bits must still match what a
|
|
// device fallback seeded, otherwise that prefix could never be removed by value.
|
|
assert.Equal(t, netip.MustParsePrefix("10.20.0.0/16"),
|
|
normalizePrefix(netip.MustParsePrefix("10.20.0.1/16")), "host bits must be cleared")
|
|
assert.Equal(t, netip.MustParsePrefix("fd00::/64"),
|
|
normalizePrefix(netip.MustParsePrefix("fd00::1/64")), "host bits must be cleared for v6")
|
|
}
|
|
|
|
func TestPrefixesToIPNetsNormalizes(t *testing.T) {
|
|
// net.IPNet prints a v4-mapped address as v4 but takes the length from its 16 byte
|
|
// mask, so an unnormalized ::ffff:10.1.2.3/64 reaches a userspace device as 10.1.2.3/0,
|
|
// an allowed IP that matches every v4 address.
|
|
tests := []struct {
|
|
name string
|
|
given string
|
|
want string
|
|
}{
|
|
{name: "mapped below /96", given: "::ffff:10.1.2.3/64", want: "::/64"},
|
|
{name: "mapped at /112", given: "::ffff:10.1.2.3/112", want: "10.1.0.0/16"},
|
|
{name: "host bits are cleared", given: "10.20.0.1/16", want: "10.20.0.0/16"},
|
|
{name: "v6 is untouched", given: "fd00::1/64", want: "fd00::/64"},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
got := prefixesToIPNets([]netip.Prefix{netip.MustParsePrefix(tc.given)})
|
|
require.Len(t, got, 1, "the prefix must be converted, not dropped")
|
|
assert.Equal(t, tc.want, got[0].String(), "what the device is given")
|
|
assert.NotEqual(t, 0, mustOnes(t, got[0]), "a device must never be given a zero length allowed IP")
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestPrefixesToIPNetsAgreesWithTheStore(t *testing.T) {
|
|
for _, given := range []string{"::ffff:10.1.2.3/64", "::ffff:10.1.2.3/112", "10.20.0.1/16", "fd00::1/64"} {
|
|
prefix := netip.MustParsePrefix(given)
|
|
|
|
toDevice := prefixesToIPNets([]netip.Prefix{prefix})
|
|
recorded := normalizePrefix(prefix)
|
|
|
|
assert.Equal(t, recorded.String(), toDevice[0].String(),
|
|
"%s must reach the device in the form the store records", given)
|
|
}
|
|
}
|
|
|
|
func mustOnes(t *testing.T, ipNet net.IPNet) int {
|
|
t.Helper()
|
|
|
|
ones, _ := ipNet.Mask.Size()
|
|
return ones
|
|
}
|