mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-13 17:09:07 +02:00
Zoltan Papp
01185ba353
* [client] Configure the userspace device through its typed API The userspace configurer drove wireguard-go through UAPI text: every write was rendered to the configuration protocol and parsed back, and every read, including the per-second statistics poll, dumped the whole device as text and parsed it again. With 10000 peers a statistics read cost about 16 ms, and clearing one endpoint needed a peer remove and a re-add because the protocol cannot clear an endpoint or drop a single prefix in place. The allowed IP mirror in the configurer existed only to feed those rewrites. The wireguard-go fork now exposes a typed peer API, so the configurer calls the device directly: ConfigurePeer for creates and updates, single-prefix add and remove on the routing table, ClearEndpoint, and accessors for statistics. The mirror, the UAPI rendering and the parsers are gone from the userspace path; the UAPI socket for wg show stays. Clearing an endpoint keeps the peer object, its counters and its allowed IPs, but resets the session and switches the keepalive off until the next endpoint arrives. The watcher expects a fresh handshake after an endpoint reset, and an endpoint-less peer with a keepalive would retry handshakes it cannot send; this is what the remove and re-add provided before. Handshake times now carry nanosecond precision like the kernel path. Measured with 10000 peers against the UAPI implementation: clearing an endpoint drops from 713 ms to 3 ms for all peers, a statistics read from 15 ms to 0.9 ms, a full dump from 18 ms to 4 ms, and single allowed IP changes are 7 to 20 times faster. * [client] Keep the allowed IP mirror kernel-only The userspace configurer no longer uses the allowed IP mirror, so its ensure method and the preshared key config helper had no caller left on Windows and macOS, where the kernel configurer is not compiled, and the unused linter failed there. The mirror and its tests now carry the kernel build tag, the prefix normalizers that both paths share move to common.go, and the preshared key helper moves next to its only caller. * [client] Trim historical references from configurer comments * [client] Keep the endpoint zone in the userspace configurer The UAPI path wrote the endpoint as text, so a link-local IPv6 endpoint reached the device with its zone. The typed path built the address from the IP bytes only and dropped the zone, leaving the device with an unroutable fe80:: address. The activity recorder keeps the zone-less address it always had. * [client] Run the prefix conversion tests on every platform prefixesToIPNets lives in the untagged common.go and the userspace stats path uses it on every platform, but its tests stayed in the kernel-tagged allowedips_test.go, so darwin and windows CI stopped running them. Move them next to the normalizePrefix tests. The round-trip test stays tagged because ipNetsToPrefixes is kernel-only. * [client] Pin wireguard-go to the merged typed peer API The typed peer configuration API landed on master as #23, so the replace no longer needs to point at the PR branch commit.
51 lines
1.9 KiB
Go
51 lines
1.9 KiB
Go
package configurer
|
|
|
|
import (
|
|
"net"
|
|
"net/netip"
|
|
)
|
|
|
|
// prefixesToIPNets converts prefixes on their way to a device. It is the only place that
|
|
// conversion happens, so it also normalizes: the device is then given the same form the
|
|
// store records, and a v4-mapped prefix cannot reach net.IPNet, which prints such an
|
|
// address as v4 while taking the length from its 16 byte mask and so turns
|
|
// ::ffff:10.1.2.3/64 into 10.1.2.3/0 — an allowed IP matching every v4 address.
|
|
func prefixesToIPNets(prefixes []netip.Prefix) []net.IPNet {
|
|
ipNets := make([]net.IPNet, len(prefixes))
|
|
for i, prefix := range prefixes {
|
|
normalized := normalizePrefix(prefix)
|
|
ipNets[i] = net.IPNet{
|
|
IP: normalized.Addr().AsSlice(),
|
|
Mask: net.CIDRMask(normalized.Bits(), normalized.Addr().BitLen()),
|
|
}
|
|
}
|
|
return ipNets
|
|
}
|
|
|
|
// normalizePrefix puts a prefix into the form the store recognises it by. It clears the
|
|
// host bits, which a device does on its own, so a caller passing 10.20.0.1/16 still matches
|
|
// the 10.20.0.0/16 read back from the device; and it unmaps a v4-mapped prefix so that it
|
|
// compares equal to, and marshals like, the plain v4 prefix for the same network.
|
|
//
|
|
// Masking comes first because it also decides the address family: only a prefix at least 96
|
|
// bits long keeps the mapped marker through the mask, so a shorter prefix inside the mapped
|
|
// range is a genuine v6 prefix and unmapping it would yield an invalid v4 prefix.
|
|
func normalizePrefix(prefix netip.Prefix) netip.Prefix {
|
|
masked := prefix.Masked()
|
|
|
|
addr := masked.Addr()
|
|
if !addr.Is4In6() {
|
|
return masked
|
|
}
|
|
return netip.PrefixFrom(addr.Unmap(), masked.Bits()-96)
|
|
}
|
|
|
|
// normalizePrefixes returns a normalized copy without changing the caller's slice.
|
|
func normalizePrefixes(prefixes []netip.Prefix) []netip.Prefix {
|
|
normalized := make([]netip.Prefix, len(prefixes))
|
|
for i, prefix := range prefixes {
|
|
normalized[i] = normalizePrefix(prefix)
|
|
}
|
|
return normalized
|
|
}
|