mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-09 23:19:11 +02:00
Riccardo Manfrin
3e85e40be2
* [client] Take a WireGuard detector through the interface filter The interface filter answers whether an interface is a WireGuard device by opening a wgctrl client and asking for it, and it does that for every interface it is given. Nothing about that call is tied to the caller, so it can be answered by a shared object instead of being repeated, but the filter has no way to receive one. InterfaceFilter and the constructors that build one now take a detector, and the ICE config carries it so that every agent can be handed the same one. Nobody supplies a detector yet: a nil one probes on every call, which is what the filter did before, so this changes no behaviour. * [client] Share one WireGuard detector across every ICE agent Creating an ICE agent builds two interface filters, one for the agent and one for the transport net it sits on, and each is asked about every host interface. For an interface the disallow list does not settle, answering means opening a wgctrl client, which builds a kernel and a userspace client and resolves the netlink family, and then a round trip that usually just reports the device does not exist. An agent is created per peer connection attempt, so on a large network that runs constantly: on a routing peer with ~16000 peers it measured 2.40s of a 66.59s CPU profile, 3.6%, split evenly between opening the client and the round trip. The engine now owns a detector and passes it to every agent through the ICE config, so the answer for an interface is reused instead of being asked again for each agent. It is kept for a second, short enough that a WireGuard interface appearing is picked up before ICE settles on candidates over it. The callers that build one filter and keep it, the relay and the UDP mux, keep passing nil and so keep probing, which costs them nothing at their rate. * [client] Recheck the WireGuard cache inside the singleflight group A caller that saw an expired entry could enter the singleflight group after another caller had already refreshed the entry and left it, and probe the interface a second time. Read the cache again inside the group before probing. This also makes the concurrent probe test independent of scheduling: a late caller finds the fresh entry instead of starting a new probe. * [client] Drop expired WireGuard detector entries The detector lives as long as the engine and kept an entry for every interface name it was ever asked about. On hosts that churn interfaces, such as container veths, the map only grew. Remove expired entries when a new answer is stored; the map holds a few dozen names at most, so the sweep is cheap and runs at most once per interface per TTL. * [client] Skip the disallow-list filter test on iOS InterfaceFilter does not apply the disallow list on iOS, so the subtest reaches the probe there and its no-probe assertion cannot hold.
619 lines
14 KiB
Go
619 lines
14 KiB
Go
//go:build privileged
|
|
|
|
package iface
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net"
|
|
"net/netip"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
log "github.com/sirupsen/logrus"
|
|
"github.com/stretchr/testify/assert"
|
|
"golang.zx2c4.com/wireguard/wgctrl"
|
|
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
|
|
|
"github.com/netbirdio/netbird/client/iface/device"
|
|
"github.com/netbirdio/netbird/client/iface/wgaddr"
|
|
"github.com/netbirdio/netbird/client/internal/stdnet"
|
|
)
|
|
|
|
// keep darwin compatibility
|
|
const (
|
|
WgIntNumber = 2000
|
|
)
|
|
|
|
var (
|
|
key string
|
|
peerPubKey string
|
|
)
|
|
|
|
func init() {
|
|
log.SetLevel(log.DebugLevel)
|
|
privateKey, _ := wgtypes.GeneratePrivateKey()
|
|
key = privateKey.String()
|
|
peerPrivateKey, _ := wgtypes.GeneratePrivateKey()
|
|
peerPubKey = peerPrivateKey.PublicKey().String()
|
|
}
|
|
|
|
// testIFaceBlackList mirrors the prefixes profilemanager.DefaultInterfaceBlacklist
|
|
// carries for the overlay interface. These tests create their own utun device, and
|
|
// stdnet's filter probes with wgctrl every interface it is not told to skip, which
|
|
// on a userspace WireGuard platform reaches the UAPI socket of this same process.
|
|
// Declared here rather than imported because profilemanager imports this package.
|
|
var testIFaceBlackList = []string{"wt", "utun", "tun0"}
|
|
|
|
func TestWGIface_UpdateAddr(t *testing.T) {
|
|
ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
|
|
addr := "100.64.0.1/8"
|
|
wgPort := 33100
|
|
newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
|
|
|
|
opts := WGIFaceOpts{
|
|
IFaceName: ifaceName,
|
|
Address: wgaddr.MustParseWGAddress(addr),
|
|
WGPort: wgPort,
|
|
WGPrivKey: key,
|
|
MTU: DefaultMTU,
|
|
TransportNet: newNet,
|
|
}
|
|
|
|
iface, err := NewWGIFace(opts)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = iface.Create()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer func() {
|
|
err = iface.Close()
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
|
|
}()
|
|
|
|
_, err = iface.Up()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
addrs, err := getIfaceAddrs(ifaceName)
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
assert.Equal(t, addr, addrs[0].String())
|
|
|
|
//update WireGuard address
|
|
addr = "100.64.0.2/8"
|
|
err = iface.UpdateAddr(wgaddr.MustParseWGAddress(addr))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
addrs, err = getIfaceAddrs(ifaceName)
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
|
|
var found bool
|
|
for _, a := range addrs {
|
|
prefix, err := netip.ParsePrefix(a.String())
|
|
assert.NoError(t, err)
|
|
if prefix.Addr().Is4() {
|
|
found = true
|
|
assert.Equal(t, addr, prefix.String())
|
|
}
|
|
}
|
|
|
|
if !found {
|
|
t.Fatal("v4 address not found")
|
|
}
|
|
}
|
|
|
|
func getIfaceAddrs(ifaceName string) ([]net.Addr, error) {
|
|
ief, err := net.InterfaceByName(ifaceName)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
addrs, err := ief.Addrs()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return addrs, nil
|
|
}
|
|
|
|
func Test_CreateInterface(t *testing.T) {
|
|
ifaceName := fmt.Sprintf("utun%d", WgIntNumber+1)
|
|
wgIP := "10.99.99.1/32"
|
|
newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
|
|
opts := WGIFaceOpts{
|
|
IFaceName: ifaceName,
|
|
Address: wgaddr.MustParseWGAddress(wgIP),
|
|
WGPort: 33100,
|
|
WGPrivKey: key,
|
|
MTU: DefaultMTU,
|
|
TransportNet: newNet,
|
|
}
|
|
|
|
iface, err := NewWGIFace(opts)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = iface.Create()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer func() {
|
|
err = iface.Close()
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
}()
|
|
wg, err := wgctrl.New()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer func() {
|
|
err = wg.Close()
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
}()
|
|
}
|
|
|
|
func Test_Close(t *testing.T) {
|
|
ifaceName := fmt.Sprintf("utun%d", WgIntNumber+2)
|
|
wgIP := "10.99.99.2/32"
|
|
wgPort := 33100
|
|
newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
|
|
|
|
opts := WGIFaceOpts{
|
|
IFaceName: ifaceName,
|
|
Address: wgaddr.MustParseWGAddress(wgIP),
|
|
WGPort: wgPort,
|
|
WGPrivKey: key,
|
|
MTU: DefaultMTU,
|
|
TransportNet: newNet,
|
|
}
|
|
|
|
iface, err := NewWGIFace(opts)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = iface.Create()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
wg, err := wgctrl.New()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer func() {
|
|
err = wg.Close()
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
}()
|
|
|
|
err = iface.Close()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func TestRecreation(t *testing.T) {
|
|
for i := 0; i < 100; i++ {
|
|
t.Run(fmt.Sprintf("down-%d", i), func(t *testing.T) {
|
|
ifaceName := fmt.Sprintf("utun%d", WgIntNumber+2)
|
|
wgIP := "10.99.99.2/32"
|
|
wgPort := 33100
|
|
newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
|
|
|
|
opts := WGIFaceOpts{
|
|
IFaceName: ifaceName,
|
|
Address: wgaddr.MustParseWGAddress(wgIP),
|
|
WGPort: wgPort,
|
|
WGPrivKey: key,
|
|
MTU: DefaultMTU,
|
|
TransportNet: newNet,
|
|
}
|
|
|
|
iface, err := NewWGIFace(opts)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
for {
|
|
_, err = net.InterfaceByName(ifaceName)
|
|
if err != nil {
|
|
t.Logf("interface %s not found: err: %s", ifaceName, err)
|
|
break
|
|
}
|
|
t.Logf("interface %s found", ifaceName)
|
|
}
|
|
|
|
err = iface.Create()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
wg, err := wgctrl.New()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer func() {
|
|
err = wg.Close()
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
}()
|
|
|
|
_, err = iface.Up()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
for {
|
|
_, err = net.InterfaceByName(ifaceName)
|
|
if err == nil {
|
|
t.Logf("interface %s found", ifaceName)
|
|
|
|
break
|
|
}
|
|
t.Logf("interface %s not found: err: %s", ifaceName, err)
|
|
|
|
}
|
|
|
|
start := time.Now()
|
|
err = iface.Close()
|
|
t.Logf("down time: %s", time.Since(start))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func Test_ConfigureInterface(t *testing.T) {
|
|
ifaceName := fmt.Sprintf("utun%d", WgIntNumber+3)
|
|
wgIP := "10.99.99.5/30"
|
|
wgPort := 33100
|
|
newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
|
|
opts := WGIFaceOpts{
|
|
IFaceName: ifaceName,
|
|
Address: wgaddr.MustParseWGAddress(wgIP),
|
|
WGPort: wgPort,
|
|
WGPrivKey: key,
|
|
MTU: DefaultMTU,
|
|
TransportNet: newNet,
|
|
}
|
|
iface, err := NewWGIFace(opts)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = iface.Create()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer func() {
|
|
err = iface.Close()
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
}()
|
|
|
|
_, err = iface.Up()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
wg, err := wgctrl.New()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer func() {
|
|
err = wg.Close()
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
}()
|
|
|
|
wgDevice, err := wg.Device(ifaceName)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if wgDevice.PrivateKey.String() != key {
|
|
t.Fatalf("Private keys don't match after configure: %s != %s", key, wgDevice.PrivateKey.String())
|
|
}
|
|
}
|
|
|
|
func Test_UpdatePeer(t *testing.T) {
|
|
ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
|
|
wgIP := "10.99.99.9/30"
|
|
newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
|
|
|
|
opts := WGIFaceOpts{
|
|
IFaceName: ifaceName,
|
|
Address: wgaddr.MustParseWGAddress(wgIP),
|
|
WGPort: 33100,
|
|
WGPrivKey: key,
|
|
MTU: DefaultMTU,
|
|
TransportNet: newNet,
|
|
}
|
|
|
|
iface, err := NewWGIFace(opts)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = iface.Create()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer func() {
|
|
err = iface.Close()
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
}()
|
|
|
|
_, err = iface.Up()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
keepAlive := 15 * time.Second
|
|
allowedIP := netip.MustParsePrefix("10.99.99.10/32")
|
|
endpoint, err := net.ResolveUDPAddr("udp", "127.0.0.1:9900")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = iface.UpdatePeer(peerPubKey, []netip.Prefix{allowedIP}, keepAlive, endpoint, nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
peer, err := getPeer(ifaceName, peerPubKey)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if peer.PersistentKeepaliveInterval != keepAlive {
|
|
t.Fatal("configured peer with mismatched keepalive interval value")
|
|
}
|
|
|
|
if peer.Endpoint.String() != endpoint.String() {
|
|
t.Fatal("configured peer with mismatched endpoint")
|
|
}
|
|
|
|
var foundAllowedIP bool
|
|
for _, aip := range peer.AllowedIPs {
|
|
if aip.String() == allowedIP.String() {
|
|
foundAllowedIP = true
|
|
break
|
|
}
|
|
}
|
|
if !foundAllowedIP {
|
|
t.Fatal("configured peer with mismatched Allowed IPs")
|
|
}
|
|
}
|
|
|
|
func Test_RemovePeer(t *testing.T) {
|
|
ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
|
|
wgIP := "10.99.99.13/30"
|
|
newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
|
|
|
|
opts := WGIFaceOpts{
|
|
IFaceName: ifaceName,
|
|
Address: wgaddr.MustParseWGAddress(wgIP),
|
|
WGPort: 33100,
|
|
WGPrivKey: key,
|
|
MTU: DefaultMTU,
|
|
TransportNet: newNet,
|
|
}
|
|
|
|
iface, err := NewWGIFace(opts)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = iface.Create()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer func() {
|
|
err = iface.Close()
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
}()
|
|
|
|
_, err = iface.Up()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
keepAlive := 15 * time.Second
|
|
allowedIP := netip.MustParsePrefix("10.99.99.14/32")
|
|
err = iface.UpdatePeer(peerPubKey, []netip.Prefix{allowedIP}, keepAlive, nil, nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = iface.RemovePeer(peerPubKey)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
_, err = getPeer(ifaceName, peerPubKey)
|
|
if err.Error() != "peer not found" {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func Test_ConnectPeers(t *testing.T) {
|
|
t.Setenv("NB_DISABLE_EBPF_WG_PROXY", "true")
|
|
|
|
peer1ifaceName := fmt.Sprintf("utun%d", WgIntNumber+400)
|
|
peer1wgIP := netip.MustParsePrefix("10.99.99.17/30")
|
|
peer1Key, _ := wgtypes.GeneratePrivateKey()
|
|
peer1wgPort := 33100
|
|
|
|
peer2ifaceName := "utun500"
|
|
peer2wgIP := netip.MustParsePrefix("10.99.99.18/30")
|
|
peer2Key, _ := wgtypes.GeneratePrivateKey()
|
|
peer2wgPort := 33200
|
|
|
|
keepAlive := 1 * time.Second
|
|
newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
|
|
|
|
guid := fmt.Sprintf("{%s}", uuid.New().String())
|
|
device.CustomWindowsGUIDString = strings.ToLower(guid)
|
|
|
|
optsPeer1 := WGIFaceOpts{
|
|
IFaceName: peer1ifaceName,
|
|
Address: wgaddr.MustParseWGAddress(peer1wgIP.String()),
|
|
WGPort: peer1wgPort,
|
|
WGPrivKey: peer1Key.String(),
|
|
MTU: DefaultMTU,
|
|
TransportNet: newNet,
|
|
}
|
|
iface1, err := NewWGIFace(optsPeer1)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = iface1.Create()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
_, err = iface1.Up()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
localIP1 := "127.0.0.1"
|
|
peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP1, peer1wgPort))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
guid = fmt.Sprintf("{%s}", uuid.New().String())
|
|
device.CustomWindowsGUIDString = strings.ToLower(guid)
|
|
|
|
newNet = stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
|
|
|
|
optsPeer2 := WGIFaceOpts{
|
|
IFaceName: peer2ifaceName,
|
|
Address: wgaddr.MustParseWGAddress(peer2wgIP.String()),
|
|
WGPort: peer2wgPort,
|
|
WGPrivKey: peer2Key.String(),
|
|
MTU: DefaultMTU,
|
|
TransportNet: newNet,
|
|
}
|
|
|
|
iface2, err := NewWGIFace(optsPeer2)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = iface2.Create()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
_, err = iface2.Up()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
localIP2 := "127.0.0.1"
|
|
peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP2, peer2wgPort))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer func() {
|
|
err = iface1.Close()
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
err = iface2.Close()
|
|
if err != nil {
|
|
t.Error(err)
|
|
}
|
|
}()
|
|
|
|
err = iface1.UpdatePeer(peer2Key.PublicKey().String(), []netip.Prefix{peer2wgIP}, keepAlive, peer2endpoint, nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = iface2.UpdatePeer(peer1Key.PublicKey().String(), []netip.Prefix{peer1wgIP}, keepAlive, peer1endpoint, nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// On Linux with the kernel module both peers are kernel devices, elsewhere
|
|
// they run on wireguard-go. A tight busy-loop here would starve the
|
|
// wireguard-go goroutines that process the handshake, so poll on a ticker
|
|
// instead and yield the CPU between checks. WireGuard also only retries a
|
|
// lost handshake initiation every REKEY_TIMEOUT (5s), which is why the
|
|
// overall wait can occasionally stretch to tens of seconds. Each side sends
|
|
// its first initiation when its peer is configured, and the first one leaves
|
|
// before the other device knows the peer, so that one is always wasted.
|
|
timeout := 30 * time.Second
|
|
timeoutChannel := time.After(timeout)
|
|
ticker := time.NewTicker(500 * time.Millisecond)
|
|
defer ticker.Stop()
|
|
|
|
for {
|
|
peer, gpErr := getPeer(peer1ifaceName, peer2Key.PublicKey().String())
|
|
if gpErr != nil {
|
|
t.Fatal(gpErr)
|
|
}
|
|
if !peer.LastHandshakeTime.IsZero() {
|
|
t.Log("peers successfully handshake")
|
|
break
|
|
}
|
|
|
|
select {
|
|
case <-timeoutChannel:
|
|
// The counters tell whether initiations were sent at all, whether they
|
|
// arrived, and whether only one direction is working.
|
|
t.Fatalf("waiting for peer handshake timeout after %s\n%s\n%s", timeout.String(),
|
|
describePeer(peer1ifaceName, peer2Key.PublicKey().String()),
|
|
describePeer(peer2ifaceName, peer1Key.PublicKey().String()))
|
|
case <-ticker.C:
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
func describePeer(ifaceName, peerPubKey string) string {
|
|
peer, err := getPeer(ifaceName, peerPubKey)
|
|
if err != nil {
|
|
return fmt.Sprintf("%s: peer %s: %v", ifaceName, peerPubKey, err)
|
|
}
|
|
return fmt.Sprintf("%s: peer %s endpoint=%v tx=%d rx=%d last_handshake=%v",
|
|
ifaceName, peerPubKey, peer.Endpoint, peer.TransmitBytes, peer.ReceiveBytes, peer.LastHandshakeTime)
|
|
}
|
|
|
|
func getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
|
|
wg, err := wgctrl.New()
|
|
if err != nil {
|
|
return wgtypes.Peer{}, err
|
|
}
|
|
defer func() {
|
|
err = wg.Close()
|
|
if err != nil {
|
|
log.Errorf("got error while closing wgctl: %v", err)
|
|
}
|
|
}()
|
|
|
|
wgDevice, err := wg.Device(ifaceName)
|
|
if err != nil {
|
|
return wgtypes.Peer{}, err
|
|
}
|
|
for _, peer := range wgDevice.Peers {
|
|
if peer.PublicKey.String() == peerPubKey {
|
|
return peer, nil
|
|
}
|
|
}
|
|
return wgtypes.Peer{}, fmt.Errorf("peer not found")
|
|
}
|