ab/tsunagi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Separate control and data logically, move WireGuard into userspace, add a CLI

Browse Source 
Corrects the architecture on two points raised in review, while the project
is still small enough to change cheaply.

1. Control and data are separated *logically*, not physically.

The old reading — "nothing but control may ride on iroh" — threw away iroh's
whole value and would have forced the data plane to reimplement STUN, ICE and
a relay. Now both planes ride on iroh with different ALPNs and different
connections, so the data plane inherits hole punching and relay fallback,
while proto/ still knows nothing about packets and dataplane/ knows nothing
about the control protocol.

New boundary: PacketTransport / PacketLink, an authenticated unreliable
datagram channel per (network, peer, protocol). tsunagi/data/1 runs the same
membership handshake, then DataOpen/DataOpenAck, then QUIC datagrams. Only
the smaller endpoint id dials, so exactly one link exists per pair.

A plugin is handed links and never learns reachability, so the WireGuard
announcement shrank to a public key: there is no address left to lie about.

2. WireGuard now runs in userspace, on boringtun's protocol state machine.

No kernel module, no wg tool, no ip shell-out, no loopback proxy: the wgtool,
backend and bridge modules are gone. Only creating a TUN device needs
privileges, and that sits behind TunFactory, so the entire data plane —
handshake, encryption, routing, address ownership — is tested with none.

Address ownership is enforced rather than believed: outbound packets go to
the owner of the destination address, inbound packets are dropped unless
their source is the address derived for the peer that sent them.

3. A `tsunagi` binary: secret, doctor, id, up. It owns the runtime, the
logging subscriber and Ctrl-C, which the library still refuses to.

Also fixes a reference cycle where IrohTransport held Arc<Inner>, which kept
the databases open and the directory lock held after shutdown; two storage
tests caught it once the cycle existed.

81 tests pass offline with no privileges, including real IPv6 packets
crossing a real WireGuard tunnel over real iroh connections. Verified by
hand: two CLI processes forming a mesh both on loopback and via n0 discovery
using only an endpoint id.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
tsunagi
2026-09-21 11:55:20 +01:00
co-authored by Claude Opus 5
parent ea7aaa2b69
commit 21be7e9b44
35 changed files with 3987 additions and 2664 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/wireguard.rs
+365 -461
View File
File diff suppressed because it is too large Load Diff
tests/wireguard_system.rs
-120
View File
@@ -1,120 +0,0 @@
//! Opt-in tests for the real `wg` / `ip` backend.
//!
//! These are the only tests in this repository that change the host's network,
//! so they are **ignored by default** and are not part of the standard suite.
//!
//! They need Linux, the `wireguard` kernel module, `wg` from wireguard-tools,
//! `ip` from iproute2, and `CAP_NET_ADMIN` (in practice: root):
//!
//! ```text
//! sudo -E cargo test --test wireguard_system -- --ignored --test-threads=1
//! ```
//!
//! Everything they exercise — the command plan, the parsers, the configuration
//! builder and reconciliation — is already covered without root by the unit
//! tests in `src/dataplane/wireguard/` and by `tests/wireguard.rs`. What these
//! add is confirmation that the plan the planner produces is one the real
//! tools accept.
#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
use std::net::SocketAddr;
use tsunagi::dataplane::wireguard::wgtool::WgToolBackend;
use tsunagi::dataplane::wireguard::{
Cidr, InterfaceParams, WgSecretKey, WireguardBackend, build_interface, overlay_address,
};
use tsunagi::identity::{NetworkKeys, NetworkName, NetworkSecret};
/// A name unlikely to collide with anything already on the host.
const TEST_INTERFACE: &str = "tsunagitest0";
fn test_network() -> tsunagi::NetworkId {
NetworkKeys::derive(
&NetworkName::new("system-test").unwrap(),
&NetworkSecret::from_bytes(vec![11u8; 32]).unwrap(),
)
.network_id()
}
#[test]
#[ignore = "changes the host's network; needs Linux, wg, ip and CAP_NET_ADMIN"]
fn the_real_backend_applies_reads_back_and_removes_a_configuration() {
let backend = WgToolBackend::new().expect("the wg-tools backend should be available on Linux");
let network = test_network();
let local = WgSecretKey::generate();
let peer = WgSecretKey::generate().public();
// Start from a clean slate even if a previous run was interrupted.
backend.remove(TEST_INTERFACE).unwrap();
assert_eq!(backend.inspect(TEST_INTERFACE).unwrap(), None);
let desired = build_interface(
InterfaceParams {
network,
name: TEST_INTERFACE.to_string(),
private_key: local.clone(),
listen_port: 51899,
mtu: Some(1380),
keepalive: Some(25),
},
[peer],
|_| Some("10.99.0.2:51899".parse::<SocketAddr>().unwrap()),
);
backend.apply(&desired).unwrap();
let observed = backend
.inspect(TEST_INTERFACE)
.unwrap()
.expect("the interface should exist after apply");
assert_eq!(observed.public_key, local.public());
assert_eq!(observed.listen_port, 51899);
assert_eq!(observed.peers.len(), 1);
assert_eq!(observed.peers[0].public_key, peer);
assert_eq!(
observed.peers[0].allowed_ips,
vec![Cidr::host(overlay_address(network, &peer))]
);
assert!(
observed
.addresses
.contains(&Cidr::host(overlay_address(network, &local.public()))),
"the overlay address should be assigned: {:?}",
observed.addresses
);
// Applying the same configuration again must be a no-op, not a rebuild.
backend.apply(&desired).unwrap();
assert_eq!(backend.inspect(TEST_INTERFACE).unwrap(), Some(observed));
backend.remove(TEST_INTERFACE).unwrap();
assert_eq!(backend.inspect(TEST_INTERFACE).unwrap(), None);
// Removing something that is not there is not an error.
backend.remove(TEST_INTERFACE).unwrap();
}
#[test]
#[ignore = "changes the host's network; needs Linux, wg, ip and CAP_NET_ADMIN"]
fn the_real_backend_refuses_an_interface_it_did_not_create() {
let backend = WgToolBackend::new().expect("the wg-tools backend should be available on Linux");
let name = "tsunagitest1";
// A plain dummy link, not a WireGuard device: something that belongs to
// somebody else.
let created = std::process::Command::new("ip")
.args(["link", "add", "dev", name, "type", "dummy"])
.status()
.expect("ip should be available");
assert!(created.success(), "could not create the dummy link");
let result = backend.inspect(name);
let _ = std::process::Command::new("ip")
.args(["link", "del", "dev", name])
.status();
assert!(
result.is_err(),
"an interface the plugin did not create must be refused, not adopted"
);
}