tsunagiandClaude Opus 5
21be7e9b44
Corrects the architecture on two points raised in review, while the project is still small enough to change cheaply. 1. Control and data are separated *logically*, not physically. The old reading — "nothing but control may ride on iroh" — threw away iroh's whole value and would have forced the data plane to reimplement STUN, ICE and a relay. Now both planes ride on iroh with different ALPNs and different connections, so the data plane inherits hole punching and relay fallback, while proto/ still knows nothing about packets and dataplane/ knows nothing about the control protocol. New boundary: PacketTransport / PacketLink, an authenticated unreliable datagram channel per (network, peer, protocol). tsunagi/data/1 runs the same membership handshake, then DataOpen/DataOpenAck, then QUIC datagrams. Only the smaller endpoint id dials, so exactly one link exists per pair. A plugin is handed links and never learns reachability, so the WireGuard announcement shrank to a public key: there is no address left to lie about. 2. WireGuard now runs in userspace, on boringtun's protocol state machine. No kernel module, no wg tool, no ip shell-out, no loopback proxy: the wgtool, backend and bridge modules are gone. Only creating a TUN device needs privileges, and that sits behind TunFactory, so the entire data plane — handshake, encryption, routing, address ownership — is tested with none. Address ownership is enforced rather than believed: outbound packets go to the owner of the destination address, inbound packets are dropped unless their source is the address derived for the peer that sent them. 3. A `tsunagi` binary: secret, doctor, id, up. It owns the runtime, the logging subscriber and Ctrl-C, which the library still refuses to. Also fixes a reference cycle where IrohTransport held Arc<Inner>, which kept the databases open and the directory lock held after shutdown; two storage tests caught it once the cycle existed. 81 tests pass offline with no privileges, including real IPv6 packets crossing a real WireGuard tunnel over real iroh connections. Verified by hand: two CLI processes forming a mesh both on loopback and via n0 discovery using only an endpoint id. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
68 lines
2.9 KiB
Rust
68 lines
2.9 KiB
Rust
//! The WireGuard data plane plugin.
|
|
//!
|
|
//! WireGuard is the first IP plugin. It creates real IP connectivity between
|
|
//! participants, while the control plane keeps doing what it does: agreeing on
|
|
//! who is in the network and carrying each participant's opaque announcement.
|
|
//!
|
|
//! The two planes stay separate:
|
|
//!
|
|
//! * **The plugin knows nothing about reachability.** It is handed a
|
|
//! [`PacketLink`](crate::dataplane::transport::PacketLink) per peer and
|
|
//! bridges the kernel WireGuard device onto it. Hole punching and relaying
|
|
//! belong to the transport.
|
|
//! * **The announcement says who, not where.** It carries a public key, so
|
|
//! there is no address for a peer to lie about.
|
|
//! * **The core never parses these announcements.** It moves a bounded opaque
|
|
//! blob; only [`announcement`] interprets it.
|
|
//! * **Keys are separate.** The plugin has its own key per network, in its own
|
|
//! store, unrelated to the iroh device key and to the network secret.
|
|
//! * **WireGuard's own crypto is untouched.** The bridge is a pipe; the
|
|
//! handshake and encryption run end to end between the two kernels.
|
|
//!
|
|
//! # How a mesh forms
|
|
//!
|
|
//! Every participant derives its own overlay address from the network id and
|
|
//! its own WireGuard public key ([`overlay`]), so no coordinator hands out
|
|
//! addresses. Because that derivation is public, each agent computes every
|
|
//! peer's `AllowedIPs` itself instead of believing what the peer claims — a
|
|
//! member cannot route another member's traffic to itself.
|
|
//!
|
|
//! WireGuard itself is [`boringtun`]'s protocol state machine, running in this
|
|
//! process: no kernel module, no `wg` tool, the same code on every platform.
|
|
//! [`device::WireguardDevice`] drives one tunnel per peer and routes packets
|
|
//! between them and a [`tun::TunDevice`].
|
|
//!
|
|
//! The only part that needs privileges is the packet interface. With
|
|
//! [`tun::MemoryTunFactory`] the whole data plane — handshake, encryption,
|
|
//! routing, address ownership — runs and is tested with no privileges at all;
|
|
//! `SystemTunFactory` swaps in a real interface when you want traffic to
|
|
//! reach the operating system.
|
|
//!
|
|
//! See `docs/wireguard.md` for the full picture.
|
|
|
|
pub mod announcement;
|
|
pub mod config;
|
|
pub mod device;
|
|
pub mod keys;
|
|
pub mod overlay;
|
|
pub mod packet;
|
|
pub mod plugin;
|
|
pub mod store;
|
|
pub mod tun;
|
|
|
|
pub use announcement::{ValidatedAnnouncement, WgAnnouncement};
|
|
pub use config::{Cidr, DEFAULT_INTERFACE_PREFIX, MAX_INTERFACE_NAME_LEN, interface_name};
|
|
pub use device::{PeerHealth, PeerStats, PeerSummary, WireguardDevice};
|
|
pub use keys::{WgPublicKey, WgSecretKey};
|
|
pub use overlay::{OVERLAY_PREFIX_LEN, overlay_address, overlay_prefix};
|
|
pub use packet::IpHeader;
|
|
pub use plugin::{
|
|
DEFAULT_MTU, NetworkOverview, PeerOverview, WIREGUARD_PROTOCOL, WireguardConfig,
|
|
WireguardPlugin,
|
|
};
|
|
pub use store::WgKeyStore;
|
|
pub use tun::{MemoryTun, MemoryTunFactory, TunDevice, TunFactory, TunRequest};
|
|
|
|
#[cfg(feature = "tun-device")]
|
|
pub use tun::SystemTunFactory;
|