Aleksandr Bogomiakov
7070a16104
Peers communicating on uncensored networks can benefit from raw WireGuard
performance over direct UDP without QUIC framing or double-encryption
overhead. This provides Tailscale-like direct tunnel performance while
preserving Tsunagi's decentralized mesh architecture.
Key changes:
- Create `tsunagi-wireguard` crate implementing the `IpPlugin` and
`PacketTransport` contracts:
- `WG_PROTOCOL = "wg"` with wire version 1.
- Bounded `WgAnnouncement` carrying WireGuard public keys, listening UDP
ports, and candidate IP addresses (filtering out overlay interfaces).
- `WgKeyStore` managing persistent per-network WireGuard X25519 keys
in SQLite with zeroization on drop.
- `WireguardTransport` providing direct UDP packet transmission, candidate
address tracking, inbound link delivery, and roaming support.
- `WireguardDevice` running userspace WireGuard encryption via `boringtun`,
timer maintenance, and AllowedIPs source enforcement.
- Integrate `wg` into `tsunagi-cli`:
- Set default protocols to `"wg,tcp-tls,wg-quic"` so all protocols are
enabled by default in order of throughput and performance.
- Support `"wireguard"` as a convenience alias for `"wg"` in `--protocol`.
- Bind `PureWgTransport` and launch the inbound datagram accept loop on `up`.
- Pass `pure_wg` plugin to `AgentControl` and update `build_report` so
active WireGuard tunnels and overlay metrics are reported in `tsunagi status`.
- Clean up WireGuard keys on network removal in `forget_protocol_state`.
- Comprehensive test coverage in `tsunagi-wireguard`:
- `announcement_tests`: round-trip serialization and verification of malformed,
mismatched network, zero port, or self-claiming announcements.
- `transport_tests`: loopback UDP link delivery between transports.
- `plugin_tests`: end-to-end two-peer handshake and bidirectional IP packet
transit over direct UDP.
Validation on Linux:
- cargo fmt --all -- --check passed.
- cargo clippy --locked --workspace --all-targets -- -D warnings passed.
- cargo test --locked --workspace --all-targets passed.
43 lines
1.5 KiB
TOML
43 lines
1.5 KiB
TOML
[package]
|
|
name = "tsunagi-cli"
|
|
version = "0.1.0"
|
|
description = "The tsunagi command line agent."
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
|
|
[[bin]]
|
|
name = "tsunagi"
|
|
path = "src/main.rs"
|
|
# The binary and the library share a name, which `cargo doc` cannot map to
|
|
# two directories. The command line is documented by `--help`, not rustdoc,
|
|
# so the library keeps the name and this opts out.
|
|
doc = false
|
|
|
|
[dependencies]
|
|
tsunagi = { path = "../tsunagi", version = "0.1.0", features = ["tun-device", "dns-publish"] }
|
|
tsunagi-wireguard = { path = "../tsunagi-wireguard", version = "0.1.0" }
|
|
tsunagi-wg-quic = { path = "../tsunagi-wg-quic", version = "0.1.0" }
|
|
tsunagi-tcp-tls = { path = "../tsunagi-tcp-tls", version = "0.1.0" }
|
|
iroh.workspace = true
|
|
tokio = { version = "1.53", features = ["rt", "rt-multi-thread", "sync", "time", "macros", "signal"] }
|
|
tracing.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
clap = { version = "4.5", features = ["derive", "env"] }
|
|
# Already in the tree through clap. `anstream` strips the escapes when stdout
|
|
# is not a terminal and turns on virtual terminal processing on Windows, so
|
|
# colour is never written where it would show up as rubbish.
|
|
anstream = "1.0"
|
|
anstyle = "1.0"
|
|
# Local interface addresses, for the diagnostics in `status`.
|
|
netwatch = "0.19.3"
|
|
|
|
[dev-dependencies]
|
|
tokio = { version = "1.53", features = ["rt", "rt-multi-thread", "sync", "time", "macros", "process"] }
|
|
tempfile.workspace = true
|
|
simple-dns = "0.12"
|
|
|
|
[lints]
|
|
workspace = true
|