WireGuard 加密

// 文件: felix/wireguard/wireguard.go:110-171

type Wireguard struct {
    // 基本配置（不变）
    hostname      string
    config        *Config
    ipVersion     uint8
    interfaceName string

    // 客户端和工厂
    newNetlinkClient     func() (netlinkshim.Interface, error)
    newWireguardClient   func() (netlinkshim.Wireguard, error)
    cachedNetlinkClient  netlinkshim.Interface
    cachedWireguardClient netlinkshim.Wireguard

    // 同步状态
    inSyncWireguard     bool  // WireGuard 配置同步状态
    inSyncLink          bool  // 网络接口同步状态
    inSyncInterfaceAddr bool  // 接口地址同步状态
    ifaceUp             bool  // 接口是否 UP

    // 本节点信息
    ourPublicKey     *wgtypes.Key  // 本节点公钥
    ourInterfaceAddr ip.Addr       // 接口 IP 地址
    ourHostAddr      ip.Addr       // 主机 IP 地址

    // 本地路由信息
    localIPs    set.Set[ip.Addr]  // 本地 IP 集合
    localCIDRs  set.Set[ip.CIDR]  // 本地 CIDR 集合

    // 节点映射
    cidrToNodeName       map[ip.CIDR]string           // CIDR 到节点名映射
    nodes                map[string]*nodeData         // 节点数据缓存
    publicKeyToNodeNames map[wgtypes.Key]set.Set[string]  // 公钥到节点名映射
    nodeUpdates          map[string]*nodeUpdateData   // 待处理的节点更新

    // 路由管理
    routetable *routetable.ClassView
    routerule  *routerule.RouteRules
}

// 文件: felix/wireguard/config.go:18-37

type Config struct {
    // 启用控制
    Enabled             bool    // IPv4 WireGuard 启用
    EnabledV6           bool    // IPv6 WireGuard 启用

    // 网络配置
    ListeningPort       int     // IPv4 监听端口 [Default: 51820]
    ListeningPortV6     int     // IPv6 监听端口 [Default: 51821]
    InterfaceName       string  // IPv4 接口名 [Default: wireguard.cali]
    InterfaceNameV6     string  // IPv6 接口名 [Default: wg-v6.cali]
    MTU                 int     // IPv4 MTU [Default: 1440]
    MTUV6               int     // IPv6 MTU [Default: 1420]

    // 路由配置
    FirewallMark        int     // 防火墙标记
    RoutingRulePriority int     // 路由规则优先级 [Default: 99]
    RoutingTableIndex   int     // IPv4 路由表索引
    RoutingTableIndexV6 int     // IPv6 路由表索引

    // 高级配置
    EncryptHostTraffic  bool            // 加密主机流量
    PersistentKeepAlive time.Duration   // 保活间隔
    ThreadedNAPI        bool            // 启用多线程 NAPI
}

apiVersion: projectcalico.org/v3
kind: Node
metadata:
  name: node-1
spec:
  bgp:
    ipv4Address: 192.168.1.10/24
status:
  wireguardPublicKey: "abc123..."      # IPv4 公钥
  wireguardPublicKeyV6: "def456..."    # IPv6 公钥

// 文件: felix/wireguard/wireguard.go:1298-1312

// 在 resync 时检查并生成密钥
if device.PrivateKey == zeroKey || device.PublicKey == zeroKey {
    // 私钥或公钥未设置，生成新密钥对
    w.logCtx.Info("Generate new private/public key pair")
    pkey, err := wgtypes.GeneratePrivateKey()
    if err != nil {
        w.logCtx.WithError(err).Error("error generating private-key")
        return zeroKey, nil, err
    }
    wireguardUpdate.PrivateKey = &pkey

    // 从私钥派生公钥
    publicKey = pkey.PublicKey()
    w.logCtx.WithField("publicKey", publicKey).Debug("Generated new public key")
}

// 文件: felix/wireguard/wireguard.go:70-82

type nodeData struct {
    endpointAddr          ip.Addr           // 节点端点地址
    publicKey             wgtypes.Key       // 节点公钥
    cidrs                 set.Set[ip.CIDR]  // 允许的 CIDR 列表
    programmedInWireguard bool              // 是否已配置到 WireGuard
    routingToWireguard    bool              // 是否路由到 WireGuard
}

// 文件: felix/wireguard/wireguard.go:1687-1701

// shouldProgramWireguardPeer 判断是否应该配置 peer
func (w *Wireguard) shouldProgramWireguardPeer(name string, node *nodeData) bool {
    logCtx := w.logCtx.WithField("node", name)

    // 必须有端点地址
    if node.endpointAddr == nil {
        logCtx.Debug("Peer should not be programmed, no endpoint address")
        return false
    }

    // 必须有有效的公钥
    if node.publicKey == zeroKey {
        logCtx.Debug("Peer should not be programmed, no valid public key")
        return false
    }

    // 只能有一个节点声明该公钥（避免冲突）
    if w.publicKeyToNodeNames[node.publicKey].Len() != 1 {
        logCtx.Debug("Peer should not be programmed, multiple nodes claiming same key")
        return false
    }

    logCtx.Debug("Peer should be programmed")
    return true
}

// 文件: felix/wireguard/wireguard.go:84-90

func (n *nodeData) allowedCidrsForWireguard() []net.IPNet {
    cidrs := make([]net.IPNet, 0, n.cidrs.Len())
    for item := range n.cidrs.All() {
        cidrs = append(cidrs, item.ToIPNet())
    }
    return cidrs
}

// 文件: felix/wireguard/wireguard.go:1632-1639

// addRouteRule 添加使用 WireGuard 表的路由规则
func (w *Wireguard) addRouteRule() {
    // 创建规则：匹配非 WireGuard 标记的流量，跳转到 WireGuard 路由表
    w.routerule.SetRule(routerule.NewRule(int(w.ipVersion), w.config.RoutingRulePriority).
        GoToTable(w.config.RoutingTableIndex).
        Not().MatchFWMarkWithMask(uint32(w.config.FirewallMark), uint32(w.config.FirewallMark)))
}

// 文件: felix/wireguard/wireguard.go:1092-1164

// updateRouteTableFromNodeUpdates 根据节点更新更新路由表
func (w *Wireguard) updateRouteTableFromNodeUpdates() {
    // 1. 先处理删除
    for _, update := range w.nodeUpdates {
        for cidr := range update.cidrsDeleted.All() {
            w.routetable.RouteRemove(w.interfaceName, cidr)
            w.routetable.RouteRemove(routetable.InterfaceNone, cidr)
        }
    }

    // 2. 再处理添加/更新
    for name, update := range w.nodeUpdates {
        node := w.getOrInitNodeData(name)
        shouldRouteToWireguard := w.shouldProgramWireguardPeer(name, node)

        // 决定路由目标
        var targetType routetable.TargetType
        var ifaceName string

        if !shouldRouteToWireguard {
            // 使用 throw 规则返回主路由表
            targetType = routetable.TargetTypeThrow
            ifaceName = routetable.InterfaceNone
        } else {
            // 路由到 WireGuard 接口
            ifaceName = w.interfaceName
        }

        // 配置路由
        for cidr := range updateSet.All() {
            w.routetable.RouteUpdate(ifaceName, routetable.Target{
                Type: targetType,
                CIDR: cidr,
            })
        }
    }
}

// 文件: felix/dataplane/linux/wireguard_mgr.go:38-59

type wireguardManager struct {
    wireguardRouteTable *wireguard.Wireguard
    dpConfig            Config
    ipVersion           uint8
}

func (m *wireguardManager) OnUpdate(protoBufMsg interface{}) {
    switch msg := protoBufMsg.(type) {
    case *proto.HostMetadataUpdate:
        // 更新节点端点地址
        m.wireguardRouteTable.EndpointUpdate(msg.Hostname, ip.FromString(msg.Ipv4Addr))

    case *proto.RouteUpdate:
        // 更新路由（工作负载、隧道地址）
        if msg.Types&proto.RouteType_REMOTE_WORKLOAD != 0 {
            m.wireguardRouteTable.RouteUpdate(msg.DstNodeName, cidr)
        }

    case *proto.WireguardEndpointUpdate:
        // 更新 WireGuard 端点（公钥、接口地址）
        key, _ := wgtypes.ParseKey(msg.PublicKey)
        m.wireguardRouteTable.EndpointWireguardUpdate(msg.Hostname, key, ifaceAddr)
    }
}

apiVersion: projectcalico.org/v3
kind: FelixConfiguration
metadata:
  name: default
spec:
  wireguardEnabled: true
  wireguardHostEncryptionEnabled: true  # 启用主机加密

// 文件: felix/wireguard/bootstrap.go:129-178

// BootstrapAndFilterTyphaAddresses 处理 WireGuard 启动问题
func BootstrapAndFilterTyphaAddresses(
    configParams *config.Config,
    getNetlinkHandle func() (netlinkshim.Interface, error),
    getWireguardHandle func() (netlinkshim.Wireguard, error),
    calicoClient clientv3.NodesClient,
    typhas []discovery.Typha,
) ([]discovery.Typha, error) {

    // 1. 如果 WireGuard 禁用，删除所有配置
    if !wgEnabled {
        return typhas, removeWireguardForBootstrapping(...)
    }

    // 2. 获取内核中的公钥和 Peer 列表
    kernelPublicKey, kernelPeerKeys := getWireguardDeviceInfo(...)

    // 3. 如果内核无有效配置，删除 WireGuard
    if kernelPublicKey == "" || kernelPeerKeys.Len() == 0 {
        return typhas, removeWireguardForBootstrapping(...)
    }

    // 4. 检查存储的公钥是否与内核匹配
    storedPublicKey, _ := getPublicKeyForNode(...)
    if storedPublicKey != kernelPublicKey {
        return typhas, removeWireguardForBootstrapping(...)
    }

    // 5. 过滤 Typha 端点，排除不可达的节点
    if len(typhas) > 0 {
        filtered := filterTyphaEndpoints(configParams, calicoClient, typhas, kernelPeerKeys)
        if len(filtered) == 0 {
            // 无法连接任何 Typha，删除 WireGuard 配置
            return typhas, removeWireguardForBootstrapping(...)
        }
        return filtered, nil
    }

    return typhas, nil
}

apiVersion: projectcalico.org/v3
kind: FelixConfiguration
metadata:
  name: default
spec:
  # IPv4 WireGuard
  wireguardEnabled: true
  wireguardInterfaceName: wireguard.cali   # 接口名
  wireguardListeningPort: 51820            # UDP 端口
  wireguardMTU: 1440                       # MTU

  # IPv6 WireGuard
  wireguardEnabledV6: true
  wireguardInterfaceNameV6: wg-v6.cali
  wireguardListeningPortV6: 51821
  wireguardMTUV6: 1420

  # 通用配置
  wireguardRoutingRulePriority: 99         # 路由规则优先级
  wireguardHostEncryptionEnabled: false    # 主机加密
  wireguardKeepAlive: 0s                   # 保活间隔

  # 性能调优
  wireguardThreadingEnabled: false         # 多线程 NAPI

// 文件: felix/wireguard/wireguard.go:641-875

func (w *Wireguard) Apply() (err error) {
    // 1. 延迟发送公钥状态更新
    defer func() {
        if !w.ourPublicKeyAgreesWithDataplaneMsg && w.ourPublicKey != nil {
            w.statusCallback(*w.ourPublicKey)
            w.ourPublicKeyAgreesWithDataplaneMsg = true
        }
    }()

    // 2. 如果 WireGuard 禁用，确保配置被删除
    if !w.Enabled() {
        if !w.inSyncWireguard {
            w.ensureDisabled(netlinkClient)
            w.ourPublicKey = &zeroKey
            w.inSyncWireguard = true
        }
        return nil
    }

    // 3. 准备更新
    wireguardPeerDelete := w.prepareWireguardPeerDeletion()
    conflictingKeys := w.updateCacheFromNodeUpdates()
    w.updateRouteTableFromNodeUpdates()

    // 4. 确保 WireGuard 链路就绪
    if !w.inSyncLink {
        if err := w.ensureLink(netlinkClient); err != nil {
            return err
        }
        w.inSyncLink = true
    }

    // 5. 并行执行更新
    var wg sync.WaitGroup

    // 5a. 更新接口地址
    if !w.inSyncInterfaceAddr {
        wg.Add(1)
        go func() {
            defer wg.Done()
            errLink = w.ensureLinkAddress(netlinkClient)
        }()
    }

    // 5b. 更新路由表
    wg.Add(1)
    go func() {
        defer wg.Done()
        errRoutes = w.routetable.Apply()
    }()

    // 5c. 更新 WireGuard 配置
    wg.Add(1)
    go func() {
        defer wg.Done()
        if w.inSyncWireguard {
            // Delta 更新
            w.applyWireguardConfig(wireguardClient, wireguardPeerDelete)
            wireguardNodeUpdate = w.constructWireguardDeltaFromNodeUpdates(conflictingKeys)
            w.applyWireguardConfig(wireguardClient, wireguardNodeUpdate)
        } else {
            // 全量同步
            publicKey, wireguardNodeUpdate, _ = w.constructWireguardDeltaForResync(wireguardClient)
            w.applyWireguardConfig(wireguardClient, wireguardNodeUpdate)
        }
        w.inSyncWireguard = true
    }()

    wg.Wait()

    // 6. 配置路由规则
    w.addRouteRule()
    w.routerule.Apply()

    return nil
}

spec:
  wireguardThreadingEnabled: true

// 文件: felix/wireguard/wireguard.go:1505-1533

func (w *Wireguard) maybeUpdateNAPIThreading() {
    if w.inSyncNAPI {
        return
    }
    // 必须等待链路 UP 和至少一个 Peer
    if !w.inSyncLink || len(w.nodes) == 0 || !w.inSyncWireguard {
        return
    }

    // 设置 NAPI 线程
    threadedNAPIBit := boolToBinaryString(w.config.ThreadedNAPI)
    napiThreadedPath := fmt.Sprintf("/sys/class/net/%s/threaded", w.interfaceName)
    w.writeProcSys(napiThreadedPath, threadedNAPIBit)
}