dataplane: don't require peer id from underlay

The peer id isn't actually known a priori from the underlay, even if
some transports can give an indication of what they think it is (such as
derp reporting the nodekey). Ultimately the only way the peer identity
can be trusted is if it's cryptographically authenticated by data within
the packet, which WireGuard derives from the ongoing session (identified
by the session id field), and disco gets from the disco pubkey field in
its header. STUN packets are unverified but don't require any association
to the peer's id.

Removing this requirement will simplify the architecture for the UDP
direct transport in future commits.

Signed-off-by: Nathan Perry <nathan@tailscale.com>
Change-Id: Ib3fe81d7f41fbd6e3b637f282b51f4f96a6a6964

Author: npry

Cargo.lock

@@ -9,19 +9,30 @@ use ts_tunnel::NodeKeyPair;
 
 use crate::{EventResult, InboundResult, OutboundResult};
 
-/// Queue for packets leaving the data plane "up" into an overlay transport.
-pub type DataplaneToOverlay = mpsc::UnboundedSender<Vec<PacketMut>>;
-
-/// Queue for packets entering the data plane "down" from an overlay transport.
-pub type DataplaneFromOverlay = mpsc::UnboundedReceiver<Vec<PacketMut>>;
-
-/// Queue for packets leaving the data plane "down" into an underlay transport.
-pub type DataplaneToUnderlay = mpsc::UnboundedSender<(PeerId, Vec<PacketMut>)>;
-
-/// Queue for packets entering the data plane "up" from an underlay transport.
-pub type DataplaneFromUnderlay = mpsc::UnboundedReceiver<(PeerId, Vec<PacketMut>)>;
-
-// TODO: wire in overlay/underlay transport traits
+// NOTE(npry): this used to have unique types for each queue, but the names got confusing due to
+// having to think about the cartesian product of PacketType x QueueDirection x Network
+// (this is a "sender handle for receive packets on the overlay", vs. "receive handle for sender
+// packets on the overlay", etc.). It wasn't always clear to distinguish what referred to the
+// channel direction (sender/receiver) and what referred to the actual traffic kind (packets
+// received _from_ the underlay are different from packets sent _to_ the underlay). So now we name
+// the packet type here (to/from overlay/underlay) and use separate helper types to make the channel
+// directions easier to name.
+
+/// Packet batches sent to an overlay.
+pub type ToOverlay = Vec<PacketMut>;
+/// Packet batches received from an overlay.
+pub type FromOverlay = Vec<PacketMut>;
+
+/// Packet batches sent to an underlay.
+pub type ToUnderlay = (PeerId, Vec<PacketMut>);
+/// Packet batches received from an underlay.
+pub type FromUnderlay = Vec<PacketMut>;
+
+/// Shorthand for a sender channel.
+pub type Tx<T> = mpsc::UnboundedSender<T>;
+
+/// Shorthand for a receiver channel.
+pub type Rx<T> = mpsc::UnboundedReceiver<T>;
 
 /// Transforms packets to make tailscale happen.
 pub struct DataPlane {
@@ -30,8 +41,10 @@ pub struct DataPlane {
 
     transports_changed: tokio::sync::Notify,
 
-    underlay_down: DataplaneToUnderlay,
-    overlay_up: DataplaneToOverlay,
+    // These are the senders handed out in new_*_transport, just held here so we can clone them, we
+    // never send to them.
+    underlay_down: Tx<FromUnderlay>,
+    overlay_up: Tx<FromOverlay>,
 
     next_underlay_transport: AtomicU32,
     next_overlay_transport: AtomicU32,
@@ -42,17 +55,17 @@ struct CoreState {
     sync: crate::DataPlane,
 
     /// Queues to write packets to overlay transports.
-    overlay_transports: HashMap<OverlayTransportId, DataplaneToOverlay>,
+    overlay_transports: HashMap<OverlayTransportId, Tx<ToOverlay>>,
     /// Queues to write packets to underlay transports.
-    underlay_transports: HashMap<UnderlayTransportId, DataplaneToUnderlay>,
+    underlay_transports: HashMap<UnderlayTransportId, Tx<ToUnderlay>>,
 }
 
 /// State that must be held during async polling.
 struct PollState {
     /// Queue for packets entering the data plane ("coming down") from overlay transports.
-    from_overlay: DataplaneFromOverlay,
+    from_overlay: Rx<FromOverlay>,
     /// Queue for packets entering the data plane ("coming up") from underlay transports.
-    from_underlay: DataplaneFromUnderlay,
+    from_underlay: Rx<FromUnderlay>,
 }
 
 impl DataPlane {
@@ -89,13 +102,12 @@ impl DataPlane {
     }
 
     /// Allocate a new underlay transport.
+    ///
+    /// The channels handed back are for an underlay to receive messages from the dataplane
+    /// (`ToUnderlay`) and send messages to the dataplane (`FromUnderlay`).
     pub async fn new_underlay_transport(
         &self,
-    ) -> (
-        UnderlayTransportId,
-        DataplaneFromUnderlay,
-        DataplaneToUnderlay,
-    ) {
+    ) -> (UnderlayTransportId, Rx<ToUnderlay>, Tx<FromUnderlay>) {
         let id = self
             .next_underlay_transport
             .fetch_add(1, std::sync::atomic::Ordering::Relaxed)
@@ -114,9 +126,12 @@ impl DataPlane {
     }
 
     /// Allocate a new overlay transport.
+    ///
+    /// The channels handed back are for an overlay to send messages to the dataplane
+    /// (`FromOverlay`) and receive messages from the dataplane (`ToOverlay`).
     pub async fn new_overlay_transport(
         &self,
-    ) -> (OverlayTransportId, DataplaneToOverlay, DataplaneFromOverlay) {
+    ) -> (OverlayTransportId, Tx<FromOverlay>, Rx<ToOverlay>) {
         let id = self
             .next_overlay_transport
             .fetch_add(1, std::sync::atomic::Ordering::Relaxed)
@@ -146,7 +161,7 @@ impl DataPlane {
     pub async fn step(&self) {
         enum SelectResult {
             OverlayDown(Vec<PacketMut>),
-            UnderlayUp(PeerId, Vec<PacketMut>),
+            UnderlayUp(Vec<PacketMut>),
             TransportsChanged,
             Event,
         }
@@ -185,10 +200,10 @@ impl DataPlane {
                 }
 
                 underlay_pkts = underlay_up.recv() => {
-                    let (peer_id, underlay_pkts) = underlay_pkts.unwrap();
-                    tracing::trace!(%peer_id, n_underlay_pkts = underlay_pkts.len());
+                    let underlay_pkts = underlay_pkts.unwrap();
+                    tracing::trace!(n_underlay_pkts = underlay_pkts.len());
 
-                    SelectResult::UnderlayUp(peer_id, underlay_pkts)
+                    SelectResult::UnderlayUp(underlay_pkts)
                 }
 
                 _ = self.transports_changed.notified() => {
@@ -214,7 +229,7 @@ impl DataPlane {
 
                 (Some(to_peers), Some(loopback))
             }
-            SelectResult::UnderlayUp(_peer_id, underlay_up) => {
+            SelectResult::UnderlayUp(underlay_up) => {
                 let InboundResult { to_local, to_peers } = core.sync.process_inbound(underlay_up);
 
                 (Some(to_peers), Some(to_local))

ts_dataplane/src/async_tokio.rs

@@ -4,9 +4,8 @@ use kameo::{
     actor::{ActorRef, Spawn},
     message::{Context, Message},
 };
-use tokio::sync::mpsc;
-use ts_packet::PacketMut;
-use ts_transport::{OverlayTransportId, PeerId, UnderlayTransportId};
+use ts_dataplane::async_tokio::{FromOverlay, FromUnderlay, Rx, ToOverlay, ToUnderlay, Tx};
+use ts_transport::{OverlayTransportId, UnderlayTransportId};
 
 use crate::{
     Error, Task,
@@ -17,18 +16,6 @@ use crate::{
     src_filter::SourceFilterState,
 };
 
-/// Queue for packets sent from the overlay to the dataplane.
-pub type OverlayToDataplane = mpsc::UnboundedSender<Vec<PacketMut>>;
-
-/// Queue for packets entering the overlay from the dataplane.
-pub type OverlayFromDataplane = mpsc::UnboundedReceiver<Vec<PacketMut>>;
-
-/// Queue for packets leaving the underlay to the dataplane.
-pub type UnderlayToDataplane = mpsc::UnboundedSender<(PeerId, Vec<PacketMut>)>;
-
-/// Queue for packets entering an underlay from the dataplane.
-pub type UnderlayFromDataplane = mpsc::UnboundedReceiver<(PeerId, Vec<PacketMut>)>;
-
 pub struct DataplaneActor {
     dataplane: Arc<ts_dataplane::async_tokio::DataPlane>,
 }
@@ -38,18 +25,14 @@ impl DataplaneActor {
     #[message]
     pub async fn new_overlay_transport(
         &self,
-    ) -> (OverlayTransportId, OverlayToDataplane, OverlayFromDataplane) {
+    ) -> (OverlayTransportId, Tx<FromOverlay>, Rx<ToOverlay>) {
         self.dataplane.new_overlay_transport().await
     }
 
     #[message]
     pub async fn new_underlay_transport(
         &self,
-    ) -> (
-        UnderlayTransportId,
-        UnderlayFromDataplane,
-        UnderlayToDataplane,
-    ) {
+    ) -> (UnderlayTransportId, Rx<ToUnderlay>, Tx<FromUnderlay>) {
         self.dataplane.new_underlay_transport().await
     }
 }

ts_runtime/src/dataplane.rs

@@ -12,6 +12,7 @@ use kameo::{
 use smol_str::SmolStr;
 use tokio::sync::{Mutex, watch};
 use ts_control::DerpRegion;
+use ts_dataplane::async_tokio::{FromUnderlay, Rx, ToUnderlay, Tx};
 use ts_derp::RegionId;
 use ts_keys::{NodeKeyPair, NodePublicKey};
 use ts_packet::PacketMut;
@@ -21,7 +22,7 @@ use ts_transport::{
 
 use crate::{
     Task,
-    dataplane::{DataplaneActor, NewUnderlayTransport, UnderlayFromDataplane, UnderlayToDataplane},
+    dataplane::{DataplaneActor, NewUnderlayTransport},
     derp_latency::DerpLatencyMeasurement,
     env::Env,
     multiderp::{Multiderp, SetRegionTransportId},
@@ -221,8 +222,8 @@ struct Runner {
     region_id: RegionId,
     region: DerpRegion,
     home_derp_rx: watch::Receiver<bool>,
-    to_dataplane: UnderlayToDataplane,
-    from_dataplane: Arc<Mutex<UnderlayFromDataplane>>,
+    to_dataplane: Tx<FromUnderlay>,
+    from_dataplane: Arc<Mutex<Rx<ToUnderlay>>>,
     peer_db: Arc<RwLock<Option<Arc<PeerDb>>>>,
     keys: NodeKeyPair,
 }
@@ -306,7 +307,7 @@ impl Runner {
 
                         tracing::trace!(parent: &span, %peer_id, len = pkts.len(), "packet from derp server");
 
-                        let Ok(()) = self.to_dataplane.send((peer_id, pkts)) else {
+                        let Ok(()) = self.to_dataplane.send(pkts) else {
                             tracing::error!(parent: &span, "underlay receive channel closed");
                             break;
                         };

ts_runtime/src/multiderp/uniderp.rs

@@ -9,14 +9,10 @@ use netstack::{
     netcore::{Channel, NetstackControl},
 };
 use tokio::sync::Mutex;
+use ts_dataplane::async_tokio::{FromOverlay, Rx, ToOverlay, Tx};
 use ts_packet::PacketMut;
 
-use crate::{
-    Error,
-    dataplane::{OverlayFromDataplane, OverlayToDataplane},
-    env::Env,
-    task::Task,
-};
+use crate::{Error, env::Env, task::Task};
 
 pub struct NetstackActor {
     channel: Channel,
@@ -26,8 +22,8 @@ impl kameo::Actor for NetstackActor {
     type Args = (
         Env,
         netstack::netcore::Config,
-        OverlayToDataplane,
-        Arc<Mutex<OverlayFromDataplane>>,
+        Tx<FromOverlay>,
+        Arc<Mutex<Rx<ToOverlay>>>,
     );
     type Error = Error;