Skip to content

Latest commit

 

History

History
94 lines (73 loc) · 6.52 KB

README.md

File metadata and controls

94 lines (73 loc) · 6.52 KB
Raw

wireguard-mpls

Wireguard, but compatible with mpls, no MTU overhead.

How

  • Decapsulate MPLS header (decap_mpls) before sending traffic out of WG interface
  • Encapsulate MPLS header (encap_mpls) after receiving traffic from WG interface
  • Nearly all magical stuff is in magic.h
  • Use back progagation of TTL from inner IP header to restore MPLS TTL
  • Add MESSAGE_DATA_MPLS = 5 to avoid conflicts with some providers (e.g., cloudflare)
    • Also add MESSAGE_DATA_MPLS_MC = 6 as multicast MPLS
  • select 0.0.0.0 and :: as peer for non-IP(mpls) traffic
(IP) ==[encap]==> (MPLS|IP) ==[wg-decap]==> (WG|IP) ==[wg-encap]==> (MPLS|IP) ==[decap]==> (IP)

╔═══════════════════════════════════════════════════════════════════════════════════╗
║                               WireGuard Header                                    ║
╠════════════════════════════════════════════════════════════════╦══════════════════╣
║ type                                                           ║ others           ║
║ 32 bit                                                         ║ (we don't care)  ║
╠══════════════════════════════════════════╦═════════════════════╬══════════════════╣
║ reserved zero 24 bit                     ║ type 8 bit          ║                  ║
║ Used for MPLS Label/Exp/BoS              ║ new type for MPLS   ║                  ║
╚══════════════════════════════════════════╩═════════════════════╩══════════════════╝

╔═══════════════════════════════════════════════════════════════════════════════════╗
║                               MPLS Header                                         ║
╠══════════════════════════════╦═══════╦═══════╦════════════════════════════════════╣
║ Label                        ║ Exp   ║ BoS   ║ TTL                                ║
║ 20 bit                       ║ 3 bit ║ 1 bit ║ 8 bit                              ║
╠══════════════════════════════╩═══════╩═══════╬════════════════════════════════════╣
║   Put in Wireguard reserved zeros (24 bit)   ║ Extracted from inner IP header TTL ║
╚══════════════════════════════════════════════╩════════════════════════════════════╝

╔═══════════════════════════════════════════════════════════════════════════════════╗
║                            sk_buff reserved room                                  ║
╠══════════════════════╦════════════════════════════════════════════════════════════╣
║ type                 ║ MPLS Data (label + exp + bos)                              ║
║ 8 bit                ║ 24 bit                                                     ║
╠══════════════════════╬════════════════════════════════════════════════════════════╣
║ 0 for MPLS_UC        ║ used in wg pkt processing                                  ║
║ 1 for MPLS_MC        ║ (clear before finish post-receive processing)              ║
╚══════════════════════╩════════════════════════════════════════════════════════════╝

Source

The origin code is copied from wireguard kernel module from linux-6.10.x.

Compile

  • make
  • use wireguard.ko

Usage

Setup wireguard tunnels as usual, route MPLS traffic into wg interfaces, and enjoy.

Limit

  • MTU is reduced to 1416, may fix it soon.
  • Only IPv4/IPv6 packets are allowed to be MPLS payload, may add fallback option to accept more protocols. (Now supported)
    • However, TTL would be propagated from inner IP headers to MPLS headers, inner protocols without TTL would cause MPLS TTL to always be 64.
  • Can not disable MPLS function. Use sysctl for temporary solution.
  • Non-IP traffic would be sent to peers with allowed-ips 0.0.0.0/0 and/or ::/0.
  • There will be MTU issues. For 2 stacked labels, working MTU is reduced to 1408.
  • Multicast MPLS is never tested!

TODO

  • MPLS type encoding (send)
  • MPLS type decoding (receive)
  • MPLS packet to IP (send)
  • IP packet to MPLS (receive)
  • TTL back propagation (receive)
  • MPLS handing (receive)
  • Multi-layer MPLS headers handling
  • non-IP inner protocol handling
  • Adjust MPLS to use MTU 1420
  • BUG: encap ip packet from wg1, decap mpls and send to wg2

Test

  • make test-install: replace current wireguard with wireguard-mpls.
  • make test-tunnel: set up a tunnel from host to netns with MPLS routing.
  • make test-router: set up 6 netns and 5 tunnels with MPLS routing, run traceroutes.
  • make test-stack: set up a tunnel from host to netns with MPLS routing with stacked labels.

Benchmark

WIP (From the results of known tests, there is little difference in performance)