From f7f8b9b898757f9400cdb49499f1b123fcd19627 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jon=20H=C3=A4ggblad?= Date: Mon, 6 Nov 2023 16:50:10 +0100 Subject: [PATCH 1/3] wireguard: set MTU to 1420 --- common/wireguard/src/platform/linux/tun_device.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/common/wireguard/src/platform/linux/tun_device.rs b/common/wireguard/src/platform/linux/tun_device.rs index 638c00ce3f..8c3ee9ea15 100644 --- a/common/wireguard/src/platform/linux/tun_device.rs +++ b/common/wireguard/src/platform/linux/tun_device.rs @@ -24,7 +24,7 @@ fn setup_tokio_tun_device(name: &str, address: Ipv4Addr, netmask: Ipv4Addr) -> t .name(name) .tap(false) .packet_info(false) - .mtu(1350) + .mtu(1420) .up() .address(address) .netmask(netmask) From b461645d3d5f1923080537e0fbe0eebe385dc3f3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jon=20H=C3=A4ggblad?= Date: Mon, 6 Nov 2023 17:10:28 +0100 Subject: [PATCH 2/3] Make MTU configurable at runtime --- common/wireguard/src/platform/linux/tun_device.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/common/wireguard/src/platform/linux/tun_device.rs b/common/wireguard/src/platform/linux/tun_device.rs index 8c3ee9ea15..535302bcdc 100644 --- a/common/wireguard/src/platform/linux/tun_device.rs +++ b/common/wireguard/src/platform/linux/tun_device.rs @@ -20,11 +20,16 @@ use crate::{ fn setup_tokio_tun_device(name: &str, address: Ipv4Addr, netmask: Ipv4Addr) -> tokio_tun::Tun { log::info!("Creating TUN device with: address={address}, netmask={netmask}"); + // Read MTU size from env variable NYM_MTU_SIZE, else default to 1420. + let mtu = std::env::var("NYM_MTU_SIZE") + .map(|mtu| mtu.parse().expect("NYM_MTU_SIZE must be a valid integer")) + .unwrap_or(1420); + log::info!("Using MTU size: {mtu}"); tokio_tun::Tun::builder() .name(name) .tap(false) .packet_info(false) - .mtu(1420) + .mtu(mtu) .up() .address(address) .netmask(netmask) From 2c90229fce79fed4cba1f9193361c4e4d3b9b7a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jon=20H=C3=A4ggblad?= Date: Mon, 6 Nov 2023 17:54:00 +0100 Subject: [PATCH 3/3] Set peer at runtime --- common/wireguard/src/setup.rs | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/common/wireguard/src/setup.rs b/common/wireguard/src/setup.rs index 94331d2e79..10e7321444 100644 --- a/common/wireguard/src/setup.rs +++ b/common/wireguard/src/setup.rs @@ -16,10 +16,6 @@ pub const TUN_DEVICE_NETMASK: &str = "255.255.255.0"; // Corresponding public key: "WM8s8bYegwMa0TJ+xIwhk+dImk2IpDUKslDBCZPizlE=" const PRIVATE_KEY: &str = "AEqXrLFT4qjYq3wmX0456iv94uM6nDj5ugp6Jedcflg="; -// The public keys of the registered peer (clients) -// Corresponding private key: "ILeN6gEh6vJ3Ju8RJ3HVswz+sPgkcKtAYTqzQRhTtlo=" -const PEER: &str = "NCIhkgiqxFx1ckKl3Zuh595DzIFl8mxju1Vg995EZhI="; - // The AllowedIPs for the connected peer, which is one a single IP and the same as the IP that the // peer has configured on their side. const ALLOWED_IPS: &str = "10.0.0.2"; @@ -46,7 +42,11 @@ pub fn server_static_private_key() -> x25519::StaticSecret { pub fn peer_static_public_key() -> x25519::PublicKey { // A single static public key is used during development - let peer_static_public_bytes: [u8; 32] = decode_base64_key(PEER); + + // Read from NYM_PEER_PUBLIC_KEY env variable + let peer = std::env::var("NYM_PEER_PUBLIC_KEY").expect("NYM_PEER_PUBLIC_KEY must be set"); + + let peer_static_public_bytes: [u8; 32] = decode_base64_key(&peer); let peer_static_public = x25519::PublicKey::try_from(peer_static_public_bytes).unwrap(); info!( "Adding wg peer public key: {}",