wg

Documentation

Overview

Package wg holds the WireGuard primitives the tool needs. For now that is just key handling — generating a key pair and deriving the public key from an existing private key. It mirrors the Key type used elsewhere in muco.

Index

• type Config
  • func (c Config) Render(format Format, w io.Writer) (err error)
• type Format
• type Interface
• type Key
  • func FromPrivateKey(private string) (k *Key, err error)
  • func Generate() (k *Key, err error)
• type Nested
  • func (n Nested) Render(exitW, entryW io.Writer) error
• type Peer

Types

type Config

type Config struct {
	Interface Interface
	Peers     []Peer
}

Config is a full WireGuard configuration ready to be rendered.

func (Config) Render

func (c Config) Render(format Format, w io.Writer) (err error)

Render writes the configuration to w in the requested format.

type Format

type Format string

Format identifies a target configuration syntax.

const (
	FormatLinux   Format = "linux"   // wg-quick / wg(8) .conf
	FormatOpenBSD Format = "openbsd" // hostname.if(5)
)

type Interface

type Interface struct {
	PrivateKey  string
	Address     []string // CIDRs assigned to this peer
	DNS         []string
	MTU         int
	Description string   // OpenBSD: description "..."; Linux: leading # comment
	Rtable      int      // OpenBSD wgrtable (0 = unset)
	PostUp      []string // OpenBSD: shell commands emitted as "!<cmd>" after "up"
}

Interface is the local end of a WireGuard tunnel.

type Key

type Key struct {
	Private string
	Public  string
}

Key is a WireGuard key pair, both halves base64-encoded as WireGuard expects.

func FromPrivateKey

func FromPrivateKey(private string) (k *Key, err error)

FromPrivateKey derives the public key for an existing base64 private key.

func Generate

func Generate() (k *Key, err error)

Generate creates a fresh WireGuard key pair. The X25519 scalar returned by crypto/ecdh is already clamped the way WireGuard expects, so the encoded private key matches what `wg genkey` would emit.

type Nested

type Nested struct {
	PrivateKey     string
	Address        []string // tunnel CIDRs (on the exit interface)
	MTU            int      // exit interface MTU (user traffic)
	EntryMTU       int      // entry interface MTU (must hold the exit tunnel's wrapped packets)
	InternetRtable int      // rdomain with real internet (R); the entry's wgrtable
	EntryRdomain   int      // new rdomain for the entry interface (E); the exit's wgrtable
	EntryIface     string   // e.g. "wg1"
	ExitIface      string   // e.g. "wg0"
	EntryGateway   string   // entry interface's IPv4 (bare); gateway for the exit-relay route
	Entry          Peer     // entry relay peer (AllowedIPs = exit relay IP)
	Exit           Peer     // exit relay peer (AllowedIPs = 0.0.0.0/0, ::/0)
	Description    string   // e.g. "<device>:<entry>:<exit>"
	PostUp         []string
}

Nested describes an OpenBSD two-peer nested multihop setup, rendered as two hostname.if(5) files (entry hop + exit hop).

InternetRtable (R) is the routing domain that has real internet access. The entry interface is created in a new routing domain EntryRdomain (E, e.g. R+1) and uses wgrtable R, so it reaches the entry relay over the internet. The exit interface lives in rdomain 0 and uses wgrtable E, so its outer traffic to the exit relay is routed through the entry tunnel.

func (Nested) Render

func (n Nested) Render(exitW, entryW io.Writer) error

Render writes the two hostname.if(5) files to separate writers: the exit hop to exitW and the entry hop to entryW. The CLI sends exit to stdout and entry to stderr, so `mvctl -nested … 1>/etc/hostname.wg0 2>/etc/hostname.wg1` writes both files at once.

type Peer

type Peer struct {
	PublicKey           string
	Endpoint            string // host:port
	AllowedIPs          []string
	PersistentKeepalive int
}

Peer is a remote WireGuard endpoint (a Mullvad relay).