stealth

Documentation

Index

• Constants
• type FrameReader
  • func NewFrameReader(r io.Reader) *FrameReader
  • func (fr *FrameReader) ReadPacket(buf []byte) (int, error)
• type FrameWriter
  • func NewFrameWriter(w io.Writer) *FrameWriter
  • func (fw *FrameWriter) WritePacket(pkt []byte) error
• type StealthConfig
• type StealthManager
  • func NewStealthManager() *StealthManager
  • func (m *StealthManager) Close() error
  • func (m *StealthManager) Down() error
  • func (m *StealthManager) IfIndex() int
  • func (m *StealthManager) Link() netlink.Link
  • func (m *StealthManager) Stats() (rxBytes, txBytes int64, lastHandshake time.Time, err error)
  • func (m *StealthManager) Up(cfg *StealthConfig) error
• type TLSBind
  • func NewTLSBind(serverIP string, port int, sni string) *TLSBind
  • func (b *TLSBind) BatchSize() int
  • func (b *TLSBind) Close() error
  • func (b *TLSBind) Open(port uint16) ([]conn.ReceiveFunc, uint16, error)
  • func (b *TLSBind) ParseEndpoint(s string) (conn.Endpoint, error)
  • func (b *TLSBind) Send(bufs [][]byte, ep conn.Endpoint) error
  • func (b *TLSBind) SetMark(mark uint32) error
• type TLSEndpoint
  • func (e *TLSEndpoint) ClearSrc()
  • func (e *TLSEndpoint) DstIP() netip.Addr
  • func (e *TLSEndpoint) DstToBytes() []byte
  • func (e *TLSEndpoint) DstToString() string
  • func (e *TLSEndpoint) SrcIP() netip.Addr
  • func (e *TLSEndpoint) SrcToString() string

Constants

const (
	InterfaceName = "pvpn0"
	// Stealth connects on TCP 443 to look like HTTPS
	DefaultStealthPort = 443
	// FWMark must match the value in vpn/wireguard.go
	FWMark     = 51820
	RouteTable = 51820
	DefaultMTU = 1320 // Lower than normal WG (1420) to account for TLS + TCP overhead
)

Types

type FrameReader

type FrameReader struct {
	// contains filtered or unexported fields
}

FrameReader reads TunSafe-framed WireGuard packets from a stream.

func NewFrameReader

func NewFrameReader(r io.Reader) *FrameReader

NewFrameReader creates a framing reader.

func (*FrameReader) ReadPacket

func (fr *FrameReader) ReadPacket(buf []byte) (int, error)

ReadPacket reads the next TunSafe-framed WireGuard packet.

type FrameWriter

type FrameWriter struct {
	// contains filtered or unexported fields
}

FrameWriter writes TunSafe-framed WireGuard packets to a stream.

func NewFrameWriter

func NewFrameWriter(w io.Writer) *FrameWriter

NewFrameWriter creates a framing writer.

func (*FrameWriter) WritePacket

func (fw *FrameWriter) WritePacket(pkt []byte) error

WritePacket converts a WG packet to TunSafe framing and writes it.

type StealthConfig

type StealthConfig struct {
	PrivateKey string // Base64 X25519 private key
	PublicKey  string // Base64 X25519 server public key
	ServerIP   string // Server entry IP
	Port       int    // TCP port (default 443)
	SNI        string // TLS SNI (Server Name Indication)
	Address    string // VPN interface address (e.g., "10.2.0.2/32")
}

StealthConfig holds everything needed for a stealth WireGuard-over-TLS connection.

type StealthManager

type StealthManager struct {
	OnLog func(string) // optional debug logger
	// contains filtered or unexported fields
}

StealthManager manages a WireGuard-over-TLS tunnel using wireguard-go userspace.

func NewStealthManager

func NewStealthManager() *StealthManager

NewStealthManager creates a new stealth tunnel manager.

func (*StealthManager) Close

func (m *StealthManager) Close() error

Close releases resources.

func (*StealthManager) Down

func (m *StealthManager) Down() error

Down tears down the stealth tunnel.

func (*StealthManager) IfIndex

func (m *StealthManager) IfIndex() int

IfIndex returns the TUN interface index.

func (*StealthManager) Link

func (m *StealthManager) Link() netlink.Link

Link returns the netlink.Link for the TUN interface.

func (*StealthManager) Stats

func (m *StealthManager) Stats() (rxBytes, txBytes int64, lastHandshake time.Time, err error)

Stats returns WireGuard peer stats. For stealth, we read from wireguard-go's IPC.

func (*StealthManager) Up

func (m *StealthManager) Up(cfg *StealthConfig) error

Up creates the TUN device, establishes TLS, and starts wireguard-go.

type TLSBind

type TLSBind struct {
	// contains filtered or unexported fields
}

TLSBind implements conn.Bind for WireGuard-over-TLS (Stealth protocol).

Matches Proton's StdNetBindTcp lazy-connect pattern: - Open() just marks the bind as ready, doesn't connect - The actual TCP+TLS connection is established on first Send/Receive - TunSafe framing wraps WG packets in the TLS stream

func NewTLSBind

func NewTLSBind(serverIP string, port int, sni string) *TLSBind

NewTLSBind creates a new TLS-based WireGuard bind.

func (*TLSBind) BatchSize

func (b *TLSBind) BatchSize() int

BatchSize returns 1 since TCP is a sequential stream.

func (*TLSBind) Close

func (b *TLSBind) Close() error

Close tears down the TLS and TCP connections.

func (*TLSBind) Open

func (b *TLSBind) Open(port uint16) ([]conn.ReceiveFunc, uint16, error)

Open puts the bind into listening state. Connection is established lazily.

func (*TLSBind) ParseEndpoint

func (b *TLSBind) ParseEndpoint(s string) (conn.Endpoint, error)

ParseEndpoint parses a string endpoint.

func (*TLSBind) Send

func (b *TLSBind) Send(bufs [][]byte, ep conn.Endpoint) error

Send writes WireGuard packets via TunSafe framing over the TLS connection.

func (*TLSBind) SetMark

func (b *TLSBind) SetMark(mark uint32) error

SetMark stores the fwmark for SO_MARK on the TCP socket.

type TLSEndpoint

type TLSEndpoint struct {
	// contains filtered or unexported fields
}

TLSEndpoint implements conn.Endpoint for the TLS connection.

func (*TLSEndpoint) ClearSrc

func (e *TLSEndpoint) ClearSrc()

func (*TLSEndpoint) DstIP

func (e *TLSEndpoint) DstIP() netip.Addr

func (*TLSEndpoint) DstToBytes

func (e *TLSEndpoint) DstToBytes() []byte

func (*TLSEndpoint) DstToString

func (e *TLSEndpoint) DstToString() string

func (*TLSEndpoint) SrcIP

func (e *TLSEndpoint) SrcIP() netip.Addr

func (*TLSEndpoint) SrcToString

func (e *TLSEndpoint) SrcToString() string