device

package
v0.5.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 17, 2026 License: MIT Imports: 44 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	RekeyAfterMessages      = (1 << 60)
	RejectAfterMessages     = (1 << 64) - (1 << 13) - 1
	RekeyAfterTime          = time.Second * 120
	RekeyAttemptTime        = time.Second * 90
	RekeyTimeout            = time.Second * 5
	MaxTimerHandshakes      = 90 / 5 /* RekeyAttemptTime / RekeyTimeout */
	RekeyTimeoutJitterMaxMs = 334
	RejectAfterTime         = time.Second * 180
	KeepaliveTimeout        = time.Second * 10
	CookieRefreshTime       = time.Second * 120
	HandshakeInitiationRate = time.Second / 50
	PaddingMultiple         = 16
)
View Source 
const (
	MinMessageSize = MessageKeepaliveSize                  // minimum size of transport message (keepalive)
	MaxMessageSize = MaxSegmentSize                        // maximum size of transport message
	MaxContentSize = MaxSegmentSize - MessageTransportSize // maximum size of transport message content

	// Keep transport message sizing fixed and reserve a small amount of extra
	// headroom for TUN implementations that require larger adapter offsets.
	MaxTunOffsetHeadroom = 64
	MessageBufferSize    = MaxMessageSize + MaxTunOffsetHeadroom
)
View Source 
const (
	UnderLoadAfterTime = time.Second // how long does the device remain under load after detected
	MaxPeers           = 1 << 16     // maximum number of configured peers
)
View Source 
const (
	IPv4offsetTotalLength = 2
	IPv4offsetSrc         = 12
	IPv4offsetDst         = IPv4offsetSrc + net.IPv4len
)
View Source 
const (
	IPv6offsetPayloadLength = 4
	IPv6offsetSrc           = 8
	IPv6offsetDst           = IPv6offsetSrc + net.IPv6len
)
View Source 
const (
	NoiseConstruction = "Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s"
	WGIdentifier      = "WireGuard v1 zx2c4 Jason@zx2c4.com"
	WGLabelMAC1       = "mac1----"
	WGLabelCookie     = "cookie--"
)
View Source 
const (
	MessageUnknownType     = 0
	MessageInitiationType  = 1
	MessageResponseType    = 2
	MessageCookieReplyType = 3
	MessageTransportType   = 4
)
View Source 
const (
	MessageInitiationSize      = 148                                           // size of handshake initiation message
	MessageResponseSize        = 92                                            // size of response message
	MessageCookieReplySize     = 64                                            // size of cookie reply message
	MessageTransportHeaderSize = 16                                            // size of data preceding content in transport message
	MessageTransportSize       = MessageTransportHeaderSize + poly1305.TagSize // size of empty transport
	MessageKeepaliveSize       = MessageTransportSize                          // size of keepalive
	MessageHandshakeSize       = MessageInitiationSize                         // size of largest handshake related message
)
View Source 
const (
	MessageTransportOffsetReceiver = 4
	MessageTransportOffsetCounter  = 8
	MessageTransportOffsetContent  = 16
)
View Source 
const (
	NoisePublicKeySize    = 32
	NoisePrivateKeySize   = 32
	NoisePresharedKeySize = 32
)
View Source 
const (
	QueueStagedSize            = conn.IdealBatchSize
	QueueOutboundSize          = 1024
	QueueInboundSize           = 1024
	QueueHandshakeSize         = 1024
	MaxSegmentSize             = (1 << 16) - 1 // largest possible UDP datagram
	PreallocatedBuffersPerPool = 0             // Disable and allow for infinite memory growth
)
View Source 
const (
	// DefaultRuntimeStatsByteDelta is the default traffic delta required before
	// runtime stats subscribers are notified about RX/TX byte changes.
	DefaultRuntimeStatsByteDelta uint64 = 10 << 20

	// DefaultRuntimeStatsPacketDelta is the default traffic delta required before
	// runtime stats subscribers are notified about RX/TX packet changes.
	DefaultRuntimeStatsPacketDelta uint64 = 100
)
View Source 
const DefaultMTU = 1420
View Source 
const LogLevelVerbose = LogLevelDebug

Backward-compatible alias for the old verbose level.

Variables

View Source 
var (
	InitialChainKey [blake2s.Size]byte
	InitialHash     [blake2s.Size]byte
	ZeroNonce       [chacha20poly1305.NonceSize]byte
)

Functions

func HMAC1 

func HMAC1(sum *[blake2s.Size]byte, key, in0 []byte)

func HMAC2 

func HMAC2(sum *[blake2s.Size]byte, key, in0, in1 []byte)

func KDF1 

func KDF1(t0 *[blake2s.Size]byte, key, input []byte)

func KDF2 

func KDF2(t0, t1 *[blake2s.Size]byte, key, input []byte)

func KDF3 

func KDF3(t0, t1, t2 *[blake2s.Size]byte, key, input []byte)

func ReceiveErrorShouldRecover added in v0.3.2 

func ReceiveErrorShouldRecover(err error) bool

ReceiveErrorShouldRecover reports whether an unexpected receive error is a candidate for caller-controlled bind recovery.

func ValidateAmneziaWGConfig added in v0.3.0 

func ValidateAmneziaWGConfig(cfg AmneziaWGConfig) error

ValidateAmneziaWGConfig validates a complete AmneziaWG configuration.

func ValidateAmneziaWGConfigPatch added in v0.3.0 

func ValidateAmneziaWGConfigPatch(patch AmneziaWGConfigPatch) error

ValidateAmneziaWGConfigPatch validates patch-local AmneziaWG values.

func ValidateConfig added in v0.3.0 

func ValidateConfig(cfg DeviceConfig) error

ValidateConfig validates a full device configuration without mutating a Device.

func ValidateConfigWithOptions added in v0.3.0 

func ValidateConfigWithOptions(cfg DeviceConfig, opts ValidationOptions) error

ValidateConfigWithOptions validates a full device configuration with optional parser dependencies.

func ValidatePeerConfig added in v0.3.0 

func ValidatePeerConfig(peer PeerConfig) error

ValidatePeerConfig validates a single peer configuration without mutating a Device.

Types

type AllowedIPs 

type AllowedIPs struct {
	IPv4 *trieEntry
	IPv6 *trieEntry
	// contains filtered or unexported fields
}

func (*AllowedIPs) EntriesForPeer 

func (table *AllowedIPs) EntriesForPeer(peer *Peer, cb func(prefix netip.Prefix) bool)

func (*AllowedIPs) Insert 

func (table *AllowedIPs) Insert(prefix netip.Prefix, peer *Peer)

func (*AllowedIPs) Lookup 

func (table *AllowedIPs) Lookup(ip []byte) *Peer

func (*AllowedIPs) Remove 

func (table *AllowedIPs) Remove(prefix netip.Prefix, peer *Peer)

func (*AllowedIPs) RemoveByPeer 

func (table *AllowedIPs) RemoveByPeer(peer *Peer)

type AmneziaWGConfig 

type AmneziaWGConfig struct {
	JunkCount         int
	JunkMin           int
	JunkMax           int
	InitHeader        AmneziaWGHeaderRange
	ResponseHeader    AmneziaWGHeaderRange
	CookieHeader      AmneziaWGHeaderRange
	TransportHeader   AmneziaWGHeaderRange
	InitPadding       int
	ResponsePadding   int
	CookiePadding     int
	TransportPadding  int
	InitiationPackets [amneziaPacketCount]string
}

func DefaultAmneziaWGConfig 

func DefaultAmneziaWGConfig() AmneziaWGConfig

type AmneziaWGConfigPatch 

type AmneziaWGConfigPatch struct {
	JunkCount         *int
	JunkMin           *int
	JunkMax           *int
	InitHeader        *AmneziaWGHeaderRange
	ResponseHeader    *AmneziaWGHeaderRange
	CookieHeader      *AmneziaWGHeaderRange
	TransportHeader   *AmneziaWGHeaderRange
	InitPadding       *int
	ResponsePadding   *int
	CookiePadding     *int
	TransportPadding  *int
	InitiationPackets [amneziaPacketCount]*string
}

type AmneziaWGHeaderRange 

type AmneziaWGHeaderRange struct {
	Start uint32
	End   uint32
}

func DefaultAmneziaWGHeaderRange 

func DefaultAmneziaWGHeaderRange(messageType uint32) AmneziaWGHeaderRange

func ParseAmneziaWGHeaderRange 

func ParseAmneziaWGHeaderRange(spec string) (AmneziaWGHeaderRange, error)

func (AmneziaWGHeaderRange) Generate 

func (r AmneziaWGHeaderRange) Generate() uint32

func (AmneziaWGHeaderRange) Spec 

func (r AmneziaWGHeaderRange) Spec() string

func (AmneziaWGHeaderRange) Validate 

func (r AmneziaWGHeaderRange) Validate(value uint32) bool

type ApplyConfigOptions added in v0.3.2 

type ApplyConfigOptions struct {
	ReplacePeers   bool
	ApplyEndpoints bool
	ActivatePeers  bool
}

type CookieChecker 

type CookieChecker struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

func (*CookieChecker) CheckMAC1 

func (st *CookieChecker) CheckMAC1(msg []byte) bool

func (*CookieChecker) CheckMAC2 

func (st *CookieChecker) CheckMAC2(msg, src []byte) bool

func (*CookieChecker) CreateReply 

func (st *CookieChecker) CreateReply(
	msg []byte,
	recv uint32,
	src []byte,
	msgType uint32,
) (*MessageCookieReply, error)

func (*CookieChecker) Init 

func (st *CookieChecker) Init(pk NoisePublicKey)

type CookieGenerator 

type CookieGenerator struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

func (*CookieGenerator) AddMacs 

func (st *CookieGenerator) AddMacs(msg []byte)

func (*CookieGenerator) ConsumeReply 

func (st *CookieGenerator) ConsumeReply(msg *MessageCookieReply) bool

func (*CookieGenerator) Init 

func (st *CookieGenerator) Init(pk NoisePublicKey)

type DefaultLogger 

type DefaultLogger struct {
	// contains filtered or unexported fields
}

DefaultLogger writes log lines to stdout with a severity prefix.

func (*DefaultLogger) Debug 

func (l *DefaultLogger) Debug(args ...any)

func (*DefaultLogger) Debugf 

func (l *DefaultLogger) Debugf(format string, args ...any)

func (*DefaultLogger) Err 

func (l *DefaultLogger) Err(args ...any)

func (*DefaultLogger) Errf 

func (l *DefaultLogger) Errf(format string, args ...any)

func (*DefaultLogger) Fatal 

func (l *DefaultLogger) Fatal(args ...any)

func (*DefaultLogger) Fatalf 

func (l *DefaultLogger) Fatalf(format string, args ...any)

func (*DefaultLogger) Info 

func (l *DefaultLogger) Info(args ...any)

func (*DefaultLogger) Infof 

func (l *DefaultLogger) Infof(format string, args ...any)

func (*DefaultLogger) Warn 

func (l *DefaultLogger) Warn(args ...any)

func (*DefaultLogger) Warnf 

func (l *DefaultLogger) Warnf(format string, args ...any)

type Device 

type Device struct {
	// contains filtered or unexported fields
}

func NewDevice 

func NewDevice(tunDevice gtun.Tun, bind conn.Bind, logger Logger, spawner gonnect.Spawner, options DeviceOptions) *Device

NewDevice creates a WireGuard device and starts its background workers.

Long-lived workers are started with spawner when it is non-nil, allowing the caller to observe and manage worker lifecycle through gonnect. Passing nil preserves direct goroutine spawning.

func (*Device) ActivatePeer 

func (device *Device) ActivatePeer(publicKey NoisePublicKey) error

ActivatePeer applies the same post-configuration activation used by UAPI. If the device is up, it starts the peer and flushes any staged packets.

func (*Device) AddPeerAllowedIP 

func (device *Device) AddPeerAllowedIP(publicKey NoisePublicKey, prefix netip.Prefix) error

func (*Device) AmneziaWGConfig 

func (device *Device) AmneziaWGConfig() AmneziaWGConfig

func (*Device) ApplyConfig added in v0.3.2 

func (device *Device) ApplyConfig(cfg DeviceConfig, opts ApplyConfigOptions) error

ApplyConfig reconciles the device with cfg according to opts.

func (*Device) AttachBind 

func (device *Device) AttachBind(bind conn.Bind) error

AttachBind attaches a bind to a device that is currently detached.

func (*Device) AttachTUN 

func (device *Device) AttachTUN(tunDevice gtun.Tun) error

AttachTUN attaches a TUN to a device that is currently detached.

func (*Device) BatchSize 

func (device *Device) BatchSize() int

BatchSize returns the BatchSize for the device as a whole which is the max of the bind batch size and the tun batch size. The batch size reported by device is the size used to construct memory pools, and is the allowed batch size for the lifetime of the device.

func (*Device) Bind 

func (device *Device) Bind() conn.Bind

func (*Device) BindClose 

func (device *Device) BindClose() error

func (*Device) BindSetMark 

func (device *Device) BindSetMark(mark uint32) error

func (*Device) BindUpdate 

func (device *Device) BindUpdate() error

func (*Device) ClearPeerAmneziaWGConfig 

func (device *Device) ClearPeerAmneziaWGConfig(publicKey NoisePublicKey) error

func (*Device) Close 

func (device *Device) Close()

func (*Device) Config 

func (device *Device) Config() DeviceConfig

func (*Device) ConsumeMessageInitiation 

func (device *Device) ConsumeMessageInitiation(msg *MessageInitiation) *Peer

func (*Device) ConsumeMessageResponse 

func (device *Device) ConsumeMessageResponse(msg *MessageResponse) *Peer

func (*Device) CreateMessageInitiation 

func (device *Device) CreateMessageInitiation(peer *Peer) (*MessageInitiation, error)

func (*Device) CreateMessageResponse 

func (device *Device) CreateMessageResponse(peer *Peer) (*MessageResponse, error)

func (*Device) DeleteKeypair 

func (device *Device) DeleteKeypair(key *Keypair)

func (*Device) DetachBind 

func (device *Device) DetachBind() error

DetachBind closes and removes the currently attached bind, if any. If the device is up, active peer sessions are stopped until another bind is attached.

func (*Device) DetachTUN 

func (device *Device) DetachTUN() error

DetachTUN closes and removes the currently attached TUN, if any.

func (*Device) DeterminePacketTypeAndPadding 

func (device *Device) DeterminePacketTypeAndPadding(packet []byte, expectedType uint32) (uint32, int)

func (*Device) DisableSomeRoamingForBrokenMobileSemantics 

func (device *Device) DisableSomeRoamingForBrokenMobileSemantics()

DisableSomeRoamingForBrokenMobileSemantics should ideally be called before peers are created, though it will try to deal with it, and race maybe, if called after.

func (*Device) Down 

func (device *Device) Down() error

func (*Device) Fwmark 

func (device *Device) Fwmark() uint32

func (*Device) GetInboundElement 

func (device *Device) GetInboundElement() *QueueInboundElement

func (*Device) GetInboundElementsContainer 

func (device *Device) GetInboundElementsContainer() *QueueInboundElementsContainer

func (*Device) GetMessageBuffer 

func (device *Device) GetMessageBuffer() *[MessageBufferSize]byte

func (*Device) GetOutboundElement 

func (device *Device) GetOutboundElement() *QueueOutboundElement

func (*Device) GetOutboundElementsContainer 

func (device *Device) GetOutboundElementsContainer() *QueueOutboundElementsContainer

func (*Device) IpcGet 

func (device *Device) IpcGet() (string, error)

func (*Device) IpcGetOperation 

func (device *Device) IpcGetOperation(w io.Writer) error

IpcGetOperation implements the WireGuard configuration protocol "get" operation. See https://www.wireguard.com/xplatform/#configuration-protocol for details.

func (*Device) IpcHandle 

func (device *Device) IpcHandle(socket net.Conn)

func (*Device) IpcSet 

func (device *Device) IpcSet(uapiConf string) error

func (*Device) IpcSetOperation 

func (device *Device) IpcSetOperation(r io.Reader) (err error)

IpcSetOperation implements the WireGuard configuration protocol "set" operation. See https://www.wireguard.com/xplatform/#configuration-protocol for details.

func (*Device) IsUnderLoad 

func (device *Device) IsUnderLoad() bool

func (*Device) ListenPort 

func (device *Device) ListenPort() uint16

func (*Device) LookupPeer 

func (device *Device) LookupPeer(pk NoisePublicKey) *Peer

func (*Device) NewOutboundElement 

func (device *Device) NewOutboundElement() *QueueOutboundElement

func (*Device) NewPeer 

func (device *Device) NewPeer(pk NoisePublicKey) (*Peer, error)

func (*Device) PeerAmneziaWGConfigOverride 

func (device *Device) PeerAmneziaWGConfigOverride(publicKey NoisePublicKey) (AmneziaWGConfigPatch, bool)

func (*Device) PeerConfig 

func (device *Device) PeerConfig(publicKey NoisePublicKey) (PeerConfig, bool)

func (*Device) PopulatePools 

func (device *Device) PopulatePools()

func (*Device) PrivateKey 

func (device *Device) PrivateKey() NoisePrivateKey

func (*Device) PutInboundElement 

func (device *Device) PutInboundElement(elem *QueueInboundElement)

func (*Device) PutInboundElementsContainer 

func (device *Device) PutInboundElementsContainer(c *QueueInboundElementsContainer)

func (*Device) PutMessageBuffer 

func (device *Device) PutMessageBuffer(msg *[MessageBufferSize]byte)

func (*Device) PutOutboundElement 

func (device *Device) PutOutboundElement(elem *QueueOutboundElement)

func (*Device) PutOutboundElementsContainer 

func (device *Device) PutOutboundElementsContainer(c *QueueOutboundElementsContainer)

func (*Device) RemoveAllPeers 

func (device *Device) RemoveAllPeers()

func (*Device) RemovePeer 

func (device *Device) RemovePeer(key NoisePublicKey)

func (*Device) RemovePeerAllowedIP 

func (device *Device) RemovePeerAllowedIP(publicKey NoisePublicKey, prefix netip.Prefix) error

func (*Device) ReplaceBind 

func (device *Device) ReplaceBind(bind conn.Bind) error

ReplaceBind atomically swaps the active bind attachment. If the device is up, active peer sessions are restarted around the transition.

func (*Device) ReplacePeerAllowedIPs 

func (device *Device) ReplacePeerAllowedIPs(publicKey NoisePublicKey, allowedIPs []netip.Prefix) error

func (*Device) ReplaceTUN 

func (device *Device) ReplaceTUN(tunDevice gtun.Tun) error

ReplaceTUN atomically swaps the active TUN attachment. The old TUN is closed to unblock its reader before the new one takes over.

func (*Device) RoutineDecryption 

func (device *Device) RoutineDecryption(id int)

func (*Device) RoutineEncryption 

func (device *Device) RoutineEncryption(id int)

Encrypts the elements in the queue * and marks them for sequential consumption (by releasing the mutex) * * Obs. One instance per core

func (*Device) RoutineHandshake 

func (device *Device) RoutineHandshake(id int)

Handles incoming packets related to handshake

func (*Device) RoutineReadFromTUN 

func (device *Device) RoutineReadFromTUN(tun *tunState)

func (*Device) RoutineReceiveIncoming 

func (device *Device) RoutineReceiveIncoming(maxBatchSize int, recv conn.ReceiveFunc)

Receives incoming datagrams for the device * * Every time the bind is updated a new routine is started for * IPv4 and IPv6 (separately)

func (*Device) RoutineTUNEventReader 

func (device *Device) RoutineTUNEventReader(tun *tunState)

func (*Device) RuntimeStats added in v0.3.1 

func (device *Device) RuntimeStats() RuntimeStats

RuntimeStats returns a current runtime stats snapshot.

func (*Device) SendHandshakeCookie 

func (device *Device) SendHandshakeCookie(initiatingElem *QueueHandshakeElement) error

func (*Device) SendKeepalivesToPeersWithCurrentKeypair 

func (device *Device) SendKeepalivesToPeersWithCurrentKeypair()

func (*Device) SetAmneziaWGConfig 

func (device *Device) SetAmneziaWGConfig(cfg AmneziaWGConfig) error

func (*Device) SetAmneziaWGConfigPatch 

func (device *Device) SetAmneziaWGConfigPatch(patch AmneziaWGConfigPatch) error

func (*Device) SetFwmark 

func (device *Device) SetFwmark(mark uint32) error

func (*Device) SetListenPort 

func (device *Device) SetListenPort(port uint16) error

func (*Device) SetPeerAmneziaWGConfig 

func (device *Device) SetPeerAmneziaWGConfig(publicKey NoisePublicKey, cfg AmneziaWGConfig) error

func (*Device) SetPeerAmneziaWGConfigPatch 

func (device *Device) SetPeerAmneziaWGConfigPatch(publicKey NoisePublicKey, patch AmneziaWGConfigPatch) error

func (*Device) SetPeerEndpoint 

func (device *Device) SetPeerEndpoint(publicKey NoisePublicKey, endpoint string) error

func (*Device) SetPeerPersistentKeepaliveInterval 

func (device *Device) SetPeerPersistentKeepaliveInterval(publicKey NoisePublicKey, seconds uint16) error

func (*Device) SetPeerPresharedKey 

func (device *Device) SetPeerPresharedKey(publicKey NoisePublicKey, presharedKey NoisePresharedKey) error

func (*Device) SetPeerProtocolVersion 

func (device *Device) SetPeerProtocolVersion(publicKey NoisePublicKey, version int) error

func (*Device) SetPrivateKey 

func (device *Device) SetPrivateKey(sk NoisePrivateKey) error

func (*Device) SetRuntimeStatsThresholds added in v0.3.1 

func (device *Device) SetRuntimeStatsThresholds(thresholds RuntimeStatsThresholds)

SetRuntimeStatsThresholds updates traffic notification thresholds. Peer lifecycle and handshake events still notify subscribers immediately.

func (*Device) SubscribeReceiveErrors added in v0.3.2 

func (device *Device) SubscribeReceiveErrors(cb func(ReceiveError)) func()

SubscribeReceiveErrors registers cb for receive-loop errors and returns an unsubscribe function. Callbacks are invoked asynchronously.

func (*Device) SubscribeRuntimeStats added in v0.3.1 

func (device *Device) SubscribeRuntimeStats(cb RuntimeStatsCallback) func()

SubscribeRuntimeStats registers cb for runtime stats updates and returns an unsubscribe function. The subscriber receives an initial snapshot asynchronously.

func (*Device) Up 

func (device *Device) Up() error

func (*Device) Wait 

func (device *Device) Wait() chan struct{}

type DeviceConfig 

type DeviceConfig struct {
	PrivateKey NoisePrivateKey
	ListenPort uint16
	Fwmark     uint32
	AmneziaWG  AmneziaWGConfig
	Peers      []PeerConfig
}

type DeviceOptions added in v0.5.0 

type DeviceOptions struct {
	// BatchSize controls the number of packet slots allocated for TUN and bind
	// processing batches. Values less than 1 use the historical default. Smaller
	// positive values can reduce retained memory in idle or low-throughput
	// devices, but may reduce peak packet throughput.
	//
	// The effective batch size is always raised to at least the batch size
	// required by the initially attached TUN and bind.
	BatchSize int

	// WorkerCount controls how many encryption, decryption, and handshake
	// workers are started. Values less than 1 use runtime.GOMAXPROCS(0).
	WorkerCount int
}

DeviceOptions controls construction-time sizing for a Device.

The zero value preserves the high-throughput batch sizing used by previous releases while deriving the default worker count from runtime.GOMAXPROCS(0), which reflects the scheduler parallelism available to this process.

type EndpointParser added in v0.3.0 

type EndpointParser interface {
	ParseEndpoint(string) (conn.Endpoint, error)
}

EndpointParser validates endpoint strings using bind-specific endpoint parsing.

type Handshake 

type Handshake struct {
	// contains filtered or unexported fields
}

func (*Handshake) Clear 

func (h *Handshake) Clear()

type IPCError 

type IPCError struct {
	// contains filtered or unexported fields
}

func (IPCError) Error 

func (s IPCError) Error() string

func (IPCError) ErrorCode 

func (s IPCError) ErrorCode() int64

func (IPCError) Unwrap 

func (s IPCError) Unwrap() error

type IndexTable 

type IndexTable struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

func (*IndexTable) Delete 

func (table *IndexTable) Delete(index uint32)

func (*IndexTable) Init 

func (table *IndexTable) Init()

func (*IndexTable) Lookup 

func (table *IndexTable) Lookup(id uint32) IndexTableEntry

func (*IndexTable) NewIndexForHandshake 

func (table *IndexTable) NewIndexForHandshake(peer *Peer, handshake *Handshake) (uint32, error)

func (*IndexTable) SwapIndexForKeypair 

func (table *IndexTable) SwapIndexForKeypair(index uint32, keypair *Keypair)

type IndexTableEntry 

type IndexTableEntry struct {
	// contains filtered or unexported fields
}

type Keypair 

type Keypair struct {
	// contains filtered or unexported fields
}

type Keypairs 

type Keypairs struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

func (*Keypairs) Current 

func (kp *Keypairs) Current() *Keypair

type LogLevel 

type LogLevel int

Log levels for use with NewLogger. 

const (
	LogLevelSilent LogLevel = iota
	LogLevelError
	LogLevelWarn
	LogLevelInfo
	LogLevelDebug
)

type Logger 

type Logger interface {
	Debug(args ...any)
	Debugf(format string, args ...any)
	Info(args ...any)
	Infof(format string, args ...any)
	Warn(args ...any)
	Warnf(format string, args ...any)
	Err(args ...any)
	Errf(format string, args ...any)
	Fatal(args ...any)
	Fatalf(format string, args ...any)
}

Logger provides logging for a Device. Implementations must be safe for concurrent use.

func NewLogger 

func NewLogger(level LogLevel, prepend string) Logger

NewLogger constructs the default stdout logger. It logs at the specified log level and above. It decorates log lines with the log level, date, time, and prepend.

type MessageCookieReply 

type MessageCookieReply struct {
	Type     uint32
	Receiver uint32
	Nonce    [chacha20poly1305.NonceSizeX]byte
	Cookie   [blake2s.Size128 + poly1305.TagSize]byte
}

type MessageInitiation 

type MessageInitiation struct {
	Type      uint32
	Sender    uint32
	Ephemeral NoisePublicKey
	Static    [NoisePublicKeySize + poly1305.TagSize]byte
	Timestamp [tai64n.TimestampSize + poly1305.TagSize]byte
	MAC1      [blake2s.Size128]byte
	MAC2      [blake2s.Size128]byte
}

type MessageResponse 

type MessageResponse struct {
	Type      uint32
	Sender    uint32
	Receiver  uint32
	Ephemeral NoisePublicKey
	Empty     [poly1305.TagSize]byte
	MAC1      [blake2s.Size128]byte
	MAC2      [blake2s.Size128]byte
}

type MessageTransport 

type MessageTransport struct {
	Type     uint32
	Receiver uint32
	Counter  uint64
	Content  []byte
}

type NoiseNonce 

type NoiseNonce uint64 // padded to 12-bytes

type NoisePresharedKey 

type NoisePresharedKey [NoisePresharedKeySize]byte

func ParsePresharedKey added in v0.3.2 

func ParsePresharedKey(value string) (NoisePresharedKey, error)

ParsePresharedKey parses a standard WireGuard base64 preshared key. Hex input is also accepted for compatibility with the lower-level FromHex API. An empty string returns the zero preshared key.

func (NoisePresharedKey) Base64 added in v0.3.2 

func (key NoisePresharedKey) Base64() string

func (*NoisePresharedKey) FromHex 

func (key *NoisePresharedKey) FromHex(src string) error

type NoisePrivateKey 

type NoisePrivateKey [NoisePrivateKeySize]byte

func GeneratePrivateKey added in v0.3.2 

func GeneratePrivateKey() (NoisePrivateKey, error)

GeneratePrivateKey returns a new Curve25519 private key suitable for WireGuard static identity use.

func ParsePrivateKey added in v0.3.2 

func ParsePrivateKey(value string) (NoisePrivateKey, error)

ParsePrivateKey parses a standard WireGuard base64 private key. Hex input is also accepted for compatibility with the lower-level FromHex API. An empty string returns the zero private key.

func (NoisePrivateKey) Base64 added in v0.3.2 

func (key NoisePrivateKey) Base64() string

func (NoisePrivateKey) Equals 

func (key NoisePrivateKey) Equals(tar NoisePrivateKey) bool

func (*NoisePrivateKey) FromHex 

func (key *NoisePrivateKey) FromHex(src string) (err error)

func (*NoisePrivateKey) FromMaybeZeroHex 

func (key *NoisePrivateKey) FromMaybeZeroHex(src string) (err error)

func (NoisePrivateKey) IsZero 

func (key NoisePrivateKey) IsZero() bool

func (NoisePrivateKey) PublicKey added in v0.3.2 

func (key NoisePrivateKey) PublicKey() NoisePublicKey

type NoisePublicKey 

type NoisePublicKey [NoisePublicKeySize]byte

func ParsePublicKey added in v0.3.2 

func ParsePublicKey(value string) (NoisePublicKey, error)

ParsePublicKey parses a standard WireGuard base64 public key. Hex input is also accepted for compatibility with the lower-level FromHex API. Empty and all-zero public keys are rejected.

func (NoisePublicKey) Base64 added in v0.3.2 

func (key NoisePublicKey) Base64() string

func (NoisePublicKey) Equals 

func (key NoisePublicKey) Equals(tar NoisePublicKey) bool

func (*NoisePublicKey) FromHex 

func (key *NoisePublicKey) FromHex(src string) error

func (NoisePublicKey) IsZero 

func (key NoisePublicKey) IsZero() bool

type NopLogger 

type NopLogger struct{}

NopLogger discards all log output.

func (NopLogger) Debug 

func (NopLogger) Debug(args ...any)

func (NopLogger) Debugf 

func (NopLogger) Debugf(format string, args ...any)

func (NopLogger) Err 

func (NopLogger) Err(args ...any)

func (NopLogger) Errf 

func (NopLogger) Errf(format string, args ...any)

func (NopLogger) Fatal 

func (NopLogger) Fatal(args ...any)

func (NopLogger) Fatalf 

func (NopLogger) Fatalf(format string, args ...any)

func (NopLogger) Info 

func (NopLogger) Info(args ...any)

func (NopLogger) Infof 

func (NopLogger) Infof(format string, args ...any)

func (NopLogger) Warn 

func (NopLogger) Warn(args ...any)

func (NopLogger) Warnf 

func (NopLogger) Warnf(format string, args ...any)

type Peer 

type Peer struct {
	// contains filtered or unexported fields
}

func (*Peer) BeginSymmetricSession 

func (peer *Peer) BeginSymmetricSession() error

Derives a new keypair from the current handshake state *

func (*Peer) ExpireCurrentKeypairs 

func (peer *Peer) ExpireCurrentKeypairs()

func (*Peer) FlushStagedPackets 

func (peer *Peer) FlushStagedPackets()

func (*Peer) NewTimer 

func (peer *Peer) NewTimer(expirationFunction func(*Peer)) *Timer

func (*Peer) ReceivedWithKeypair 

func (peer *Peer) ReceivedWithKeypair(receivedKeypair *Keypair) bool

func (*Peer) RoutineSequentialReceiver 

func (peer *Peer) RoutineSequentialReceiver(maxBatchSize int)

func (*Peer) RoutineSequentialSender 

func (peer *Peer) RoutineSequentialSender(maxBatchSize int)

func (*Peer) SendBuffers 

func (peer *Peer) SendBuffers(buffers [][]byte) error

func (*Peer) SendHandshakeInitiation 

func (peer *Peer) SendHandshakeInitiation(isRetry bool) error

func (*Peer) SendHandshakeResponse 

func (peer *Peer) SendHandshakeResponse() error

func (*Peer) SendKeepalive 

func (peer *Peer) SendKeepalive()

Queues a keepalive if no packets are queued for peer

func (*Peer) SendStagedPackets 

func (peer *Peer) SendStagedPackets()

func (*Peer) SetEndpointFromPacket 

func (peer *Peer) SetEndpointFromPacket(endpoint conn.Endpoint)

func (*Peer) StagePackets 

func (peer *Peer) StagePackets(elems *QueueOutboundElementsContainer)

func (*Peer) Start 

func (peer *Peer) Start()

func (*Peer) Stop 

func (peer *Peer) Stop()

func (*Peer) String 

func (peer *Peer) String() string

func (*Peer) ZeroAndFlushAll 

func (peer *Peer) ZeroAndFlushAll()

type PeerConfig 

type PeerConfig struct {
	PublicKey                   NoisePublicKey
	PresharedKey                NoisePresharedKey
	ProtocolVersion             int
	Endpoint                    string
	LastHandshakeTime           time.Time
	TxBytes                     uint64
	RxBytes                     uint64
	PersistentKeepaliveInterval uint16
	AllowedIPs                  []netip.Prefix
	AmneziaWG                   *AmneziaWGConfig
}

type QueueHandshakeElement 

type QueueHandshakeElement struct {
	// contains filtered or unexported fields
}

type QueueInboundElement 

type QueueInboundElement struct {
	// contains filtered or unexported fields
}

type QueueInboundElementsContainer 

type QueueInboundElementsContainer struct {
	sync.Mutex
	// contains filtered or unexported fields
}

type QueueOutboundElement 

type QueueOutboundElement struct {
	// contains filtered or unexported fields
}

type QueueOutboundElementsContainer 

type QueueOutboundElementsContainer struct {
	sync.Mutex
	// contains filtered or unexported fields
}

type ReceiveError added in v0.3.2 

type ReceiveError struct {
	Name  string
	Err   error
	Fatal bool
}

type RuntimeStats added in v0.3.1 

type RuntimeStats struct {
	Timestamp time.Time

	PeerCount          int
	ActivePeerCount    int
	ConnectedPeerCount int

	RxBytes   uint64
	TxBytes   uint64
	RxPackets uint64
	TxPackets uint64

	LastHandshakeTime time.Time
}

RuntimeStats is a point-in-time device stats snapshot delivered to subscribers and returned by Device.RuntimeStats. Traffic counters are lifetime totals for the device. Connected peers are active peers with a recent completed handshake.

func (RuntimeStats) Equal added in v0.3.2 

func (stats RuntimeStats) Equal(other RuntimeStats) bool

Equal reports whether two runtime stats snapshots describe the same device state, ignoring the snapshot timestamp.

type RuntimeStatsCallback added in v0.3.1 

type RuntimeStatsCallback func(RuntimeStats)

RuntimeStatsCallback receives device runtime stats snapshots. Callbacks are invoked from a device-owned goroutine, not from packet processing goroutines.

type RuntimeStatsThresholds added in v0.3.1 

type RuntimeStatsThresholds struct {
	ByteDelta   uint64
	PacketDelta uint64
}

RuntimeStatsThresholds controls how often high-frequency traffic stats notify subscribers. Zero fields are replaced with the package defaults.

type Timer 

type Timer struct {
	*time.Timer
	// contains filtered or unexported fields
}

A Timer manages time-based aspects of the WireGuard protocol. Timer roughly copies the interface of the Linux kernel's struct timer_list.

func (*Timer) Del 

func (timer *Timer) Del()

func (*Timer) DelSync 

func (timer *Timer) DelSync()

func (*Timer) IsPending 

func (timer *Timer) IsPending() bool

func (*Timer) Mod 

func (timer *Timer) Mod(d time.Duration)

type ValidationOptions added in v0.3.0 

type ValidationOptions struct {
	EndpointParser EndpointParser
}

ValidationOptions configures optional dependencies for pure config validation.

type WaitPool 

type WaitPool struct {
	// contains filtered or unexported fields
}

func NewWaitPool 

func NewWaitPool(max uint32, new func() any) *WaitPool

func (*WaitPool) Get 

func (p *WaitPool) Get() any

func (*WaitPool) Put 

func (p *WaitPool) Put(x any)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.