userspace

Documentation

Overview

Package userspace provides a service.Backend that runs each interface as an in-process userspace WireGuard device using the amneziawg-go library — for hosts without a (matching) AmneziaWG kernel module. It's wired in by the awg-agent-userspace binary via service.SetBackend; the rest of the agent is unchanged.

Unlike the kernel backend it needs no netlink library: the interface is a TUN the amneziawg-go library creates in-process, and its address/MTU/up are set with the `ip` command (the same tool the agent already uses for lifecycle hooks, and the way jwg / awg-quick's userspace path do it). So the userspace build doesn't pull in vishvananda/netlink at all.

Index

• type Backend
  • func New() *Backend
  • func (b *Backend) Add(iface string, _ bool) error
  • func (b *Backend) AddrAdd(iface, addr string) error
  • func (b *Backend) Delete(iface string) error
  • func (b *Backend) Down(iface string) error
  • func (b *Backend) Exists(iface string) bool
  • func (b *Backend) Info() service.BackendInfo
  • func (b *Backend) SetMTU(iface string, mtu int) error
  • func (b *Backend) SyncAddr(iface, addr string) error
  • func (b *Backend) Up(iface string) error

Types

type Backend

type Backend struct {
	// contains filtered or unexported fields
}

Backend runs interfaces as in-process userspace WireGuard devices via amneziawg-go. Add creates the TUN + device + UAPI socket; Delete tears them down; the address/MTU/up operations shell out to `ip`. The device config itself is still pushed and read back through wgctrl, which finds the device's UAPI socket under /var/run/amneziawg (the same path the admin's agent client already probes) — so nothing above the backend changes.

func New

func New() *Backend

New returns a userspace Backend backed by the in-process amneziawg-go library.

func (*Backend) Add

func (b *Backend) Add(iface string, _ bool) error

Add creates the interface's userspace TUN, its amneziawg-go device and the UAPI socket wgctrl configures it through. The device stays down until the caller brings the link up (Up → the TUN's up event) and pushes its config over the UAPI socket, matching the kernel backend's lifecycle. The amnezia flag is irrelevant here: the amneziawg-go device serves both plain WireGuard and AmneziaWG, deciding per the obfuscation params pushed over the UAPI.

func (*Backend) AddrAdd

func (b *Backend) AddrAdd(iface, addr string) error

func (*Backend) Delete

func (b *Backend) Delete(iface string) error

Delete tears down the interface's UAPI socket and amneziawg-go device, which removes the TUN. Idempotent: an interface this backend didn't create is a no-op here — the caller's netlink-free teardown still runs.

func (*Backend) Down

func (b *Backend) Down(iface string) error

func (*Backend) Exists

func (b *Backend) Exists(iface string) bool

Exists reports whether this backend is running a device for iface. Unlike the kernel backend it doesn't probe netlink: a userspace TUN's lifetime is this process's, so the in-process map is authoritative (a device from a previous run is gone with that process).

func (*Backend) Info

func (b *Backend) Info() service.BackendInfo

Info reports the userspace backend's capabilities. The amneziawg-go device serves both plain WireGuard and AmneziaWG in process, needing no kernel module, so both kinds are always creatable and KernelModule is always false.

func (*Backend) SetMTU

func (b *Backend) SetMTU(iface string, mtu int) error

func (*Backend) SyncAddr

func (b *Backend) SyncAddr(iface, addr string) error

SyncAddr makes addr the interface's only address: flush what's there, then add it (mirrors the kernel backend's remove-others-then-set, via `ip`).

func (*Backend) Up

func (b *Backend) Up(iface string) error