swu

package
v0.0.0-...-4c693b6 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: AGPL-3.0 Imports: 22 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	DataplaneModeDisabled  = "disabled"
	DataplaneModeUserspace = "userspace"
	DataplaneModeKernel    = "kernel"
)
View Source 
const DefaultNATTUDPPort = "4500"
View Source 
const EAPReauthenticationSnapshotVersion = 1

Variables

View Source 
var (
	ErrInvalidPacketTunnel       = errors.New("invalid swu packet tunnel")
	ErrPacketTunnelClosed        = errors.New("swu packet tunnel closed")
	ErrUnsupportedInnerPacket    = errors.New("unsupported inner packet")
	ErrInvalidChildSARekeyPolicy = errors.New("invalid swu child sa rekey policy")
)
View Source 
var (
	ErrInvalidTunnelConfig = errors.New("invalid swu tunnel config")
	ErrTunnelNotReady      = errors.New("swu tunnel not ready")
)
View Source 
var ErrInvalidEAPReauthenticationState = errors.New("invalid eap reauthentication state")
View Source 
var ErrInvalidIKEControl = errors.New("invalid swu ike control")
View Source 
var ErrInvalidIKELiveness = errors.New("invalid swu ike liveness")
View Source 
var ErrInvalidIKETunnelManager = errors.New("invalid swu ike tunnel manager")
View Source 
var ErrInvalidPacketPump = errors.New("invalid swu packet pump")
View Source 
var ErrInvalidTUNRouting = errors.New("invalid swu tun routing")
View Source 
var ErrInvalidTUNTunnelManager = errors.New("invalid swu tun tunnel manager")
View Source 
var ErrInvalidXFRMConfig = errors.New("invalid swu xfrm config")
View Source 
var ErrMOBIKEUpdateRejected = errors.New("mobike update rejected")

Functions

func NATTKeepalivePayload 

func NATTKeepalivePayload() []byte

func NewIKECloseHandler 

func NewIKECloseHandler(cfg IKECloseConfig) (func(context.Context) error, error)

func NewIKEMOBIKEHandler 

func NewIKEMOBIKEHandler(cfg IKEMOBIKEConfig) (func(context.Context, MOBIKERequest) (MOBIKEResult, error), error)

func NextHeaderForInnerPacket 

func NextHeaderForInnerPacket(packet []byte) (uint8, error)

Types

type ChildSARekeyAction 

type ChildSARekeyAction uint8
const (
	ChildSARekeyNoAction ChildSARekeyAction = iota
	ChildSARekeyDue
)

func (ChildSARekeyAction) String 

func (a ChildSARekeyAction) String() string

type ChildSARekeyController 

type ChildSARekeyController interface {
	RekeyChildSA(context.Context) (TunnelResult, error)
}

type ChildSARekeyDecision 

type ChildSARekeyDecision struct {
	Action        ChildSARekeyAction
	EstablishedAt time.Time
	DueAt         time.Time
	ExpiresAt     time.Time
	NextDue       time.Time
	Age           time.Duration
	TimeToExpire  time.Duration
	Lifetime      time.Duration
	LeadTime      time.Duration
	Expired       bool
	Reason        string
}

type ChildSARekeyHandler 

type ChildSARekeyHandler func(context.Context) (ikev2.ChildSAResult, error)

type ChildSARekeyPolicy 

type ChildSARekeyPolicy struct {
	Lifetime time.Duration
	LeadTime time.Duration
	Disabled bool
}

type ChildSARekeyScheduler 

type ChildSARekeyScheduler interface {
	RekeyChildSA(context.Context) (TunnelResult, error)
	NextChildSARekeyDue() (time.Time, bool)
	RunChildSARekeyDue(context.Context, time.Time) (ChildSARekeyDecision, error)
	ChildSARekeySnapshot() ChildSARekeySnapshot
}

type ChildSARekeySnapshot 

type ChildSARekeySnapshot struct {
	Enabled       bool
	EstablishedAt time.Time
	DueAt         time.Time
	ExpiresAt     time.Time
	Lifetime      time.Duration
	LeadTime      time.Duration
}

type ChildSARekeyState 

type ChildSARekeyState struct {
	// contains filtered or unexported fields
}

func NewChildSARekeyState 

func NewChildSARekeyState(policy ChildSARekeyPolicy, establishedAt time.Time) (*ChildSARekeyState, error)

func (*ChildSARekeyState) Advance 

func (s *ChildSARekeyState) Advance(now time.Time) ChildSARekeyDecision

func (*ChildSARekeyState) NextDue 

func (s *ChildSARekeyState) NextDue() (time.Time, bool)

func (*ChildSARekeyState) RecordRekey 

func (s *ChildSARekeyState) RecordRekey(at time.Time)

func (*ChildSARekeyState) Snapshot 

func (s *ChildSARekeyState) Snapshot() ChildSARekeySnapshot

type ChildSARekeyWindow 

type ChildSARekeyWindow struct {
	Enabled       bool
	Due           bool
	Expired       bool
	EstablishedAt time.Time
	DueAt         time.Time
	ExpiresAt     time.Time
	Age           time.Duration
	TimeToRekey   time.Duration
	TimeToExpire  time.Duration
	Lifetime      time.Duration
	LeadTime      time.Duration
}

func ChildSARekeyWindowFor 

func ChildSARekeyWindowFor(policy ChildSARekeyPolicy, establishedAt, now time.Time) (ChildSARekeyWindow, error)

type EAPReauthenticationKeySnapshot 

type EAPReauthenticationKeySnapshot struct {
	MK      []byte `json:"mk,omitempty"`
	KEncr   []byte `json:"k_encr,omitempty"`
	KAut    []byte `json:"k_aut,omitempty"`
	KRe     []byte `json:"k_re,omitempty"`
	MSK     []byte `json:"msk,omitempty"`
	EMSK    []byte `json:"emsk,omitempty"`
	CKPrime []byte `json:"ck_prime,omitempty"`
	IKPrime []byte `json:"ik_prime,omitempty"`
}

type EAPReauthenticationSnapshot 

type EAPReauthenticationSnapshot struct {
	Version             int                            `json:"version"`
	ReauthIdentity      string                         `json:"reauth_identity,omitempty"`
	Pseudonym           string                         `json:"pseudonym,omitempty"`
	Expiry              time.Time                      `json:"expiry,omitempty"`
	OperatorRealm       string                         `json:"operator_realm,omitempty"`
	Counter             uint16                         `json:"counter,omitempty"`
	CounterOK           bool                           `json:"counter_ok,omitempty"`
	Keys                EAPReauthenticationKeySnapshot `json:"keys,omitempty"`
	Reauthenticated     bool                           `json:"reauthenticated,omitempty"`
	CounterTooSmall     bool                           `json:"counter_too_small,omitempty"`
	LastAcceptedCounter uint16                         `json:"last_accepted_counter,omitempty"`
	LastRejectedCounter uint16                         `json:"last_rejected_counter,omitempty"`
}

func (EAPReauthenticationSnapshot) State 

func (s EAPReauthenticationSnapshot) State() (EAPReauthenticationState, error)

type EAPReauthenticationState 

type EAPReauthenticationState struct {
	Identity            string
	Counter             uint16
	CounterOK           bool
	Keys                eapaka.Keys
	NextPseudonym       string
	ExpiresAt           time.Time
	OperatorRealm       string
	Reauthenticated     bool
	CounterTooSmall     bool
	LastAcceptedCounter uint16
	LastRejectedCounter uint16
}

func (EAPReauthenticationState) AnyUsableAt 

func (s EAPReauthenticationState) AnyUsableAt(now time.Time) bool

func (EAPReauthenticationState) ApplyUpdate 

func (s EAPReauthenticationState) ApplyUpdate(update EAPReauthenticationUpdate) (EAPReauthenticationState, bool)

func (EAPReauthenticationState) Expired 

func (s EAPReauthenticationState) Expired(now time.Time) bool

func (EAPReauthenticationState) MatchesOperatorRealm 

func (s EAPReauthenticationState) MatchesOperatorRealm(realm string) bool

func (EAPReauthenticationState) PseudonymUsableAt 

func (s EAPReauthenticationState) PseudonymUsableAt(now time.Time) bool

func (EAPReauthenticationState) ReauthenticationUsableAt 

func (s EAPReauthenticationState) ReauthenticationUsableAt(now time.Time) bool

func (EAPReauthenticationState) Snapshot 

func (s EAPReauthenticationState) Snapshot() EAPReauthenticationSnapshot

func (EAPReauthenticationState) Usable 

func (s EAPReauthenticationState) Usable() bool

type EAPReauthenticationStateManager 

type EAPReauthenticationStateManager struct {
	Store         EAPReauthenticationStore
	Key           string
	OperatorRealm string
	Lifetime      time.Duration
	Now           func() time.Time
}

func (EAPReauthenticationStateManager) Delete 

func (m EAPReauthenticationStateManager) Delete(ctx context.Context) error

func (EAPReauthenticationStateManager) Load 

func (m EAPReauthenticationStateManager) Load(ctx context.Context) (EAPReauthenticationState, bool, error)

func (EAPReauthenticationStateManager) Save 

func (m EAPReauthenticationStateManager) Save(ctx context.Context, state EAPReauthenticationState) error

type EAPReauthenticationStore 

type EAPReauthenticationStore interface {
	LoadEAPReauthentication(context.Context, string) (EAPReauthenticationSnapshot, bool, error)
	SaveEAPReauthentication(context.Context, string, EAPReauthenticationSnapshot) error
	DeleteEAPReauthentication(context.Context, string) error
}

type EAPReauthenticationUpdate 

type EAPReauthenticationUpdate struct {
	NextReauthID    string
	NextPseudonym   string
	Keys            eapaka.Keys
	Reauthenticated bool
	CounterTooSmall bool
	Counter         uint16
	ExpiresAt       time.Time
	OperatorRealm   string
}

type EPDGRouteExclusion 

type EPDGRouteExclusion struct {
	Address       string
	InterfaceName string
	Via           string
	Source        string
	Table         string
	Tables        []string
	Metric        int
}

type EPDGRouteResolver 

type EPDGRouteResolver func(context.Context, string) ([]net.IP, error)

type ESPPacketReadWriteTransport 

type ESPPacketReadWriteTransport interface {
	ESPPacketTransport
	ESPPacketReceiver
}

type ESPPacketReceiver 

type ESPPacketReceiver interface {
	ReadESPPacket(context.Context) ([]byte, error)
}

type ESPPacketTransport 

type ESPPacketTransport interface {
	SendESPPacket(context.Context, []byte) error
}

type ESPPacketTransportCloser 

type ESPPacketTransportCloser interface {
	ESPPacketTransport
	Close(context.Context) error
}

type ESPPacketTransportFunc 

type ESPPacketTransportFunc func(context.Context, []byte) error

func (ESPPacketTransportFunc) SendESPPacket 

func (f ESPPacketTransportFunc) SendESPPacket(ctx context.Context, packet []byte) error

type ESPTransportConfig 

type ESPTransportConfig struct {
	EPDGAddress string
	RemoteAddr  string
	LocalAddr   string
	Timeout     time.Duration
}

type ExecIPCommandRunner 

type ExecIPCommandRunner struct {
	Path string
}

func (ExecIPCommandRunner) RunIP 

func (r ExecIPCommandRunner) RunIP(ctx context.Context, args ...string) error

type IKEAuthRunner 

type IKEAuthRunner func(context.Context, ikev2.FullAuthConfig) (ikev2.FullAuthResult, error)

type IKECloseConfig 

type IKECloseConfig struct {
	Transport     ikev2.InitTransport
	Init          ikev2.InitResult
	Keys          ikev2.IKEKeys
	ChildSA       ikev2.ChildSAResult
	NextMessageID uint32
	Payloads      []ikev2.Payload
	Random        io.Reader
}

type IKEESPTransportFactory 

type IKEESPTransportFactory func(TunnelConfig, ESPTransportConfig) (ESPPacketTransport, error)

type IKEInitRunner 

type IKEInitRunner func(context.Context, ikev2.InitConfig) (ikev2.InitResult, error)

type IKELivenessAction 

type IKELivenessAction uint8
const (
	IKELivenessNoAction IKELivenessAction = iota
	IKELivenessSendKeepalive
	IKELivenessSendDPD
	IKELivenessDeclareDead
)

func (IKELivenessAction) String 

func (a IKELivenessAction) String() string

type IKELivenessConfig 

type IKELivenessConfig struct {
	KeepaliveInterval  time.Duration
	DPDInterval        time.Duration
	DPDTimeout         time.Duration
	MaxMissedDPDProbes int
	DisableKeepalive   bool
	DisableDPD         bool
}

type IKELivenessController 

type IKELivenessController interface {
	AdvanceIKELiveness(context.Context, time.Time) (IKELivenessDecision, error)
	RecordIKELivenessInbound(time.Time)
	RecordIKELivenessOutbound(time.Time)
	RecordIKELivenessResult(time.Time, bool)
	IKELivenessSnapshot() IKELivenessSnapshot
}

type IKELivenessDecision 

type IKELivenessDecision struct {
	Action          IKELivenessAction
	ProbeID         uint32
	MissedDPDProbes int
	IdleFor         time.Duration
	Deadline        time.Time
	NextDue         time.Time
	Dead            bool
	Reason          string
}

type IKELivenessSnapshot 

type IKELivenessSnapshot struct {
	LastInbound      time.Time
	LastOutbound     time.Time
	LastDPDProbe     time.Time
	OutstandingDPD   bool
	ProbeID          uint32
	MissedDPDProbes  int
	Dead             bool
	KeepaliveEnabled bool
	DPDEnabled       bool
}

type IKELivenessState 

type IKELivenessState struct {
	// contains filtered or unexported fields
}

func NewIKELivenessState 

func NewIKELivenessState(cfg IKELivenessConfig, establishedAt time.Time) (*IKELivenessState, error)

func (*IKELivenessState) Advance 

func (s *IKELivenessState) Advance(now time.Time) IKELivenessDecision

func (*IKELivenessState) RecordInbound 

func (s *IKELivenessState) RecordInbound(at time.Time)

func (*IKELivenessState) RecordLivenessResult 

func (s *IKELivenessState) RecordLivenessResult(at time.Time, ok bool)

func (*IKELivenessState) RecordOutbound 

func (s *IKELivenessState) RecordOutbound(at time.Time)

func (*IKELivenessState) Snapshot 

func (s *IKELivenessState) Snapshot() IKELivenessSnapshot

type IKEMOBIKEConfig 

type IKEMOBIKEConfig struct {
	Transport             ikev2.InitTransport
	Init                  ikev2.InitResult
	Keys                  ikev2.IKEKeys
	NextMessageID         uint32
	Result                TunnelResult
	LocalIP               net.IP
	RemoteIP              net.IP
	LocalPort             uint16
	RemotePort            uint16
	AdditionalAddresses   []net.IP
	NoAdditionalAddresses bool
	Random                io.Reader
}

type IKEPacketSessionFactory 

type IKEPacketSessionFactory func(PacketSessionConfig) (TunnelSession, error)

type IKEPacketTunnelManager 

type IKEPacketTunnelManager struct {
	Config IKEPacketTunnelManagerConfig
}

func NewIKEPacketTunnelManager 

func NewIKEPacketTunnelManager(cfg IKEPacketTunnelManagerConfig) *IKEPacketTunnelManager

func (*IKEPacketTunnelManager) EstablishTunnel 

func (m *IKEPacketTunnelManager) EstablishTunnel(ctx context.Context, cfg TunnelConfig) (TunnelSession, error)

type IKEPacketTunnelManagerConfig 

type IKEPacketTunnelManagerConfig struct {
	Transport                ikev2.InitTransport
	ESPTransport             ESPPacketTransport
	SIM                      sim.AKAProvider
	Random                   io.Reader
	Timeout                  time.Duration
	LocalIP                  net.IP
	RemoteIP                 net.IP
	LocalPort                uint16
	RemotePort               uint16
	UseNonESPMarker          bool
	EAPIdentity              string
	Reauthentication         EAPReauthenticationState
	OnReauthenticationState  func(EAPReauthenticationState)
	ReauthenticationLifetime time.Duration
	InitiatorID              ikev2.Identity
	IKETransportFactory      IKETransportFactory
	ESPTransportFactory      IKEESPTransportFactory
	InitRunner               IKEInitRunner
	AuthRunner               IKEAuthRunner
	PacketSessionFactory     IKEPacketSessionFactory
	KernelXFRMManager        KernelXFRMManager
	KernelXFRMConfig         KernelXFRMConfig
	SA                       ikev2.SecurityAssociation
	ChildSA                  ikev2.SecurityAssociation
	ChildSPI                 []byte
	TSi                      ikev2.TrafficSelectors
	TSr                      ikev2.TrafficSelectors
	Configuration            ikev2.Configuration
	AdditionalAddresses      []net.IP
	NoAdditionalAddresses    bool
	Liveness                 IKELivenessConfig
	ChildSARekey             ChildSARekeyPolicy
	DisableControlPlaneHooks bool
}

type IKETransportConfig 

type IKETransportConfig struct {
	EPDGAddress     string
	RemoteAddr      string
	LocalAddr       string
	LocalIP         net.IP
	RemoteIP        net.IP
	LocalPort       uint16
	RemotePort      uint16
	Timeout         time.Duration
	UseNonESPMarker bool
}

type IKETransportFactory 

type IKETransportFactory func(TunnelConfig, IKETransportConfig) (ikev2.InitTransport, error)

type IKETunnelManager 

type IKETunnelManager = IKEPacketTunnelManager

func NewIKETunnelManager 

func NewIKETunnelManager(cfg IKETunnelManagerConfig) *IKETunnelManager

type IKETunnelManagerConfig 

type IKETunnelManagerConfig = IKEPacketTunnelManagerConfig

type IMSIdentity 

type IMSIdentity struct {
	IMPI   string
	IMPU   string
	Domain string
}

type IPCommandRunner 

type IPCommandRunner interface {
	RunIP(context.Context, ...string) error
}

type IPCommandRunnerFunc 

type IPCommandRunnerFunc func(context.Context, ...string) error

func (IPCommandRunnerFunc) RunIP 

func (f IPCommandRunnerFunc) RunIP(ctx context.Context, args ...string) error

type InnerPacketDevice 

type InnerPacketDevice interface {
	InnerPacketReader
	InnerPacketWriter
}

type InnerPacketDeviceCloser 

type InnerPacketDeviceCloser interface {
	InnerPacketDevice
	Close(context.Context) error
}

type InnerPacketReader 

type InnerPacketReader interface {
	ReadInnerPacket(context.Context) ([]byte, error)
}

type InnerPacketWriter 

type InnerPacketWriter interface {
	WriteInnerPacket(context.Context, []byte) error
}

type KernelXFRMConfig 

type KernelXFRMConfig struct {
	ChildSA              ikev2.ChildSAResult
	OuterLocalIP         string
	OuterRemoteIP        string
	InnerLocalPrefix     string
	InnerRemotePrefix    string
	ReqID                int
	Mark                 string
	InterfaceID          uint32
	IncludeForwardPolicy bool
	XFRMInterface        XFRMInterfaceConfig
	NATTraversal         XFRMNATTraversalConfig
}

func KernelXFRMConfigFromIKE 

func KernelXFRMConfigFromIKE(cfg KernelXFRMConfigFromIKEConfig) (KernelXFRMConfig, error)

KernelXFRMConfigFromIKE builds a validated XFRM config without applying kernel state.

type KernelXFRMConfigFromIKEConfig 

type KernelXFRMConfigFromIKEConfig struct {
	Tunnel               TunnelConfig
	Transport            IKETransportConfig
	Init                 ikev2.InitResult
	ChildSA              ikev2.ChildSAResult
	InnerLocalPrefix     string
	InnerRemotePrefix    string
	ReqID                int
	Mark                 string
	InterfaceID          uint32
	IncludeForwardPolicy bool
	XFRMInterface        XFRMInterfaceConfig
	NATTraversal         XFRMNATTraversalConfig
}

KernelXFRMConfigFromIKEConfig carries the negotiated IKE state needed to build a kernel XFRM config.

type KernelXFRMManager 

type KernelXFRMManager interface {
	Apply(context.Context, KernelXFRMConfig) (KernelXFRMState, error)
	Cleanup(context.Context, KernelXFRMState) error
}

type KernelXFRMState 

type KernelXFRMState struct {
	// contains filtered or unexported fields
}

type LinuxTUNRoutingManager 

type LinuxTUNRoutingManager struct {
	Runner IPCommandRunner
}

func (LinuxTUNRoutingManager) Apply 

func (m LinuxTUNRoutingManager) Apply(ctx context.Context, cfg TUNRoutingConfig) (TUNRoutingState, error)

func (LinuxTUNRoutingManager) Cleanup 

func (m LinuxTUNRoutingManager) Cleanup(ctx context.Context, state TUNRoutingState) error

type LinuxXFRMManager 

type LinuxXFRMManager struct {
	Runner IPCommandRunner
}

func (LinuxXFRMManager) Apply 

func (m LinuxXFRMManager) Apply(ctx context.Context, cfg KernelXFRMConfig) (KernelXFRMState, error)

func (LinuxXFRMManager) Cleanup 

func (m LinuxXFRMManager) Cleanup(ctx context.Context, state KernelXFRMState) error

type MOBIKENATChange 

type MOBIKENATChange struct {
	Changed              bool
	RequiresMOBIKEUpdate bool
	LocalAddressChanged  bool
	RemoteAddressChanged bool
	PortChanged          bool
	NATChanged           bool
	Previous             MOBIKENATEndpoint
	Current              MOBIKENATEndpoint
	Request              MOBIKERequest
	Reason               string
	At                   time.Time
}

type MOBIKENATEndpoint 

type MOBIKENATEndpoint struct {
	LocalIP     net.IP
	RemoteIP    net.IP
	LocalPort   uint16
	RemotePort  uint16
	NATDetected bool
}

type MOBIKENATObservation 

type MOBIKENATObservation struct {
	DeviceID         string
	TraceID          string
	LocalIP          net.IP
	RemoteIP         net.IP
	LocalPort        uint16
	RemotePort       uint16
	NATDetected      bool
	NATDetectedKnown bool
	At               time.Time
}

type MOBIKENATObserver 

type MOBIKENATObserver interface {
	ObserveMOBIKENAT(context.Context, MOBIKENATObservation) (MOBIKENATChange, MOBIKEResult, error)
	MOBIKENATSnapshot() (MOBIKENATEndpoint, time.Time)
}

type MOBIKENATState 

type MOBIKENATState struct {
	// contains filtered or unexported fields
}

func NewMOBIKENATState 

func NewMOBIKENATState(cfg MOBIKENATStateConfig) *MOBIKENATState

func (*MOBIKENATState) Observe 

func (s *MOBIKENATState) Observe(obs MOBIKENATObservation) MOBIKENATChange

func (*MOBIKENATState) Snapshot 

func (s *MOBIKENATState) Snapshot() (MOBIKENATEndpoint, time.Time)

type MOBIKENATStateConfig 

type MOBIKENATStateConfig struct {
	MOBIKESupported bool
	LocalIP         net.IP
	RemoteIP        net.IP
	LocalPort       uint16
	RemotePort      uint16
	NATDetected     bool
	UpdatedAt       time.Time
}

type MOBIKERequest 

type MOBIKERequest struct {
	DeviceID string
	TraceID  string
	OldIP    string
	NewIP    string
	At       time.Time
}

type MOBIKEResult 

type MOBIKEResult struct {
	Rekeyed          bool
	OuterLocalIP     string
	LocalInnerIP     string
	RemoteInnerIP    string
	DNSServers       []string
	IKEEstablished   bool
	IPsecEstablished bool
	Reason           string
	UpdatedAt        time.Time
}

type MemoryEAPReauthenticationStore 

type MemoryEAPReauthenticationStore struct {
	// contains filtered or unexported fields
}

func NewMemoryEAPReauthenticationStore 

func NewMemoryEAPReauthenticationStore() *MemoryEAPReauthenticationStore

func (*MemoryEAPReauthenticationStore) DeleteEAPReauthentication 

func (s *MemoryEAPReauthenticationStore) DeleteEAPReauthentication(ctx context.Context, key string) error

func (*MemoryEAPReauthenticationStore) LoadEAPReauthentication 

func (s *MemoryEAPReauthenticationStore) LoadEAPReauthentication(ctx context.Context, key string) (EAPReauthenticationSnapshot, bool, error)

func (*MemoryEAPReauthenticationStore) SaveEAPReauthentication 

func (s *MemoryEAPReauthenticationStore) SaveEAPReauthentication(ctx context.Context, key string, snapshot EAPReauthenticationSnapshot) error

type NATTKeepaliveSender 

type NATTKeepaliveSender interface {
	SendNATTKeepalive(context.Context) error
}

type PacketPump 

type PacketPump struct {
	// contains filtered or unexported fields
}

func NewPacketPump 

func NewPacketPump(cfg PacketPumpConfig) (*PacketPump, error)

func (*PacketPump) Close 

func (p *PacketPump) Close(ctx context.Context) error

func (*PacketPump) Done 

func (p *PacketPump) Done() <-chan struct{}

func (*PacketPump) Start 

func (p *PacketPump) Start(ctx context.Context) error

func (*PacketPump) Wait 

func (p *PacketPump) Wait() (PacketPumpStats, error)

type PacketPumpConfig 

type PacketPumpConfig struct {
	Session PacketTunnelReadSession
	Device  InnerPacketDevice
	OnError func(PacketPumpDirection, error)
}

type PacketPumpDirection 

type PacketPumpDirection string
const (
	PacketPumpDeviceToESP PacketPumpDirection = "device_to_esp"
	PacketPumpESPToDevice PacketPumpDirection = "esp_to_device"
)

type PacketPumpStats 

type PacketPumpStats struct {
	DeviceToESPPackets uint64
	DeviceToESPBytes   uint64
	ESPToDevicePackets uint64
	ESPToDeviceBytes   uint64
	DeviceReadErrors   uint64
	DeviceWriteErrors  uint64
	ESPReadErrors      uint64
	ESPSendErrors      uint64
	ChildSARekeys      uint64
	ChildSARekeyErrors uint64
}

type PacketSession 

type PacketSession struct {
	// contains filtered or unexported fields
}

func NewPacketSession 

func NewPacketSession(cfg PacketSessionConfig) (*PacketSession, error)

func (*PacketSession) AdvanceChildSARekey 

func (s *PacketSession) AdvanceChildSARekey(ctx context.Context, now time.Time) (ChildSARekeyDecision, error)

func (*PacketSession) AdvanceIKELiveness 

func (s *PacketSession) AdvanceIKELiveness(ctx context.Context, now time.Time) (IKELivenessDecision, error)

func (*PacketSession) ChildSARekeySnapshot 

func (s *PacketSession) ChildSARekeySnapshot() ChildSARekeySnapshot

func (*PacketSession) Close 

func (s *PacketSession) Close(ctx context.Context) error

func (*PacketSession) IKELivenessSnapshot 

func (s *PacketSession) IKELivenessSnapshot() IKELivenessSnapshot

func (*PacketSession) MOBIKE 

func (s *PacketSession) MOBIKE(ctx context.Context, req MOBIKERequest) (MOBIKEResult, error)

func (*PacketSession) MOBIKENATSnapshot 

func (s *PacketSession) MOBIKENATSnapshot() (MOBIKENATEndpoint, time.Time)

func (*PacketSession) NextChildSARekeyDue 

func (s *PacketSession) NextChildSARekeyDue() (time.Time, bool)

func (*PacketSession) ObserveMOBIKENAT 

func (s *PacketSession) ObserveMOBIKENAT(ctx context.Context, obs MOBIKENATObservation) (MOBIKENATChange, MOBIKEResult, error)

func (*PacketSession) PacketStats 

func (s *PacketSession) PacketStats() PacketTunnelStats

func (*PacketSession) ReadInnerPacket 

func (s *PacketSession) ReadInnerPacket(ctx context.Context) (PacketTunnelPacket, error)

func (*PacketSession) ReceiveESPPacket 

func (s *PacketSession) ReceiveESPPacket(ctx context.Context, packet []byte) (PacketTunnelPacket, error)

func (*PacketSession) RecordIKELivenessInbound 

func (s *PacketSession) RecordIKELivenessInbound(at time.Time)

func (*PacketSession) RecordIKELivenessOutbound 

func (s *PacketSession) RecordIKELivenessOutbound(at time.Time)

func (*PacketSession) RecordIKELivenessResult 

func (s *PacketSession) RecordIKELivenessResult(at time.Time, ok bool)

func (*PacketSession) RekeyChildSA 

func (s *PacketSession) RekeyChildSA(ctx context.Context) (TunnelResult, error)

func (*PacketSession) Result 

func (s *PacketSession) Result() TunnelResult

func (*PacketSession) RunChildSARekeyDue 

func (s *PacketSession) RunChildSARekeyDue(ctx context.Context, now time.Time) (ChildSARekeyDecision, error)

func (*PacketSession) SendInnerPacket 

func (s *PacketSession) SendInnerPacket(ctx context.Context, inner []byte) error

func (*PacketSession) SendInnerPacketWithNextHeader 

func (s *PacketSession) SendInnerPacketWithNextHeader(ctx context.Context, nextHeader uint8, inner []byte) error

type PacketSessionConfig 

type PacketSessionConfig struct {
	Result        TunnelResult
	ChildSA       ikev2.ChildSAResult
	OutboundSA    *esp.SA
	InboundSA     *esp.SA
	Transport     ESPPacketTransport
	Random        io.Reader
	MOBIKEHandler func(context.Context, MOBIKERequest) (MOBIKEResult, error)
	RekeyHandler  ChildSARekeyHandler
	RekeyPolicy   ChildSARekeyPolicy
	MOBIKENAT     *MOBIKENATState
	Liveness      *IKELivenessState
	DPDHandler    func(context.Context) error
	CloseHandler  func(context.Context) error
}

type PacketTunnelPacket 

type PacketTunnelPacket struct {
	SPI        uint32
	Sequence   uint32
	NextHeader uint8
	Payload    []byte
}

type PacketTunnelReadSession 

type PacketTunnelReadSession interface {
	PacketTunnelSession
	ReadInnerPacket(context.Context) (PacketTunnelPacket, error)
}

type PacketTunnelSession 

type PacketTunnelSession interface {
	TunnelSession
	SendInnerPacket(context.Context, []byte) error
	SendInnerPacketWithNextHeader(context.Context, uint8, []byte) error
	ReceiveESPPacket(context.Context, []byte) (PacketTunnelPacket, error)
	PacketStats() PacketTunnelStats
}

type PacketTunnelStats 

type PacketTunnelStats struct {
	OutboundInnerPackets uint64
	OutboundInnerBytes   uint64
	OutboundESPPackets   uint64
	OutboundESPBytes     uint64
	OutboundErrors       uint64
	InboundInnerPackets  uint64
	InboundInnerBytes    uint64
	InboundESPPackets    uint64
	InboundESPBytes      uint64
	InboundErrors        uint64
	ReplayDrops          uint64
	InvalidDrops         uint64
	UnsupportedDrops     uint64
}

type ProxyConfig 

type ProxyConfig struct {
	ID       string
	URL      string
	Address  string
	Addr     string
	Username string
	Password string
	Country  string
	Enabled  bool
}

type TUNDevice 

type TUNDevice struct {
	// contains filtered or unexported fields
}

func OpenTUNDevice 

func OpenTUNDevice(cfg TUNDeviceConfig) (*TUNDevice, error)

func (*TUNDevice) Close 

func (d *TUNDevice) Close(ctx context.Context) error

func (*TUNDevice) Name 

func (d *TUNDevice) Name() string

func (*TUNDevice) ReadInnerPacket 

func (d *TUNDevice) ReadInnerPacket(ctx context.Context) ([]byte, error)

func (*TUNDevice) WriteInnerPacket 

func (d *TUNDevice) WriteInnerPacket(ctx context.Context, packet []byte) error

type TUNDeviceConfig 

type TUNDeviceConfig struct {
	Name string
	Path string
}

type TUNDeviceFactory 

type TUNDeviceFactory func(context.Context, TunnelConfig, TunnelResult) (InnerPacketDevice, string, error)

type TUNPacketTunnelSession 

type TUNPacketTunnelSession struct {
	// contains filtered or unexported fields
}

func (*TUNPacketTunnelSession) ChildSARekeySnapshot 

func (s *TUNPacketTunnelSession) ChildSARekeySnapshot() ChildSARekeySnapshot

func (*TUNPacketTunnelSession) Close 

func (s *TUNPacketTunnelSession) Close(ctx context.Context) error

func (*TUNPacketTunnelSession) MOBIKE 

func (s *TUNPacketTunnelSession) MOBIKE(ctx context.Context, req MOBIKERequest) (MOBIKEResult, error)

func (*TUNPacketTunnelSession) NextChildSARekeyDue 

func (s *TUNPacketTunnelSession) NextChildSARekeyDue() (time.Time, bool)

func (*TUNPacketTunnelSession) RekeyChildSA 

func (s *TUNPacketTunnelSession) RekeyChildSA(ctx context.Context) (TunnelResult, error)

func (*TUNPacketTunnelSession) Result 

func (s *TUNPacketTunnelSession) Result() TunnelResult

func (*TUNPacketTunnelSession) RunChildSARekeyDue 

func (s *TUNPacketTunnelSession) RunChildSARekeyDue(ctx context.Context, now time.Time) (ChildSARekeyDecision, error)

type TUNRoute 

type TUNRoute struct {
	Destination string
	Via         string
	Source      string
	Table       string
	Metric      int
}

type TUNRoutingConfig 

type TUNRoutingConfig struct {
	InterfaceName       string
	MTU                 int
	Addresses           []string
	EPDGRouteExclusions []EPDGRouteExclusion
	Routes              []TUNRoute
	Rules               []TUNRule
}

type TUNRoutingConfigFactory 

type TUNRoutingConfigFactory func(TunnelConfig, TunnelResult, string) (TUNRoutingConfig, error)

type TUNRoutingManager 

type TUNRoutingManager interface {
	Apply(context.Context, TUNRoutingConfig) (TUNRoutingState, error)
	Cleanup(context.Context, TUNRoutingState) error
}

type TUNRoutingState 

type TUNRoutingState struct {
	InterfaceName string
	// contains filtered or unexported fields
}

type TUNRule 

type TUNRule struct {
	Priority int
	From     string
	To       string
	FwMark   string
	Table    string
}

type TUNTunnelManager 

type TUNTunnelManager struct {
	Config TUNTunnelManagerConfig
}

func NewTUNIKETunnelManager 

func NewTUNIKETunnelManager(ikeCfg IKEPacketTunnelManagerConfig, tunCfg TUNTunnelManagerConfig) *TUNTunnelManager

func NewTUNTunnelManager 

func NewTUNTunnelManager(cfg TUNTunnelManagerConfig) *TUNTunnelManager

func (*TUNTunnelManager) EstablishTunnel 

func (m *TUNTunnelManager) EstablishTunnel(ctx context.Context, cfg TunnelConfig) (TunnelSession, error)

type TUNTunnelManagerConfig 

type TUNTunnelManagerConfig struct {
	Base                 TunnelManager
	TUN                  TUNDeviceConfig
	DeviceFactory        TUNDeviceFactory
	RoutingManager       TUNRoutingManager
	RoutingConfigFactory TUNRoutingConfigFactory
	DisableRouting       bool
	DefaultRoutes        bool
	ProtectEPDGRoutes    bool
	EPDGRouteResolver    EPDGRouteResolver
	MTU                  int
	Addresses            []string
	EPDGRouteExclusions  []EPDGRouteExclusion
	Routes               []TUNRoute
	Rules                []TUNRule
	OnPumpError          func(PacketPumpDirection, error)
}

type TunnelConfig 

type TunnelConfig struct {
	DeviceID       string
	TraceID        string
	Mode           string
	EPDGAddress    string
	EPDGSource     string
	LocalInterface string
	OuterLocalIP   string
	InnerLocalIP   string
	RemoteInnerIP  string
	IMSI           string
	MCC            string
	MNC            string
	IMEI           string
	Identity       IMSIdentity
	Proxy          *ProxyConfig
	StartedAt      time.Time
}

func (TunnelConfig) NormalizedMode 

func (c TunnelConfig) NormalizedMode() string

func (TunnelConfig) Validate 

func (c TunnelConfig) Validate() error

type TunnelManager 

type TunnelManager interface {
	EstablishTunnel(context.Context, TunnelConfig) (TunnelSession, error)
}

type TunnelResult 

type TunnelResult struct {
	Ready             bool
	Mode              string
	EPDGAddress       string
	LocalInnerIP      string
	RemoteInnerIP     string
	DNSServers        []string
	IKEEstablished    bool
	IPsecEstablished  bool
	MOBIKESupported   bool
	ChildSAIdentifier string
	Reason            string
	EstablishedAt     time.Time
}

func (TunnelResult) IsReady 

func (r TunnelResult) IsReady() bool

type TunnelSession 

type TunnelSession interface {
	Result() TunnelResult
	MOBIKE(context.Context, MOBIKERequest) (MOBIKEResult, error)
	Close(context.Context) error
}

type UDPESPPacketTransport 

type UDPESPPacketTransport struct {
	RemoteAddr     string
	LocalAddr      string
	Timeout        time.Duration
	ReadBufferSize int
	// contains filtered or unexported fields
}

func (*UDPESPPacketTransport) Close 

func (t *UDPESPPacketTransport) Close(ctx context.Context) error

func (*UDPESPPacketTransport) LocalNetworkAddr 

func (t *UDPESPPacketTransport) LocalNetworkAddr() net.Addr

func (*UDPESPPacketTransport) ReadESPPacket 

func (t *UDPESPPacketTransport) ReadESPPacket(ctx context.Context) ([]byte, error)

func (*UDPESPPacketTransport) SendESPPacket 

func (t *UDPESPPacketTransport) SendESPPacket(ctx context.Context, packet []byte) error

func (*UDPESPPacketTransport) SendNATTKeepalive 

func (t *UDPESPPacketTransport) SendNATTKeepalive(ctx context.Context) error

type XFRMInterfaceConfig 

type XFRMInterfaceConfig struct {
	Name           string
	OuterDev       string
	IfID           uint32
	MTU            int
	SkipCreateLink bool
}

type XFRMNATTraversalConfig 

type XFRMNATTraversalConfig struct {
	Enabled         bool
	LocalPort       uint16
	RemotePort      uint16
	OriginalAddress string
}

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.