service

package
v0.19.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 18, 2026 License: MPL-2.0 Imports: 26 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func VPNGatewayClientSupported added in v0.18.0 

func VPNGatewayClientSupported() error

VPNGatewayClientSupported reports whether client-side VPN gateway mode can run on this OS/build.

func VPNGatewayServerSupported added in v0.18.0 

func VPNGatewayServerSupported() error

VPNGatewayServerSupported reports whether server-side VPN gateway mode can run on this OS/build. Linux (iptables NAT) and Windows (WFP + WinNAT); Android exit-node support requires root or special system config, macOS lacks NAT/route glue.

func VPNGatewaySupported added in v0.18.0 

func VPNGatewaySupported() error

VPNGatewaySupported reports whether any part of the VPN gateway feature set (client or server) can run on this OS/build. Callers that need a specific side must use VPNGatewayClientSupported / VPNGatewayServerSupported — the tray menu already gates client and server entries separately.

Types

type AuthStatus 

type AuthStatus struct {
	// contains filtered or unexported fields
}

func NewAuthStatus 

func NewAuthStatus(p2pService P2p, conf *config.Config, eventbus awlevent.Bus) *AuthStatus

func (*AuthStatus) AddPeer 

func (s *AuthStatus) AddPeer(ctx context.Context, peerID peer.ID, name, alias string, confirmed bool, ipAddr string) error

func (*AuthStatus) AuthStreamHandler 

func (s *AuthStatus) AuthStreamHandler(stream network.Stream)

func (*AuthStatus) BackgroundExchangeStatusInfo 

func (s *AuthStatus) BackgroundExchangeStatusInfo(ctx context.Context)

func (*AuthStatus) BackgroundRetryAuthRequests 

func (s *AuthStatus) BackgroundRetryAuthRequests(ctx context.Context)

func (*AuthStatus) BlockPeer 

func (s *AuthStatus) BlockPeer(peerID peer.ID, name string)

func (*AuthStatus) ExchangeNewStatusInfo 

func (s *AuthStatus) ExchangeNewStatusInfo(ctx context.Context, remotePeerID peer.ID, knownPeer config.KnownPeer) error

func (*AuthStatus) ExchangeStatusInfoWithAllKnownPeers 

func (s *AuthStatus) ExchangeStatusInfoWithAllKnownPeers(ctx context.Context)

func (*AuthStatus) GetAuthRequestCounts added in v0.17.0 

func (s *AuthStatus) GetAuthRequestCounts() (ingoing, outgoing int)

GetAuthRequestCounts returns the number of pending ingoing and outgoing auth requests.

func (*AuthStatus) GetIngoingAuthRequests 

func (s *AuthStatus) GetIngoingAuthRequests() map[string]protocol.AuthPeer

func (*AuthStatus) SendAuthRequest 

func (s *AuthStatus) SendAuthRequest(ctx context.Context, peerID peer.ID, req protocol.AuthPeer) error

func (*AuthStatus) StatusStreamHandler 

func (s *AuthStatus) StatusStreamHandler(stream network.Stream)

type DNSReconfigurer added in v0.18.0 

type DNSReconfigurer interface {
	// ForceUpstreamDNS toggles full-capture mode where all DNS is routed
	// through the tunnel to a public upstream. Idempotent; a no-op when DNS is
	// not active as the system resolver.
	ForceUpstreamDNS(enabled bool) error
}

DNSReconfigurer is the narrow slice of the DNS service the gateway needs to prevent DNS leaks in client mode. Implemented by awl.DNSService; injected to avoid a service -> awl import cycle. May be nil.

type NetManager added in v0.19.0 

type NetManager interface {
	EnableClientRoutes(tunIfName string) error
	DisableClientRoutes() error
	ClientRoutesActive() bool
	EnableServerNAT(awlSubnet, tunIfName string) error
	DisableServerNAT() error
	ServerNATActive() bool
}

NetManager is the slice of *netstate.Manager the gateway service needs: the runtime apply/revert of the OS-level client routes and server NAT. All methods are idempotent. Declared consumer-side so tests can substitute a bookkeeping-only fake.

type P2p 

type P2p interface {
	ConnectPeer(ctx context.Context, peerID peer.ID) error
	IsConnected(peerID peer.ID) bool
	NewStream(ctx context.Context, id peer.ID, proto libp2pProtocol.ID) (network.Stream, error)
	NewStreamMulti(ctx context.Context, id peer.ID, protos ...libp2pProtocol.ID) (network.Stream, error)
	NewStreamWithDedicatedConn(ctx context.Context, id peer.ID, proto libp2pProtocol.ID) (network.Stream, error)
	SubscribeConnectionEvents(onConnected, onDisconnected func(network.Network, network.Conn))
	RecordPeerLatency(id peer.ID, rtt time.Duration)
}

type SOCKS5 added in v0.12.0 

type SOCKS5 struct {
	// contains filtered or unexported fields
}

func NewSOCKS5 added in v0.12.0 

func NewSOCKS5(p2pService P2p, conf *config.Config, sockMarker SocketMarker) (*SOCKS5, error)

func (*SOCKS5) Close added in v0.12.0 

func (s *SOCKS5) Close()

func (*SOCKS5) GetProxyPeerID added in v0.17.0 

func (s *SOCKS5) GetProxyPeerID() string

func (*SOCKS5) ListAvailableProxies added in v0.12.0 

func (s *SOCKS5) ListAvailableProxies() []entity.AvailableProxy

func (*SOCKS5) ProxyStreamHandler added in v0.12.0 

func (s *SOCKS5) ProxyStreamHandler(stream network.Stream)

func (*SOCKS5) ServeConns added in v0.12.0 

func (s *SOCKS5) ServeConns(ctx context.Context)

func (*SOCKS5) SetProxyPeerID added in v0.12.0 

func (s *SOCKS5) SetProxyPeerID(peerID string)

func (*SOCKS5) SetProxyingLocalhostEnabled added in v0.12.0 

func (s *SOCKS5) SetProxyingLocalhostEnabled(enabled bool)

SetProxyingLocalhostEnabled is created for tests and not intended for real usage.

type SocketMarker added in v0.19.0 

type SocketMarker interface {
	ControlFunc() func(network, address string, c syscall.RawConn) error
}

SocketMarker is the slice of *netstate.Manager the SOCKS5 service needs: the control function that marks exit-node dial sockets to bypass our own VPN gateway routes.

type Tunnel 

type Tunnel struct {
	// contains filtered or unexported fields
}

func NewTunnel 

func NewTunnel(p2pService P2p, device *vpn.Device, conf *config.Config, eventbus awlevent.Bus) *Tunnel

func (*Tunnel) ClearVPNGatewayPeer added in v0.18.0 

func (t *Tunnel) ClearVPNGatewayPeer()

ClearVPNGatewayPeer disables VPN gateway client mode and persists the choice.

func (*Tunnel) Close 

func (t *Tunnel) Close()

func (*Tunnel) HandleReadPackets added in v0.15.0 

func (t *Tunnel) HandleReadPackets(packets []*vpn.Packet)

HandleReadPackets for successfully handled packets it sets packet in slice as nil

func (*Tunnel) RefreshPeersList 

func (t *Tunnel) RefreshPeersList()

func (*Tunnel) SetVPNGatewayPeer added in v0.18.0 

func (t *Tunnel) SetVPNGatewayPeer(gatewayPeerID peer.ID) error

SetVPNGatewayPeer enables VPN gateway client mode using the existing VpnPeer for the given gateway peer, validates the peer's permission, and persists the choice in the config.

The peer must:

  1. Be in KnownPeers.
  2. Currently allow being used as a VPN gateway (KnownPeer.CanUseAsVPNGateway, i.e. AllowedUsingAsExitNode AND RemoteVPNGatewayServerEnabled from the most recent status exchange).

func (*Tunnel) SetVPNGatewayServerEnabled added in v0.18.0 

func (t *Tunnel) SetVPNGatewayServerEnabled(enabled bool)

SetVPNGatewayServerEnabled enables or disables VPN gateway server mode on this tunnel and persists the choice in the config. The decision propagates to other peers on the next status exchange so their UI reflects whether this node is currently offering VPN gateway server.

func (*Tunnel) StreamHandler 

func (t *Tunnel) StreamHandler(stream network.Stream)

type VPNGateway added in v0.18.0 

type VPNGateway struct {
	// contains filtered or unexported fields
}

VPNGateway owns the lifecycle of VPN gateway mode (both client and server sides): the glue that ties the OS-level state (applied via the netstate manager) to the persisted VPNGatewayConfig and the Tunnel's runtime peer state.

Responsibility split:

  • Tunnel owns the packet-path state (gateway peer pointer, fwmark forwarding decisions, connectivity observation via p2p events).
  • The netstate manager owns the OS-level state itself (routes, NAT).
  • VPNGateway orchestrates: config, tunnel binding, DNS policy and the manager calls, from the API and from Application.Init / Close.

VPNGateway calls into Tunnel for the runtime bind/unbind operations (SetVPNGatewayPeer / ClearVPNGatewayPeer / SetVPNGatewayServerEnabled). When the VPN interface is disabled, Tunnel is nil and VPNGateway writes directly to the config — the API endpoints still succeed, persistence still works, and the next start with a real TUN will pick the values up.

func NewVPNGateway added in v0.18.0 

func NewVPNGateway(conf *config.Config, tunnel *Tunnel, device *vpn.Device, p2p P2p, netManager NetManager, dns DNSReconfigurer) *VPNGateway

NewVPNGateway constructs a VPNGateway service. tunnel may be nil when the VPN interface is disabled; the API methods still work but only update the persisted config.

func (*VPNGateway) DisableClient added in v0.18.0 

func (g *VPNGateway) DisableClient()

DisableClient turns off VPN gateway client mode and persists the choice. Tears OS-level state down first so return traffic from the gateway peer can still flow while we still hold the tunnel binding; once routes are gone, packets fall back to the regular awl path. Idempotent. Handles tunnel==nil (VPN interface disabled) by writing the config directly.

func (*VPNGateway) EnableClient added in v0.18.0 

func (g *VPNGateway) EnableClient(gatewayPeerID peer.ID) error

EnableClient turns on VPN gateway client mode using the given peer as the gateway, applying OS-level routes immediately. Atomic: rolls back the tunnel binding on apply failure.

On android the OS-level apply (the netstate manager's routes / marking) is a no-op — routing is owned by the host's VpnService.Builder. This call flips the in-memory tunnel binding and persists config; the host then re-establishes the VpnService with the new routes and hot-swaps the fresh tun fd into the running app (see cmd/gomobile-lib UpdateTunDevice and vpn.SwappableTUN), so the change takes effect without restarting the daemon.

func (*VPNGateway) IsClientActive added in v0.18.0 

func (g *VPNGateway) IsClientActive() bool

IsClientActive reports whether client-side gateway routes are currently installed. Test-friendly accessor; production code should not depend on this — the canonical "is gateway on" signal is config.VPNGateway.ClientEnabled or PeerInfo.VPNGateway.

func (*VPNGateway) IsServerActive added in v0.18.0 

func (g *VPNGateway) IsServerActive() bool

IsServerActive reports whether VPN gateway server NAT is currently installed. Test-friendly accessor.

func (*VPNGateway) ListAvailableVPNGateways added in v0.18.0 

func (g *VPNGateway) ListAvailableVPNGateways() []entity.AvailableVPNGateway

ListAvailableVPNGateways returns peers that are currently a valid VPN gateway target — i.e. they allow being used as an exit node and have VPN gateway server enabled on their side. Peers that allow exit-node use only for SOCKS5 are not included here. Returned slice is sorted by connected first, then by display name.

func (*VPNGateway) SetServerEnabled added in v0.18.0 

func (g *VPNGateway) SetServerEnabled(enabled bool) error

SetServerEnabled toggles whether this node serves as a VPN gateway for permitted peers. Persisted; the new value propagates to other peers via the next status exchange. NAT / iptables state is (re)applied at runtime — no restart required. Handles tunnel==nil (VPN interface disabled) by writing the config directly.

func (*VPNGateway) SetupAtStartup added in v0.18.0 

func (g *VPNGateway) SetupAtStartup() error

SetupAtStartup is the boot-time path

func (*VPNGateway) TeardownAtShutdown added in v0.18.0 

func (g *VPNGateway) TeardownAtShutdown()

TeardownAtShutdown reverses SetupAtStartup. It only restores OS-level state (routes, NAT). It does NOT touch Tunnel's gateway peer pointer or the persisted config — the daemon should resume gateway mode on next start with the same gateway peer.

type VpnPeer 

type VpnPeer struct {
	// contains filtered or unexported fields
}

func NewVpnPeer added in v0.15.0 

func NewVpnPeer(peerID peer.ID, localIP net.IP) *VpnPeer

func (*VpnPeer) Close 

func (vp *VpnPeer) Close(t *Tunnel)

func (*VpnPeer) Start 

func (vp *VpnPeer) Start(t *Tunnel)

TODO: remove Tunnel from VpnPeer dependencies

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.