proxyuplink

package
v1.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 31, 2026 License: Apache-2.0 Imports: 28 Imported by: 0

Documentation

Overview

Package proxyuplink adapts netclient to gravitl/proxy WSS uplink.

  • Client: UseTcpUplink + RelayedBy + PeerIDs.tcp_proxy_endpoint (wss://…/uplink/v1) → uplink.Client + userspace Bind
  • Gateway: TcpProxyEnabled + TcpProxyListenPort + TcpProxyTLSMode → uplink.Server (selfsigned WSS or proxy-mode WS) + userspace Bind

Index

Constants

View Source 
const DefaultListenPort = 443

Variables

This section is empty.

Functions

func ClientTLSConfig 

func ClientTLSConfig(serverName, expectedFingerprint string) *tls.Config

ClientTLSConfig builds TLS client config for WSS dial.

Trust order:

  1. If expectedFingerprint (SHA-256 hex of leaf) is set → pin that certificate.
  2. Else use normal system/RootCAs verification (reverse-proxy / public certs).
  3. Legacy fallback: if host is an IP literal and no fingerprint is set, InsecureSkipVerify is used (Phase-1 self-signed without published pin). This path is temporary and marked for removal once fingerprints are always published.

func FindUplinkClient 

func FindUplinkClient() (config.Node, bool)

FindUplinkClient returns the first local node opted into TCP uplink to its gateway. Requires Connected so disconnect stops the TCP client without flipping userspace WG mode.

func LoadOrCreateServerTLS 

func LoadOrCreateServerTLS() (*tls.Config, string, error)

LoadOrCreateServerTLS loads a persisted self-signed cert for the uplink listener, or creates one under the netclient config directory. The certificate is not regenerated on every process restart.

func NeedsUserspaceWG 

func NeedsUserspaceWG() bool

NeedsUserspaceWG reports whether TCP uplink client or gateway listen requires userspace WireGuard conn.Bind.

func ParseTLSMode 

func ParseTLSMode(s string) (uplink.TLSMode, error)

ParseTLSMode maps host config to uplink.TLSMode (default selfsigned).

func PeerPubKeyForNode 

func PeerPubKeyForNode(nodeID string) string

PeerPubKeyForNode returns the WireGuard public key string for a node ID from cached PeerIDs.

func RefreshTCPPeerRoutes 

func RefreshTCPPeerRoutes()

RefreshTCPPeerRoutes re-resolves gateway TCP peer routes from current HostPeers for peers that already have a divert mapping plus every peer with a live TCP session.

func RelayPeerUDPEndpoint 

func RelayPeerUDPEndpoint(relayNodeID string) string

RelayPeerUDPEndpoint returns the WireGuard UDP endpoint (host:port) for the relay node ID, using NetworkPeerIDs and HostPeers. Empty if not found. Falls back to cached PeerIDs when peer-info cache was cleared (e.g. disconnect SIGHUP).

Uses the server-published HostPeers endpoint (not EndpointCache). If endpoint detection later moves the live WG peer to a private LAN address, Bind.Send will not match this divert key and will use UDP directly — which is intentional when LAN works.

func TLSServerNameFromAddr 

func TLSServerNameFromAddr(addr string) string

TLSServerNameFromAddr returns the host part of a WSS URL or host:port for SNI.

func TcpProxyCertFingerprintForRelay 

func TcpProxyCertFingerprintForRelay(relayNodeID string) string

TcpProxyCertFingerprintForRelay returns the published cert fingerprint for the gateway.

func TcpProxyEndpointForRelay 

func TcpProxyEndpointForRelay(relayNodeID string) string

TcpProxyEndpointForRelay returns the WSS URL (or legacy host:port) for the gateway node ID.

func UpdatePeerIDs 

func UpdatePeerIDs(m models.PeerMap)

UpdatePeerIDs caches PeerIDs / peer_ids from HostPull or HostPeerUpdate for TCP endpoint lookup. Ignores nil/empty maps so a partial peer update cannot wipe pubkey↔node mappings needed for ClientHello / gateway peer route registration after a GW restart.

Types

type GatewayListenConfig 

type GatewayListenConfig struct {
	Node       config.Node
	ListenPort int
	ListenAddr string
	TLSMode    string
}

GatewayListenConfig is returned by FindTCPGateway.

func FindTCPGateway 

func FindTCPGateway() (cfg GatewayListenConfig, ok bool)

FindTCPGateway returns the first local gateway node that should listen for TCP uplinks. Listen enable/port/mode are host-level (peer update Host); node TcpProxy* is a fallback.

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

Manager owns a WSS uplink.Client to the gateway.

func Active 

func Active() *Manager

Active returns the last successfully started Manager, or nil.

func NewManager 

func NewManager(opts Options) (*Manager, error)

NewManager validates options; the client is created on Start.

func (*Manager) Addr 

func (m *Manager) Addr() string

Addr returns the dial address / URL.

func (*Manager) RelayPeerID 

func (m *Manager) RelayPeerID() string

RelayPeerID returns the gateway node ID.

func (*Manager) SendPacket 

func (m *Manager) SendPacket(ctx context.Context, pkt []byte) error

SendPacket sends a WG packet to the gateway.

func (*Manager) Start 

func (m *Manager) Start(ctx context.Context, server *config.Server, host *config.Config, opts Options) error

Start dials the gateway over WSS and runs the framed session until ctx is cancelled or Stop.

func (*Manager) State 

func (m *Manager) State() uplink.ClientState

State returns the uplink client state.

func (*Manager) Stop 

func (m *Manager) Stop(ctx context.Context) error

Stop shuts down the client.

type Options 

type Options struct {
	// Addr is the WSS endpoint URL (wss://host:port/uplink/v1) or legacy host:port.
	Addr string
	// TLSServerName is TLS SNI (optional; derived from URL when empty).
	TLSServerName string
	// CertFingerprint is the expected SHA-256 hex of the gateway leaf cert (selfsigned).
	CertFingerprint string
	// NodeID is this client's network node ID (ClientHello.node_id).
	NodeID string
	// RelayPeerID is the gateway/relay node ID (required).
	RelayPeerID string
	// NetworkID is the logical network name.
	NetworkID string
	// InboundToWG delivers gateway→client DATA frames into userspace WireGuard.
	InboundToWG func([]byte)
}

Options configures the uplink from server-published settings.

type ServerManager 

type ServerManager struct {
	// contains filtered or unexported fields
}

ServerManager owns an uplink.Server on a TCP-uplink-enabled gateway.

func ActiveServer 

func ActiveServer() *ServerManager

ActiveServer returns the running gateway TCP uplink server, or nil.

func NewServerManager 

func NewServerManager(opts ServerManagerOptions) (*ServerManager, error)

NewServerManager prepares a gateway uplink listener (Start creates the server).

func (*ServerManager) CertFingerprint 

func (m *ServerManager) CertFingerprint() string

CertFingerprint returns the self-signed cert fingerprint when applicable.

func (*ServerManager) HasSession 

func (m *ServerManager) HasSession(peerID string) bool

HasSession reports whether peerID currently has an attached TCP uplink session.

func (*ServerManager) ListenAddr 

func (m *ServerManager) ListenAddr() string

ListenAddr returns the configured bind address (empty = all interfaces).

func (*ServerManager) ListenPort 

func (m *ServerManager) ListenPort() int

ListenPort returns the configured listen port.

func (*ServerManager) NodeID 

func (m *ServerManager) NodeID() string

NodeID returns the gateway node ID.

func (*ServerManager) SendToPeer 

func (m *ServerManager) SendToPeer(ctx context.Context, peerID string, pkt []byte) error

SendToPeer forwards WG ciphertext to an attached TCP uplink client.

func (*ServerManager) SessionPeerIDs 

func (m *ServerManager) SessionPeerIDs() []string

SessionPeerIDs returns peer IDs that currently have a live session.

func (*ServerManager) Start 

func (m *ServerManager) Start(ctx context.Context) error

Start listens for WSS (or WS in proxy mode) uplink clients.

func (*ServerManager) Stop 

func (m *ServerManager) Stop(ctx context.Context) error

Stop shuts down the listener.

func (*ServerManager) TLSMode 

func (m *ServerManager) TLSMode() uplink.TLSMode

TLSMode returns the configured TLS mode.

type ServerManagerOptions 

type ServerManagerOptions struct {
	GatewayNodeID string
	ListenPort    int
	ListenAddr    string // optional bind host (e.g. 127.0.0.1); empty = all interfaces
	TLSMode       string // selfsigned|proxy; empty = selfsigned
}

ServerManagerOptions configures the gateway uplink listener.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.