wireguard

package
v1.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 31, 2026 License: Apache-2.0 Imports: 36 Imported by: 0

Documentation

Overview

Package wireguard manipulates wireguard interfaces

Index

Constants

View Source 
const (
	// IGWDialTimeout is the timeout for dialing internet gateway. Kept well inside
	// IGWMonitorInterval so a failing probe cannot stretch the sampling period.
	IGWDialTimeout = time.Second * 3
	// IGWMonitorInterval is the interval at which to check internet gateway's health.
	// While the exit node is down the host has no internet at all, so samples are
	// taken often enough that IGWFailureThreshold of them is still seconds, not
	// minutes.
	IGWMonitorInterval = time.Second * 10
	// IGWRecoveryThreshold is the number of consecutive successes before considering
	// internet gateway is up.
	IGWRecoveryThreshold = 3
	// IGWFailureThreshold is the number of consecutive failures before considering
	// internet gateway is down.
	IGWFailureThreshold = 3
	// IGWHandshakeFreshness is how recent a WireGuard handshake must be to count as
	// proof of life on its own. It has to stay short: a handshake as old as
	// WireGuard's rekey period would keep a gateway that died seconds ago looking
	// healthy for minutes, which is exactly the outage this monitor exists to end.
	IGWHandshakeFreshness = 90 * time.Second
	// IGWStartupGrace skips failure counting briefly after monitor start so the
	// first handshake can complete. It only has to cover monitor start through
	// first handshake — BeginIfaceRebuild covers rebuilds — and it is re-armed
	// after every rebuild, so a long grace compounds into real blindness.
	IGWStartupGrace = 45 * time.Second
)
View Source 
const (
	IPv4Network = "0.0.0.0/0"
	IPv6Network = "::/0"
)
View Source 
const (
	RouteTableName    = 111
	EgressRouteMetric = 256
)

Variables

View Source 
var EgressResetCh = make(chan struct{}, 2)
View Source 
var (
	ErrModuleNotFound = errors.New("module not found")
)
View Source 
var ErrPeerNotFound = fmt.Errorf("peer not found")
View Source 
var HaEgressCheckInterval = time.Second * 2
View Source 
var HaEgressTicker *time.Ticker

Functions

func ApplyWithoutWGQuick 

func ApplyWithoutWGQuick(nc *NCIface) error

ApplyWithoutWGQuick - Function for running the equivalent of "wg-quick up" for linux if wg-quick is missing

func BeginIfaceRebuild added in v1.7.0 

func BeginIfaceRebuild() func()

BeginIfaceRebuild pauses internet gateway health checks for the duration of an iface teardown and rebuild. The returned func must be called once the iface is configured again; calling it more than once is safe.

func ClearAllTCPPeerRoutes added in v1.7.0 

func ClearAllTCPPeerRoutes()

ClearAllTCPPeerRoutes clears all gateway-mode peer routes.

func ClearClientRelay added in v1.7.0 

func ClearClientRelay()

ClearClientRelay clears the client-mode TCP uplink route so packets fall back to UDP.

func ClearTCPPeerRoute added in v1.7.0 

func ClearTCPPeerRoute(peerID string)

ClearTCPPeerRoute removes a gateway-mode peer route.

func DeleteOldInterface added in v0.18.3 

func DeleteOldInterface(iface string)

DeleteOldInterface - removes named interface

func DeliverRelayTCPInbound added in v1.7.0 

func DeliverRelayTCPInbound(pkt []byte)

DeliverRelayTCPInbound pushes gateway→client DATA into userspace WG (client mode).

func DeliverTCPInbound added in v1.7.0 

func DeliverTCPInbound(udpEndpoint string, pkt []byte)

DeliverTCPInbound pushes TCP→WG ciphertext as if received from udpEndpoint (gateway mode).

func DrainTCPOutQueue added in v1.7.0 

func DrainTCPOutQueue(timeout time.Duration)

DrainTCPOutQueue closes the current outbound worker, waits up to timeout for in-flight jobs, then allows a fresh worker on the next enqueue.

func EndpointDetectedAlready added in v0.22.0 

func EndpointDetectedAlready(peerPubKey string) bool

EndpointDetectedAlready - checks if better endpoint has been detected already

func FindInternetGwPeer added in v1.7.0 

func FindInternetGwPeer(peers []wgtypes.PeerConfig, gw4, gw6 net.IP) (wgtypes.PeerConfig, bool)

FindInternetGwPeer picks the WireGuard peer that should carry internet-exit traffic. Prefers a peer advertising 0.0.0.0/0 or ::/0; falls back to a peer that includes the overlay nexthop. Skips Remove peers.

func GetBetterEndpoint added in v1.0.0 

func GetBetterEndpoint(peerKey string) (*net.UDPAddr, bool)

func GetDefaultGateway added in v0.23.0 

func GetDefaultGateway() (gwRoute netlink.Route, err error)

GetDefaultGateway - get current default gateway

func GetDefaultGatewayIp added in v0.23.0 

func GetDefaultGatewayIp() (ip net.IP, err error)

GetDefaultGatewayIp - get current default gateway

func GetDefaultGatewayIp6 added in v1.7.0 

func GetDefaultGatewayIp6() (ip net.IP, err error)

GetDefaultGatewayIp6 - get current default gateway IPv6 address

func GetDefaultGatewayV6 added in v0.25.0 

func GetDefaultGatewayV6() (gwRoute netlink.Route, err error)

GetDefaultGatewayV6 - get current default gateway ipv6

func GetDomainAnsFromCache added in v1.1.0 

func GetDomainAnsFromCache(egressDomain models.EgressDomain) (ips []string)

func GetEgressDomains added in v1.1.0 

func GetEgressDomains() []models.EgressDomain

func GetIPNetfromIp added in v0.23.0 

func GetIPNetfromIp(ip net.IP) (ipCidr *net.IPNet)

GetIPNetfromIp - converts ip into ipnet based network class

func GetOriginalDefaulGw added in v0.23.0 

func GetOriginalDefaulGw() (gwIP net.IP, err error)

GetOriginalDefaulGw - fetches system's original default gw

func GetPeer added in v0.22.0 

func GetPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error)

GetPeer - gets the peerinfo from the wg interface

func GetPeersFromDevice added in v0.90.0 

func GetPeersFromDevice(ifaceName string) (map[string]wgtypes.Peer, error)

func IfaceDelta 

func IfaceDelta(currentNode *config.Node, newNode *config.Node) bool

IfaceDelta - checks if the new node causes an interface change

func IfaceExists 

func IfaceExists(ifacename string) bool

IfaceExists - return true if you can find the iface

func InternetGwHostIPs added in v1.7.0 

func InternetGwHostIPs(publicKey string) []net.IP

InternetGwHostIPs returns underlay IPs that must stay reachable via the original LAN path when 0.0.0.0/0 is moved onto WireGuard (exit-node client). Without an OS pin, underlay traffic to the exit peer (UDP handshake and/or TCP uplink TLS) is routed into the tunnel and breaks. Collects HostPeers, endpoint cache, live GetPeer, and any TCP-proxy host IPs registered by the uplink client.

func IsNetworkPresentOnLocalInterface added in v1.6.0 

func IsNetworkPresentOnLocalInterface(network net.IPNet) bool

IsNetworkPresentOnLocalInterface checks whether the given network overlaps with any address already assigned to a local network interface (excluding the netmaker WG interface). Overlap means the egress network contains a local interface IP, which would cause a routing conflict.

func IsZeroWGPublicKey added in v1.7.0 

func IsZeroWGPublicKey(publicKey string) bool

IsZeroWGPublicKey reports whether publicKey is empty or the all-zero WireGuard key.

func NormalizeIGWNexthops added in v1.7.0 

func NormalizeIGWNexthops(gwIP, gwIP6 net.IP) (gw4, gw6 net.IP)

NormalizeIGWNexthops splits DefaultGwIp / DefaultGwIp6 into family-correct nexthops. Legacy servers may place an IPv6 address in DefaultGwIp when the client has no EndpointIP.

func PrepareUserspaceTeardown added in v1.7.0 

func PrepareUserspaceTeardown()

PrepareUserspaceTeardown clears TCP uplink wiring and drains async sends. Call before Device.Close / iface recreate so Bind.Send and recv paths cannot hang Close.

func ReapplyInternetGw added in v1.7.0 

func ReapplyInternetGw(gw4, gw6 net.IP)

ReapplyInternetGw restores then sets the host default route via the exit peer.

func ReapplyInternetGwAfterIfaceRecreate added in v1.7.0 

func ReapplyInternetGwAfterIfaceRecreate()

ReapplyInternetGwAfterIfaceRecreate reinstalls OS default routes for an active exit nexthop after the netmaker iface was torn down. Closing the iface drops those routes while IGWMonitor may still report IsCurrentIGW=true, so callers must not gate on IsCurrentIGW.

func RefreshInternetGwHostPins added in v1.7.0 

func RefreshInternetGwHostPins()

RefreshInternetGwHostPins adds LAN underlay pins for InternetGwHostIPs when exit-node routing is already active (e.g. TCP proxy IP registered after SetInternetGw). Does not move 0.0.0.0/0.

func RemoveEgressRoutes added in v0.24.1 

func RemoveEgressRoutes()

func RemoveRoutes added in v0.24.1 

func RemoveRoutes(addrs []ifaceAddress)

RemoveRoutes - Remove routes to the interface

func RemoveWithoutWGQuick 

func RemoveWithoutWGQuick(ifacename string) error

RemoveWithoutWGQuick - Function for running the equivalent of "wg-quick down" for linux if wg-quick is missing

func RestoreHostPeerEndpoint added in v1.7.0 

func RestoreHostPeerEndpoint(endpoint string)

RestoreHostPeerEndpoint resets the live WG peer endpoint to the given host:port (typically the server-published HostPeers underlay address) so TCP-uplink divert keys stay aligned after endpoint detection.

func RestoreInternetGw added in v0.23.0 

func RestoreInternetGw() (err error)

RestoreInternetGw - delete the route in table ROUTE_TABLE_NAME and delet the rules

func SetDomainAnsInCache added in v1.1.0 

func SetDomainAnsInCache(egressDomain models.EgressDomain, ips []string)

func SetEgressDomains added in v1.1.0 

func SetEgressDomains(egressDomains []models.EgressDomain)

func SetEgressRoutes added in v0.20.4 

func SetEgressRoutes(egressRoutes []models.EgressNetworkRoutes)

func SetEgressRoutesInCache added in v1.1.0 

func SetEgressRoutesInCache(egressRoutesInfo []models.EgressNetworkRoutes)

func SetInternetGw added in v0.23.0 

func SetInternetGw(publicKey string, gw4, gw6 net.IP) (err error)

SetInternetGw - set a new default gateway and add rules to activate it. Installs IPv4 and/or IPv6 OS default routes when the corresponding nexthop is present.

func SetNeedTCPUplinkBind added in v1.7.0 

func SetNeedTCPUplinkBind(v bool)

SetNeedTCPUplinkBind marks that userspace WireGuard + TCP bind should be used.

func SetPeers 

func SetPeers(replace bool) error

SetPeers - sets peers on netmaker WireGuard interface 

func SetRelayTCPUplink(u relayTCPUplink)

SetRelayTCPUplink registers the active TCP uplink client. Pass nil on shutdown.

func SetRelayUDPEndpoint added in v1.7.0 

func SetRelayUDPEndpoint(addr string) error

SetRelayUDPEndpoint configures the WireGuard UDP endpoint for the client's relay/gateway peer so ciphertext to that address is sent over the TCP uplink instead of UDP.

func SetRoutes added in v0.20.4 

func SetRoutes(addrs []ifaceAddress) error

SetRoutes - sets additional routes to the interface

func SetRoutesFromCache added in v0.24.1 

func SetRoutesFromCache()

func SetTCPPeerRoute added in v1.7.0 

func SetTCPPeerRoute(peerID, udpEndpoint string) error

SetTCPPeerRoute maps a TCP-uplink client peer ID to a WG UDP endpoint string (gateway mode).

func SetTCPUplinkHostRouteIPs added in v1.7.0 

func SetTCPUplinkHostRouteIPs(ips []net.IP)

SetTCPUplinkHostRouteIPs registers underlay IPs of the TCP proxy endpoint so Windows/Linux exit-node setup can pin them via the LAN gateway before 0.0.0.0/0 moves onto netmaker. Pass nil/empty to clear.

func SetTCPUplinkServer added in v1.7.0 

func SetTCPUplinkServer(s tcpUplinkServer)

SetTCPUplinkServer registers the gateway TCP uplink server. Pass nil on shutdown.

func ShouldReplace added in v0.22.0 

func ShouldReplace(incomingPeers []wgtypes.PeerConfig) bool

ShouldReplace - checks curr peers and incoming peers to see if the peers should be replaced

func ShouldSkipEndpointDetection added in v1.7.0 

func ShouldSkipEndpointDetection(peerPubKey string) bool

ShouldSkipEndpointDetection returns true for peers that must keep their server-published underlay endpoint: internet-exit peers (0.0.0.0/0 / ::/0) and the active TCP-uplink relay. Endpoint detection often picks private 10.x addresses that break TCP divert and blackhole UDP after IGW install.

func StartEgressHAFailOverThread added in v1.1.0 

func StartEgressHAFailOverThread(ctx context.Context, waitg *sync.WaitGroup)

func TCPPeerEndpoint added in v1.7.0 

func TCPPeerEndpoint(peerID string) string

TCPPeerEndpoint returns the UDP endpoint string registered for a TCP uplink peer ID.

func TCPRoutedPeerIDs added in v1.7.0 

func TCPRoutedPeerIDs() []string

TCPRoutedPeerIDs returns peer IDs currently mapped for gateway TCP uplink.

func UpdatePeer 

func UpdatePeer(p *wgtypes.PeerConfig) error

UpdatePeer replaces a wireguard peer temporarily making public func to pass staticchecks this function will be required in future when update node on server is refactored

func UserspaceWGActive added in v1.7.0 

func UserspaceWGActive() bool

UserspaceWGActive reports whether the current netmaker iface is userspace WireGuard.

Types

type IGWMonitor added in v1.1.0 

type IGWMonitor struct {
	// contains filtered or unexported fields
}

func GetIGWMonitor added in v1.1.0 

func GetIGWMonitor() *IGWMonitor

func (*IGWMonitor) IsCurrentIGW added in v1.1.0 

func (m *IGWMonitor) IsCurrentIGW(gw4, gw6 net.IP) bool

IsCurrentIGW returns true if the configured nexthops match the current internet gateway.

func (*IGWMonitor) Monitor added in v1.1.0 

func (m *IGWMonitor) Monitor(publicKey string, gw4, gw6 net.IP)

Monitor starts the monitor for dual-stack (or single-family) internet gateway nexthops.

func (*IGWMonitor) Stop added in v1.1.0 

func (m *IGWMonitor) Stop()

Stop stops the monitor and resets its status.

type NCIface 

type NCIface struct {
	Iface       netIface
	Name        string
	Addresses   []ifaceAddress
	MTU         int
	Config      wgtypes.Config
	IsTestIface bool
}

NCIface - represents a Netclient network interface

func GetInterface 

func GetInterface() *NCIface

func NewNCIface 

func NewNCIface(host *config.Config, nodes config.NodeMap) *NCIface

NewNCIFace - creates a new Netclient interface in memory

func (*NCIface) ApplyAddrs 

func (nc *NCIface) ApplyAddrs() error

netLink.ApplyAddrs - applies the assigned node addresses to given interface (netLink)

func (*NCIface) Close 

func (n *NCIface) Close()

NCIface.Close closes netmaker interface

func (*NCIface) Configure 

func (n *NCIface) Configure() error

Configure applies configuration to netmaker wireguard interface

func (*NCIface) Create 

func (nc *NCIface) Create() error

NCIface.Create - creates a linux WG interface based on a node's host config

func (*NCIface) SetMTU 

func (n *NCIface) SetMTU() error

NCIface.SetMTU - sets the mtu for the interface

func (*NCIface) UpdatePeer 

func (n *NCIface) UpdatePeer(p wgtypes.PeerConfig)

NCIface.UpdatePeer - Updates Peers from provided PeerConfig

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.