Documentation
¶
Overview ¶
Package userspace is the userspace dataplane Backend (design.md 6.3, 7a.7 節). It uses neither kernel WireGuard nor nftables nor conntrack: a wireguard-go + netstack tunnel (utun), the Go admission evaluator (internal/policy/goengine) in place of nftables, and the shared relay (relay) turned around so that it accepts on the host's public ports and dials the agents through the netstack.
Everything the Backend converges to comes from the Plan it is given (design.md 7a.2 節): Transparent ports become relay listeners, Plan.Admission feeds the evaluator, per-source flow caps included. Only process-wide budgets (Resource Guard, design.md 7a.5 節) are fixed at New.
Index ¶
- type Backend
- func (b *Backend) AdmitRelayFlow(ruleID string, src netip.Addr) (release func(), ok bool)
- func (b *Backend) Dial(network, addr string) (net.Conn, error)
- func (b *Backend) EnsureDevice(cfg dataplane.WGConfig) ([]string, error)
- func (b *Backend) Observe() (dataplane.Observed, error)
- func (b *Backend) Prepare(d dataplane.Desired) (dataplane.Prepared, error)
- func (b *Backend) Repair() dataplane.Committed
- func (b *Backend) TCPPool() *resource.Pool
- func (b *Backend) UDPPool() *resource.Pool
- func (b *Backend) UDPReplies() map[string]dataplane.UDPReply
- func (b *Backend) WGStatus() (*wgtypes.Device, error)
- type Options
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Backend ¶
type Backend struct {
// contains filtered or unexported fields
}
Backend is the userspace dataplane. It implements dataplane.Backend.
func New ¶
New builds a Backend with no tunnel and no listeners; EnsureDevice brings the tunnel up, the first Prepare binds the listeners and its Commit serves them. The evaluator rejects every flow until that first Commit gives it the Plan's admission policy, before any listener serves.
func (*Backend) AdmitRelayFlow ¶ added in v0.5.0
AdmitRelayFlow judges a new connection of the server's Relay frontend (proxyrelay) in userspace mode by every Admission Policy step, exactly as a Transparent TCP connection is judged: Forwarding picks how a flow is carried, not whether it is admitted (design.md 7a.9 節). The evaluator counts the drop of whichever step refuses, and Relay connections share the per-source concurrent-flow count with the Transparent TCP rules (design.md 6.3 節). When it admits, the caller calls release once when the connection ends, or at once when a later limit (Resource Guard) refuses it.
The size is 0 because a refused TCP connection counts as one packet of zero bytes (design.md 7a.9 節の許容差 drop_counter_units).
func (*Backend) Dial ¶
Dial connects to an agent through the netstack. The relay, the server's Relay frontend and the connectivity check all dial with it.
func (*Backend) EnsureDevice ¶ added in v0.5.0
EnsureDevice brings the tunnel up on first use. The peers are converged by the transactions (dataplane.Desired.WG), not here.
func (*Backend) Observe ¶ added in v0.5.0
Observe reports the peers the tunnel has. The tunnel lives only as long as the process, so after a restart it has none until the first transaction.
func (*Backend) Prepare ¶
Prepare stages d (design.md 7a.2 節): it adds the peers d newly declares, and binds the host listeners of the Transparent ports that are not open yet, without serving them. A rule with a port that cannot be bound is a rule-local failure (design.md 7a.3 節): it is reported by Failed, none of its ports is staged, and Commit leaves it out of the evaluator too. A failure to change the peers is backend-wide and returned as the error.
d.RelayListening is not used: the kernel backend needs it to give Relay ports per-source flow rows (design.md 6.1 節), while in userspace mode the Relay frontend asks the evaluator through AdmitRelayFlow.
func (*Backend) Repair ¶ added in v0.5.0
Repair reruns a peer removal the last Commit or Repair left failed (design.md 7a.3 節: 戻れない 地点の後の修復). Closing the relay sessions cannot fail, so it is never a repair.
func (*Backend) TCPPool ¶ added in v0.5.0
TCPPool is the TCP flow budget the relay uses. The server hands it to its Relay frontend so that both count against one process-wide TCP budget, and against one per-rule cap, in userspace mode (design.md 7, 7a.10 節). It is the relay's own pool: agent and server read the budget through the same accessor (design.md 10.2c 節).
func (*Backend) UDPPool ¶ added in v0.5.0
UDPPool is the UDP flow budget the relay uses. The admin API reads it to report Resource Guard's status (design.md 7a.10 節「拒否の報告」); kernel mode has no equivalent, since it counts UDP through nftables/conntrack, not through resource.Pool.
func (*Backend) UDPReplies ¶ added in v1.2.0
UDPReplies implements dataplane.UDPReplyObserver: for each published UDP rule, when this process began watching it and the last reply its listeners read from the agent since then (design.md 10.2a 節「UDP の応答の観測」). The relay marks a listener's last reply at most once a second.
type Options ¶
type Options struct {
// Limits gives the process-wide flow budgets and the per-rule isolation derived from them
// (design.md 7 節 and 7a.5 節, Resource Guard). The per-source caps are Admission Policy, a
// separate type (policy.AdmissionLimits) that comes with every Plan
// (Plan.Admission.PerSourceFlowCaps), not a field of this one.
Limits resource.Limits
// Logf is where the Backend and its tunnel log. nil means log.Printf.
Logf func(format string, args ...any)
}
Options configures a Backend.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package relay は、エージェントの netstack 上のリスナーと、LAN 内の target への中継を持つ(仕様 7 節)。
|
Package relay は、エージェントの netstack 上のリスナーと、LAN 内の target への中継を持つ(仕様 7 節)。 |
|
Package tunnel は、エージェント側が wireguard-go と gVisor の netstack でユーザー空間に持つトンネル (仕様 7 節)。
|
Package tunnel は、エージェント側が wireguard-go と gVisor の netstack でユーザー空間に持つトンネル (仕様 7 節)。 |
|
Package utun は、ユーザー空間モード(仕様 6.3 節)の VPS 側トンネル。
|
Package utun は、ユーザー空間モード(仕様 6.3 節)の VPS 側トンネル。 |