vpn

type Client struct {
	// contains filtered or unexported fields
}

type ClientConfig struct {
	Killswitch bool
	ServerPK   cipher.PubKey
	DNSAddr    string
	// MuxRoutes, when > 1, dials the server over that many parallel
	// (multiplexed) routes. MinHops, when >= 2, forces the route through
	// at least that many intermediate visors (multihop) instead of a
	// direct path. Both default to 0 (the plain single-route dial).
	MuxRoutes int
	MinHops   int
	// DmsgFallback, when true, dials the VPN server over a direct dmsg stream if
	// the skynet (route) dial fails. Opt-in: dmsg relays through a dmsg server, so
	// the fallback trades higher latency and a metadata downgrade (the dmsg server
	// sees both endpoint PKs, unlike a source-routed multihop skynet path) for the
	// resilience of an always-available baseline. Default off keeps the plain
	// skynet-only dial.
	DmsgFallback bool

	// MeshGateway, when true (Linux only), additionally runs a local MESH
	// GATEWAY: the host resolves *.dmsg / *.skynet by name and those connections
	// are proxied over the mesh (bypassing the tunnel), the single-machine
	// counterpart of the vpn-router's LAN gateway. MeshDial must be set.
	MeshGateway bool
	// MeshGatewayCIDR is the synthetic-IP pool (empty = 100.64.0.0/16).
	MeshGatewayCIDR string
	// MeshDial performs the mesh dial for resolved names; the vpn-client app
	// wires it to its app.Client. Required when MeshGateway is true.
	MeshDial meshgw.MeshDial
	// MeshAliases maps friendly names to PKs (reach http://<alias>.dmsg). Optional.
	MeshAliases map[string]cipher.PubKey
	// MeshTLSMinter, when set, enables TLS-MITM for HTTPS to *.dmsg / *.skynet.
	// The host must trust the minter's CA. Optional.
	MeshTLSMinter skynetca.LeafMinter
}

type ClientHello struct {
	UnavailablePrivateIPs []net.IP `json:"unavailable_private_ips"`
}

type DirectRoutesEnvConfig struct {
	DmsgDiscovery   string
	DmsgServers     []string
	TPDiscovery     string
	RF              string
	AddressResolver string
	TPRemoteIPs     []string
	STCPTable       map[cipher.PubKey]string
}

type HandshakeStatus int

type IPGenerator struct {
	// contains filtered or unexported fields
}

type MeshGatewayConfig struct {
	// LANInterface is the interface LAN traffic arrives on — the `iif` the
	// PREROUTING REDIRECT matches. Required: the REDIRECT must be pinned to the
	// downstream link so it never catches the board's own upstream traffic.
	LANInterface string

	// BindIP is the address the DNS server and transparent proxy listen on.
	// Nil / unspecified = all interfaces (0.0.0.0). Set it to the board's LAN IP
	// to avoid exposing DNS on other interfaces.
	BindIP net.IP

	// DNSPort is the mesh-name DNS port. 0 = defaultMeshGatewayDNSPort (53).
	DNSPort int

	// CIDR is the synthetic-IP pool leased to `.dmsg` / `.skynet` names. Empty =
	// defaultMeshGatewayCIDR (100.64.0.0/16). This is the range the upstream
	// router must static-route to this board.
	CIDR string

	// MeshDial dials the mesh for a resolved (scheme, pk, port). Required — from
	// the vpn-router app it is vpn.MeshDialer(appClient).
	MeshDial meshgw.MeshDial

	// Aliases (optional) maps friendly names → PK for names that aren't a raw PK.
	Aliases map[string]cipher.PubKey

	// TLSMinter (optional) enables TLS-MITM for HTTPS to `.dmsg` / `.skynet`
	// (port 443). LAN clients must trust the minter's CA.
	TLSMinter skynetca.LeafMinter
}

type Router struct {
	// contains filtered or unexported fields
}

type RouterConfig struct {
	// LANInterface is the downstream interface that serves clients — a wired NIC
	// (e.g. "eth1") for the ethernet-out variant, or an AP-capable wireless NIC
	// (e.g. "wlan0") for the WiFi-out variant.
	LANInterface string

	// TUNInterface is the upstream mesh-VPN tunnel to masquerade into (e.g.
	// "tun0"), owned by the vpn-client app. Empty = auto-detect the first tun*
	// interface once vpn-client has brought it up.
	TUNInterface string

	// Gateway is the router's own address on the downstream subnet (the default
	// gateway handed to clients), e.g. 192.168.42.1.
	Gateway net.IP

	// Subnet is the downstream network in CIDR form, e.g. 192.168.42.0/24.
	Subnet *net.IPNet

	// DHCPStart and DHCPEnd bound the DHCP address pool. Both must lie inside
	// Subnet. Zero values default to .10 … .254 of the subnet.
	DHCPStart net.IP
	DHCPEnd   net.IP

	// DNS is the resolver advertised to clients over DHCP (e.g. 1.1.1.1). Zero
	// value defaults to the Gateway (dnsmasq then resolves for clients).
	DNS net.IP

	// LeaseTime is the DHCP lease duration in dnsmasq form (e.g. "12h"). Empty
	// defaults to "12h".
	LeaseTime string

	// WiFi, when non-nil, additionally runs hostapd to create a WiFi AP on
	// LANInterface. Nil = ethernet-out (no AP).
	WiFi *WiFiConfig

	// MeshDial, when non-nil, enables the MESH GATEWAY: the router's DNS answers
	// *.dmsg / *.skynet with synthetic IPs, and a transparent proxy dials those
	// targets over the mesh via this func — so any downstream client can reach
	// dmsg/skynet services by name. The vpn-router app supplies a dialer backed
	// by its app.Client. Nil = mesh gateway off. See pkg/vpnrouter/meshgw.
	MeshDial meshgw.MeshDial

	// MeshGatewayCIDR is the private range the mesh gateway leases synthetic IPs
	// from. Empty defaults to defaultMeshGatewayCIDR. Ignored when MeshDial nil.
	MeshGatewayCIDR string

	// MeshAliases maps friendly names to destination PKs, so a client can reach
	// `http://<alias>.dmsg` instead of the raw `<pk-label>.dmsg`. May be nil.
	// Ignored when MeshDial nil.
	MeshAliases map[string]cipher.PubKey

	// MeshTLSMinter, when non-nil (and MeshDial set), enables TLS-MITM for the
	// mesh gateway: HTTPS to *.dmsg / *.skynet is terminated with a leaf minted
	// here and bridged to the plain-HTTP mesh upstream, so browsers get a secure
	// context. LAN clients must trust the minter's CA. Ignored when MeshDial nil.
	MeshTLSMinter skynetca.LeafMinter
}

type Server struct {
	// contains filtered or unexported fields
}

type ServerConfig struct {
	Whitelist        []cipher.PubKey
	Secure           bool
	NetworkInterface string
}

type ServerHello struct {
	Status     HandshakeStatus `json:"status"`
	TUNIP      net.IP          `json:"tun_ip"`
	TUNGateway net.IP          `json:"tun_gateway"`
}

type SkyDNSConfig struct {
	// Dial carries connections to mesh names. See MeshDialer.
	Dial meshgw.MeshDial
	// Upstream is the resolver for every other name, an IP. Empty means the
	// phone's own, as the app reports them.
	Upstream string
	Log      logrus.FieldLogger
}

type TUNDevice interface {
	io.ReadWriteCloser
	Name() string
}

type WiFiConfig struct {
	SSID string
	// Passphrase is the WPA2 pre-shared key (8–63 chars). Empty = open network
	// (allowed but strongly discouraged; validate() warns via error unless
	// explicitly opened with AllowOpen).
	Passphrase string
	// Band is "2.4" or "5". Selects hostapd hw_mode (g / a).
	Band string
	// Channel is the 802.11 channel. 0 = a sensible default for the band
	// (channel 6 on 2.4 GHz, 36 on 5 GHz).
	Channel int
	// CountryCode is the regulatory domain (e.g. "US"). Empty = "US".
	CountryCode string
	// AllowOpen permits an empty Passphrase (open network) without erroring.
	AllowOpen bool
}