thakares/nx9-wg
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Release v1.1.0

Browse Source
This commit is contained in:
thakares committed 2026-09-02 15:19:19 +05:30
1 parent 34227efd2b
commit edc710cbd2
46 files changed
+5324 -190
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/NATIVE-WIREGUARD.md
+10 -7
View File
@@ -29,13 +29,14 @@ Unlike traditional WireGuard management tools that spawn external CLI processes
### B. WireGuard Generic Netlink Protocol
- Resolves the dynamic Generic Netlink family ID for `"wireguard"`.
- **`WG_CMD_SET_DEVICE`**: Atomically configures the interface private key, UDP listen port, and peer list.
- **`WG_CMD_SET_DEVICE`**: Atomically configures the interface private key, UDP listen port (if explicitly configured), and peer list.
- **Optional ListenPort**: If `interface.listen_port` is `Some(port)` and `port != 0`, `WGDEVICE_A_LISTEN_PORT` is emitted. If `None` (standard for Upstream interfaces like `proton0`), the attribute is omitted, allowing the Linux kernel to automatically bind an ephemeral dynamic UDP port.
- **`WG_CMD_GET_DEVICE`**: Queries live kernel device state, active listen port, public key, peer public keys, endpoints, allowed IPs, last handshake timestamps, and transfer byte counters.
- **`WGDEVICE_F_REPLACE_PEERS`**: When syncing peers, setting this flag instructs the kernel to atomically replace all existing peers with the supplied desired set, removing stale peers in a single transaction.
---
## 2. Peer Cryptographic Synchronization
## 2. Peer Cryptographic Synchronization & Role-Aware AllowedIPs
```mermaid
sequenceDiagram
@@ -45,9 +46,9 @@ sequenceDiagram
participant Kernel as Linux Kernel (wireguard.ko)
Engine->>Genl: Send WG_CMD_SET_DEVICE (Interface wg0, ReplacePeers=true)
Note over Engine,Genl: Encodes ListenPort, PrivateKey, Peer Array
Note over Engine,Genl: Encodes ListenPort (if Some), PrivateKey, Peer Array
Genl->>Kernel: Transmit Netlink Message
Kernel->>Kernel: Validate Keys, Bind UDP Port, Apply Peers
Kernel->>Kernel: Validate Keys, Bind UDP Port (or dynamic), Apply Peers
Kernel-->>Genl: NLMSG_ERROR (error=0 / Success)
Genl-->>Engine: Ok(())
@@ -57,10 +58,12 @@ sequenceDiagram
Genl-->>Engine: Live Telemetry (Handshakes, Bytes Tx/Rx)
```
### Cryptographic Attribute Encoding:
### Role-Aware Cryptographic Attribute Encoding:
- **Keys**: 32-byte binary Curve25519 keys (`WGPEER_A_PUBLIC_KEY`, `WGPEER_A_PRESHARED_KEY`).
- **Allowed IPs**: Nested attributes (`WGALLOWEDIP_A_FAMILY`, `WGALLOWEDIP_A_IPADDR`, `WGALLOWEDIP_A_CIDR_MASK`).
- **Endpoint**: `sockaddr_in` (IPv4) or `sockaddr_in6` (IPv6) socket address structures.
- **Role-Aware Allowed IPs**:
- **Overlay Peers**: Scoped to `/32` (IPv4) or `/128` (IPv6) derived from the peer's assigned tunnel address.
- **Upstream Provider Peers**: Preserves full-tunnel AllowedIPs (`0.0.0.0/0, ::/0`) on the WireGuard device without modifying the server's Linux FIB default routing table.
- **Endpoint**: `sockaddr_in` (IPv4) or `sockaddr_in6` (IPv6) socket address structures representing the remote destination (e.g. `37.19.199.155:51820`), independent of the local interface listen port.
- **Persistent Keepalive**: Interval in seconds (`WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL`).
---