wgcfg: remove for now

Going to develop this on a branch and bring it in all at once.

Signed-off-by: David Crawshaw <crawshaw@tailscale.com>

wgcfg/config.go

@@ -1,78 +0,0 @@
-/* SPDX-License-Identifier: MIT
- *
- * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
- */
-
-// Package wgcfg has types and a parser for representing WireGuard config.
-package wgcfg
-
-import (
-	"fmt"
-	"strings"
-)
-
-// Config is a wireguard configuration.
-type Config struct {
-	Name       string
-	PrivateKey PrivateKey
-	Addresses  []CIDR
-	ListenPort uint16
-	MTU        uint16
-	DNS        []IP
-	Peers      []Peer
-}
-
-type Peer struct {
-	PublicKey           PublicKey
-	PresharedKey        SymmetricKey
-	AllowedIPs          []CIDR
-	Endpoints           []Endpoint
-	PersistentKeepalive uint16
-}
-
-type Endpoint struct {
-	Host string
-	Port uint16
-}
-
-func (e *Endpoint) String() string {
-	if strings.IndexByte(e.Host, ':') > 0 {
-		return fmt.Sprintf("[%s]:%d", e.Host, e.Port)
-	}
-	return fmt.Sprintf("%s:%d", e.Host, e.Port)
-}
-
-func (e *Endpoint) IsEmpty() bool {
-	return len(e.Host) == 0
-}
-
-// Copy makes a deep copy of Config.
-// The result aliases no memory with the original.
-func (cfg Config) Copy() Config {
-	res := cfg
-	if res.Addresses != nil {
-		res.Addresses = append([]CIDR{}, res.Addresses...)
-	}
-	if res.DNS != nil {
-		res.DNS = append([]IP{}, res.DNS...)
-	}
-	peers := make([]Peer, 0, len(res.Peers))
-	for _, peer := range res.Peers {
-		peers = append(peers, peer.Copy())
-	}
-	res.Peers = peers
-	return res
-}
-
-// Copy makes a deep copy of Peer.
-// The result aliases no memory with the original.
-func (peer Peer) Copy() Peer {
-	res := peer
-	if res.AllowedIPs != nil {
-		res.AllowedIPs = append([]CIDR{}, res.AllowedIPs...)
-	}
-	if res.Endpoints != nil {
-		res.Endpoints = append([]Endpoint{}, res.Endpoints...)
-	}
-	return res
-}

wgcfg/ip.go

@@ -1,152 +0,0 @@
-package wgcfg
-
-import (
-	"fmt"
-	"math"
-	"net"
-)
-
-// IP is an IPv4 or an IPv6 address.
-//
-// Internally the address is always represented in its IPv6 form.
-// IPv4 addresses use the IPv4-in-IPv6 syntax.
-type IP struct {
-	Addr [16]byte
-}
-
-func (ip IP) String() string { return net.IP(ip.Addr[:]).String() }
-
-// IP converts ip into a standard library net.IP.
-func (ip IP) IP() net.IP { return net.IP(ip.Addr[:]) }
-
-// Is6 reports whether ip is an IPv6 address.
-func (ip IP) Is6() bool { return !ip.Is4() }
-
-// Is4 reports whether ip is an IPv4 address.
-func (ip IP) Is4() bool {
-	return ip.Addr[0] == 0 && ip.Addr[1] == 0 &&
-		ip.Addr[2] == 0 && ip.Addr[3] == 0 &&
-		ip.Addr[4] == 0 && ip.Addr[5] == 0 &&
-		ip.Addr[6] == 0 && ip.Addr[7] == 0 &&
-		ip.Addr[8] == 0 && ip.Addr[9] == 0 &&
-		ip.Addr[10] == 0xff && ip.Addr[11] == 0xff
-}
-
-// To4 returns either a 4 byte slice for an IPv4 address, or nil if
-// it's not IPv4.
-func (ip IP) To4() []byte {
-	if ip.Is4() {
-		return ip.Addr[12:16]
-	} else {
-		return nil
-	}
-}
-
-// Equal reports whether ip == x.
-func (ip IP) Equal(x IP) bool {
-	return ip == x
-}
-
-func (ip IP) MarshalText() ([]byte, error) {
-	return []byte(ip.String()), nil
-}
-
-func (ip *IP) UnmarshalText(text []byte) error {
-	parsedIP, ok := ParseIP(string(text))
-	if !ok {
-		return fmt.Errorf("wgcfg.IP: UnmarshalText: bad IP address %q", text)
-	}
-	*ip = parsedIP
-	return nil
-}
-
-func IPv4(b0, b1, b2, b3 byte) (ip IP) {
-	ip.Addr[10], ip.Addr[11] = 0xff, 0xff // IPv4-in-IPv6 prefix
-	ip.Addr[12] = b0
-	ip.Addr[13] = b1
-	ip.Addr[14] = b2
-	ip.Addr[15] = b3
-	return ip
-}
-
-// ParseIP parses the string representation of an address into an IP.
-//
-// It accepts IPv4 notation such as "1.2.3.4" and IPv6 notation like ""::0".
-// The ok result reports whether s was a valid IP and ip is valid.
-func ParseIP(s string) (ip IP, ok bool) {
-	netIP := net.ParseIP(s)
-	if netIP == nil {
-		return IP{}, false
-	}
-	copy(ip.Addr[:], netIP.To16())
-	return ip, true
-}
-
-// CIDR is a compact IP address and subnet mask.
-type CIDR struct {
-	IP   IP
-	Mask uint8 // 0-32 for IsIPv4, 4-128 for IsIPv6
-}
-
-// ParseCIDR parses CIDR notation into a CIDR type.
-// Typical CIDR strings look like "192.168.1.0/24".
-func ParseCIDR(s string) (CIDR, error) {
-	netIP, netAddr, err := net.ParseCIDR(s)
-	if err != nil {
-		return CIDR{}, err
-	}
-	var cidr CIDR
-	copy(cidr.IP.Addr[:], netIP.To16())
-	ones, _ := netAddr.Mask.Size()
-	cidr.Mask = uint8(ones)
-
-	return cidr, nil
-}
-
-func (r CIDR) String() string { return r.IPNet().String() }
-
-func (r CIDR) IPNet() *net.IPNet {
-	bits := 128
-	if r.IP.Is4() {
-		bits = 32
-	}
-	return &net.IPNet{IP: r.IP.IP(), Mask: net.CIDRMask(int(r.Mask), bits)}
-}
-
-func (r CIDR) Contains(ip IP) bool {
-	c := int8(r.Mask)
-	i := 0
-	if r.IP.Is4() {
-		i = 12
-		if ip.Is6() {
-			return false
-		}
-	}
-	for ; i < 16 && c > 0; i++ {
-		var x uint8
-		if c < 8 {
-			x = 8 - uint8(c)
-		}
-		m := uint8(math.MaxUint8) >> x << x
-		a := r.IP.Addr[i] & m
-		b := ip.Addr[i] & m
-		if a != b {
-			return false
-		}
-		c -= 8
-	}
-	return true
-}
-
-func (r CIDR) MarshalText() ([]byte, error) {
-	return []byte(r.String()), nil
-}
-
-func (r *CIDR) UnmarshalText(text []byte) error {
-	cidr, err := ParseCIDR(string(text))
-	if err != nil {
-		return fmt.Errorf("wgcfg.CIDR: UnmarshalText: %v", err)
-	}
-	*r = cidr
-	return nil
-}

wgcfg/ip_test.go

@@ -1,106 +0,0 @@
-/* SPDX-License-Identifier: MIT
- *
- * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
- */
-
-package wgcfg_test
-
-import (
-	"testing"
-
-	"golang.zx2c4.com/wireguard/wgcfg"
-)
-
-func parseIP(t testing.TB, ipStr string) wgcfg.IP {
-	t.Helper()
-	ip, ok := wgcfg.ParseIP(ipStr)
-	if !ok {
-		t.Fatalf("failed to parse IP: %q", ipStr)
-	}
-	return ip
-}
-
-func TestCIDRContains(t *testing.T) {
-	t.Run("home router test", func(t *testing.T) {
-		r, err := wgcfg.ParseCIDR("192.168.0.0/24")
-		if err != nil {
-			t.Fatal(err)
-		}
-		ip := parseIP(t, "192.168.0.1")
-		if !r.Contains(ip) {
-			t.Fatalf("%q should contain %q", r, ip)
-		}
-	})
-
-	t.Run("IPv4 outside network", func(t *testing.T) {
-		r, err := wgcfg.ParseCIDR("192.168.0.0/30")
-		if err != nil {
-			t.Fatal(err)
-		}
-		ip := parseIP(t, "192.168.0.4")
-		if r.Contains(ip) {
-			t.Fatalf("%q should not contain %q", r, ip)
-		}
-	})
-
-	t.Run("IPv4 does not contain IPv6", func(t *testing.T) {
-		r, err := wgcfg.ParseCIDR("192.168.0.0/24")
-		if err != nil {
-			t.Fatal(err)
-		}
-		ip := parseIP(t, "2001:db8:85a3:0:0:8a2e:370:7334")
-		if r.Contains(ip) {
-			t.Fatalf("%q should not contain %q", r, ip)
-		}
-	})
-
-	t.Run("IPv6 inside network", func(t *testing.T) {
-		r, err := wgcfg.ParseCIDR("2001:db8:1234::/48")
-		if err != nil {
-			t.Fatal(err)
-		}
-		ip := parseIP(t, "2001:db8:1234:0000:0000:0000:0000:0001")
-		if !r.Contains(ip) {
-			t.Fatalf("%q should not contain %q", r, ip)
-		}
-	})
-
-	t.Run("IPv6 outside network", func(t *testing.T) {
-		r, err := wgcfg.ParseCIDR("2001:db8:1234:0:190b:0:1982::/126")
-		if err != nil {
-			t.Fatal(err)
-		}
-		ip := parseIP(t, "2001:db8:1234:0:190b:0:1982:4")
-		if r.Contains(ip) {
-			t.Fatalf("%q should not contain %q", r, ip)
-		}
-	})
-}
-
-func BenchmarkCIDRContainsIPv4(b *testing.B) {
-	b.Run("IPv4", func(b *testing.B) {
-		r, err := wgcfg.ParseCIDR("192.168.1.0/24")
-		if err != nil {
-			b.Fatal(err)
-		}
-		ip := parseIP(b, "1.2.3.4")
-		b.ResetTimer()
-
-		for i := 0; i < b.N; i++ {
-			r.Contains(ip)
-		}
-	})
-
-	b.Run("IPv6", func(b *testing.B) {
-		r, err := wgcfg.ParseCIDR("2001:db8:1234::/48")
-		if err != nil {
-			b.Fatal(err)
-		}
-		ip := parseIP(b, "2001:db8:1234:0000:0000:0000:0000:0001")
-		b.ResetTimer()
-
-		for i := 0; i < b.N; i++ {
-			r.Contains(ip)
-		}
-	})
-}

wgcfg/key.go

@@ -1,182 +0,0 @@
-package wgcfg
-
-import (
-	"bytes"
-	cryptorand "crypto/rand"
-	"crypto/subtle"
-	"encoding/base64"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"strings"
-
-	"golang.org/x/crypto/chacha20poly1305"
-	"golang.org/x/crypto/curve25519"
-)
-
-const KeySize = 32
-
-// PublicKey is curve25519 key.
-// It is used by WireGuard to represent public and preshared keys.
-type PublicKey [KeySize]byte
-
-func ParseKey(b64 string) (*PublicKey, error) { return parseKeyBase64(base64.StdEncoding, b64) }
-
-func ParseHexKey(s string) (PublicKey, error) {
-	b, err := hex.DecodeString(s)
-	if err != nil {
-		return PublicKey{}, &ParseError{"invalid hex key: " + err.Error(), s}
-	}
-	if len(b) != KeySize {
-		return PublicKey{}, &ParseError{fmt.Sprintf("invalid hex key length: %d", len(b)), s}
-	}
-
-	var key PublicKey
-	copy(key[:], b)
-	return key, nil
-}
-
-func ParsePrivateHexKey(v string) (PrivateKey, error) {
-	k, err := ParseHexKey(v)
-	if err != nil {
-		return PrivateKey{}, err
-	}
-	pk := PrivateKey(k)
-	if pk.IsZero() {
-		// Do not clamp a zero key, pass the zero through
-		// (much like NaN propagation) so that IsZero reports
-		// a useful result.
-		return pk, nil
-	}
-	pk.clamp()
-	return pk, nil
-}
-
-func (k PublicKey) Base64() string          { return base64.StdEncoding.EncodeToString(k[:]) }
-func (k PublicKey) String() string          { return k.ShortString() }
-func (k PublicKey) HexString() string       { return hex.EncodeToString(k[:]) }
-func (k PublicKey) Equal(k2 PublicKey) bool { return subtle.ConstantTimeCompare(k[:], k2[:]) == 1 }
-
-func (k *PublicKey) ShortString() string {
-	long := k.Base64()
-	return "[" + long[0:5] + "]"
-}
-
-func (k PublicKey) IsZero() bool {
-	var zeros PublicKey
-	return subtle.ConstantTimeCompare(zeros[:], k[:]) == 1
-}
-
-// PrivateKey is curve25519 key.
-// It is used by WireGuard to represent private keys.
-type PrivateKey [KeySize]byte
-
-// NewPrivateKey generates a new curve25519 secret key.
-// It conforms to the format described on https://cr.yp.to/ecdh.html.
-func NewPrivateKey() (pk PrivateKey, err error) {
-	_, err = cryptorand.Read(pk[:])
-	if err != nil {
-		return PrivateKey{}, err
-	}
-	pk.clamp()
-	return pk, nil
-}
-
-func ParsePrivateKey(b64 string) (*PrivateKey, error) {
-	k, err := parseKeyBase64(base64.StdEncoding, b64)
-	return (*PrivateKey)(k), err
-}
-
-func (k *PrivateKey) String() string           { return base64.StdEncoding.EncodeToString(k[:]) }
-func (k *PrivateKey) HexString() string        { return hex.EncodeToString(k[:]) }
-func (k *PrivateKey) Equal(k2 PrivateKey) bool { return subtle.ConstantTimeCompare(k[:], k2[:]) == 1 }
-
-func (k PrivateKey) IsZero() bool {
-	var zeros PrivateKey
-	return subtle.ConstantTimeCompare(zeros[:], k[:]) == 1
-}
-
-func (k *PrivateKey) clamp() {
-	k[0] &= 248
-	k[31] = (k[31] & 127) | 64
-}
-
-// Public computes the public key matching this curve25519 secret key.
-func (k PrivateKey) Public() PublicKey {
-	if k.IsZero() {
-		panic("wgcfg: tried to generate public key for a zero key")
-	}
-	var p [KeySize]byte
-	curve25519.ScalarBaseMult(&p, (*[KeySize]byte)(&k))
-	return (PublicKey)(p)
-}
-
-func (k PrivateKey) MarshalText() ([]byte, error) {
-	buf := new(bytes.Buffer)
-	fmt.Fprintf(buf, `privkey:%x`, k[:])
-	return buf.Bytes(), nil
-}
-
-func (k *PrivateKey) UnmarshalText(b []byte) error {
-	s := string(b)
-	if !strings.HasPrefix(s, `privkey:`) {
-		return errors.New("wgcfg.PrivateKey: UnmarshalText not given a private-key string")
-	}
-	s = strings.TrimPrefix(s, `privkey:`)
-	key, err := ParseHexKey(s)
-	if err != nil {
-		return fmt.Errorf("wgcfg.PrivateKey: UnmarshalText: %v", err)
-	}
-	copy(k[:], key[:])
-	return nil
-}
-
-func (k PrivateKey) SharedSecret(pub PublicKey) (ss [KeySize]byte) {
-	apk := (*[KeySize]byte)(&pub)
-	ask := (*[KeySize]byte)(&k)
-	curve25519.ScalarMult(&ss, ask, apk)
-	return ss
-}
-
-func parseKeyBase64(enc *base64.Encoding, s string) (*PublicKey, error) {
-	k, err := enc.DecodeString(s)
-	if err != nil {
-		return nil, &ParseError{"Invalid key: " + err.Error(), s}
-	}
-	if len(k) != KeySize {
-		return nil, &ParseError{"Keys must decode to exactly 32 bytes", s}
-	}
-	var key PublicKey
-	copy(key[:], k)
-	return &key, nil
-}
-
-func ParseSymmetricKey(b64 string) (SymmetricKey, error) {
-	k, err := parseKeyBase64(base64.StdEncoding, b64)
-	if err != nil {
-		return SymmetricKey{}, err
-	}
-	return SymmetricKey(*k), nil
-}
-
-func ParseSymmetricHexKey(s string) (SymmetricKey, error) {
-	b, err := hex.DecodeString(s)
-	if err != nil {
-		return SymmetricKey{}, &ParseError{"invalid symmetric hex key: " + err.Error(), s}
-	}
-	if len(b) != chacha20poly1305.KeySize {
-		return SymmetricKey{}, &ParseError{fmt.Sprintf("invalid symmetric hex key length: %d", len(b)), s}
-	}
-	var key SymmetricKey
-	copy(key[:], b)
-	return key, nil
-}
-
-// SymmetricKey is a 32-byte value used as a pre-shared key.
-type SymmetricKey [chacha20poly1305.KeySize]byte
-
-func (k SymmetricKey) Base64() string             { return base64.StdEncoding.EncodeToString(k[:]) }
-func (k SymmetricKey) String() string             { return "sym:" + k.Base64()[:8] }
-func (k SymmetricKey) HexString() string          { return hex.EncodeToString(k[:]) }
-func (k SymmetricKey) IsZero() bool               { return k.Equal(SymmetricKey{}) }
-func (k SymmetricKey) Equal(k2 SymmetricKey) bool { return subtle.ConstantTimeCompare(k[:], k2[:]) == 1 }

wgcfg/key_test.go

@@ -1,33 +0,0 @@
-package wgcfg
-
-import (
-	"bytes"
-	"testing"
-)
-
-func TestKeyBasics(t *testing.T) {
-	pk1, err := NewPrivateKey()
-	if err != nil {
-		t.Fatal(err)
-	}
-	k1 := pk1.Public()
-
-	t.Run("second key", func(t *testing.T) {
-		// Different keys should be different.
-		pk2, err := NewPrivateKey()
-		if err != nil {
-			t.Fatal(err)
-		}
-		k2 := pk2.Public()
-		if bytes.Equal(k1[:], k2[:]) {
-			t.Fatalf("k1 %v == k2 %v", k1[:], k2[:])
-		}
-		// Check for obvious comparables to make sure we are not generating bad strings somewhere.
-		if b1, b2 := k1.String(), k2.String(); b1 == b2 {
-			t.Fatalf("base64-encoded keys match: %s, %s", b1, b2)
-		}
-		if pub1, pub2 := pk1.Public().String(), pk2.Public().String(); pub1 == pub2 {
-			t.Fatalf("base64-encoded public keys match: %s, %s", pub1, pub2)
-		}
-	})
-}

wgcfg/name.go

@@ -1,49 +0,0 @@
-/* SPDX-License-Identifier: MIT
- *
- * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
- */
-
-package wgcfg
-
-import (
-	"regexp"
-	"strings"
-)
-
-var reservedNames = []string{
-	"CON", "PRN", "AUX", "NUL",
-	"COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
-	"LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9",
-}
-
-const specialChars = "/\\<>:\"|?*\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x00"
-
-var allowedNameFormat *regexp.Regexp
-
-func init() {
-	allowedNameFormat = regexp.MustCompile("^[a-zA-Z0-9_=+.-]{1,32}$")
-}
-
-func isReserved(name string) bool {
-	if len(name) == 0 {
-		return false
-	}
-	for _, reserved := range reservedNames {
-		if strings.EqualFold(name, reserved) {
-			return true
-		}
-	}
-	return false
-}
-
-func hasSpecialChars(name string) bool {
-	return strings.ContainsAny(name, specialChars)
-}
-
-func TunnelNameIsValid(name string) bool {
-	// Aside from our own restrictions, let's impose the Windows restrictions first
-	if isReserved(name) || hasSpecialChars(name) {
-		return false
-	}
-	return allowedNameFormat.MatchString(name)
-}

wgcfg/parser.go

@@ -1,397 +0,0 @@
-/* SPDX-License-Identifier: MIT
- *
- * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
- */
-
-package wgcfg
-
-import (
-	"encoding/hex"
-	"fmt"
-	"net"
-	"strconv"
-	"strings"
-)
-
-type ParseError struct {
-	why      string
-	offender string
-}
-
-func (e *ParseError) Error() string {
-	return fmt.Sprintf("%s: ‘%s’", e.why, e.offender)
-}
-
-func parseEndpoints(s string) ([]Endpoint, error) {
-	var eps []Endpoint
-	vals := strings.Split(s, ",")
-	for _, val := range vals {
-		e, err := parseEndpoint(val)
-		if err != nil {
-			return nil, err
-		}
-		eps = append(eps, *e)
-	}
-	return eps, nil
-}
-
-func parseEndpoint(s string) (*Endpoint, error) {
-	i := strings.LastIndexByte(s, ':')
-	if i < 0 {
-		return nil, &ParseError{"Missing port from endpoint", s}
-	}
-	host, portStr := s[:i], s[i+1:]
-	if len(host) < 1 {
-		return nil, &ParseError{"Invalid endpoint host", host}
-	}
-	port, err := parsePort(portStr)
-	if err != nil {
-		return nil, err
-	}
-	hostColon := strings.IndexByte(host, ':')
-	if host[0] == '[' || host[len(host)-1] == ']' || hostColon > 0 {
-		err := &ParseError{"Brackets must contain an IPv6 address", host}
-		if len(host) > 3 && host[0] == '[' && host[len(host)-1] == ']' && hostColon > 0 {
-			maybeV6 := net.ParseIP(host[1 : len(host)-1])
-			if maybeV6 == nil || len(maybeV6) != net.IPv6len {
-				return nil, err
-			}
-		} else {
-			return nil, err
-		}
-		host = host[1 : len(host)-1]
-	}
-	return &Endpoint{host, uint16(port)}, nil
-}
-
-func parseMTU(s string) (uint16, error) {
-	m, err := strconv.Atoi(s)
-	if err != nil {
-		return 0, err
-	}
-	if m < 576 || m > 65535 {
-		return 0, &ParseError{"Invalid MTU", s}
-	}
-	return uint16(m), nil
-}
-
-func parsePort(s string) (uint16, error) {
-	m, err := strconv.Atoi(s)
-	if err != nil {
-		return 0, err
-	}
-	if m < 0 || m > 65535 {
-		return 0, &ParseError{"Invalid port", s}
-	}
-	return uint16(m), nil
-}
-
-func parsePersistentKeepalive(s string) (uint16, error) {
-	if s == "off" {
-		return 0, nil
-	}
-	m, err := strconv.Atoi(s)
-	if err != nil {
-		return 0, err
-	}
-	if m < 0 || m > 65535 {
-		return 0, &ParseError{"Invalid persistent keepalive", s}
-	}
-	return uint16(m), nil
-}
-
-func parseKeyHex(s string) (*PublicKey, error) {
-	k, err := hex.DecodeString(s)
-	if err != nil {
-		return nil, &ParseError{"Invalid key: " + err.Error(), s}
-	}
-	if len(k) != KeySize {
-		return nil, &ParseError{"Keys must decode to exactly 32 bytes", s}
-	}
-	var key PublicKey
-	copy(key[:], k)
-	return &key, nil
-}
-
-func parseBytesOrStamp(s string) (uint64, error) {
-	b, err := strconv.ParseUint(s, 10, 64)
-	if err != nil {
-		return 0, &ParseError{"Number must be a number between 0 and 2^64-1: " + err.Error(), s}
-	}
-	return b, nil
-}
-
-func splitList(s string) ([]string, error) {
-	var out []string
-	for _, split := range strings.Split(s, ",") {
-		trim := strings.TrimSpace(split)
-		if len(trim) == 0 {
-			return nil, &ParseError{"Two commas in a row", s}
-		}
-		out = append(out, trim)
-	}
-	return out, nil
-}
-
-type parserState int
-
-const (
-	inInterfaceSection parserState = iota
-	inPeerSection
-	notInASection
-)
-
-func (c *Config) maybeAddPeer(p *Peer) {
-	if p != nil {
-		c.Peers = append(c.Peers, *p)
-	}
-}
-
-func FromWgQuick(s string, name string) (*Config, error) {
-	if !TunnelNameIsValid(name) {
-		return nil, &ParseError{"Tunnel name is not valid", name}
-	}
-	lines := strings.Split(s, "\n")
-	parserState := notInASection
-	conf := Config{Name: name}
-	sawPrivateKey := false
-	var peer *Peer
-	for _, line := range lines {
-		pound := strings.IndexByte(line, '#')
-		if pound >= 0 {
-			line = line[:pound]
-		}
-		line = strings.TrimSpace(line)
-		lineLower := strings.ToLower(line)
-		if len(line) == 0 {
-			continue
-		}
-		if lineLower == "[interface]" {
-			conf.maybeAddPeer(peer)
-			parserState = inInterfaceSection
-			continue
-		}
-		if lineLower == "[peer]" {
-			conf.maybeAddPeer(peer)
-			peer = &Peer{}
-			parserState = inPeerSection
-			continue
-		}
-		if parserState == notInASection {
-			return nil, &ParseError{"Line must occur in a section", line}
-		}
-		equals := strings.IndexByte(line, '=')
-		if equals < 0 {
-			return nil, &ParseError{"Invalid config key is missing an equals separator", line}
-		}
-		key, val := strings.TrimSpace(lineLower[:equals]), strings.TrimSpace(line[equals+1:])
-		if len(val) == 0 {
-			return nil, &ParseError{"Key must have a value", line}
-		}
-		if parserState == inInterfaceSection {
-			switch key {
-			case "privatekey":
-				k, err := ParseKey(val)
-				if err != nil {
-					return nil, err
-				}
-				conf.PrivateKey = PrivateKey(*k)
-				sawPrivateKey = true
-			case "listenport":
-				p, err := parsePort(val)
-				if err != nil {
-					return nil, err
-				}
-				conf.ListenPort = p
-			case "mtu":
-				m, err := parseMTU(val)
-				if err != nil {
-					return nil, err
-				}
-				conf.MTU = m
-			case "address":
-				addresses, err := splitList(val)
-				if err != nil {
-					return nil, err
-				}
-				for _, address := range addresses {
-					a, err := ParseCIDR(address)
-					if err != nil {
-						return nil, err
-					}
-					conf.Addresses = append(conf.Addresses, a)
-				}
-			case "dns":
-				addresses, err := splitList(val)
-				if err != nil {
-					return nil, err
-				}
-				for _, address := range addresses {
-					a, ok := ParseIP(address)
-					if !ok {
-						return nil, &ParseError{"Invalid IP address", address}
-					}
-					conf.DNS = append(conf.DNS, a)
-				}
-			default:
-				return nil, &ParseError{"Invalid key for [Interface] section", key}
-			}
-		} else if parserState == inPeerSection {
-			switch key {
-			case "publickey":
-				k, err := ParseKey(val)
-				if err != nil {
-					return nil, err
-				}
-				peer.PublicKey = *k
-			case "presharedkey":
-				k, err := ParseKey(val)
-				if err != nil {
-					return nil, err
-				}
-				peer.PresharedKey = SymmetricKey(*k)
-			case "allowedips":
-				addresses, err := splitList(val)
-				if err != nil {
-					return nil, err
-				}
-				for _, address := range addresses {
-					a, err := ParseCIDR(address)
-					if err != nil {
-						return nil, err
-					}
-					peer.AllowedIPs = append(peer.AllowedIPs, a)
-				}
-			case "persistentkeepalive":
-				p, err := parsePersistentKeepalive(val)
-				if err != nil {
-					return nil, err
-				}
-				peer.PersistentKeepalive = p
-			case "endpoint":
-				eps, err := parseEndpoints(val)
-				if err != nil {
-					return nil, err
-				}
-				peer.Endpoints = eps
-			default:
-				return nil, &ParseError{"Invalid key for [Peer] section", key}
-			}
-		}
-	}
-	conf.maybeAddPeer(peer)
-
-	if !sawPrivateKey {
-		return nil, &ParseError{"An interface must have a private key", "[none specified]"}
-	}
-	for _, p := range conf.Peers {
-		if p.PublicKey.IsZero() {
-			return nil, &ParseError{"All peers must have public keys", "[none specified]"}
-		}
-	}
-
-	return &conf, nil
-}
-
-// TODO(apenwarr): This is incompatibe with current Device.IpcSetOperation.
-//  It duplicates all the parser stuff in there, but is missing some
-//  keywords. Nothing useful seems to need it anymore.
-func Broken_FromUAPI(s string, existingConfig *Config) (*Config, error) {
-	lines := strings.Split(s, "\n")
-	parserState := inInterfaceSection
-	conf := Config{
-		Name:      existingConfig.Name,
-		Addresses: existingConfig.Addresses,
-		DNS:       existingConfig.DNS,
-		MTU:       existingConfig.MTU,
-	}
-	var peer *Peer
-	for _, line := range lines {
-		if len(line) == 0 {
-			continue
-		}
-		equals := strings.IndexByte(line, '=')
-		if equals < 0 {
-			return nil, &ParseError{"Invalid config key is missing an equals separator", line}
-		}
-		key, val := line[:equals], line[equals+1:]
-		if len(val) == 0 {
-			return nil, &ParseError{"Key must have a value", line}
-		}
-		switch key {
-		case "public_key":
-			conf.maybeAddPeer(peer)
-			peer = &Peer{}
-			parserState = inPeerSection
-		case "errno":
-			if val == "0" {
-				continue
-			} else {
-				return nil, &ParseError{"Error in getting configuration", val}
-			}
-		}
-		if parserState == inInterfaceSection {
-			switch key {
-			case "private_key":
-				k, err := parseKeyHex(val)
-				if err != nil {
-					return nil, err
-				}
-				conf.PrivateKey = PrivateKey(*k)
-			case "listen_port":
-				p, err := parsePort(val)
-				if err != nil {
-					return nil, err
-				}
-				conf.ListenPort = p
-			case "fwmark":
-				// Ignored for now.
-
-			default:
-				return nil, &ParseError{"Invalid key for interface section", key}
-			}
-		} else if parserState == inPeerSection {
-			switch key {
-			case "public_key":
-				k, err := parseKeyHex(val)
-				if err != nil {
-					return nil, err
-				}
-				peer.PublicKey = *k
-			case "preshared_key":
-				k, err := parseKeyHex(val)
-				if err != nil {
-					return nil, err
-				}
-				peer.PresharedKey = SymmetricKey(*k)
-			case "protocol_version":
-				if val != "1" {
-					return nil, &ParseError{"Protocol version must be 1", val}
-				}
-			case "allowed_ip":
-				a, err := ParseCIDR(val)
-				if err != nil {
-					return nil, err
-				}
-				peer.AllowedIPs = append(peer.AllowedIPs, a)
-			case "persistent_keepalive_interval":
-				p, err := parsePersistentKeepalive(val)
-				if err != nil {
-					return nil, err
-				}
-				peer.PersistentKeepalive = p
-			case "endpoint":
-				eps, err := parseEndpoints(val)
-				if err != nil {
-					return nil, err
-				}
-				peer.Endpoints = eps
-			default:
-				return nil, &ParseError{"Invalid key for peer section", key}
-			}
-		}
-	}
-	conf.maybeAddPeer(peer)
-
-	return &conf, nil
-}

wgcfg/parser_test.go

@@ -1,127 +0,0 @@
-/* SPDX-License-Identifier: MIT
- *
- * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
- */
-
-package wgcfg
-
-import (
-	"reflect"
-	"runtime"
-	"testing"
-)
-
-const testInput = `
-[Interface] 
-Address = 10.192.122.1/24 
-Address = 10.10.0.1/16 
-PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk= 
-ListenPort = 51820  #comments don't matter
-
-[Peer] 
-PublicKey   =   xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=    
-Endpoint = 192.95.5.67:1234 
-AllowedIPs = 10.192.122.3/32, 10.192.124.1/24
-
-[Peer] 
-PublicKey = TrMvSoP4jYQlY6RIzBgbssQqY3vxI2Pi+y71lOWWXX0= 
-Endpoint = [2607:5300:60:6b0::c05f:543]:2468 
-AllowedIPs = 10.192.122.4/32, 192.168.0.0/16
-PersistentKeepalive = 100
-
-[Peer] 
-PublicKey = gN65BkIKy1eCE9pP1wdc8ROUtkHLF2PfAqYdyYBz6EA= 
-PresharedKey = TrMvSoP4jYQlY6RIzBgbssQqY3vxI2Pi+y71lOWWXX0= 
-Endpoint = test.wireguard.com:18981 
-AllowedIPs = 10.10.10.230/32`
-
-func noError(t *testing.T, err error) bool {
-	if err == nil {
-		return true
-	}
-	_, fn, line, _ := runtime.Caller(1)
-	t.Errorf("Error at %s:%d: %#v", fn, line, err)
-	return false
-}
-
-func equal(t *testing.T, expected, actual interface{}) bool {
-	if reflect.DeepEqual(expected, actual) {
-		return true
-	}
-	_, fn, line, _ := runtime.Caller(1)
-	t.Errorf("Failed equals at %s:%d\nactual   %#v\nexpected %#v", fn, line, actual, expected)
-	return false
-}
-func lenTest(t *testing.T, actualO interface{}, expected int) bool {
-	actual := reflect.ValueOf(actualO).Len()
-	if reflect.DeepEqual(expected, actual) {
-		return true
-	}
-	_, fn, line, _ := runtime.Caller(1)
-	t.Errorf("Wrong length at %s:%d\nactual   %#v\nexpected %#v", fn, line, actual, expected)
-	return false
-}
-func contains(t *testing.T, list, element interface{}) bool {
-	listValue := reflect.ValueOf(list)
-	for i := 0; i < listValue.Len(); i++ {
-		if reflect.DeepEqual(listValue.Index(i).Interface(), element) {
-			return true
-		}
-	}
-	_, fn, line, _ := runtime.Caller(1)
-	t.Errorf("Error %s:%d\nelement not found: %#v", fn, line, element)
-	return false
-}
-
-func TestFromWgQuick(t *testing.T) {
-	conf, err := FromWgQuick(testInput, "test")
-	if noError(t, err) {
-
-		lenTest(t, conf.Addresses, 2)
-		contains(t, conf.Addresses, CIDR{IPv4(10, 10, 0, 1), 16})
-		contains(t, conf.Addresses, CIDR{IPv4(10, 192, 122, 1), 24})
-		equal(t, "yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=", conf.PrivateKey.String())
-		equal(t, uint16(51820), conf.ListenPort)
-
-		lenTest(t, conf.Peers, 3)
-		lenTest(t, conf.Peers[0].AllowedIPs, 2)
-		equal(t, Endpoint{Host: "192.95.5.67", Port: 1234}, conf.Peers[0].Endpoints[0])
-		equal(t, "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=", conf.Peers[0].PublicKey.Base64())
-
-		lenTest(t, conf.Peers[1].AllowedIPs, 2)
-		equal(t, Endpoint{Host: "2607:5300:60:6b0::c05f:543", Port: 2468}, conf.Peers[1].Endpoints[0])
-		equal(t, "TrMvSoP4jYQlY6RIzBgbssQqY3vxI2Pi+y71lOWWXX0=", conf.Peers[1].PublicKey.Base64())
-		equal(t, uint16(100), conf.Peers[1].PersistentKeepalive)
-
-		lenTest(t, conf.Peers[2].AllowedIPs, 1)
-		equal(t, Endpoint{Host: "test.wireguard.com", Port: 18981}, conf.Peers[2].Endpoints[0])
-		equal(t, "gN65BkIKy1eCE9pP1wdc8ROUtkHLF2PfAqYdyYBz6EA=", conf.Peers[2].PublicKey.Base64())
-		equal(t, "TrMvSoP4jYQlY6RIzBgbssQqY3vxI2Pi+y71lOWWXX0=", conf.Peers[2].PresharedKey.Base64())
-	}
-}
-
-func TestParseEndpoint(t *testing.T) {
-	_, err := parseEndpoint("[192.168.42.0:]:51880")
-	if err == nil {
-		t.Error("Error was expected")
-	}
-	e, err := parseEndpoint("192.168.42.0:51880")
-	if noError(t, err) {
-		equal(t, "192.168.42.0", e.Host)
-		equal(t, uint16(51880), e.Port)
-	}
-	e, err = parseEndpoint("test.wireguard.com:18981")
-	if noError(t, err) {
-		equal(t, "test.wireguard.com", e.Host)
-		equal(t, uint16(18981), e.Port)
-	}
-	e, err = parseEndpoint("[2607:5300:60:6b0::c05f:543]:2468")
-	if noError(t, err) {
-		equal(t, "2607:5300:60:6b0::c05f:543", e.Host)
-		equal(t, uint16(2468), e.Port)
-	}
-	_, err = parseEndpoint("[::::::invalid:18981")
-	if err == nil {
-		t.Error("Error was expected")
-	}
-}

wgcfg/writer.go

@@ -1,73 +0,0 @@
-/* SPDX-License-Identifier: MIT
- *
- * Copyright (C) 2019 WireGuard LLC. All Rights Reserved.
- */
-
-package wgcfg
-
-import (
-	"fmt"
-	"net"
-	"strings"
-)
-
-func (conf *Config) ToUAPI() (string, error) {
-	output := new(strings.Builder)
-	fmt.Fprintf(output, "private_key=%s\n", conf.PrivateKey.HexString())
-
-	if conf.ListenPort > 0 {
-		fmt.Fprintf(output, "listen_port=%d\n", conf.ListenPort)
-	}
-
-	output.WriteString("replace_peers=true\n")
-
-	for _, peer := range conf.Peers {
-		fmt.Fprintf(output, "public_key=%s\n", peer.PublicKey.HexString())
-		fmt.Fprintf(output, "protocol_version=1\n")
-		fmt.Fprintf(output, "replace_allowed_ips=true\n")
-
-		if !peer.PresharedKey.IsZero() {
-			fmt.Fprintf(output, "preshared_key = %s\n", peer.PresharedKey.String())
-		}
-
-		if len(peer.AllowedIPs) > 0 {
-			for _, address := range peer.AllowedIPs {
-				fmt.Fprintf(output, "allowed_ip=%s\n", address.String())
-			}
-		}
-
-		if len(peer.Endpoints) > 0 {
-			var reps []string
-			for _, ep := range peer.Endpoints {
-				ips, err := net.LookupIP(ep.Host)
-				if err != nil {
-					return "", err
-				}
-				var ip net.IP
-				for _, iterip := range ips {
-					if ip4 := iterip.To4(); ip4 != nil {
-						ip = ip4
-						break
-					}
-					if ip == nil {
-						ip = iterip
-					}
-				}
-				if ip == nil {
-					return "", fmt.Errorf("unable to resolve IP address of endpoint %q (%v)", ep.Host, ips)
-				}
-				resolvedEndpoint := Endpoint{ip.String(), ep.Port}
-				reps = append(reps, resolvedEndpoint.String())
-			}
-			fmt.Fprintf(output, "endpoint=%s\n", strings.Join(reps, ","))
-		} else {
-			fmt.Fprint(output, "endpoint=\n")
-		}
-
-		// Note: this needs to come *after* endpoint definitions,
-		// because setting it will trigger a handshake to all
-		// already-defined endpoints.
-		fmt.Fprintf(output, "persistent_keepalive_interval=%d\n", peer.PersistentKeepalive)
-	}
-	return output.String(), nil
-}