mirror of
https://github.com/psviderski/uncloud.git
synced 2026-08-26 19:13:34 +00:00
46 lines
1.6 KiB
Go
46 lines
1.6 KiB
Go
package network
|
|
|
|
import (
|
|
"fmt"
|
|
"net/netip"
|
|
"time"
|
|
|
|
"github.com/psviderski/uncloud/internal/secret"
|
|
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
|
)
|
|
|
|
const (
|
|
WireGuardInterfaceName = "uncloud"
|
|
DefaultWireGuardPort = 51820
|
|
// MinWireGuardMTU is the minimum MTU for the WireGuard interface. The management traffic inside the tunnel uses
|
|
// IPv6 whose minimum link MTU is 1280, so this is a safe floor that also keeps Corrosion's max_mtu (>= 1200) valid.
|
|
MinWireGuardMTU = 1280
|
|
// MaxWireGuardMTU is the conservative maximum MTU set by auto-detection and the fallback when detection fails.
|
|
// It's the standard WireGuard MTU for a 1500-byte underlay (1500 - 80) that matches the kernel's default
|
|
// for WireGuard links.
|
|
MaxWireGuardMTU = 1500 - wireGuardEncapOverhead
|
|
// wireGuardEncapOverhead is WireGuard's worst-case (IPv6 endpoint) encapsulation overhead: outer IPv6 (40) +
|
|
// UDP (8) + WireGuard message header and auth tag (32).
|
|
wireGuardEncapOverhead = 80
|
|
// WireGuardKeepaliveInterval is sensible interval that works with a wide variety of firewalls.
|
|
WireGuardKeepaliveInterval = 25 * time.Second
|
|
)
|
|
|
|
type EndpointChangeEvent struct {
|
|
PublicKey secret.Secret
|
|
// Endpoint is the new endpoint of the peer.
|
|
Endpoint netip.AddrPort
|
|
}
|
|
|
|
// NewMachineKeys generates a new WireGuard private and public key pair.
|
|
func NewMachineKeys() (privKey, pubKey secret.Secret, err error) {
|
|
wgPrivKey, err := wgtypes.GeneratePrivateKey()
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("generate WireGuard private key: %w", err)
|
|
}
|
|
privKey = wgPrivKey[:]
|
|
wgPubKey := wgPrivKey.PublicKey()
|
|
pubKey = wgPubKey[:]
|
|
return
|
|
}
|