rosenpass

package module
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 1, 2023 License: Apache-2.0 Imports: 23 Imported by: 0

README

go-rosenpass

Codecov branch goreportcard License GitHub go.mod Go version Go Reference

🚧 go-rosenpass has not been audited. Please use with care!

go-rosenpass is a port of Rosenpass to Go.

The implementation aims to be compatible with the reference implementation in Rust for the:

  • on-wire protocol
  • handshake parameters
  • command-line interface

Installation

Binary releases

go-rosenpass distributes builds via GitHub Releases. You can download a pre-built binary from there.

From source
go install cunicu.li/go-rosenpass/cmd@latest

Example Setup

# Generate our own WireGuard key pair
WG_PRIVATE_KEY=$(wg genkey)
WG_PUBLIC_KEY=$(wg pubkey <<< ${WG_PRIVATE_KEY})

# Generate our own Rosenpass key pair
go-rosenpass gen-keys-intf wg0

# Show our details
echo "Your hostname: $(hostname)"
echo "Your WireGuard public key: ${WG_PUBLIC_KEY}"

# Query the peer details
read -p "Enter your peers hostname: " PEER
read -p "Enter your peers WireGuard public key: " WG_PUBLIC_KEY_PEER

# Exchange Rosenpass public key
scp /etc/wireguard/wg0/pqpk root@${PEER}:/etc/wireguard/wg0/${WG_PUBLIC_KEY//\//}.pqpk

# Generate wg-quick configuration
cat <<EOF >> /etc/wireguard/wg0.conf
[Interface]
PrivateKey = ${WG_PRIVATE_KEY}
ListenPort = 51820

PostUp = go-rosenpass exchange-intf %i & echo $! > /run/go-rosenpass.%i.pid
PreDown = pkill -F /run/go-rosenpass.%i.pid || true

[Peer]
PublicKey = ${WG_PUBLIC_KEY_PEER}
Endpoint = ${PEER}:51820
EOF

# Bring connection up
wg-quick up wg0

References

Authors

License

go-rosenpass is licensed under the Apache 2.0 license.

  • SPDX-FileCopyrightText: 2023 Steffen Vogel post@steffenvogel.de
  • SPDX-License-Identifier: Apache-2.0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (

	// From the WireGuard paper
	// Rekey every two minutes, discard the key if no rekey is achieved within three.
	RekeyAfterTimeResponder = 2 * time.Minute
	RekeyAfterTimeInitiator = RekeyAfterTimeResponder + 10*time.Second
	RejectAfterTime         = 3 * time.Minute

	// Seconds until the biscuit key is changed; we issue biscuits
	// using one biscuit key for one epoch and store the biscuit for
	// decryption for a second epoch.
	BiscuitEpoch = 5 * time.Minute

	// Retransmission constants
	// will retransmit for up to 2 minutes; starting with a delay of
	// 0.5 seconds and increasing the delay exponentially by a factor of
	// 2 up to 10 seconds. An additional jitter factor of ±0.5 seconds is added.
	RetransmitDelayGrowth = 2.0
	RetransmitDelayBegin  = 500 * time.Millisecond
	RetransmitDelayEnd    = 10 * time.Second
	RetransmitDelayJitter = 500 * time.Millisecond
)

Functions

func GenerateKeyPair 

func GenerateKeyPair() (PublicKey, SecretKey, error)

GenerateKeyPair generates a new Classic McEliece key pair.

func GenerateRound2KeyPair 

func GenerateRound2KeyPair() (PublicKey, SecretKey, error)

GenerateKeyPair generates a new Classic McEliece key pair in its old (round 2) format.

func ParsePeerID 

func ParsePeerID(s string) (pid, error)

Types

type Config 

type Config struct {
	ListenSinglePort bool
	ListenAddrs      []*net.UDPAddr

	PublicKey spk
	SecretKey ssk

	Peers    []PeerConfig
	Handlers []Handler

	Conn Conn

	Logger *slog.Logger
	// contains filtered or unexported fields
}

type Conn added in v0.3.1 

type Conn interface {
	Close() error
	Open() ([]ReceiveFunc, error)
	Send(pl payload, spkm spk, cep Endpoint) error

	// A list of local endpoints at which the Conn can receive handshake messages
	LocalEndpoints() ([]Endpoint, error)
}

type Endpoint added in v0.3.1 

type Endpoint interface {
	String() string
	Equal(Endpoint) bool
}

type Handler 

type Handler any

Handler is on of the supported handlers declared below.

type HandshakeCompletedHandler 

type HandshakeCompletedHandler interface {
	HandshakeCompleted(pid, key)
}

type HandshakeExpiredHandler 

type HandshakeExpiredHandler interface {
	HandshakeExpired(pid)
}

type Key 

type Key = key

func GeneratePresharedKey 

func GeneratePresharedKey() (Key, error)

Generates a new pre-shared key.

type KeyOutput 

type KeyOutput struct {
	Peer    PeerID
	KeyFile string
	Why     KeyOutputReason
}

Output format: output-key peer {} key-file {of:?} {why}.

func ParseKeyOutput 

func ParseKeyOutput(str string) (o KeyOutput, err error)

func (KeyOutput) String 

func (o KeyOutput) String() string

type KeyOutputReason 

type KeyOutputReason string
const (
	KeyOutputReasonExchanged KeyOutputReason = "exchanged"
	KeyOutputReasonStale     KeyOutputReason = "stale"
)

type PeerConfig 

type PeerConfig struct {
	PublicKey    spk // The peer’s public key
	PresharedKey key // The peer's pre-shared key

	Endpoint *net.UDPAddr // The peers's endpoint
}

func (*PeerConfig) PID 

func (p *PeerConfig) PID() PeerID

type PeerID 

type PeerID = pid

Some aliases for the public API.

func PeerIDFromPublicKey 

func PeerIDFromPublicKey(spk spk) PeerID

type PresharedKey 

type PresharedKey = key

type PublicKey 

type PublicKey = spk

type ReceiveFunc added in v0.3.1 

type ReceiveFunc func(spkm spk) (payload, Endpoint, error)

type SecretKey 

type SecretKey = ssk

type Server 

type Server struct {
	// contains filtered or unexported fields
}

func NewServer 

func NewServer(cfg Config) (*Server, error)

func NewUDPServer 

func NewUDPServer(cfg Config) (_ *Server, err error)

func (*Server) AddPeer added in v0.3.1 

func (s *Server) AddPeer(pCfg PeerConfig) (PeerID, error)

func (*Server) Close 

func (s *Server) Close() error

func (*Server) PID 

func (s *Server) PID() PeerID

func (*Server) RemovePeer added in v0.3.1 

func (s *Server) RemovePeer(pid pid) error

func (*Server) Run 

func (s *Server) Run() error

type SinglePortUDPConn added in v0.4.0 

type SinglePortUDPConn struct {
	// contains filtered or unexported fields
}

func NewSinglePortUDPConn added in v0.4.0 

func NewSinglePortUDPConn(la []*net.UDPAddr) (*SinglePortUDPConn, error)

func (*SinglePortUDPConn) Close added in v0.4.0 

func (c *SinglePortUDPConn) Close() error

func (*SinglePortUDPConn) LocalEndpoints added in v0.4.0 

func (c *SinglePortUDPConn) LocalEndpoints() (eps []Endpoint, err error)

func (*SinglePortUDPConn) Open added in v0.4.0 

func (c *SinglePortUDPConn) Open() (recvFncs []ReceiveFunc, err error)

func (*SinglePortUDPConn) Send added in v0.4.0 

func (c *SinglePortUDPConn) Send(pl payload, spkt spk, ep Endpoint) error

type UDPConn added in v0.3.1 

type UDPConn struct {
	// contains filtered or unexported fields
}

func NewUDPConn added in v0.3.1 

func NewUDPConn(la []*net.UDPAddr) (*UDPConn, error)

func (*UDPConn) Close added in v0.3.1 

func (c *UDPConn) Close() error

func (*UDPConn) LocalEndpoints added in v0.3.1 

func (c *UDPConn) LocalEndpoints() (eps []Endpoint, err error)

func (*UDPConn) Open added in v0.3.1 

func (s *UDPConn) Open() ([]ReceiveFunc, error)

func (*UDPConn) Send added in v0.3.1 

func (c *UDPConn) Send(pl payload, spkt spk, ep Endpoint) error

type UDPEndpoint added in v0.3.1 

type UDPEndpoint net.UDPAddr

func NewUDPEndpoint added in v0.3.1 

func NewUDPEndpoint(s string) (*UDPEndpoint, error)

func (UDPEndpoint) Equal added in v0.3.1 

func (ep UDPEndpoint) Equal(o Endpoint) bool

func (*UDPEndpoint) String added in v0.3.1 

func (ep *UDPEndpoint) String() string

Source Files

View all Source files

Directories

Path Synopsis
internal
ebpf
net
test

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.