855b2b272f
The control websocket had no read deadline and only sent application-level "newt/ping" JSON (never protocol PING frames), so a half-open connection — for example a cloud load balancer keeping the socket open after the backend API server restarted — was never detected. ReadMessage blocked forever while the buffered ping writes kept succeeding, so newt stayed "connected" to a dead peer and only recovered after a manual restart. - Arm a read deadline (pongWait = 2x pingInterval, min 20s) and refresh it on every pong and every inbound message. - Send a protocol-level PING alongside the existing app ping, so a compliant server replies with a PONG that refreshes the read deadline. - On ping-write failure, close the connection and let the read pump perform a single reconnect (previously sendPing and the read-pump defer could both trigger a reconnect, racing two connections). - Give each connection a lifecycle channel so its ping monitor stops when the connection ends (previously one ping-monitor goroutine leaked per reconnect).
Newt
Newt is a fully user space WireGuard tunnel client and TCP/UDP proxy, designed to securely expose private resources controlled by Pangolin. By using Newt, you don't need to manage complex WireGuard tunnels and NATing.
Installation and Documentation
Newt is used with Pangolin and Gerbil as part of the larger system. See documentation below:
Key Functions
Registers with Pangolin
Using the Newt ID and a secret, the client will make HTTP requests to Pangolin to receive a session token. Using that token, it will connect to a websocket and maintain that connection. Control messages will be sent over the websocket.
Receives WireGuard Control Messages
When Newt receives WireGuard control messages, it will use the information encoded (endpoint, public key) to bring up a WireGuard tunnel using netstack fully in user space. It will ping over the tunnel to ensure the peer on the Gerbil side is brought up.
Receives Proxy Control Messages
When Newt receives WireGuard control messages, it will use the information encoded to create a local low level TCP and UDP proxies attached to the virtual tunnel in order to relay traffic to programmed targets.
Build
Binary
Make sure to have Go 1.25 installed.
make
Nix Flake
nix build
Binary will be at ./result/bin/newt
Development shell available with nix develop
Licensing
Newt is dual licensed under the AGPLv3 and the Fossorial Commercial license. For inquiries about commercial licensing, please contact us.
Contributions
Please see CONTRIBUTIONS in the repository for guidelines and best practices.