Mobile (#735)

Initial modification to support mobile client

Export necessary interfaces for Android framework

iface/iface.go

@@ -1,13 +1,11 @@
 package iface
 
 import (
-	"fmt"
 	"net"
 	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/wgctrl"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
@@ -16,46 +14,30 @@ const (
 	DefaultWgPort = 51820
 )
 
-// NetInterface represents a generic network tunnel interface
-type NetInterface interface {
-	Close() error
-}
-
 // WGIface represents a interface instance
 type WGIface struct {
-	name         string
-	address      WGAddress
-	mtu          int
-	netInterface NetInterface
-	mu           sync.Mutex
+	tun        *tunDevice
+	configurer wGConfigurer
+	mu         sync.Mutex
 }
 
-// NewWGIFace Creates a new Wireguard interface instance
-func NewWGIFace(iface string, address string, mtu int) (*WGIface, error) {
-	wgIface := &WGIface{
-		name: iface,
-		mtu:  mtu,
-		mu:   sync.Mutex{},
-	}
-
-	wgAddress, err := parseWGAddress(address)
-	if err != nil {
-		return wgIface, err
-	}
-
-	wgIface.address = wgAddress
-
-	return wgIface, nil
+// Create creates a new Wireguard interface, sets a given IP and brings it up.
+// Will reuse an existing one.
+func (w *WGIface) Create() error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	log.Debugf("create Wireguard interface %s", w.tun.DeviceName())
+	return w.tun.Create()
 }
 
 // Name returns the interface name
 func (w *WGIface) Name() string {
-	return w.name
+	return w.tun.DeviceName()
 }
 
 // Address returns the interface address
 func (w *WGIface) Address() WGAddress {
-	return w.address
+	return w.tun.WgAddress()
 }
 
 // Configure configures a Wireguard interface
@@ -63,27 +45,8 @@ func (w *WGIface) Address() WGAddress {
 func (w *WGIface) Configure(privateKey string, port int) error {
 	w.mu.Lock()
 	defer w.mu.Unlock()
-
-	log.Debugf("configuring Wireguard interface %s", w.name)
-
-	log.Debugf("adding Wireguard private key")
-	key, err := wgtypes.ParseKey(privateKey)
-	if err != nil {
-		return err
-	}
-	fwmark := 0
-	config := wgtypes.Config{
-		PrivateKey:   &key,
-		ReplacePeers: true,
-		FirewallMark: &fwmark,
-		ListenPort:   &port,
-	}
-
-	err = w.configureDevice(config)
-	if err != nil {
-		return fmt.Errorf(`received error "%w" while configuring interface %s with port %d`, err, w.name, port)
-	}
-	return nil
+	log.Debugf("configuring Wireguard interface %s", w.tun.DeviceName())
+	return w.configurer.configureInterface(privateKey, port)
 }
 
 // UpdateAddr updates address of the interface
@@ -96,8 +59,7 @@ func (w *WGIface) UpdateAddr(newAddr string) error {
 		return err
 	}
 
-	w.address = addr
-	return w.assignAddr()
+	return w.tun.UpdateAddr(addr)
 }
 
 // UpdatePeer updates existing Wireguard Peer or creates a new one if doesn't exist
@@ -106,119 +68,8 @@ func (w *WGIface) UpdatePeer(peerKey string, allowedIps string, keepAlive time.D
 	w.mu.Lock()
 	defer w.mu.Unlock()
 
-	log.Debugf("updating interface %s peer %s: endpoint %s ", w.name, peerKey, endpoint)
-
-	//parse allowed ips
-	_, ipNet, err := net.ParseCIDR(allowedIps)
-	if err != nil {
-		return err
-	}
-
-	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
-	if err != nil {
-		return err
-	}
-	peer := wgtypes.PeerConfig{
-		PublicKey:                   peerKeyParsed,
-		ReplaceAllowedIPs:           true,
-		AllowedIPs:                  []net.IPNet{*ipNet},
-		PersistentKeepaliveInterval: &keepAlive,
-		PresharedKey:                preSharedKey,
-		Endpoint:                    endpoint,
-	}
-
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
-	}
-	err = w.configureDevice(config)
-	if err != nil {
-		return fmt.Errorf(`received error "%w" while updating peer on interface %s with settings: allowed ips %s, endpoint %s`, err, w.name, allowedIps, endpoint.String())
-	}
-	return nil
-}
-
-// AddAllowedIP adds a prefix to the allowed IPs list of peer
-func (w *WGIface) AddAllowedIP(peerKey string, allowedIP string) error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	log.Debugf("adding allowed IP to interface %s and peer %s: allowed IP %s ", w.name, peerKey, allowedIP)
-
-	_, ipNet, err := net.ParseCIDR(allowedIP)
-	if err != nil {
-		return err
-	}
-
-	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
-	if err != nil {
-		return err
-	}
-	peer := wgtypes.PeerConfig{
-		PublicKey:         peerKeyParsed,
-		UpdateOnly:        true,
-		ReplaceAllowedIPs: false,
-		AllowedIPs:        []net.IPNet{*ipNet},
-	}
-
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
-	}
-	err = w.configureDevice(config)
-	if err != nil {
-		return fmt.Errorf(`received error "%w" while adding allowed Ip to peer on interface %s with settings: allowed ips %s`, err, w.name, allowedIP)
-	}
-	return nil
-}
-
-// RemoveAllowedIP removes a prefix from the allowed IPs list of peer
-func (w *WGIface) RemoveAllowedIP(peerKey string, allowedIP string) error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	log.Debugf("removing allowed IP from interface %s and peer %s: allowed IP %s ", w.name, peerKey, allowedIP)
-
-	_, ipNet, err := net.ParseCIDR(allowedIP)
-	if err != nil {
-		return err
-	}
-
-	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
-	if err != nil {
-		return err
-	}
-
-	existingPeer, err := getPeer(w.name, peerKey)
-	if err != nil {
-		return err
-	}
-
-	newAllowedIPs := existingPeer.AllowedIPs
-
-	for i, existingAllowedIP := range existingPeer.AllowedIPs {
-		if existingAllowedIP.String() == ipNet.String() {
-			newAllowedIPs = append(existingPeer.AllowedIPs[:i], existingPeer.AllowedIPs[i+1:]...)
-			break
-		}
-	}
-
-	if err != nil {
-		return err
-	}
-	peer := wgtypes.PeerConfig{
-		PublicKey:         peerKeyParsed,
-		UpdateOnly:        true,
-		ReplaceAllowedIPs: true,
-		AllowedIPs:        newAllowedIPs,
-	}
-
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
-	}
-	err = w.configureDevice(config)
-	if err != nil {
-		return fmt.Errorf(`received error "%w" while removing allowed IP from peer on interface %s with settings: allowed ips %s`, err, w.name, allowedIP)
-	}
-	return nil
+	log.Debugf("updating interface %s peer %s: endpoint %s ", w.tun.DeviceName(), peerKey, endpoint)
+	return w.configurer.updatePeer(peerKey, allowedIps, keepAlive, endpoint, preSharedKey)
 }
 
 // RemovePeer removes a Wireguard Peer from the interface iface
@@ -226,66 +77,31 @@ func (w *WGIface) RemovePeer(peerKey string) error {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 
-	log.Debugf("Removing peer %s from interface %s ", peerKey, w.name)
-
-	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
-	if err != nil {
-		return err
-	}
-
-	peer := wgtypes.PeerConfig{
-		PublicKey: peerKeyParsed,
-		Remove:    true,
-	}
-
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
-	}
-	err = w.configureDevice(config)
-	if err != nil {
-		return fmt.Errorf(`received error "%w" while removing peer %s from interface %s`, err, peerKey, w.name)
-	}
-	return nil
+	log.Debugf("Removing peer %s from interface %s ", peerKey, w.tun.DeviceName())
+	return w.configurer.removePeer(peerKey)
 }
 
-func getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
-	wg, err := wgctrl.New()
-	if err != nil {
-		return wgtypes.Peer{}, err
-	}
-	defer func() {
-		err = wg.Close()
-		if err != nil {
-			log.Errorf("got error while closing wgctl: %v", err)
-		}
-	}()
+// AddAllowedIP adds a prefix to the allowed IPs list of peer
+func (w *WGIface) AddAllowedIP(peerKey string, allowedIP string) error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
 
-	wgDevice, err := wg.Device(ifaceName)
-	if err != nil {
-		return wgtypes.Peer{}, err
-	}
-	for _, peer := range wgDevice.Peers {
-		if peer.PublicKey.String() == peerPubKey {
-			return peer, nil
-		}
-	}
-	return wgtypes.Peer{}, fmt.Errorf("peer not found")
+	log.Debugf("adding allowed IP to interface %s and peer %s: allowed IP %s ", w.tun.DeviceName(), peerKey, allowedIP)
+	return w.configurer.addAllowedIP(peerKey, allowedIP)
 }
 
-// configureDevice configures the wireguard device
-func (w *WGIface) configureDevice(config wgtypes.Config) error {
-	wg, err := wgctrl.New()
-	if err != nil {
-		return err
-	}
-	defer wg.Close()
+// RemoveAllowedIP removes a prefix from the allowed IPs list of peer
+func (w *WGIface) RemoveAllowedIP(peerKey string, allowedIP string) error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
 
-	// validate if device with name exists
-	_, err = wg.Device(w.name)
-	if err != nil {
-		return err
-	}
-	log.Debugf("got Wireguard device %s", w.name)
+	log.Debugf("removing allowed IP from interface %s and peer %s: allowed IP %s ", w.tun.DeviceName(), peerKey, allowedIP)
+	return w.configurer.removeAllowedIP(peerKey, allowedIP)
+}
 
-	return wg.ConfigureDevice(w.name, config)
+// Close closes the tunnel interface
+func (w *WGIface) Close() error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	return w.tun.Close()
 }

iface/iface_android.go

@@ -0,0 +1,22 @@
+package iface
+
+import "sync"
+
+// NewWGIFace Creates a new Wireguard interface instance
+func NewWGIFace(ifaceName string, address string, mtu int, tunAdapter TunAdapter) (*WGIface, error) {
+	wgIface := &WGIface{
+		mu: sync.Mutex{},
+	}
+
+	wgAddress, err := parseWGAddress(address)
+	if err != nil {
+		return wgIface, err
+	}
+
+	tun := newTunDevice(wgAddress, mtu, tunAdapter)
+	wgIface.tun = tun
+
+	wgIface.configurer = newWGConfigurer(tun)
+
+	return wgIface, nil
+}

iface/iface_nonandroid.go

@@ -0,0 +1,22 @@
+//go:build !android
+
+package iface
+
+import "sync"
+
+// NewWGIFace Creates a new Wireguard interface instance
+func NewWGIFace(ifaceName string, address string, mtu int, tunAdapter TunAdapter) (*WGIface, error) {
+	wgIface := &WGIface{
+		mu: sync.Mutex{},
+	}
+
+	wgAddress, err := parseWGAddress(address)
+	if err != nil {
+		return wgIface, err
+	}
+
+	wgIface.tun = newTunDevice(ifaceName, wgAddress, mtu)
+
+	wgIface.configurer = newWGConfigurer(ifaceName)
+	return wgIface, nil
+}

iface/iface_test.go

@@ -32,7 +32,7 @@ func init() {
 func TestWGIface_UpdateAddr(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
 	addr := "100.64.0.1/8"
-	iface, err := NewWGIFace(ifaceName, addr, DefaultMTU)
+	iface, err := NewWGIFace(ifaceName, addr, DefaultMTU, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -92,7 +92,7 @@ func getIfaceAddrs(ifaceName string) ([]net.Addr, error) {
 func Test_CreateInterface(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+1)
 	wgIP := "10.99.99.1/32"
-	iface, err := NewWGIFace(ifaceName, wgIP, DefaultMTU)
+	iface, err := NewWGIFace(ifaceName, wgIP, DefaultMTU, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -121,7 +121,7 @@ func Test_CreateInterface(t *testing.T) {
 func Test_Close(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+2)
 	wgIP := "10.99.99.2/32"
-	iface, err := NewWGIFace(ifaceName, wgIP, DefaultMTU)
+	iface, err := NewWGIFace(ifaceName, wgIP, DefaultMTU, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -149,7 +149,7 @@ func Test_Close(t *testing.T) {
 func Test_ConfigureInterface(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+3)
 	wgIP := "10.99.99.5/30"
-	iface, err := NewWGIFace(ifaceName, wgIP, DefaultMTU)
+	iface, err := NewWGIFace(ifaceName, wgIP, DefaultMTU, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -196,7 +196,7 @@ func Test_ConfigureInterface(t *testing.T) {
 func Test_UpdatePeer(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
 	wgIP := "10.99.99.9/30"
-	iface, err := NewWGIFace(ifaceName, wgIP, DefaultMTU)
+	iface, err := NewWGIFace(ifaceName, wgIP, DefaultMTU, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -228,7 +228,7 @@ func Test_UpdatePeer(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	peer, err := getPeer(ifaceName, peerPubKey)
+	peer, err := iface.configurer.getPeer(ifaceName, peerPubKey)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -255,7 +255,7 @@ func Test_UpdatePeer(t *testing.T) {
 func Test_RemovePeer(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
 	wgIP := "10.99.99.13/30"
-	iface, err := NewWGIFace(ifaceName, wgIP, DefaultMTU)
+	iface, err := NewWGIFace(ifaceName, wgIP, DefaultMTU, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -288,7 +288,7 @@ func Test_RemovePeer(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	_, err = getPeer(ifaceName, peerPubKey)
+	_, err = iface.configurer.getPeer(ifaceName, peerPubKey)
 	if err.Error() != "peer not found" {
 		t.Fatal(err)
 	}
@@ -305,7 +305,7 @@ func Test_ConnectPeers(t *testing.T) {
 
 	keepAlive := 1 * time.Second
 
-	iface1, err := NewWGIFace(peer1ifaceName, peer1wgIP, DefaultMTU)
+	iface1, err := NewWGIFace(peer1ifaceName, peer1wgIP, DefaultMTU, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -322,7 +322,7 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	iface2, err := NewWGIFace(peer2ifaceName, peer2wgIP, DefaultMTU)
+	iface2, err := NewWGIFace(peer2ifaceName, peer2wgIP, DefaultMTU, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -375,7 +375,7 @@ func Test_ConnectPeers(t *testing.T) {
 			t.Fatalf("waiting for peer handshake timeout after %s", timeout.String())
 		default:
 		}
-		peer, gpErr := getPeer(peer1ifaceName, peer2Key.PublicKey().String())
+		peer, gpErr := iface1.configurer.getPeer(peer1ifaceName, peer2Key.PublicKey().String())
 		if gpErr != nil {
 			t.Fatal(gpErr)
 		}

iface/iface_windows.go

@@ -1,69 +1,6 @@
 package iface
 
-import (
-	"fmt"
-	"net"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-	"golang.zx2c4.com/wireguard/windows/driver"
-)
-
-// Create Creates a new Wireguard interface, sets a given IP and brings it up.
-func (w *WGIface) Create() error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	WintunStaticRequestedGUID, _ := windows.GenerateGUID()
-	adapter, err := driver.CreateAdapter(w.name, "WireGuard", &WintunStaticRequestedGUID)
-	if err != nil {
-		err = fmt.Errorf("error creating adapter: %w", err)
-		return err
-	}
-	w.netInterface = adapter
-	err = adapter.SetAdapterState(driver.AdapterStateUp)
-	if err != nil {
-		return err
-	}
-	state, _ := adapter.LUID().GUID()
-	log.Debugln("device guid: ", state.String())
-	return w.assignAddr()
-}
-
-// GetInterfaceGUIDString returns an interface GUID string
+// GetInterfaceGUIDString returns an interface GUID. This is useful on Windows only
 func (w *WGIface) GetInterfaceGUIDString() (string, error) {
-	if w.netInterface == nil {
-		return "", fmt.Errorf("interface has not been initialized yet")
-	}
-	windowsDevice := w.netInterface.(*driver.Adapter)
-	luid := windowsDevice.LUID()
-	guid, err := luid.GUID()
-	if err != nil {
-		return "", err
-	}
-	return guid.String(), nil
-}
-
-// Close closes the tunnel interface
-func (w *WGIface) Close() error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	if w.netInterface == nil {
-		return nil
-	}
-
-	return w.netInterface.Close()
-}
-
-// assignAddr Adds IP address to the tunnel interface and network route based on the range provided
-func (w *WGIface) assignAddr() error {
-	luid := w.netInterface.(*driver.Adapter).LUID()
-
-	log.Debugf("adding address %s to interface: %s", w.address.IP, w.name)
-	err := luid.SetIPAddresses([]net.IPNet{{w.address.IP, w.address.Network.Mask}})
-	if err != nil {
-		return err
-	}
-
-	return nil
+	return w.tun.getInterfaceGUIDString()
 }

iface/ipc_parser_android.go

@@ -0,0 +1,60 @@
+package iface
+
+import (
+	"encoding/hex"
+	"fmt"
+	"strings"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+func toWgUserspaceString(wgCfg wgtypes.Config) string {
+	var sb strings.Builder
+	if wgCfg.PrivateKey != nil {
+		hexKey := hex.EncodeToString(wgCfg.PrivateKey[:])
+		sb.WriteString(fmt.Sprintf("private_key=%s\n", hexKey))
+	}
+
+	if wgCfg.ListenPort != nil {
+		sb.WriteString(fmt.Sprintf("listen_port=%d\n", *wgCfg.ListenPort))
+	}
+
+	if wgCfg.ReplacePeers {
+		sb.WriteString("replace_peers=true\n")
+	}
+
+	if wgCfg.FirewallMark != nil {
+		sb.WriteString(fmt.Sprintf("fwmark=%d\n", *wgCfg.FirewallMark))
+	}
+
+	for _, p := range wgCfg.Peers {
+		hexKey := hex.EncodeToString(p.PublicKey[:])
+		sb.WriteString(fmt.Sprintf("public_key=%s\n", hexKey))
+
+		if p.PresharedKey != nil {
+			preSharedHexKey := hex.EncodeToString(p.PresharedKey[:])
+			sb.WriteString(fmt.Sprintf("public_key=%s\n", preSharedHexKey))
+		}
+
+		if p.Remove {
+			sb.WriteString("remove=true")
+		}
+
+		if p.ReplaceAllowedIPs {
+			sb.WriteString("replace_allowed_ips=true\n")
+		}
+
+		for _, aip := range p.AllowedIPs {
+			sb.WriteString(fmt.Sprintf("allowed_ip=%s\n", aip.String()))
+		}
+
+		if p.Endpoint != nil {
+			sb.WriteString(fmt.Sprintf("endpoint=%s\n", p.Endpoint.String()))
+		}
+
+		if p.PersistentKeepaliveInterval != nil {
+			sb.WriteString(fmt.Sprintf("persistent_keepalive_interval=%d\n", int(p.PersistentKeepaliveInterval.Seconds())))
+		}
+	}
+	return sb.String()
+}

iface/module.go

@@ -1,5 +1,5 @@
-//go:build !linux
-// +build !linux
+//go:build !linux || android
+// +build !linux android
 
 package iface
 

iface/module_linux.go

@@ -1,3 +1,5 @@
+//go:build linux && !android
+
 // Package iface provides wireguard network interface creation and management
 package iface
 

iface/tun.go

@@ -0,0 +1,6 @@
+package iface
+
+// NetInterface represents a generic network tunnel interface
+type NetInterface interface {
+	Close() error
+}

iface/tun_adapter.go

@@ -0,0 +1,7 @@
+package iface
+
+// TunAdapter is an interface for create tun device from externel service
+type TunAdapter interface {
+	ConfigureInterface(address string, mtu int) (int, error)
+	UpdateAddr(address string) error
+}

iface/tun_android.go

@@ -0,0 +1,112 @@
+package iface
+
+import (
+	"net"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/unix"
+	"golang.zx2c4.com/wireguard/conn"
+	"golang.zx2c4.com/wireguard/device"
+	"golang.zx2c4.com/wireguard/ipc"
+	"golang.zx2c4.com/wireguard/tun"
+)
+
+type tunDevice struct {
+	address    WGAddress
+	mtu        int
+	tunAdapter TunAdapter
+
+	fd     int
+	name   string
+	device *device.Device
+	uapi   net.Listener
+}
+
+func newTunDevice(address WGAddress, mtu int, tunAdapter TunAdapter) *tunDevice {
+	return &tunDevice{
+		address:    address,
+		mtu:        mtu,
+		tunAdapter: tunAdapter,
+	}
+}
+
+func (t *tunDevice) Create() error {
+	var err error
+	t.fd, err = t.tunAdapter.ConfigureInterface(t.address.String(), t.mtu)
+	if err != nil {
+		log.Errorf("failed to create Android interface: %s", err)
+		return err
+	}
+
+	tunDevice, name, err := tun.CreateUnmonitoredTUNFromFD(t.fd)
+	if err != nil {
+		unix.Close(t.fd)
+		return err
+	}
+	t.name = name
+
+	log.Debugf("attaching to interface %v", name)
+	t.device = device.NewDevice(tunDevice, conn.NewStdNetBind(), device.NewLogger(device.LogLevelSilent, "[wiretrustee] "))
+	t.device.DisableSomeRoamingForBrokenMobileSemantics()
+
+	log.Debugf("create uapi")
+	tunSock, err := ipc.UAPIOpen(name)
+	if err != nil {
+		return err
+	}
+
+	t.uapi, err = ipc.UAPIListen(name, tunSock)
+	if err != nil {
+		tunSock.Close()
+		unix.Close(t.fd)
+		return err
+	}
+
+	go func() {
+		for {
+			uapiConn, err := t.uapi.Accept()
+			if err != nil {
+				return
+			}
+			go t.device.IpcHandle(uapiConn)
+		}
+	}()
+
+	err = t.device.Up()
+	if err != nil {
+		tunSock.Close()
+		t.device.Close()
+		return err
+	}
+	log.Debugf("device is ready to use: %s", name)
+	return nil
+}
+
+func (t *tunDevice) Device() *device.Device {
+	return t.device
+}
+
+func (t *tunDevice) DeviceName() string {
+	return t.name
+}
+
+func (t *tunDevice) WgAddress() WGAddress {
+	return t.address
+}
+
+func (t *tunDevice) UpdateAddr(addr WGAddress) error {
+	// todo implement
+	return nil
+}
+
+func (t *tunDevice) Close() (err error) {
+	if t.uapi != nil {
+		err = t.uapi.Close()
+	}
+
+	if t.device != nil {
+		t.device.Close()
+	}
+
+	return
+}

iface/tun_darwin.go

@@ -6,23 +6,25 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-// Create Creates a new Wireguard interface, sets a given IP and brings it up.
-func (w *WGIface) Create() error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
+func (c *tunDevice) Create() error {
+	var err error
+	c.netInterface, err = c.createWithUserspace()
+	if err != nil {
+		return err
+	}
 
-	return w.createWithUserspace()
+	return c.assignAddr()
 }
 
 // assignAddr Adds IP address to the tunnel interface and network route based on the range provided
-func (w *WGIface) assignAddr() error {
-	cmd := exec.Command("ifconfig", w.name, "inet", w.address.IP.String(), w.address.IP.String())
+func (c *tunDevice) assignAddr() error {
+	cmd := exec.Command("ifconfig", c.name, "inet", c.address.IP.String(), c.address.IP.String())
 	if out, err := cmd.CombinedOutput(); err != nil {
 		log.Infof(`adding addreess command "%v" failed with output %s and error: `, cmd.String(), out)
 		return err
 	}
 
-	routeCmd := exec.Command("route", "add", "-net", w.address.Network.String(), "-interface", w.name)
+	routeCmd := exec.Command("route", "add", "-net", c.address.Network.String(), "-interface", c.name)
 	if out, err := routeCmd.CombinedOutput(); err != nil {
 		log.Printf(`adding route command "%v" failed with output %s and error: `, routeCmd.String(), out)
 		return err

iface/tun_linux.go

@@ -1,3 +1,5 @@
+//go:build linux && !android
+
 package iface
 
 import (
@@ -8,32 +10,34 @@ import (
 	"github.com/vishvananda/netlink"
 )
 
-// Create creates a new Wireguard interface, sets a given IP and brings it up.
-// Will reuse an existing one.
-func (w *WGIface) Create() error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
+func (c *tunDevice) Create() error {
 	if WireguardModuleIsLoaded() {
 		log.Info("using kernel WireGuard")
-		return w.createWithKernel()
-	} else {
-		if !tunModuleIsLoaded() {
-			return fmt.Errorf("couldn't check or load tun module")
-		}
-		log.Info("using userspace WireGuard")
-		return w.createWithUserspace()
+		return c.createWithKernel()
 	}
+
+	if !tunModuleIsLoaded() {
+		return fmt.Errorf("couldn't check or load tun module")
+	}
+	log.Info("using userspace WireGuard")
+	var err error
+	c.netInterface, err = c.createWithUserspace()
+	if err != nil {
+		return err
+	}
+
+	return c.assignAddr()
+
 }
 
 // createWithKernel Creates a new Wireguard interface using kernel Wireguard module.
 // Works for Linux and offers much better network performance
-func (w *WGIface) createWithKernel() error {
+func (c *tunDevice) createWithKernel() error {
 
-	link := newWGLink(w.name)
+	link := newWGLink(c.name)
 
 	// check if interface exists
-	l, err := netlink.LinkByName(w.name)
+	l, err := netlink.LinkByName(c.name)
 	if err != nil {
 		switch err.(type) {
 		case netlink.LinkNotFoundError:
@@ -51,33 +55,33 @@ func (w *WGIface) createWithKernel() error {
 		}
 	}
 
-	log.Debugf("adding device: %s", w.name)
+	log.Debugf("adding device: %s", c.name)
 	err = netlink.LinkAdd(link)
 	if os.IsExist(err) {
-		log.Infof("interface %s already exists. Will reuse.", w.name)
+		log.Infof("interface %s already exists. Will reuse.", c.name)
 	} else if err != nil {
 		return err
 	}
 
-	w.netInterface = link
+	c.netInterface = link
 
-	err = w.assignAddr()
+	err = c.assignAddr()
 	if err != nil {
 		return err
 	}
 
 	// todo do a discovery
-	log.Debugf("setting MTU: %d interface: %s", w.mtu, w.name)
-	err = netlink.LinkSetMTU(link, w.mtu)
+	log.Debugf("setting MTU: %d interface: %s", c.mtu, c.name)
+	err = netlink.LinkSetMTU(link, c.mtu)
 	if err != nil {
-		log.Errorf("error setting MTU on interface: %s", w.name)
+		log.Errorf("error setting MTU on interface: %s", c.name)
 		return err
 	}
 
-	log.Debugf("bringing up interface: %s", w.name)
+	log.Debugf("bringing up interface: %s", c.name)
 	err = netlink.LinkSetUp(link)
 	if err != nil {
-		log.Errorf("error bringing up interface: %s", w.name)
+		log.Errorf("error bringing up interface: %s", c.name)
 		return err
 	}
 
@@ -85,8 +89,8 @@ func (w *WGIface) createWithKernel() error {
 }
 
 // assignAddr Adds IP address to the tunnel interface
-func (w *WGIface) assignAddr() error {
-	link := newWGLink(w.name)
+func (c *tunDevice) assignAddr() error {
+	link := newWGLink(c.name)
 
 	//delete existing addresses
 	list, err := netlink.AddrList(link, 0)
@@ -102,11 +106,11 @@ func (w *WGIface) assignAddr() error {
 		}
 	}
 
-	log.Debugf("adding address %s to interface: %s", w.address.String(), w.name)
-	addr, _ := netlink.ParseAddr(w.address.String())
+	log.Debugf("adding address %s to interface: %s", c.address.String(), c.name)
+	addr, _ := netlink.ParseAddr(c.address.String())
 	err = netlink.AddrAdd(link, addr)
 	if os.IsExist(err) {
-		log.Infof("interface %s already has the address: %s", w.name, w.address.String())
+		log.Infof("interface %s already has the address: %s", c.name, c.address.String())
 	} else if err != nil {
 		return err
 	}

iface/tun_unix.go

@@ -1,5 +1,4 @@
-//go:build linux || darwin
-// +build linux darwin
+//go:build (linux || darwin) && !android
 
 package iface
 
@@ -14,24 +13,44 @@ import (
 	"golang.zx2c4.com/wireguard/tun"
 )
 
-// GetInterfaceGUIDString returns an interface GUID. This is useful on Windows only
-func (w *WGIface) GetInterfaceGUIDString() (string, error) {
-	return "", nil
+type tunDevice struct {
+	name         string
+	address      WGAddress
+	mtu          int
+	netInterface NetInterface
 }
 
-// Close closes the tunnel interface
-func (w *WGIface) Close() error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	if w.netInterface == nil {
+func newTunDevice(name string, address WGAddress, mtu int) *tunDevice {
+	return &tunDevice{
+		name:    name,
+		address: address,
+		mtu:     mtu,
+	}
+}
+
+func (c *tunDevice) UpdateAddr(address WGAddress) error {
+	c.address = address
+	return c.assignAddr()
+}
+
+func (c *tunDevice) WgAddress() WGAddress {
+	return c.address
+}
+
+func (c *tunDevice) DeviceName() string {
+	return c.name
+}
+
+func (c *tunDevice) Close() error {
+	if c.netInterface == nil {
 		return nil
 	}
-	err := w.netInterface.Close()
+	err := c.netInterface.Close()
 	if err != nil {
 		return err
 	}
 
-	sockPath := "/var/run/wireguard/" + w.name + ".sock"
+	sockPath := "/var/run/wireguard/" + c.name + ".sock"
 	if _, statErr := os.Stat(sockPath); statErr == nil {
 		statErr = os.Remove(sockPath)
 		if statErr != nil {
@@ -43,24 +62,23 @@ func (w *WGIface) Close() error {
 }
 
 // createWithUserspace Creates a new Wireguard interface, using wireguard-go userspace implementation
-func (w *WGIface) createWithUserspace() error {
-
-	tunIface, err := tun.CreateTUN(w.name, w.mtu)
+func (c *tunDevice) createWithUserspace() (NetInterface, error) {
+	tunIface, err := tun.CreateTUN(c.name, c.mtu)
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	w.netInterface = tunIface
-
 	// We need to create a wireguard-go device and listen to configuration requests
 	tunDevice := device.NewDevice(tunIface, conn.NewDefaultBind(), device.NewLogger(device.LogLevelSilent, "[wiretrustee] "))
 	err = tunDevice.Up()
 	if err != nil {
-		return err
+		return tunIface, err
 	}
-	uapi, err := getUAPI(w.name)
+
+	// todo: after this line in case of error close the tunSock
+	uapi, err := c.getUAPI(c.name)
 	if err != nil {
-		return err
+		return tunIface, err
 	}
 
 	go func() {
@@ -75,16 +93,11 @@ func (w *WGIface) createWithUserspace() error {
 	}()
 
 	log.Debugln("UAPI listener started")
-
-	err = w.assignAddr()
-	if err != nil {
-		return err
-	}
-	return nil
+	return tunIface, nil
 }
 
 // getUAPI returns a Listener
-func getUAPI(iface string) (net.Listener, error) {
+func (c *tunDevice) getUAPI(iface string) (net.Listener, error) {
 	tunSock, err := ipc.UAPIOpen(iface)
 	if err != nil {
 		return nil, err

iface/tun_windows.go

@@ -0,0 +1,93 @@
+package iface
+
+import (
+	"fmt"
+	"net"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+	"golang.zx2c4.com/wireguard/windows/driver"
+)
+
+type tunDevice struct {
+	name         string
+	address      WGAddress
+	netInterface NetInterface
+}
+
+func newTunDevice(name string, address WGAddress, mtu int) *tunDevice {
+	return &tunDevice{name: name, address: address}
+}
+
+func (c *tunDevice) Create() error {
+	var err error
+	c.netInterface, err = c.createAdapter()
+	if err != nil {
+		return err
+	}
+
+	return c.assignAddr()
+}
+
+func (c *tunDevice) UpdateAddr(address WGAddress) error {
+	c.address = address
+	return c.assignAddr()
+}
+
+func (c *tunDevice) WgAddress() WGAddress {
+	return c.address
+}
+
+func (c *tunDevice) DeviceName() string {
+	return c.name
+}
+
+func (c *tunDevice) Close() error {
+	if c.netInterface == nil {
+		return nil
+	}
+
+	return c.netInterface.Close()
+}
+
+func (c *tunDevice) getInterfaceGUIDString() (string, error) {
+	if c.netInterface == nil {
+		return "", fmt.Errorf("interface has not been initialized yet")
+	}
+	windowsDevice := c.netInterface.(*driver.Adapter)
+	luid := windowsDevice.LUID()
+	guid, err := luid.GUID()
+	if err != nil {
+		return "", err
+	}
+	return guid.String(), nil
+}
+
+func (c *tunDevice) createAdapter() (NetInterface, error) {
+	WintunStaticRequestedGUID, _ := windows.GenerateGUID()
+	adapter, err := driver.CreateAdapter(c.name, "WireGuard", &WintunStaticRequestedGUID)
+	if err != nil {
+		err = fmt.Errorf("error creating adapter: %w", err)
+		return nil, err
+	}
+	err = adapter.SetAdapterState(driver.AdapterStateUp)
+	if err != nil {
+		return adapter, err
+	}
+	state, _ := adapter.LUID().GUID()
+	log.Debugln("device guid: ", state.String())
+	return adapter, nil
+}
+
+// assignAddr Adds IP address to the tunnel interface and network route based on the range provided
+func (c *tunDevice) assignAddr() error {
+	luid := c.netInterface.(*driver.Adapter).LUID()
+
+	log.Debugf("adding address %s to interface: %s", c.address.IP, c.name)
+	err := luid.SetIPAddresses([]net.IPNet{{c.address.IP, c.address.Network.Mask}})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

iface/wg_configurer_android.go

@@ -0,0 +1,114 @@
+package iface
+
+import (
+	"errors"
+	"net"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+var (
+	errFuncNotImplemented = errors.New("function not implemented")
+)
+
+type wGConfigurer struct {
+	tunDevice *tunDevice
+}
+
+func newWGConfigurer(tunDevice *tunDevice) wGConfigurer {
+	return wGConfigurer{
+		tunDevice: tunDevice,
+	}
+}
+
+func (c *wGConfigurer) configureInterface(privateKey string, port int) error {
+	log.Debugf("adding Wireguard private key")
+	key, err := wgtypes.ParseKey(privateKey)
+	if err != nil {
+		return err
+	}
+	fwmark := 0
+	config := wgtypes.Config{
+		PrivateKey:   &key,
+		ReplacePeers: true,
+		FirewallMark: &fwmark,
+		ListenPort:   &port,
+	}
+
+	return c.tunDevice.Device().IpcSet(toWgUserspaceString(config))
+}
+
+func (c *wGConfigurer) updatePeer(peerKey string, allowedIps string, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
+	//parse allowed ips
+	_, ipNet, err := net.ParseCIDR(allowedIps)
+	if err != nil {
+		return err
+	}
+
+	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
+	if err != nil {
+		return err
+	}
+	peer := wgtypes.PeerConfig{
+		PublicKey:                   peerKeyParsed,
+		ReplaceAllowedIPs:           true,
+		AllowedIPs:                  []net.IPNet{*ipNet},
+		PersistentKeepaliveInterval: &keepAlive,
+		PresharedKey:                preSharedKey,
+		Endpoint:                    endpoint,
+	}
+
+	config := wgtypes.Config{
+		Peers: []wgtypes.PeerConfig{peer},
+	}
+
+	return c.tunDevice.Device().IpcSet(toWgUserspaceString(config))
+}
+
+func (c *wGConfigurer) removePeer(peerKey string) error {
+	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
+	if err != nil {
+		return err
+	}
+
+	peer := wgtypes.PeerConfig{
+		PublicKey: peerKeyParsed,
+		Remove:    true,
+	}
+
+	config := wgtypes.Config{
+		Peers: []wgtypes.PeerConfig{peer},
+	}
+	return c.tunDevice.Device().IpcSet(toWgUserspaceString(config))
+}
+
+func (c *wGConfigurer) addAllowedIP(peerKey string, allowedIP string) error {
+	_, ipNet, err := net.ParseCIDR(allowedIP)
+	if err != nil {
+		return err
+	}
+
+	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
+	if err != nil {
+		return err
+	}
+	peer := wgtypes.PeerConfig{
+		PublicKey:         peerKeyParsed,
+		UpdateOnly:        true,
+		ReplaceAllowedIPs: false,
+		AllowedIPs:        []net.IPNet{*ipNet},
+	}
+
+	config := wgtypes.Config{
+		Peers: []wgtypes.PeerConfig{peer},
+	}
+
+	return c.tunDevice.Device().IpcSet(toWgUserspaceString(config))
+}
+
+func (c *wGConfigurer) removeAllowedIP(peerKey string, allowedIP string) error {
+	return errFuncNotImplemented
+}

iface/wg_configurer_nonandroid.go

@@ -0,0 +1,208 @@
+//go:build !android
+
+package iface
+
+import (
+	"fmt"
+	"net"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+type wGConfigurer struct {
+	deviceName string
+}
+
+func newWGConfigurer(deviceName string) wGConfigurer {
+	return wGConfigurer{
+		deviceName: deviceName,
+	}
+}
+
+func (c *wGConfigurer) configureInterface(privateKey string, port int) error {
+	log.Debugf("adding Wireguard private key")
+	key, err := wgtypes.ParseKey(privateKey)
+	if err != nil {
+		return err
+	}
+	fwmark := 0
+	config := wgtypes.Config{
+		PrivateKey:   &key,
+		ReplacePeers: true,
+		FirewallMark: &fwmark,
+		ListenPort:   &port,
+	}
+
+	err = c.configure(config)
+	if err != nil {
+		return fmt.Errorf(`received error "%w" while configuring interface %s with port %d`, err, c.deviceName, port)
+	}
+	return nil
+}
+
+func (c *wGConfigurer) updatePeer(peerKey string, allowedIps string, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
+	//parse allowed ips
+	_, ipNet, err := net.ParseCIDR(allowedIps)
+	if err != nil {
+		return err
+	}
+
+	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
+	if err != nil {
+		return err
+	}
+	peer := wgtypes.PeerConfig{
+		PublicKey:                   peerKeyParsed,
+		ReplaceAllowedIPs:           true,
+		AllowedIPs:                  []net.IPNet{*ipNet},
+		PersistentKeepaliveInterval: &keepAlive,
+		PresharedKey:                preSharedKey,
+		Endpoint:                    endpoint,
+	}
+
+	config := wgtypes.Config{
+		Peers: []wgtypes.PeerConfig{peer},
+	}
+	err = c.configure(config)
+	if err != nil {
+		return fmt.Errorf(`received error "%w" while updating peer on interface %s with settings: allowed ips %s, endpoint %s`, err, c.deviceName, allowedIps, endpoint.String())
+	}
+	return nil
+}
+
+func (c *wGConfigurer) removePeer(peerKey string) error {
+	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
+	if err != nil {
+		return err
+	}
+
+	peer := wgtypes.PeerConfig{
+		PublicKey: peerKeyParsed,
+		Remove:    true,
+	}
+
+	config := wgtypes.Config{
+		Peers: []wgtypes.PeerConfig{peer},
+	}
+	err = c.configure(config)
+	if err != nil {
+		return fmt.Errorf(`received error "%w" while removing peer %s from interface %s`, err, peerKey, c.deviceName)
+	}
+	return nil
+}
+
+func (c *wGConfigurer) addAllowedIP(peerKey string, allowedIP string) error {
+	_, ipNet, err := net.ParseCIDR(allowedIP)
+	if err != nil {
+		return err
+	}
+
+	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
+	if err != nil {
+		return err
+	}
+	peer := wgtypes.PeerConfig{
+		PublicKey:         peerKeyParsed,
+		UpdateOnly:        true,
+		ReplaceAllowedIPs: false,
+		AllowedIPs:        []net.IPNet{*ipNet},
+	}
+
+	config := wgtypes.Config{
+		Peers: []wgtypes.PeerConfig{peer},
+	}
+	err = c.configure(config)
+	if err != nil {
+		return fmt.Errorf(`received error "%w" while adding allowed Ip to peer on interface %s with settings: allowed ips %s`, err, c.deviceName, allowedIP)
+	}
+	return nil
+}
+
+func (c *wGConfigurer) removeAllowedIP(peerKey string, allowedIP string) error {
+	_, ipNet, err := net.ParseCIDR(allowedIP)
+	if err != nil {
+		return err
+	}
+
+	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
+	if err != nil {
+		return err
+	}
+
+	existingPeer, err := c.getPeer(c.deviceName, peerKey)
+	if err != nil {
+		return err
+	}
+
+	newAllowedIPs := existingPeer.AllowedIPs
+
+	for i, existingAllowedIP := range existingPeer.AllowedIPs {
+		if existingAllowedIP.String() == ipNet.String() {
+			newAllowedIPs = append(existingPeer.AllowedIPs[:i], existingPeer.AllowedIPs[i+1:]...)
+			break
+		}
+	}
+
+	if err != nil {
+		return err
+	}
+	peer := wgtypes.PeerConfig{
+		PublicKey:         peerKeyParsed,
+		UpdateOnly:        true,
+		ReplaceAllowedIPs: true,
+		AllowedIPs:        newAllowedIPs,
+	}
+
+	config := wgtypes.Config{
+		Peers: []wgtypes.PeerConfig{peer},
+	}
+	err = c.configure(config)
+	if err != nil {
+		return fmt.Errorf(`received error "%w" while removing allowed IP from peer on interface %s with settings: allowed ips %s`, err, c.deviceName, allowedIP)
+	}
+	return nil
+}
+
+func (c *wGConfigurer) getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
+	wg, err := wgctrl.New()
+	if err != nil {
+		return wgtypes.Peer{}, err
+	}
+	defer func() {
+		err = wg.Close()
+		if err != nil {
+			log.Errorf("got error while closing wgctl: %v", err)
+		}
+	}()
+
+	wgDevice, err := wg.Device(ifaceName)
+	if err != nil {
+		return wgtypes.Peer{}, err
+	}
+	for _, peer := range wgDevice.Peers {
+		if peer.PublicKey.String() == peerPubKey {
+			return peer, nil
+		}
+	}
+	return wgtypes.Peer{}, fmt.Errorf("peer not found")
+}
+
+func (c *wGConfigurer) configure(config wgtypes.Config) error {
+	wg, err := wgctrl.New()
+	if err != nil {
+		return err
+	}
+	defer wg.Close()
+
+	// validate if device with name exists
+	_, err = wg.Device(c.deviceName)
+	if err != nil {
+		return err
+	}
+	log.Debugf("got Wireguard device %s", c.deviceName)
+
+	return wg.ConfigureDevice(c.deviceName, config)
+}