noisysockets

README

Noisy Sockets

Noisy Sockets is a secure service-to-service communications library based on the Noise Protocol Framework. Endpoints are identified by Curve25519 public keys, traffic is encrypted and authenticated using ChaCha20-Poly1305, and sent/received as UDP packets. Noisy Sockets is wire compatible with WireGuard.

Noisy Sockets implements a drop-in replacement for the Go net package, allowing it to be used with any existing code. This is implemented using a userspace TCP/IP stack based on Netstack from the gVisor project.

Usage

Examples of how to use Noisy Sockets can be found in the examples directory.

Performance

Surprisingly decent, I've been able to saturate a 1Gbps link with approximately two CPU cores and a single noisy socket. Interestingly it appears to outperform the kernel implementation of WireGuard.

Some preliminary benchmark results can be found in the benchmarks respository.

Credits

Noisy Sockets is based on code originally from the wireguard-go project by Jason A. Donenfeld.

WireGuard is a registered trademark of Jason A. Donenfeld.

Documentation

Index

• Variables
• type NoisySocketsInterface
  • func NewInterface(ctx context.Context, logger *slog.Logger, packetPool *network.PacketPool, ...) (*NoisySocketsInterface, error)
  • func (nic *NoisySocketsInterface) AddPeer(peerConf latestconfig.PeerConfig) error
  • func (nic *NoisySocketsInterface) AddRoute(ctx context.Context, routeConf latestconfig.RouteConfig) error
  • func (nic *NoisySocketsInterface) BatchSize() int
  • func (nic *NoisySocketsInterface) Close() error
  • func (nic *NoisySocketsInterface) ListenPort() uint16
  • func (nic *NoisySocketsInterface) MTU() (int, error)
  • func (nic *NoisySocketsInterface) Read(ctx context.Context, packets []*network.Packet, offset int) ([]*network.Packet, error)
  • func (nic *NoisySocketsInterface) RemovePeer(publicKey types.NoisePublicKey)
  • func (nic *NoisySocketsInterface) RemoveRoute(destination netip.Prefix) error
  • func (nic *NoisySocketsInterface) Write(ctx context.Context, packets []*network.Packet) error
• type NoisySocketsNetwork
  • func OpenNetwork(logger *slog.Logger, versionedConf configtypes.Config) (*NoisySocketsNetwork, error)
  • func (net *NoisySocketsNetwork) AddPeer(peerConf latestconfig.PeerConfig) error
  • func (net *NoisySocketsNetwork) AddRoute(routeConf latestconfig.RouteConfig) error
  • func (net *NoisySocketsNetwork) BufferedPacketsCount() int
  • func (net *NoisySocketsNetwork) Close() error
  • func (net *NoisySocketsNetwork) ListenPort() uint16
  • func (net *NoisySocketsNetwork) RemovePeer(publicKey types.NoisePublicKey)
  • func (net *NoisySocketsNetwork) RemoveRoute(destination netip.Prefix) error

Variables

var (
	ErrUnknownPeer = errors.New("unknown peer")
)

Types

type NoisySocketsInterface

type NoisySocketsInterface struct {
	// contains filtered or unexported fields
}

func NewInterface

func NewInterface(ctx context.Context, logger *slog.Logger, packetPool *network.PacketPool,
	versionedConf configtypes.Config) (*NoisySocketsInterface, error)

NewInterface creates a new WireGuard interface using the provided configuration. pr is a peer resolver that can be used to resolve peer addresses from peer names.

func (*NoisySocketsInterface) AddPeer

func (nic *NoisySocketsInterface) AddPeer(peerConf latestconfig.PeerConfig) error

AddPeer adds a peer to the WireGuard interface.

func (*NoisySocketsInterface) AddRoute

func (nic *NoisySocketsInterface) AddRoute(ctx context.Context, routeConf latestconfig.RouteConfig) error

AddRoute adds a route to the WireGuard interface.

func (*NoisySocketsInterface) BatchSize

func (nic *NoisySocketsInterface) BatchSize() int

func (*NoisySocketsInterface) Close

func (nic *NoisySocketsInterface) Close() error

func (*NoisySocketsInterface) ListenPort

func (nic *NoisySocketsInterface) ListenPort() uint16

ListenPort returns the port that wireguard is listening on.

func (*NoisySocketsInterface) MTU

func (nic *NoisySocketsInterface) MTU() (int, error)

func (*NoisySocketsInterface) Read

func (nic *NoisySocketsInterface) Read(ctx context.Context, packets []*network.Packet, offset int) ([]*network.Packet, error)

func (*NoisySocketsInterface) RemovePeer

func (nic *NoisySocketsInterface) RemovePeer(publicKey types.NoisePublicKey)

RemovePeer removes a peer from the WireGuard interface.

func (*NoisySocketsInterface) RemoveRoute

func (nic *NoisySocketsInterface) RemoveRoute(destination netip.Prefix) error

RemoveRoute removes a route from the WireGuard interface.

func (*NoisySocketsInterface) Write

func (nic *NoisySocketsInterface) Write(ctx context.Context, packets []*network.Packet) error

type NoisySocketsNetwork

type NoisySocketsNetwork struct {
	*network.UserspaceNetwork
	// contains filtered or unexported fields
}

NoisySocketsNetwork is a wrapper around a userspace WireGuard peer.

func OpenNetwork

func OpenNetwork(logger *slog.Logger, versionedConf configtypes.Config) (*NoisySocketsNetwork, error)

OpenNetwork creates a new network using the provided configuration. The returned network is a userspace WireGuard peer that exposes Dial() and Listen() methods compatible with the net package.

func (*NoisySocketsNetwork) AddPeer

func (net *NoisySocketsNetwork) AddPeer(peerConf latestconfig.PeerConfig) error

AddPeer adds a wireguard peer to the network.

func (*NoisySocketsNetwork) AddRoute

func (net *NoisySocketsNetwork) AddRoute(routeConf latestconfig.RouteConfig) error

AddRoute adds a route to the network.

func (*NoisySocketsNetwork) BufferedPacketsCount

func (net *NoisySocketsNetwork) BufferedPacketsCount() int

BufferedPacketsCount returns the number of buffered packets. This is exposed for leak testing purposes.

func (*NoisySocketsNetwork) Close

func (net *NoisySocketsNetwork) Close() error

Close closes the network.

func (*NoisySocketsNetwork) ListenPort

func (net *NoisySocketsNetwork) ListenPort() uint16

ListenPort returns the port that wireguard is listening on.

func (*NoisySocketsNetwork) RemovePeer

func (net *NoisySocketsNetwork) RemovePeer(publicKey types.NoisePublicKey)

RemovePeer removes a wireguard peer from the network.

func (*NoisySocketsNetwork) RemoveRoute

func (net *NoisySocketsNetwork) RemoveRoute(destination netip.Prefix) error

RemoveRoute removes a route from the network.