migrate to golang.zx2c4.com/wireguard/wgctrl (#239)

* migrate to golang.zx2c4.com/wireguard/wgctrl

This commit introduces the usage of wgctrl.
It avoids the usage of exec calls of the wg command
and parsing the output of `wg show`.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* vendor wgctrl

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* apply suggestions from code review

Remove wireguard.Enpoint struct and use net.UDPAddr for the resolved
endpoint and addr string (dnsanme:port) if a DN was supplied.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* pkg/*: use wireguard.Enpoint

This commit introduces the wireguard.Enpoint struct.
It encapsulates a DN name with port and a net.UPDAddr.
The fields are private and only accessible over exported Methods
to avoid accidental modification.

Also iptables.GetProtocol is improved to avoid ipv4 rules being applied
by `ip6tables`.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* pkg/wireguard/conf_test.go: add tests for Endpoint

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* cmd/kg/main.go: validate port range

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* add suggestions from review

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* pkg/mesh/mesh.go: use Equal func

Implement an Equal func for Enpoint and use it instead of comparing
strings.

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* cmd/kgctl/main.go: check port range

Signed-off-by: leonnicolas <leonloechner@gmx.de>

* vendor

Signed-off-by: leonnicolas <leonloechner@gmx.de>

vendor/github.com/mdlayher/genetlink/CHANGELOG.md

@@ -0,0 +1,9 @@
+# CHANGELOG
+
+## Unreleased
+
+n/a
+
+## v1.0.0
+
+- Initial stable commit.

vendor/github.com/mdlayher/genetlink/LICENSE.md

@@ -0,0 +1,10 @@
+MIT License
+===========
+
+Copyright (C) 2016-2017 Matt Layher
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

vendor/github.com/mdlayher/genetlink/README.md

@@ -0,0 +1,27 @@
+genetlink [![builds.sr.ht status](https://builds.sr.ht/~mdlayher/genetlink.svg)](https://builds.sr.ht/~mdlayher/genetlink?) [![GoDoc](https://godoc.org/github.com/mdlayher/genetlink?status.svg)](https://godoc.org/github.com/mdlayher/genetlink) [![Go Report Card](https://goreportcard.com/badge/github.com/mdlayher/genetlink)](https://goreportcard.com/report/github.com/mdlayher/genetlink)
+=========
+
+Package `genetlink` implements generic netlink interactions and data types.
+MIT Licensed.
+
+For more information about how netlink and generic netlink work,
+check out my blog series on [Linux, Netlink, and Go](https://mdlayher.com/blog/linux-netlink-and-go-part-1-netlink/).
+
+If you have any questions or you'd like some guidance, please join us on
+[Gophers Slack](https://invite.slack.golangbridge.org) in the `#networking`
+channel!
+
+## Stability
+
+See the [CHANGELOG](./CHANGELOG.md) file for a description of changes between
+releases.
+
+This package has reached v1.0.0 and any future breaking API changes will prompt
+the release of a new major version. Features and bug fixes will continue to
+occur in the v1.x.x series.
+
+The general policy of this package is to only support the latest, stable version
+of Go. Compatibility shims may be added for prior versions of Go on an as-needed
+basis. If you would like to raise a concern, please [file an issue](https://github.com/mdlayher/genetlink/issues/new).
+
+**If you depend on this package in your applications, please use Go modules.**

vendor/github.com/mdlayher/genetlink/conn.go

@@ -0,0 +1,235 @@
+package genetlink
+
+import (
+	"syscall"
+	"time"
+
+	"github.com/mdlayher/netlink"
+	"golang.org/x/net/bpf"
+)
+
+// Protocol is the netlink protocol constant used to specify generic netlink.
+const Protocol = 0x10 // unix.NETLINK_GENERIC
+
+// A Conn is a generic netlink connection. A Conn can be used to send and
+// receive generic netlink messages to and from netlink.
+//
+// A Conn is safe for concurrent use, but to avoid contention in
+// high-throughput applications, the caller should almost certainly create a
+// pool of Conns and distribute them among workers.
+type Conn struct {
+	// Operating system-specific netlink connection.
+	c *netlink.Conn
+}
+
+// Dial dials a generic netlink connection.  Config specifies optional
+// configuration for the underlying netlink connection.  If config is
+// nil, a default configuration will be used.
+func Dial(config *netlink.Config) (*Conn, error) {
+	c, err := netlink.Dial(Protocol, config)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewConn(c), nil
+}
+
+// NewConn creates a Conn that wraps an existing *netlink.Conn for
+// generic netlink communications.
+//
+// NewConn is primarily useful for tests. Most applications should use
+// Dial instead.
+func NewConn(c *netlink.Conn) *Conn {
+	return &Conn{c: c}
+}
+
+// Close closes the connection. Close will unblock any concurrent calls to
+// Receive which are waiting on a response from the kernel.
+func (c *Conn) Close() error {
+	return c.c.Close()
+}
+
+// GetFamily retrieves a generic netlink family with the specified name.
+//
+// If the family does not exist, the error value can be checked using
+// netlink.IsNotExist.
+func (c *Conn) GetFamily(name string) (Family, error) {
+	return c.getFamily(name)
+}
+
+// ListFamilies retrieves all registered generic netlink families.
+func (c *Conn) ListFamilies() ([]Family, error) {
+	return c.listFamilies()
+}
+
+// JoinGroup joins a netlink multicast group by its ID.
+func (c *Conn) JoinGroup(group uint32) error {
+	return c.c.JoinGroup(group)
+}
+
+// LeaveGroup leaves a netlink multicast group by its ID.
+func (c *Conn) LeaveGroup(group uint32) error {
+	return c.c.LeaveGroup(group)
+}
+
+// SetBPF attaches an assembled BPF program to a Conn.
+func (c *Conn) SetBPF(filter []bpf.RawInstruction) error {
+	return c.c.SetBPF(filter)
+}
+
+// RemoveBPF removes a BPF filter from a Conn.
+func (c *Conn) RemoveBPF() error {
+	return c.c.RemoveBPF()
+}
+
+// SetOption enables or disables a netlink socket option for the Conn.
+func (c *Conn) SetOption(option netlink.ConnOption, enable bool) error {
+	return c.c.SetOption(option, enable)
+}
+
+// SetReadBuffer sets the size of the operating system's receive buffer
+// associated with the Conn.
+func (c *Conn) SetReadBuffer(bytes int) error {
+	return c.c.SetReadBuffer(bytes)
+}
+
+// SetWriteBuffer sets the size of the operating system's transmit buffer
+// associated with the Conn.
+func (c *Conn) SetWriteBuffer(bytes int) error {
+	return c.c.SetWriteBuffer(bytes)
+}
+
+// SyscallConn returns a raw network connection. This implements the
+// syscall.Conn interface.
+//
+// On Go 1.12+, all methods of the returned syscall.RawConn are supported and
+// the Conn is integrated with the runtime network poller. On versions of Go
+// prior to Go 1.12, only the Control method of the returned syscall.RawConn
+// is implemented.
+//
+// SyscallConn is intended for advanced use cases, such as getting and setting
+// arbitrary socket options using the netlink socket's file descriptor.
+//
+// Once invoked, it is the caller's responsibility to ensure that operations
+// performed using Conn and the syscall.RawConn do not conflict with
+// each other.
+func (c *Conn) SyscallConn() (syscall.RawConn, error) {
+	return c.c.SyscallConn()
+}
+
+// SetDeadline sets the read and write deadlines associated with the connection.
+//
+// Deadline functionality is only supported on Go 1.12+. Calling this function
+// on older versions of Go will result in an error.
+func (c *Conn) SetDeadline(t time.Time) error {
+	return c.c.SetDeadline(t)
+}
+
+// SetReadDeadline sets the read deadline associated with the connection.
+//
+// Deadline functionality is only supported on Go 1.12+. Calling this function
+// on older versions of Go will result in an error.
+func (c *Conn) SetReadDeadline(t time.Time) error {
+	return c.c.SetReadDeadline(t)
+}
+
+// SetWriteDeadline sets the write deadline associated with the connection.
+//
+// Deadline functionality is only supported on Go 1.12+. Calling this function
+// on older versions of Go will result in an error.
+func (c *Conn) SetWriteDeadline(t time.Time) error {
+	return c.c.SetWriteDeadline(t)
+}
+
+// Send sends a single Message to netlink, wrapping it in a netlink.Message
+// using the specified generic netlink family and flags.  On success, Send
+// returns a copy of the netlink.Message with all parameters populated, for
+// later validation.
+func (c *Conn) Send(m Message, family uint16, flags netlink.HeaderFlags) (netlink.Message, error) {
+	nm, err := packMessage(m, family, flags)
+	if err != nil {
+		return netlink.Message{}, err
+	}
+
+	reqnm, err := c.c.Send(nm)
+	if err != nil {
+		return netlink.Message{}, err
+	}
+
+	return reqnm, nil
+}
+
+// Receive receives one or more Messages from netlink.  The netlink.Messages
+// used to wrap each Message are available for later validation.
+func (c *Conn) Receive() ([]Message, []netlink.Message, error) {
+	msgs, err := c.c.Receive()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	gmsgs, err := unpackMessages(msgs)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return gmsgs, msgs, nil
+}
+
+// Execute sends a single Message to netlink using Send, receives one or more
+// replies using Receive, and then checks the validity of the replies against
+// the request using netlink.Validate.
+//
+// Execute acquires a lock for the duration of the function call which blocks
+// concurrent calls to Send and Receive, in order to ensure consistency between
+// generic netlink request/reply messages.
+//
+// See the documentation of Send, Receive, and netlink.Validate for details
+// about each function.
+func (c *Conn) Execute(m Message, family uint16, flags netlink.HeaderFlags) ([]Message, error) {
+	nm, err := packMessage(m, family, flags)
+	if err != nil {
+		return nil, err
+	}
+
+	// Locking behavior handled by netlink.Conn.Execute.
+	msgs, err := c.c.Execute(nm)
+	if err != nil {
+		return nil, err
+	}
+
+	return unpackMessages(msgs)
+}
+
+// packMessage packs a generic netlink Message into a netlink.Message with the
+// appropriate generic netlink family and netlink flags.
+func packMessage(m Message, family uint16, flags netlink.HeaderFlags) (netlink.Message, error) {
+	nm := netlink.Message{
+		Header: netlink.Header{
+			Type:  netlink.HeaderType(family),
+			Flags: flags,
+		},
+	}
+
+	mb, err := m.MarshalBinary()
+	if err != nil {
+		return netlink.Message{}, err
+	}
+	nm.Data = mb
+
+	return nm, nil
+}
+
+// unpackMessages unpacks generic netlink Messages from a slice of netlink.Messages.
+func unpackMessages(msgs []netlink.Message) ([]Message, error) {
+	gmsgs := make([]Message, 0, len(msgs))
+	for _, nm := range msgs {
+		var gm Message
+		if err := (&gm).UnmarshalBinary(nm.Data); err != nil {
+			return nil, err
+		}
+
+		gmsgs = append(gmsgs, gm)
+	}
+
+	return gmsgs, nil
+}

vendor/github.com/mdlayher/genetlink/doc.go

@@ -0,0 +1,6 @@
+// Package genetlink implements generic netlink interactions and data types.
+//
+// If you have any questions or you'd like some guidance, please join us on
+// Gophers Slack (https://invite.slack.golangbridge.org) in the #networking
+// channel!
+package genetlink

vendor/github.com/mdlayher/genetlink/family.go

@@ -0,0 +1,17 @@
+package genetlink
+
+// A Family is a generic netlink family.
+type Family struct {
+	ID      uint16
+	Version uint8
+	Name    string
+	Groups  []MulticastGroup
+}
+
+// A MulticastGroup is a generic netlink multicast group, which can be joined
+// for notifications from generic netlink families when specific events take
+// place.
+type MulticastGroup struct {
+	ID   uint32
+	Name string
+}

vendor/github.com/mdlayher/genetlink/family_linux.go

@@ -0,0 +1,146 @@
+//+build linux
+
+package genetlink
+
+import (
+	"errors"
+	"fmt"
+	"math"
+
+	"github.com/mdlayher/netlink"
+	"github.com/mdlayher/netlink/nlenc"
+	"golang.org/x/sys/unix"
+)
+
+// errInvalidFamilyVersion is returned when a family's version is greater
+// than an 8-bit integer.
+var errInvalidFamilyVersion = errors.New("invalid family version attribute")
+
+// getFamily retrieves a generic netlink family with the specified name.
+func (c *Conn) getFamily(name string) (Family, error) {
+	b, err := netlink.MarshalAttributes([]netlink.Attribute{{
+		Type: unix.CTRL_ATTR_FAMILY_NAME,
+		Data: nlenc.Bytes(name),
+	}})
+	if err != nil {
+		return Family{}, err
+	}
+
+	req := Message{
+		Header: Header{
+			Command: unix.CTRL_CMD_GETFAMILY,
+			// TODO(mdlayher): grab nlctrl version?
+			Version: 1,
+		},
+		Data: b,
+	}
+
+	msgs, err := c.Execute(req, unix.GENL_ID_CTRL, netlink.Request)
+	if err != nil {
+		return Family{}, err
+	}
+
+	// TODO(mdlayher): consider interpreting generic netlink header values
+
+	families, err := buildFamilies(msgs)
+	if err != nil {
+		return Family{}, err
+	}
+	if len(families) != 1 {
+		// If this were to ever happen, netlink must be in a state where
+		// its answers cannot be trusted
+		panic(fmt.Sprintf("netlink returned multiple families for name: %q", name))
+	}
+
+	return families[0], nil
+}
+
+// listFamilies retrieves all registered generic netlink families.
+func (c *Conn) listFamilies() ([]Family, error) {
+	req := Message{
+		Header: Header{
+			Command: unix.CTRL_CMD_GETFAMILY,
+			// TODO(mdlayher): grab nlctrl version?
+			Version: 1,
+		},
+	}
+
+	flags := netlink.Request | netlink.Dump
+	msgs, err := c.Execute(req, unix.GENL_ID_CTRL, flags)
+	if err != nil {
+		return nil, err
+	}
+
+	return buildFamilies(msgs)
+}
+
+// buildFamilies builds a slice of Families by parsing attributes from the
+// input Messages.
+func buildFamilies(msgs []Message) ([]Family, error) {
+	families := make([]Family, 0, len(msgs))
+	for _, m := range msgs {
+		var f Family
+		if err := (&f).parseAttributes(m.Data); err != nil {
+			return nil, err
+		}
+
+		families = append(families, f)
+	}
+
+	return families, nil
+}
+
+// parseAttributes decodes netlink attributes into a Family's fields.
+func (f *Family) parseAttributes(b []byte) error {
+	ad, err := netlink.NewAttributeDecoder(b)
+	if err != nil {
+		return err
+	}
+
+	for ad.Next() {
+		switch ad.Type() {
+		case unix.CTRL_ATTR_FAMILY_ID:
+			f.ID = ad.Uint16()
+		case unix.CTRL_ATTR_FAMILY_NAME:
+			f.Name = ad.String()
+		case unix.CTRL_ATTR_VERSION:
+			v := ad.Uint32()
+			if v > math.MaxUint8 {
+				return errInvalidFamilyVersion
+			}
+
+			f.Version = uint8(v)
+		case unix.CTRL_ATTR_MCAST_GROUPS:
+			ad.Nested(func(nad *netlink.AttributeDecoder) error {
+				f.Groups = parseMulticastGroups(nad)
+				return nil
+			})
+		}
+	}
+
+	return ad.Err()
+}
+
+// parseMulticastGroups parses an array of multicast group nested attributes
+// into a slice of MulticastGroups.
+func parseMulticastGroups(ad *netlink.AttributeDecoder) []MulticastGroup {
+	groups := make([]MulticastGroup, 0, ad.Len())
+	for ad.Next() {
+		ad.Nested(func(nad *netlink.AttributeDecoder) error {
+			var g MulticastGroup
+			for nad.Next() {
+				switch nad.Type() {
+				case unix.CTRL_ATTR_MCAST_GRP_NAME:
+					g.Name = nad.String()
+				case unix.CTRL_ATTR_MCAST_GRP_ID:
+					g.ID = nad.Uint32()
+				}
+			}
+
+			groups = append(groups, g)
+			return nil
+		})
+	}
+
+	return groups
+}

vendor/github.com/mdlayher/genetlink/family_others.go

@@ -0,0 +1,23 @@
+//+build !linux
+
+package genetlink
+
+import (
+	"fmt"
+	"runtime"
+)
+
+// errUnimplemented is returned by all functions on platforms that
+// cannot make use of generic netlink.
+var errUnimplemented = fmt.Errorf("generic netlink not implemented on %s/%s",
+	runtime.GOOS, runtime.GOARCH)
+
+// getFamily always returns an error.
+func (c *Conn) getFamily(name string) (Family, error) {
+	return Family{}, errUnimplemented
+}
+
+// listFamilies always returns an error.
+func (c *Conn) listFamilies() ([]Family, error) {
+	return nil, errUnimplemented
+}

vendor/github.com/mdlayher/genetlink/fuzz.go

@@ -0,0 +1,20 @@
+//+build gofuzz
+
+package genetlink
+
+func Fuzz(data []byte) int {
+	return fuzzMessage(data)
+}
+
+func fuzzMessage(data []byte) int {
+	var m Message
+	if err := (&m).UnmarshalBinary(data); err != nil {
+		return 0
+	}
+
+	if _, err := m.MarshalBinary(); err != nil {
+		panic(err)
+	}
+
+	return 1
+}

vendor/github.com/mdlayher/genetlink/message.go

@@ -0,0 +1,61 @@
+package genetlink
+
+import "errors"
+
+// errInvalidMessage is returned when a Message is malformed.
+var errInvalidMessage = errors.New("generic netlink message is invalid or too short")
+
+// A Header is a generic netlink header. A Header is sent and received with
+// each generic netlink message to indicate metadata regarding a Message.
+type Header struct {
+	// Command specifies a command to issue to netlink.
+	Command uint8
+
+	// Version specifies the version of a command to use.
+	Version uint8
+}
+
+// headerLen is the length of a Header.
+const headerLen = 4 // unix.GENL_HDRLEN
+
+// A Message is a generic netlink message. It contains a Header and an
+// arbitrary byte payload, which may be decoded using information from the
+// Header.
+//
+// Data is encoded using the native endianness of the host system. Use
+// the netlink.AttributeDecoder and netlink.AttributeEncoder types to decode
+// and encode data.
+type Message struct {
+	Header Header
+	Data   []byte
+}
+
+// MarshalBinary marshals a Message into a byte slice.
+func (m Message) MarshalBinary() ([]byte, error) {
+	b := make([]byte, headerLen)
+
+	b[0] = m.Header.Command
+	b[1] = m.Header.Version
+
+	// b[2] and b[3] are padding bytes and set to zero
+
+	return append(b, m.Data...), nil
+}
+
+// UnmarshalBinary unmarshals the contents of a byte slice into a Message.
+func (m *Message) UnmarshalBinary(b []byte) error {
+	if len(b) < headerLen {
+		return errInvalidMessage
+	}
+
+	// Don't allow reserved pad bytes to be set
+	if b[2] != 0 || b[3] != 0 {
+		return errInvalidMessage
+	}
+
+	m.Header.Command = b[0]
+	m.Header.Version = b[1]
+
+	m.Data = b[4:]
+	return nil
+}