FreeBSD kernel support (#128)

* internal/freebsd: add initial version of FreeBSD support
* internal/wguser: Replace deprecated io/ioutil package with io
* internal/freebsd: prepare CI to run tests on FreeBSD
* test: sort AllowedIPs before diffing them
* test: skip integration test configure_peers_update_only on FreeBSD
* test: increase test timeout for slow FreeBSD tests
* add FreeBSD support to README

Signed-off-by: Steffen Vogel <[email protected]>

* *: tidy
* go.mod: bump dependencies
* .builds: try to fix OpenBSD

Signed-off-by: Matt Layher <[email protected]>

Co-authored-by: Steffen Vogel <[email protected]>

Author: mdlayher

.builds/freebsd.yml

@@ -1,11 +1,15 @@
 image: freebsd/latest
 packages:
   - go
+  - bash
+  - sudo
+  - wireguard
 sources:
   - https://github.com/WireGuard/wgctrl-go
 environment:
   GO111MODULE: "on"
   GOBIN: "/home/build/go/bin"
+  CGO_ENABLED: "1"
 tasks:
   - setup-wireguard: |
       ./wgctrl-go/.cibuild.sh

.builds/openbsd.yml

@@ -14,16 +14,15 @@ tasks:
       go version
       go install honnef.co/go/tools/cmd/staticcheck@latest
       cd wgctrl-go/
-      diff -u <(echo -n) <(/usr/local/go/bin/gofmt -d -s .)
       go vet ./...
       $GOBIN/staticcheck ./...
       # The race detector is not supported on OpenBSD.
       go test -v ./...
       # 32-bit sanity checking for different kernel structure sizes.
       GOARCH=386 go build ./...
       go test -c .
-      # TODO: re-enable once Go 1.18 is available in openbsd/latest and wireguard-go can be built
+      doas bash -c 'WGCTRL_INTEGRATION=yesreallydoit ./wgctrl.test -test.v -test.run TestIntegration'
+      # TODO: re-enable once Go 1.19 is available in openbsd/latest and wireguard-go can be built
       exit 0
       # Use wireguard-go for additional testing.
       doas /usr/local/bin/wireguard-go tun0
-      doas bash -c 'WGCTRL_INTEGRATION=yesreallydoit ./wgctrl.test -test.v -test.run TestIntegration'

.cibuild.sh

@@ -10,11 +10,22 @@ KERNEL=$(uname -s)
 SUDO="sudo"
 if [ "${KERNEL}" == "OpenBSD" ]; then
     SUDO="doas"
-    # TODO: wireguard-go only builds using Go 1.18. However, openbsd/latest
-    # currently has an older version. Re-enable once Go 1.18 is available.
+
+    # Configure a WireGuard interface.
+    doas ifconfig wg0 create
+    doas ifconfig wg0 up
+
+    # TODO: wireguard-go only builds using Go 1.19+. However, openbsd/latest
+    # currently has an older version.
     exit 0
 fi
 
+if [ "${KERNEL}" == "FreeBSD" ]; then
+    # Configure a WireGuard interface.
+    sudo ifconfig wg create name wg0
+    sudo ifconfig wg0 up
+fi
+
 if [ "${KERNEL}" == "Linux" ]; then
     # Configure a WireGuard interface.
     sudo ip link add wg0 type wireguard

.github/workflows/linux-integration-test.yml

@@ -12,7 +12,7 @@ jobs:
   build:
     strategy:
       matrix:
-        go-version: [1.18]
+        go-version: [1.19]
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/linux-test.yml

@@ -12,7 +12,7 @@ jobs:
   build:
     strategy:
       matrix:
-        go-version: [1.18]
+        go-version: [1.19]
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/static-analysis.yml

@@ -12,7 +12,7 @@ jobs:
   build:
     strategy:
       matrix:
-        go-version: [1.18]
+        go-version: [1.19]
     runs-on: ubuntu-latest
 
     steps:

CONTRIBUTING.md

@@ -1,5 +1,4 @@
-Contributing
-============
+# Contributing
 
 The `wgctrl` project makes use of the [GitHub Flow](https://guides.github.com/introduction/flow/)
 for contributions.

LICENSE.md

@@ -1,6 +1,6 @@
 # MIT License
 
-Copyright (C) 2018-2019 Matt Layher
+Copyright (C) 2018-2022 Matt Layher
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

README.md

@@ -7,19 +7,16 @@ For more information on WireGuard, please see <https://www.wireguard.com/>.
 
 MIT Licensed.
 
-```text
-go get golang.zx2c4.com/wireguard/wgctrl
-```
-
 ## Overview
 
 `wgctrl` can control multiple types of WireGuard devices, including:
 
-- Linux kernel module devices, via generic netlink
-- userspace devices (e.g. wireguard-go), via the userspace configuration protocol
-  - both UNIX-like and Windows operating systems are supported
-- **Experimental:** OpenBSD kernel module devices (read-only), via ioctl interface
-  - See <https://git.zx2c4.com/wireguard-openbsd/about/> for details.
+- Kernel module devices
+  - Linux: via generic netlink
+  - FreeBSD: via ioctl interface
+  - OpenBSD: via ioctl interface (read-only)
+  - Windows: via ioctl interface
+- Userspace devices via the userspace configuration protocol
 
 As new operating systems add support for in-kernel WireGuard implementations,
 this package should also be extended to support those native implementations.

client_integration_test.go

@@ -1,10 +1,12 @@
 package wgctrl_test
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"net"
 	"os"
+	"sort"
 	"strings"
 	"testing"
 	"time"
@@ -68,7 +70,7 @@ func TestIntegrationClient(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			// Panic if a specific test takes too long.
-			timer := time.AfterFunc(1*time.Minute, func() {
+			timer := time.AfterFunc(5*time.Minute, func() {
 				panic("test took too long")
 			})
 			defer timer.Stop()
@@ -187,6 +189,15 @@ func testConfigure(t *testing.T, c *wgctrl.Client, d *wgtypes.Device) {
 		}},
 	}
 
+	// Sort AllowedIPs as different implementations might return
+	// them in different order
+	for i := range dn.Peers {
+		ips := dn.Peers[i].AllowedIPs
+		sort.Slice(ips, func(i, j int) bool {
+			return bytes.Compare(ips[i].IP, ips[j].IP) > 0
+		})
+	}
+
 	if diff := cmp.Diff(d, dn); diff != "" {
 		t.Fatalf("unexpected Device from Device (-want +got):\n%s", diff)
 	}
@@ -354,6 +365,12 @@ func testConfigurePeersUpdateOnly(t *testing.T, c *wgctrl.Client, d *wgtypes.Dev
 	}
 
 	if err := c.ConfigureDevice(d.Name, cfg); err != nil {
+		if d.Type == wgtypes.FreeBSDKernel && err == wgtypes.ErrUpdateOnlyNotSupported {
+			// TODO(stv0g): remove as soon as the FreeBSD kernel module supports it
+			t.Skip("FreeBSD kernel devices do not support UpdateOnly flag")
+		}
+
+
 		t.Fatalf("failed to configure second time on %q: %v", d.Name, err)
 	}