summaryrefslogtreecommitdiffhomepage
path: root/talpid-wireguard/src
AgeCommit message (Collapse)AuthorFilesLines
2025-10-29Make the DAITA overhead log more compactSebastian Holmin1-23/+14
2025-10-27Remove unused importMarkus Pettersson1-2/+0
2025-10-24Add padding packet over log on disconnectSebastian Holmin1-2/+34
2025-10-24Add DAITA stats to 'Stats'David Lönnhager9-50/+46
2025-10-24Set max_padding_frac and max_blocking_fracMarkus Pettersson1-7/+8
Co-authored-by: Joakim Hulthe <joakim.hulthe@mullvad.net> Co-authored-by: David Lönnhager <david.l@mullvad.net>
2025-10-24Propagate error if configuring GotaTun device in invalid stateMarkus Pettersson2-7/+20
2025-10-24Fix tunnel setup after having negotiated with an ephemeral peerMarkus Pettersson1-2/+5
Co-authored-by: Joakim Hulthe <joakim.hulthe@mullvad.net>
2025-10-24Work around mtu getter not being implemented on AndroidJoakim Hulthe1-1/+7
2025-10-24Integrate GotaTun cleanlyMarkus Pettersson8-179/+273
Refactor `trait Tunnel` and factor `start_daita` into `set_config`. Co-authored-by: Joakim Hulthe <joakim.hulthe@mullvad.net>
2025-10-24Update important log messageJoakim Hulthe1-9/+6
2025-10-08Block tunnel traffic when negotiating with an ephemeral peer on AndroidMarkus Pettersson4-83/+80
Patch tunnel config to block traffic to non-gateway destinations during PQ setup when using Boringtun on Android. Move `patch_allowed_ips` to `config` module.
2025-10-03Remove DAITA from wireguard-ntDavid Lönnhager2-638/+9
2025-10-03Bump windows-sys version to latestDavid Lönnhager2-29/+32
This also refactors and documents some code
2025-10-03Add a UDS for wiresharking gotatun multihop trafficJoakim Hulthe1-1/+75
2025-09-23Upgrade `rand` to `0.9` in `talpid-wireguard`Markus Pettersson3-9/+8
Document why `rand` can't be upgraded in `wireguard_nt::daita`
2025-09-18Add multiplexer POC to daemon, TSM, and relay selectorDavid Lönnhager3-6/+58
2025-09-17Upgrade rtnetlink libs to latest versionMarkus Pettersson4-122/+103
Signed-off-by: Markus Pettersson <markus.pettersson@mullvad.net>
2025-09-15Add LWO obfuscatorDavid Lönnhager1-3/+12
2025-09-03Add last WG handshake to statsDavid Lönnhager9-2/+168
2025-08-26Update boringtun, adding multihop fixes and GROSebastian Holmin1-22/+32
Adds: - Userspace multihop de-fragmentation - PcapSniffer - UDP GRO on Linux Also updates setup of userspace multihop on the deamon side, as `PacketChannel` has been replaced with specifc channel types that implement the `IpSend`, `IpRecv`, `UdpSend` and `UdpRecv` traits.
2025-08-21Set QUIC MTU based on route onlyDavid Lönnhager1-55/+69
2025-08-18Set clamped MTU for obfuscationDavid Lönnhager1-6/+9
2025-08-18Update QUIC MTU valueDavid Lönnhager3-25/+45
2025-08-14Refactor device creationSebastian Holmin1-149/+90
Change the way tun devices are created to prevent two from overlapping. This caused PQ to panic when taking read-locks.
2025-08-05Fix Android boringtun buildDavid Lönnhager1-6/+8
2025-07-25Create new boringtun devices when toggling multihopDavid Lönnhager1-63/+99
2025-07-25Do not set per-route MTU for boringtunDavid Lönnhager1-9/+27
2025-07-25Set MTU in Unix tun providerDavid Lönnhager1-0/+2
2025-07-25Add userspace multihop to boringtunJoakim Hulthe1-55/+315
2025-07-15Fix `collapsible_if` clippy lintMarkus Pettersson1-6/+7
2025-07-10Run `cargo fmt`Sebastian Holmin17-67/+80
2025-07-09Adjust MTU for QUIC obfuscator based on tunnel MTUMarkus Pettersson1-13/+32
Make fields of `quic::Settings` private and expose constructors/builder fns to configure a `quic::Settings` struct. A previous commit that added a public, optional field to the settings struct broke a caller (iOS), which is suboptimal. Add a new token type: `quic::AuthToken`. This will perform "all" necessary validation that was previously done ad-hoc when the token was to be transformed into an authorization header. It also helps to not fuck up the values passed to `quic::Settings::new`, since it was previously Stringly-typed.
2025-07-09Add IPv6 support to `mullvad-masque-proxy`Markus Pettersson1-0/+1
2025-07-09Add support for QUIC in the relay selectorMarkus Pettersson1-13/+12
Parse new 'features' key from relay list API, and add Quic obfuscation to automatic retry order
2025-07-09Fix returning the result of a `let` bindingSebastian Holmin1-4/+2
2025-07-09Use `io:Error::other`Sebastian Holmin1-2/+1
2025-07-08Update FFI to handle new QUIC paramsJon Petersson1-0/+4
2025-06-27Fix bad fd on android when using boringtunDavid Göransson1-2/+2
2025-06-12Fix tun file descriptor ownershipJoakim Hulthe3-13/+9
We accidentally borrowed the file descriptor when we should have moved it. This commit adds more `OwnedFd` and friends to help handle ownership correctly. Signed-off-by: Joakim Hulthe <joakim.hulthe@mullvad.net>
2025-06-10Replace deprecated InetAddr with SocketAddrJoakim Hulthe2-20/+36
2025-06-10Update nix to 0.30 everywhereJoakim Hulthe3-11/+15
2025-06-05Fix typosomahs2-2/+2
2025-05-26Add BoringtunJoakim Hulthe9-327/+743
Co-authored-by: Joakim Hulthe <joakim.hulthe@mullvad.net> Co-authored-by: Sebastian Holmin <sebastian.holmin@mullvad.net> Co-authored-by: David Göransson <david.goransson@mullvad.net> Co-authored-by: Markus Pettersson <markus.pettersson@mullvad.net> Co-authored-by: David Lönnhager <david.l@mullvad.net>
2025-05-14Add some comments to talpid-wireguardJoakim Hulthe1-0/+5
2025-05-08Add QUIC obfuscation to mullvad daemon and management interfaceDavid Lönnhager1-1/+10
2025-03-24Make it possible to disable IPv6 in the tunnelJonatan Rhodin1-1/+7
2025-03-21Use regular default route for the tunnel interface on WindowsDavid Lönnhager1-22/+1
This replaces the /1 routes for two reasons: 1. This mitigates an issue in our fork of wireguard-nt, which intentionally allows routes back to the tunnel interface. The fork explicitly disallows this only for routes with a prefix 0, which means that the /1 routes are not exempted. This can result in an infinite routing loop if the non-tunnel route to the relay is removed (e.g., if the default interface or its routes disappear). 2. This simplifies the code and routes. The /1 routes are unnecessary since we're setting the metric on the default route and interface to the lowest value anyway, so the OS should always prefer the tunnel default route. Even if it doesn't, the firewall will prevent leaks.
2025-03-19Set MTU on IPv6 interface for wireguard-nt only if IPv6 is enabledDavid Lönnhager2-3/+8
2025-03-18Remove superfluous .to_vec()'s, and replace some with vec![]Linus Färnstrand1-114/+74
2025-02-27Use socket instead of ping command when pinging on androidJonatan Rhodin3-84/+14
Previous implementation spawned a process with tokio which in turn registered a signal handler without ONASTACK flag set. When using GO code, all signal handlers needs to have this flag set otherwise a signal might be handled on a goroutine thread which has a small stack and thus can overflow. Reference: DROID-1825 Co-authored-by: David Lönnhager <david.l@mullvad.net>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.