feat(wireguard): add WireGuard transport support with management APIs and config generation

rust/src/lib.rs

@@ -17,3 +17,4 @@ pub mod telemetry;
 pub mod ratelimit;
 pub mod qos;
 pub mod mtu;
+pub mod wireguard;

rust/src/management.rs

@@ -7,6 +7,7 @@ use tracing::{info, error, warn};
 use crate::client::{ClientConfig, VpnClient};
 use crate::crypto;
 use crate::server::{ServerConfig, VpnServer};
+use crate::wireguard::{self, WgClient, WgClientConfig, WgPeerConfig, WgServer, WgServerConfig};
 
 // ============================================================================
 // IPC protocol types
@@ -93,6 +94,8 @@ pub async fn management_loop_stdio(mode: &str) -> Result<()> {
 
     let mut vpn_client = VpnClient::new();
     let mut vpn_server = VpnServer::new();
+    let mut wg_client = WgClient::new();
+    let mut wg_server = WgServer::new();
 
     send_event_stdout("ready", serde_json::json!({ "mode": mode }));
 
@@ -127,8 +130,8 @@ pub async fn management_loop_stdio(mode: &str) -> Result<()> {
         };
 
         let response = match mode {
-            "client" => handle_client_request(&request, &mut vpn_client).await,
-            "server" => handle_server_request(&request, &mut vpn_server).await,
+            "client" => handle_client_request(&request, &mut vpn_client, &mut wg_client).await,
+            "server" => handle_server_request(&request, &mut vpn_server, &mut wg_server).await,
             _ => ManagementResponse::err(request.id.clone(), format!("Unknown mode: {}", mode)),
         };
         send_response_stdout(&response);
@@ -150,6 +153,8 @@ pub async fn management_loop_socket(socket_path: &str, mode: &str) -> Result<()>
     // Shared state behind Mutex for socket mode (multiple connections)
     let vpn_client = std::sync::Arc::new(Mutex::new(VpnClient::new()));
     let vpn_server = std::sync::Arc::new(Mutex::new(VpnServer::new()));
+    let wg_client = std::sync::Arc::new(Mutex::new(WgClient::new()));
+    let wg_server = std::sync::Arc::new(Mutex::new(WgServer::new()));
 
     loop {
         match listener.accept().await {
@@ -157,9 +162,11 @@ pub async fn management_loop_socket(socket_path: &str, mode: &str) -> Result<()>
                 let mode = mode.to_string();
                 let client = vpn_client.clone();
                 let server = vpn_server.clone();
+                let wg_c = wg_client.clone();
+                let wg_s = wg_server.clone();
                 tokio::spawn(async move {
                     if let Err(e) =
-                        handle_socket_connection(stream, &mode, client, server).await
+                        handle_socket_connection(stream, &mode, client, server, wg_c, wg_s).await
                     {
                         warn!("Socket connection error: {}", e);
                     }
@@ -177,6 +184,8 @@ async fn handle_socket_connection(
     mode: &str,
     vpn_client: std::sync::Arc<Mutex<VpnClient>>,
     vpn_server: std::sync::Arc<Mutex<VpnServer>>,
+    wg_client: std::sync::Arc<Mutex<WgClient>>,
+    wg_server: std::sync::Arc<Mutex<WgServer>>,
 ) -> Result<()> {
     let (reader, mut writer) = stream.into_split();
     let buf_reader = BufReader::new(reader);
@@ -227,11 +236,13 @@ async fn handle_socket_connection(
         let response = match mode {
             "client" => {
                 let mut client = vpn_client.lock().await;
-                handle_client_request(&request, &mut client).await
+                let mut wg_c = wg_client.lock().await;
+                handle_client_request(&request, &mut client, &mut wg_c).await
             }
             "server" => {
                 let mut server = vpn_server.lock().await;
-                handle_server_request(&request, &mut server).await
+                let mut wg_s = wg_server.lock().await;
+                handle_server_request(&request, &mut server, &mut wg_s).await
             }
             _ => ManagementResponse::err(request.id.clone(), format!("Unknown mode: {}", mode)),
         };
@@ -252,38 +263,79 @@ async fn handle_socket_connection(
 async fn handle_client_request(
     request: &ManagementRequest,
     vpn_client: &mut VpnClient,
+    wg_client: &mut WgClient,
 ) -> ManagementResponse {
     let id = request.id.clone();
 
     match request.method.as_str() {
         "connect" => {
-            let config: ClientConfig = match serde_json::from_value(
-                request.params.get("config").cloned().unwrap_or_default(),
-            ) {
-                Ok(c) => c,
-                Err(e) => {
-                    return ManagementResponse::err(id, format!("Invalid config: {}", e));
-                }
-            };
+            // Check if transport is "wireguard"
+            let transport = request.params
+                .get("config")
+                .and_then(|c| c.get("transport"))
+                .and_then(|t| t.as_str())
+                .unwrap_or("");
 
-            match vpn_client.connect(config).await {
-                Ok(assigned_ip) => {
-                    ManagementResponse::ok(id, serde_json::json!({ "assignedIp": assigned_ip }))
+            if transport == "wireguard" {
+                let config: WgClientConfig = match serde_json::from_value(
+                    request.params.get("config").cloned().unwrap_or_default(),
+                ) {
+                    Ok(c) => c,
+                    Err(e) => {
+                        return ManagementResponse::err(id, format!("Invalid WG config: {}", e));
+                    }
+                };
+                match wg_client.connect(config).await {
+                    Ok(assigned_ip) => {
+                        ManagementResponse::ok(id, serde_json::json!({ "assignedIp": assigned_ip }))
+                    }
+                    Err(e) => ManagementResponse::err(id, format!("WG connect failed: {}", e)),
+                }
+            } else {
+                let config: ClientConfig = match serde_json::from_value(
+                    request.params.get("config").cloned().unwrap_or_default(),
+                ) {
+                    Ok(c) => c,
+                    Err(e) => {
+                        return ManagementResponse::err(id, format!("Invalid config: {}", e));
+                    }
+                };
+                match vpn_client.connect(config).await {
+                    Ok(assigned_ip) => {
+                        ManagementResponse::ok(id, serde_json::json!({ "assignedIp": assigned_ip }))
+                    }
+                    Err(e) => ManagementResponse::err(id, format!("Connect failed: {}", e)),
+                }
+            }
+        }
+        "disconnect" => {
+            if wg_client.is_running() {
+                match wg_client.disconnect().await {
+                    Ok(()) => ManagementResponse::ok(id, serde_json::json!({})),
+                    Err(e) => ManagementResponse::err(id, format!("WG disconnect failed: {}", e)),
+                }
+            } else {
+                match vpn_client.disconnect().await {
+                    Ok(()) => ManagementResponse::ok(id, serde_json::json!({})),
+                    Err(e) => ManagementResponse::err(id, format!("Disconnect failed: {}", e)),
                 }
-                Err(e) => ManagementResponse::err(id, format!("Connect failed: {}", e)),
             }
         }
-        "disconnect" => match vpn_client.disconnect().await {
-            Ok(()) => ManagementResponse::ok(id, serde_json::json!({})),
-            Err(e) => ManagementResponse::err(id, format!("Disconnect failed: {}", e)),
-        },
         "getStatus" => {
-            let status = vpn_client.get_status().await;
-            ManagementResponse::ok(id, status)
+            if wg_client.is_running() {
+                ManagementResponse::ok(id, wg_client.get_status().await)
+            } else {
+                let status = vpn_client.get_status().await;
+                ManagementResponse::ok(id, status)
+            }
         }
         "getStatistics" => {
-            let stats = vpn_client.get_statistics().await;
-            ManagementResponse::ok(id, stats)
+            if wg_client.is_running() {
+                ManagementResponse::ok(id, wg_client.get_statistics().await)
+            } else {
+                let stats = vpn_client.get_statistics().await;
+                ManagementResponse::ok(id, stats)
+            }
         }
         "getConnectionQuality" => {
             match vpn_client.get_connection_quality() {
@@ -329,45 +381,92 @@ async fn handle_client_request(
 async fn handle_server_request(
     request: &ManagementRequest,
     vpn_server: &mut VpnServer,
+    wg_server: &mut WgServer,
 ) -> ManagementResponse {
     let id = request.id.clone();
 
     match request.method.as_str() {
         "start" => {
-            let config: ServerConfig = match serde_json::from_value(
-                request.params.get("config").cloned().unwrap_or_default(),
-            ) {
-                Ok(c) => c,
-                Err(e) => {
-                    return ManagementResponse::err(id, format!("Invalid config: {}", e));
-                }
-            };
+            // Check if transportMode is "wireguard"
+            let transport_mode = request.params
+                .get("config")
+                .and_then(|c| c.get("transportMode"))
+                .and_then(|t| t.as_str())
+                .unwrap_or("");
 
-            match vpn_server.start(config).await {
-                Ok(()) => ManagementResponse::ok(id, serde_json::json!({})),
-                Err(e) => ManagementResponse::err(id, format!("Start failed: {}", e)),
+            if transport_mode == "wireguard" {
+                let config: WgServerConfig = match serde_json::from_value(
+                    request.params.get("config").cloned().unwrap_or_default(),
+                ) {
+                    Ok(c) => c,
+                    Err(e) => {
+                        return ManagementResponse::err(id, format!("Invalid WG config: {}", e));
+                    }
+                };
+                match wg_server.start(config).await {
+                    Ok(()) => ManagementResponse::ok(id, serde_json::json!({})),
+                    Err(e) => ManagementResponse::err(id, format!("WG start failed: {}", e)),
+                }
+            } else {
+                let config: ServerConfig = match serde_json::from_value(
+                    request.params.get("config").cloned().unwrap_or_default(),
+                ) {
+                    Ok(c) => c,
+                    Err(e) => {
+                        return ManagementResponse::err(id, format!("Invalid config: {}", e));
+                    }
+                };
+                match vpn_server.start(config).await {
+                    Ok(()) => ManagementResponse::ok(id, serde_json::json!({})),
+                    Err(e) => ManagementResponse::err(id, format!("Start failed: {}", e)),
+                }
+            }
+        }
+        "stop" => {
+            if wg_server.is_running() {
+                match wg_server.stop().await {
+                    Ok(()) => ManagementResponse::ok(id, serde_json::json!({})),
+                    Err(e) => ManagementResponse::err(id, format!("WG stop failed: {}", e)),
+                }
+            } else {
+                match vpn_server.stop().await {
+                    Ok(()) => ManagementResponse::ok(id, serde_json::json!({})),
+                    Err(e) => ManagementResponse::err(id, format!("Stop failed: {}", e)),
+                }
             }
         }
-        "stop" => match vpn_server.stop().await {
-            Ok(()) => ManagementResponse::ok(id, serde_json::json!({})),
-            Err(e) => ManagementResponse::err(id, format!("Stop failed: {}", e)),
-        },
         "getStatus" => {
-            let status = vpn_server.get_status();
-            ManagementResponse::ok(id, status)
+            if wg_server.is_running() {
+                ManagementResponse::ok(id, wg_server.get_status())
+            } else {
+                let status = vpn_server.get_status();
+                ManagementResponse::ok(id, status)
+            }
         }
         "getStatistics" => {
-            let stats = vpn_server.get_statistics().await;
-            match serde_json::to_value(&stats) {
-                Ok(v) => ManagementResponse::ok(id, v),
-                Err(e) => ManagementResponse::err(id, format!("Serialize error: {}", e)),
+            if wg_server.is_running() {
+                ManagementResponse::ok(id, wg_server.get_statistics().await)
+            } else {
+                let stats = vpn_server.get_statistics().await;
+                match serde_json::to_value(&stats) {
+                    Ok(v) => ManagementResponse::ok(id, v),
+                    Err(e) => ManagementResponse::err(id, format!("Serialize error: {}", e)),
+                }
             }
         }
         "listClients" => {
-            let clients = vpn_server.list_clients().await;
-            match serde_json::to_value(&clients) {
-                Ok(v) => ManagementResponse::ok(id, serde_json::json!({ "clients": v })),
-                Err(e) => ManagementResponse::err(id, format!("Serialize error: {}", e)),
+            if wg_server.is_running() {
+                let peers = wg_server.list_peers().await;
+                match serde_json::to_value(&peers) {
+                    Ok(v) => ManagementResponse::ok(id, serde_json::json!({ "clients": v })),
+                    Err(e) => ManagementResponse::err(id, format!("Serialize error: {}", e)),
+                }
+            } else {
+                let clients = vpn_server.list_clients().await;
+                match serde_json::to_value(&clients) {
+                    Ok(v) => ManagementResponse::ok(id, serde_json::json!({ "clients": v })),
+                    Err(e) => ManagementResponse::err(id, format!("Serialize error: {}", e)),
+                }
             }
         }
         "disconnectClient" => {
@@ -436,6 +535,56 @@ async fn handle_server_request(
             ),
             Err(e) => ManagementResponse::err(id, format!("Keypair generation failed: {}", e)),
         },
+        "generateWgKeypair" => {
+            let (public_key, private_key) = wireguard::generate_wg_keypair();
+            ManagementResponse::ok(
+                id,
+                serde_json::json!({
+                    "publicKey": public_key,
+                    "privateKey": private_key,
+                }),
+            )
+        }
+        "addWgPeer" => {
+            if !wg_server.is_running() {
+                return ManagementResponse::err(id, "WireGuard server not running".to_string());
+            }
+            let config: WgPeerConfig = match serde_json::from_value(
+                request.params.get("peer").cloned().unwrap_or_default(),
+            ) {
+                Ok(c) => c,
+                Err(e) => {
+                    return ManagementResponse::err(id, format!("Invalid peer config: {}", e));
+                }
+            };
+            match wg_server.add_peer(config).await {
+                Ok(()) => ManagementResponse::ok(id, serde_json::json!({})),
+                Err(e) => ManagementResponse::err(id, format!("Add peer failed: {}", e)),
+            }
+        }
+        "removeWgPeer" => {
+            if !wg_server.is_running() {
+                return ManagementResponse::err(id, "WireGuard server not running".to_string());
+            }
+            let public_key = match request.params.get("publicKey").and_then(|v| v.as_str()) {
+                Some(k) => k.to_string(),
+                None => return ManagementResponse::err(id, "Missing publicKey".to_string()),
+            };
+            match wg_server.remove_peer(&public_key).await {
+                Ok(()) => ManagementResponse::ok(id, serde_json::json!({})),
+                Err(e) => ManagementResponse::err(id, format!("Remove peer failed: {}", e)),
+            }
+        }
+        "listWgPeers" => {
+            if !wg_server.is_running() {
+                return ManagementResponse::err(id, "WireGuard server not running".to_string());
+            }
+            let peers = wg_server.list_peers().await;
+            match serde_json::to_value(&peers) {
+                Ok(v) => ManagementResponse::ok(id, serde_json::json!({ "peers": v })),
+                Err(e) => ManagementResponse::err(id, format!("Serialize error: {}", e)),
+            }
+        }
         _ => ManagementResponse::err(id, format!("Unknown server method: {}", request.method)),
     }
 }