Wagyu - user-mode WireGuard for Elixir

Wagyu is a user-mode WireGuard library for Elixir.

It allows you to create an encrypted tunnel to another WireGuard peer and then tunnel TCP/UDP/TLS traffic over it using the :gen_tcp, :gen_udp and :ssl respectively, with only addiitional options required in the socket construction. No kernel capabilities or root privileges are required.

# Construct the wireguard interface
{:ok, interface} =
  Wagyu.start_link(
    name: :wg0,
    private_key: local_private_key,
    listen: %{address: {0, 0, 0, 0}, port: 51820},
    stack: [
      addresses: [{{10, 13, 0, 2}, 32}],
      routes: [{{0, 0, 0, 0}, 0, {10, 13, 0, 1}}],
      mtu: 1280
    ],
    peers: [
      %{
        public_key: remote_public_key,
        endpoint: %{address: {192, 0, 2, 1}, port: 51820},
        allowed_ips: [{{0, 0, 0, 0}, 0}]
      }
    ]
  )

# Grab the user-mode network stack
{:ok, stack} = Wagyu.stack(:wg0)

# Construct the socket
options = [
  {:tcp_module, SmolNet.Inet.Tcp}, # Set the backend module
  {:smolnet_stack, stack}, # Set the stack
  :inet,
  :binary,
  {:active, false}
]
{:ok, socket} = :gen_tcp.connect({10, 13, 0, 1}, 443, options, 5_000)

# Use the socket
:ok = :gen_tcp.send(socket, "hello")
{:ok, reply} = :gen_tcp.recv(socket, 0, 5_000)
:ok = :gen_tcp.close(socket)

Tbh, I mostly wrote this just to see if it could be done. The two libraries that underpin it, smolnet and decibel I had written previously for other work-related projects.

I thought it would mostly be a case of just glueing them together. Turns out, I was wrong about that, but getting to the initial release of wagyu resulted in improvements across all three, so I’m glad I tried.