Struct WgTunnel 

pub struct WgTunnel { /* private fields */ }

A live userspace-WireGuard tunnel to a single peer, bound to a real UDP socket.

Build with WgTunnel::bind, point it at the peer with WgTunnel::set_peer_endpoint (or let the first authenticated packet set it via roaming), then either initiate_handshake (the initiator) or wait to receive one. Drive it with pump (per datagram) and tick (per second). Encrypt outbound inner packets with send_packet.

Implementations

impl WgTunnel

pub fn bind( mine: &WgKeypair, peer_public: PublicKey, bind_addr: SocketAddr, index: u32, ) -> Result<WgTunnel, String>

Bind a UDP socket and build the tunnel state machine for peer_public.

bind_addr may use port 0 to let the OS choose (read it back with local_addr). index is a local WireGuard session index (any u32, distinct per tunnel). The peer endpoint is unset; call set_peer_endpoint before initiating, or let roaming learn it.

pub fn local_addr(&self) -> Result<SocketAddr, String>

The socket’s local address (resolves an OS-chosen port after binding to :0).

pub fn peer_endpoint(&self) -> Option<SocketAddr>

The peer endpoint we currently send to, if known.

pub fn set_peer_endpoint(&mut self, addr: SocketAddr)

Point the tunnel at addr. Roaming may later override this with the source of an authenticated packet.

pub fn set_read_timeout(&self, dur: Option<Duration>) -> Result<(), String>

Set the socket read timeout so pump returns TunnelEvent::Idle instead of blocking forever. None blocks indefinitely.

pub fn has_session(&self) -> bool

Has a WireGuard session been established (a handshake completed)?

pub fn initiate_handshake(&mut self) -> Result<(), String>

Kick off the Noise_IKpsk2 handshake: produce a handshake initiation and send it to the peer. The initiator calls this once; the responder just pumps and answers automatically.

pub fn send_packet(&mut self, inner: &[u8]) -> Result<bool, String>

Encrypt one inner IP packet and send it to the peer.

If no session is up yet, boringtun emits a handshake initiation instead of ciphertext; we forward that so the handshake starts, and the caller should retry the data send once has_session is true. Returns Ok(true) if ciphertext/handshake was sent, Ok(false) if boringtun produced nothing (e.g. the packet was queued pending a handshake).

pub fn pump(&mut self) -> Result<TunnelEvent, String>

Receive one datagram and run it through the tunnel.

Handshake responses, keepalives and cookie replies are sent back to the peer automatically (and any queued follow-up packets flushed). A decrypted inner IP packet is returned as TunnelEvent::InnerPacket. On a read timeout, TunnelEvent::Idle.

pub fn tick(&mut self) -> Result<(), String>

Drive WireGuard’s timers once (rekeying, keepalives, session expiry). Call roughly once a second from the caller’s loop. Sends any timer-produced packet (e.g. a keepalive) to the peer.