Module wireguard 

WireGuard VPN tunnel implementation

Implements the WireGuard protocol (Noise_IKpsk2 handshake pattern) for secure VPN tunneling. Provides:

• BLAKE2s hash function (RFC 7693)
• Noise IK handshake with pre-shared key
• ChaCha20-Poly1305 AEAD transport encryption
• Anti-replay sliding window
• Peer management with key rotation
• Virtual network interface (wg0)
• Timer-based session management

Structs

AllowedIp

Allowed IP range for a peer

AntiReplayWindow

Sliding-window anti-replay mechanism (2048-bit bitmap)

HandshakeContext

Handshake context for Noise_IKpsk2

PeerTimers

Timer state for a peer

SessionKeys

Session keys derived from handshake

WireGuardInterface

WireGuard virtual network interface (wg0)

WireGuardPeer

WireGuard peer

X25519KeyPair

X25519 key pair (Curve25519 Diffie-Hellman)

Enums

HandshakeState

Handshake state machine

TimerEvent

Timer events for WireGuard session management

WireGuardError

WireGuard protocol errors

Constants

DEFAULT_PORT

Default WireGuard UDP port

Functions

blake2s

Compute BLAKE2s hash of data with given output length

blake2s_keyed

Compute keyed BLAKE2s hash

check_peer_timers

Check timer events for a peer

decrypt_transport

Decrypt a transport data packet

encrypt_transport

Encrypt a transport data packet

hmac_blake2s

HMAC-BLAKE2s: delegates to HmacAlgorithm::HmacBlake2s