wg-wrap.git/internal/wireguard/wireguard_test.go, branch mainwg-wrap runs commands in network namespaces configured with userspace wireguard tunnels.
https://git.theodohertyfamily.com/wg-wrap.git/atom?h=main2026-05-30T01:07:46Zfeat: harden bootstrap and optimize network data path2026-05-30T01:07:46ZJames O'Dohertyjames@theodohertyfamily.com2026-05-30T01:07:46Zurn:sha1:d2173cdbc03884ecd9534e9369f8ebe1634f7e9c
- Security: Eliminate namespace escape risk by removing `HostBind` and enforcing `FDBind` using pre-opened host socket FDs.
- Security: Replace unsafe `atoi` with `strtol` and strict validation in the C launcher to prevent malformed PID joins.
- Stability: Fix PID wraparound by storing session timestamps in PID files to detect recycled PIDs.
- Stability: Resolve DNS mount leaks by implementing proper unmounting of `/etc/resolv.conf` during tunnel shutdown.
- Performance: Optimize `FDBind` throughput by implementing batch packet processing in the receive loop.
- Deployment: Implement `memfd_create` for the C launcher to support `noexec` temporary directories and reduce disk I/O.
- Maintenance: Replace external `ip` CLI dependency with native `netlink` library for robust network configuration.
- Quality: Fix all `golangci-lint` errors and replace remaining panics with explicit error handling.
Refactor CLI for testability and implement hermetic config path injection2026-05-22T13:18:55ZJames O'Dohertyjames@theodohertyfamily.com2026-05-22T13:18:55Zurn:sha1:96d75d9f1fab87365d7e6b5070eed3a5757c3484Scaffold wg-wrap project structure and toolchain2026-05-22T13:13:16ZJames O'Dohertyjames@theodohertyfamily.com2026-05-22T13:13:16Zurn:sha1:756ba94292b408cc4f23d137b2c4c52009b2b38d