Merge pull request #2250 from BishopFox/wg/opt-in

moloch-- · web-flow · commit 2daccb5bd311 · 2026-04-21T21:24:17.000-07:00
Disable wg wrapper on multiplayer by default
diff --git a/client/cli/cli.go b/client/cli/cli.go
@@ -52,7 +52,7 @@ func init() {
 
 	rootCmd.TraverseChildren = true
 	rootCmd.Flags().String(RCFlagName, "", "path to rc script file")
-	rootCmd.PersistentFlags().Bool(disableWGFlag, false, "connect to multiplayer directly even if the operator config includes a WireGuard wrapper")
+	rootCmd.PersistentFlags().Bool(enableWGFlag, false, "connect to multiplayer through the operator config's WireGuard wrapper")
 
 	// Create the console client, without any RPC or commands bound to it yet.
 	// This created before anything so that multiple commands can make use of
diff --git a/client/cli/transport_mode.go b/client/cli/transport_mode.go
@@ -6,23 +6,23 @@ import (
 )
 
 const (
-	disableWGFlag = "disable-wg"
+	enableWGFlag = "enable-wg"
 )
 
 func applyMultiplayerConnectMode(cmd *cobra.Command) error {
 	if cmd == nil {
-		transport.SetMultiplayerConnectMode(transport.MultiplayerConnectAuto)
+		transport.SetMultiplayerConnectMode(transport.MultiplayerConnectDirect)
 		return nil
 	}
 
-	disableWG, err := cmd.Flags().GetBool(disableWGFlag)
+	enableWG, err := cmd.Flags().GetBool(enableWGFlag)
 	if err != nil {
 		return err
 	}
 
-	mode := transport.MultiplayerConnectAuto
-	if disableWG {
-		mode = transport.MultiplayerConnectDisableWG
+	mode := transport.MultiplayerConnectDirect
+	if enableWG {
+		mode = transport.MultiplayerConnectEnableWG
 	}
 	transport.SetMultiplayerConnectMode(mode)
 	return nil
diff --git a/client/transport/connect_mode.go b/client/transport/connect_mode.go
@@ -11,8 +11,8 @@ import (
 type MultiplayerConnectMode int
 
 const (
-	MultiplayerConnectAuto MultiplayerConnectMode = iota
-	MultiplayerConnectDisableWG
+	MultiplayerConnectDirect MultiplayerConnectMode = iota
+	MultiplayerConnectEnableWG
 )
 
 type connectionCloser interface {
@@ -21,7 +21,7 @@ type connectionCloser interface {
 
 var (
 	multiplayerConnectModeMu sync.RWMutex
-	multiplayerConnectMode   = MultiplayerConnectAuto
+	multiplayerConnectMode   = MultiplayerConnectDirect
 	connClosers              sync.Map // *grpc.ClientConn -> connectionCloser
 )
 
diff --git a/client/transport/mtls.go b/client/transport/mtls.go
@@ -105,16 +105,13 @@ func selectMultiplayerDialStrategy(config *assets.ClientConfig) (multiplayerDial
 	}
 
 	switch getMultiplayerConnectMode() {
-	case MultiplayerConnectDisableWG:
-		return multiplayerDialDirect, nil
-	default:
-		if config.WG == nil {
-			return multiplayerDialDirect, nil
-		}
+	case MultiplayerConnectEnableWG:
 		if err := validateWireGuardConfig(config); err != nil {
 			return multiplayerDialDirect, err
 		}
 		return multiplayerDialWireGuard, nil
+	default:
+		return multiplayerDialDirect, nil
 	}
 }
 
diff --git a/client/transport/mtls_test.go b/client/transport/mtls_test.go
@@ -11,7 +11,7 @@ import (
 )
 
 func TestSelectMultiplayerDialStrategyLegacyConfigUsesDirectMTLS(t *testing.T) {
-	setTestMultiplayerConnectMode(t, MultiplayerConnectAuto)
+	setTestMultiplayerConnectMode(t, MultiplayerConnectDirect)
 
 	strategy, err := selectMultiplayerDialStrategy(&assets.ClientConfig{})
 	if err != nil {
@@ -22,8 +22,34 @@ func TestSelectMultiplayerDialStrategyLegacyConfigUsesDirectMTLS(t *testing.T) {
 	}
 }
 
-func TestSelectMultiplayerDialStrategyRejectsIncompleteWGConfig(t *testing.T) {
-	setTestMultiplayerConnectMode(t, MultiplayerConnectAuto)
+func TestSelectMultiplayerDialStrategyDefaultIgnoresIncompleteWGConfig(t *testing.T) {
+	setTestMultiplayerConnectMode(t, MultiplayerConnectDirect)
+
+	strategy, err := selectMultiplayerDialStrategy(&assets.ClientConfig{
+		WG: &assets.ClientWGConfig{
+			ServerPubKey: "server-pub",
+			ClientIP:     "100.64.0.2",
+		},
+	})
+	if err != nil {
+		t.Fatalf("select dial strategy: %v", err)
+	}
+	if strategy != multiplayerDialDirect {
+		t.Fatalf("expected direct mTLS strategy, got %v", strategy)
+	}
+}
+
+func TestSelectMultiplayerDialStrategyEnableWGRejectsMissingWGConfig(t *testing.T) {
+	setTestMultiplayerConnectMode(t, MultiplayerConnectEnableWG)
+
+	_, err := selectMultiplayerDialStrategy(&assets.ClientConfig{})
+	if !errors.Is(err, ErrMissingWireGuardConfig) {
+		t.Fatalf("expected missing WG config error, got %v", err)
+	}
+}
+
+func TestSelectMultiplayerDialStrategyEnableWGRejectsIncompleteWGConfig(t *testing.T) {
+	setTestMultiplayerConnectMode(t, MultiplayerConnectEnableWG)
 
 	_, err := selectMultiplayerDialStrategy(&assets.ClientConfig{
 		WG: &assets.ClientWGConfig{
@@ -36,8 +62,8 @@ func TestSelectMultiplayerDialStrategyRejectsIncompleteWGConfig(t *testing.T) {
 	}
 }
 
-func TestSelectMultiplayerDialStrategyUsesWireGuardWhenConfigComplete(t *testing.T) {
-	setTestMultiplayerConnectMode(t, MultiplayerConnectAuto)
+func TestSelectMultiplayerDialStrategyEnableWGUsesWireGuardWhenConfigComplete(t *testing.T) {
+	setTestMultiplayerConnectMode(t, MultiplayerConnectEnableWG)
 
 	strategy, err := selectMultiplayerDialStrategy(&assets.ClientConfig{
 		WG: &assets.ClientWGConfig{
@@ -54,8 +80,8 @@ func TestSelectMultiplayerDialStrategyUsesWireGuardWhenConfigComplete(t *testing
 	}
 }
 
-func TestSelectMultiplayerDialStrategyDisableWGOverridesCompleteConfig(t *testing.T) {
-	setTestMultiplayerConnectMode(t, MultiplayerConnectDisableWG)
+func TestSelectMultiplayerDialStrategyDefaultUsesDirectMTLSEvenWhenWGConfigComplete(t *testing.T) {
+	setTestMultiplayerConnectMode(t, MultiplayerConnectDirect)
 
 	strategy, err := selectMultiplayerDialStrategy(&assets.ClientConfig{
 		WG: &assets.ClientWGConfig{
@@ -68,7 +94,7 @@ func TestSelectMultiplayerDialStrategyDisableWGOverridesCompleteConfig(t *testin
 		t.Fatalf("select dial strategy: %v", err)
 	}
 	if strategy != multiplayerDialDirect {
-		t.Fatalf("expected direct strategy when WG is disabled, got %v", strategy)
+		t.Fatalf("expected direct strategy when WG is not explicitly enabled, got %v", strategy)
 	}
 }
 
diff --git a/docs/sliver-docs/pages/docs/md/Configuration Files.md b/docs/sliver-docs/pages/docs/md/Configuration Files.md
@@ -12,7 +12,7 @@ daemon:
     host: ""
     port: 31337
     tailscale: false
-    disable_wg: false
+    enable_wg: false
 logs:
     level: 4
     grpc_unary_payloads: false
@@ -54,7 +54,7 @@ cxx: {}
   - `host` - Interface to bind the daemon listener to. Empty string means all interfaces.
   - `port` - Listen port for the multiplayer listener.
   - `tailscale` - Enable Tailscale for daemon listener setup. When enabled, Sliver does not wrap multiplayer in its own WireGuard layer.
-  - `disable_wg` - Expose multiplayer directly over mTLS instead of the default WireGuard-protected mode.
+  - `enable_wg` - Wrap multiplayer in WireGuard. If omitted or false, multiplayer is exposed directly over mTLS.
 - `logs` - Server logging options.
   - `level` - `logrus` level (`0`-`6`, clamped by Sliver). `4` is `INFO`, `5` is `DEBUG`, `6` is `TRACE`.
   - `grpc_unary_payloads` - Log gRPC unary payloads.
@@ -159,4 +159,4 @@ The `wg` block is optional:
 
 - When present, `sliver-client` automatically brings up the multiplayer WireGuard wrapper and then dials the in-tunnel gRPC/mTLS service.
 - When absent, the client connects directly to the multiplayer mTLS listener.
-- Generate a direct-only profile with `new-operator --disable-wg` or `sliver-server operator --disable-wg` when you need compatibility with external gRPC clients that do not implement the multiplayer WireGuard wrapper.
+- Generate a WireGuard-enabled profile with `new-operator --enable-wg` or `sliver-server operator --enable-wg` when you want the multiplayer WireGuard wrapper.
diff --git a/docs/sliver-docs/pages/docs/md/Custom Clients.md b/docs/sliver-docs/pages/docs/md/Custom Clients.md
@@ -7,7 +7,7 @@ Current Sliver releases generate multiplayer operator configs with a `wg` block
 If you are writing a custom client in another language, you have two options:
 
 - Implement the multiplayer WireGuard wrapper described in [multiplayer mode](/docs?name=Multi-player+Mode), then connect to the in-tunnel gRPC/mTLS service.
-- Keep multiplayer in direct mode by starting the listener with `multiplayer --disable-wg` or `sliver-server daemon --disable-wg`, then generate operator profiles with `new-operator --disable-wg` or `sliver-server operator --disable-wg`.
+- Keep multiplayer in direct mode by default, or explicitly opt into the wrapper with `multiplayer --enable-wg` or `sliver-server daemon --enable-wg`. Generate matching operator profiles with `new-operator --enable-wg` or `sliver-server operator --enable-wg` when you want the client-side WireGuard wrapper.
 
 Once connected, the client/server API is still gRPC, so any language with gRPC support can in theory be used to create a custom client.
 
diff --git a/docs/sliver-docs/pages/docs/md/Daemon Mode.md b/docs/sliver-docs/pages/docs/md/Daemon Mode.md
@@ -15,11 +15,11 @@ If `server.yaml` does not exist, Sliver generates it. If a legacy `server.json`
   - `-l, --lhost` multiplayer listener host
   - `-p, --lport` multiplayer listener port
   - `-t, --tailscale` enable Tailscale listener
-  - `--disable-wg` expose multiplayer directly over mTLS instead of using the default WireGuard wrapper
+  - `--enable-wg` wrap multiplayer in WireGuard instead of exposing it directly over mTLS
   - `-f, --force` force unpack static assets
 - For `sliver-server daemon`, `--lhost` and `--lport` override config values. If omitted, Sliver uses `daemon.host` and `daemon.port` from `server.yaml`.
-- For normal startup (`sliver-server`) with `daemon_mode: true`, Sliver uses `daemon.tailscale` and `daemon.disable_wg` from `server.yaml`.
-- With `--disable-wg` or `daemon.disable_wg: true`, multiplayer falls back to direct TCP mTLS on the configured port.
+- For normal startup (`sliver-server`) with `daemon_mode: true`, Sliver uses `daemon.tailscale` and `daemon.enable_wg` from `server.yaml`.
+- With `--enable-wg` or `daemon.enable_wg: true`, multiplayer is wrapped in WireGuard. Otherwise it stays on direct TCP mTLS.
 
 ### Example Config
 
@@ -29,7 +29,7 @@ daemon:
     host: ""
     port: 31337
     tailscale: false
-    disable_wg: false
+    enable_wg: false
 logs:
     level: 4
     grpc_unary_payloads: false
@@ -49,7 +49,7 @@ Since daemon mode does not provide an interactive server console, generate opera
 ./sliver-server operator --name zer0cool --lhost 1.2.3.4 --permissions all --save zer0cool.cfg
 ```
 
-The `operator` CLI matches the daemon's multiplayer exposure by default. If the daemon is running in direct mode or over Tailscale, the generated config omits the multiplayer `wg` block automatically. You can also force a direct-only profile with `--disable-wg`.
+The `operator` CLI generates direct multiplayer profiles by default. Add `--enable-wg` when the daemon is running with the WireGuard wrapper.
 
 ### Shutdown Behavior
 
diff --git a/docs/sliver-docs/pages/docs/md/Multi-player Mode.md b/docs/sliver-docs/pages/docs/md/Multi-player Mode.md
@@ -1,6 +1,6 @@
 Multiplayer mode allows multiple operators to connect to the same Sliver server and collaborate on engagements. The easiest way to set up a server for multiplayer is to use the [Linux install script](/docs?name=Linux+Install+Script), which configures the server as a systemd service. However, any `sliver-server` binary supports multiplayer mode.
 
-By default, Sliver now protects the operator-facing multiplayer listener with a dedicated WireGuard wrapper. The gRPC/mTLS authentication stack is still used inside the tunnel, but the server no longer exposes the multiplayer gRPC listener directly unless you explicitly opt out with `--disable-wg`.
+Sliver exposes the operator-facing multiplayer listener directly over gRPC/mTLS by default. You can opt into a dedicated WireGuard wrapper with `--enable-wg`; the gRPC/mTLS authentication stack still runs inside that tunnel.
 
 ```
                     ┌──────────────────┐  C2
@@ -53,7 +53,7 @@ From the server, start the multiplayer listener and generate an operator config
 [*] Saved new client config to: /Users/moloch/Desktop/moloch_example.com.cfg
 ```
 
-**IMPORTANT:** Before clients can connect to a server you must start a multiplayer listener with the `multiplayer` command. In the default WireGuard-protected mode the outer listener is UDP/31337. If you disable the wrapper, multiplayer is exposed directly on TCP/31337 instead.
+**IMPORTANT:** Before clients can connect to a server you must start a multiplayer listener with the `multiplayer` command. By default multiplayer is exposed directly on TCP/31337. If you enable the wrapper, the outer listener becomes UDP/31337 and the gRPC/mTLS service stays inside the tunnel.
 
 You can now give this configuration file `moloch_example.com.cfg` to the operator and they can connect to the server using the `sliver-client` binary. The Sliver client will look for configuration files in `~/.sliver-client/configs/` or you can import configs using the `import` CLI. The configs directory can contain multiple configs for different servers.
 
@@ -71,11 +71,11 @@ $ ./sliver-client
 If you want the old behavior, or you need compatibility with third-party gRPC clients that do not implement the multiplayer WireGuard wrapper, disable it on both the listener and the generated operator profile:
 
 ```
-[server] sliver > multiplayer --disable-wg
+[server] sliver > multiplayer
 
 [*] Multiplayer mode enabled!
 
-[server] sliver > new-operator --name tester --lhost 1.2.3.4 --permissions all --disable-wg
+[server] sliver > new-operator --name tester --lhost 1.2.3.4 --permissions all
 
 [*] Generating new client certificate, please wait ...
 [*] Saved new client config to: /Users/tester/Desktop/tester_example.com.cfg
@@ -85,21 +85,21 @@ In direct mode:
 
 - Multiplayer is exposed directly over TCP on `--lport` (default `31337`).
 - Generated operator configs omit the `wg` block.
-- `sliver-client --disable-wg` forces a direct connection even if the config includes a `wg` block.
+- `sliver-client --enable-wg` opts into the multiplayer WireGuard wrapper when the operator config includes a `wg` block.
 
-The listener mode and the operator config need to match. A WireGuard-enabled config cannot talk to a direct listener, and a direct-only client cannot talk to the default WireGuard-wrapped listener.
+The listener mode, operator config, and client flag need to match. A WireGuard-wrapped listener needs a `wg` block in the operator profile plus `sliver-client --enable-wg`. Direct multiplayer works without the `wg` block and without the flag.
 
 ### Server CLI / Daemon Mode Multiplayer
 
-If the server is running in daemon mode, the multiplayer listener is started for you without an interactive console. By default the daemon uses the same WireGuard-protected multiplayer mode described above. You can switch the daemon back to direct exposure with `sliver-server daemon --disable-wg` or `daemon.disable_wg: true` in `server.yaml`.
+If the server is running in daemon mode, the multiplayer listener is started for you without an interactive console. By default the daemon uses direct multiplayer mTLS. You can opt into the WireGuard wrapper with `sliver-server daemon --enable-wg` or `daemon.enable_wg: true` in `server.yaml`.
 
 Use the server CLI to generate operator configuration files:
 
 ```
 ./sliver-server operator --name zer0cool --lhost 1.2.3.4 --permissions all --save zer0cool.cfg
 ```
 
-When daemon mode is configured for direct multiplayer or Tailscale, the CLI automatically omits the `wg` block by default. You can also force a direct-only profile with `--disable-wg`.
+Operator profiles omit the multiplayer `wg` block by default. Add `--enable-wg` when the listener is wrapped in WireGuard.
 
 The installation script places the `sliver-server` binary in `/root` by default.
 
@@ -116,4 +116,4 @@ $ ./sliver-server
 sliver > multiplayer -T
 ```
 
-You should now see a new Tailscale host named `sliver-server-<machine>`. Use that hostname as `--lhost` when generating operator configs for other hosts on the same tailnet. If you generate the operator config before enabling Tailscale multiplayer, add `--disable-wg` explicitly so the profile does not include the multiplayer `wg` block.
+You should now see a new Tailscale host named `sliver-server-<machine>`. Use that hostname as `--lhost` when generating operator configs for other hosts on the same tailnet. Tailscale multiplayer does not use the multiplayer WireGuard wrapper, so operator profiles should be generated without `--enable-wg`.
diff --git a/server/cli/cli.go b/server/cli/cli.go
@@ -52,7 +52,7 @@ const (
 	outputFlagStr      = "output"
 	permissionsFlagStr = "permissions"
 	tailscaleFlagStr   = "tailscale"
-	disableWGFlagStr   = "disable-wg"
+	enableWGFlagStr    = "enable-wg"
 
 	// Cert flags
 	caTypeFlagStr = "type"
@@ -87,7 +87,7 @@ func init() {
 	operatorCmd.Flags().StringP(saveFlagStr, "s", "", "save file to ...")
 	operatorCmd.Flags().StringP(outputFlagStr, "o", "file", "output format (file, stdout)")
 	operatorCmd.Flags().StringSliceP(permissionsFlagStr, "P", []string{}, "grant permissions to the operator profile (all, builder, crackstation)")
-	operatorCmd.Flags().Bool(disableWGFlagStr, false, "omit WireGuard tunnel settings from the generated operator config")
+	operatorCmd.Flags().Bool(enableWGFlagStr, false, "include WireGuard tunnel settings in the generated operator config")
 	rootCmd.AddCommand(operatorCmd)
 
 	// Certs
@@ -104,7 +104,7 @@ func init() {
 	daemonCmd.Flags().Uint16P(lportFlagStr, "p", daemon.BlankPort, "multiplayer listener port")
 	daemonCmd.Flags().BoolP(forceFlagStr, "f", false, "force unpack and overwrite static assets")
 	daemonCmd.Flags().BoolP(tailscaleFlagStr, "t", false, "enable tailscale")
-	daemonCmd.Flags().Bool(disableWGFlagStr, false, "expose multiplayer directly instead of wrapping it in WireGuard")
+	daemonCmd.Flags().Bool(enableWGFlagStr, false, "wrap the multiplayer listener in WireGuard")
 	rootCmd.AddCommand(daemonCmd)
 
 	// Builder
@@ -153,7 +153,7 @@ var rootCmd = &cobra.Command{
 			fmt.Printf("[!] %s\n", err)
 		}
 		if serverConfig.DaemonMode {
-			daemon.Start(daemon.BlankHost, daemon.BlankPort, serverConfig.DaemonConfig.Tailscale, serverConfig.DaemonConfig.DisableWG)
+			daemon.Start(daemon.BlankHost, daemon.BlankPort, serverConfig.DaemonConfig.Tailscale, serverConfig.DaemonConfig.WireGuardEnabled())
 		} else {
 			rcScript, err := clientcli.ReadRCScript(cmd)
 			if err != nil {
diff --git a/server/cli/daemon.go b/server/cli/daemon.go
@@ -47,13 +47,13 @@ var daemonCmd = &cobra.Command{
 			fmt.Printf("Failed to parse --%s flag %s\n", tailscaleFlagStr, err)
 			return
 		}
-		disableWG, err := cmd.Flags().GetBool(disableWGFlagStr)
+		enableWG, err := cmd.Flags().GetBool(enableWGFlagStr)
 		if err != nil {
-			fmt.Printf("Failed to parse --%s flag %s\n", disableWGFlagStr, err)
+			fmt.Printf("Failed to parse --%s flag %s\n", enableWGFlagStr, err)
 			return
 		}
-		if !cmd.Flags().Changed(disableWGFlagStr) {
-			disableWG = configs.GetServerConfig().DaemonConfig.DisableWG
+		if !cmd.Flags().Changed(enableWGFlagStr) {
+			enableWG = configs.GetServerConfig().DaemonConfig.WireGuardEnabled()
 		}
 
 		appDir := assets.GetRootAppDir()
@@ -87,7 +87,7 @@ var daemonCmd = &cobra.Command{
 			fmt.Printf("[!] %s\n", err)
 		}
 
-		daemon.Start(lhost, uint16(lport), tailscale, disableWG)
+		daemon.Start(lhost, uint16(lport), tailscale, enableWG)
 	},
 }
 
diff --git a/server/cli/operator.go b/server/cli/operator.go
@@ -99,14 +99,10 @@ var operatorCmd = &cobra.Command{
 		}
 
 		certs.SetupCAs()
-		includeWG := console.DefaultOperatorWireGuardEnabled()
-		if cmd.Flags().Changed(disableWGFlagStr) {
-			disableWG, err := cmd.Flags().GetBool(disableWGFlagStr)
-			if err != nil {
-				fmt.Printf("Failed to parse --%s flag %s", disableWGFlagStr, err)
-				return
-			}
-			includeWG = !disableWG
+		includeWG, err := cmd.Flags().GetBool(enableWGFlagStr)
+		if err != nil {
+			fmt.Printf("Failed to parse --%s flag %s", enableWGFlagStr, err)
+			return
 		}
 
 		configJSON, err := console.NewOperatorConfig(name, lhost, lport, permissions, includeWG)
diff --git a/server/configs/server.go b/server/configs/server.go
diff --git a/server/configs/server_config_test.go b/server/configs/server_config_test.go
diff --git a/server/console/console-admin.go b/server/console/console-admin.go
diff --git a/server/console/console-admin_wireguard_test.go b/server/console/console-admin_wireguard_test.go
diff --git a/server/console/console.go b/server/console/console.go
diff --git a/server/daemon/daemon.go b/server/daemon/daemon.go

Original file line number	Diff line number	Diff line change
`@@ -6,23 +6,23 @@ import (`
`6`	`6`	`)`
`7`	`7`
`8`	`8`	`const (`
`9`		`- disableWGFlag = "disable-wg"`
	`9`	`+ enableWGFlag = "enable-wg"`
`10`	`10`	`)`
`11`	`11`
`12`	`12`	`func applyMultiplayerConnectMode(cmd *cobra.Command) error {`
`13`	`13`	`if cmd == nil {`
`14`		`- transport.SetMultiplayerConnectMode(transport.MultiplayerConnectAuto)`
	`14`	`+ transport.SetMultiplayerConnectMode(transport.MultiplayerConnectDirect)`
`15`	`15`	`return nil`
`16`	`16`	`}`
`17`	`17`
`18`		`- disableWG, err := cmd.Flags().GetBool(disableWGFlag)`
	`18`	`+ enableWG, err := cmd.Flags().GetBool(enableWGFlag)`
`19`	`19`	`if err != nil {`
`20`	`20`	`return err`
`21`	`21`	`}`
`22`	`22`
`23`		`- mode := transport.MultiplayerConnectAuto`
`24`		`- if disableWG {`
`25`		`- mode = transport.MultiplayerConnectDisableWG`
	`23`	`+ mode := transport.MultiplayerConnectDirect`
	`24`	`+ if enableWG {`
	`25`	`+ mode = transport.MultiplayerConnectEnableWG`
`26`	`26`	`}`
`27`	`27`	`transport.SetMultiplayerConnectMode(mode)`
`28`	`28`	`return nil`
Original file line number	Diff line number	Diff line change
`@@ -105,16 +105,13 @@ func selectMultiplayerDialStrategy(config *assets.ClientConfig) (multiplayerDial`
`105`	`105`	`}`
`106`	`106`
`107`	`107`	`switch getMultiplayerConnectMode() {`
`108`		`- case MultiplayerConnectDisableWG:`
`109`		`- return multiplayerDialDirect, nil`
`110`		`- default:`
`111`		`- if config.WG == nil {`
`112`		`- return multiplayerDialDirect, nil`
`113`		`- }`
	`108`	`+ case MultiplayerConnectEnableWG:`
`114`	`109`	`if err := validateWireGuardConfig(config); err != nil {`
`115`	`110`	`return multiplayerDialDirect, err`
`116`	`111`	`}`
`117`	`112`	`return multiplayerDialWireGuard, nil`
	`113`	`+ default:`
	`114`	`+ return multiplayerDialDirect, nil`
`118`	`115`	`}`
`119`	`116`	`}`
`120`	`117`