mirror of
https://github.com/aramperes/onetun.git
synced 2025-09-09 17:18:31 -04:00
Compare commits
No commits in common. "master" and "v0.2.0" have entirely different histories.
25 changed files with 1625 additions and 2584 deletions
|
|
@ -1,4 +0,0 @@
|
|||
[env]
|
||||
# Each interface needs 1 IP allocated to the WireGuard peer IP.
|
||||
# "8" = 7 tunnels per protocol.
|
||||
SMOLTCP_IFACE_MAX_ADDR_COUNT = "8"
|
||||
6
.github/ci/macos-install-packages
vendored
6
.github/ci/macos-install-packages
vendored
|
|
@ -1,6 +1,6 @@
|
|||
#!/bin/sh
|
||||
|
||||
# brew install asciidoctor
|
||||
brew install asciidoctor
|
||||
|
||||
# brew install openssl@1.1
|
||||
# cp /usr/local/opt/openssl@1.1/lib/pkgconfig/*.pc /usr/local/lib/pkgconfig/
|
||||
brew install openssl@1.1
|
||||
cp /usr/local/opt/openssl@1.1/lib/pkgconfig/*.pc /usr/local/lib/pkgconfig/
|
||||
|
|
|
|||
10
.github/dependabot.yml
vendored
10
.github/dependabot.yml
vendored
|
|
@ -1,10 +0,0 @@
|
|||
# Please see the documentation for all configuration options:
|
||||
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
|
||||
|
||||
version: 2
|
||||
updates:
|
||||
- package-ecosystem: "cargo"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "weekly"
|
||||
rebase-strategy: "disabled"
|
||||
10
.github/workflows/build.yml
vendored
10
.github/workflows/build.yml
vendored
|
|
@ -10,7 +10,7 @@ jobs:
|
|||
matrix:
|
||||
rust:
|
||||
- stable
|
||||
- 1.80.0
|
||||
- 1.55.0
|
||||
steps:
|
||||
- name: Checkout sources
|
||||
uses: actions/checkout@v2
|
||||
|
|
@ -26,12 +26,6 @@ jobs:
|
|||
with:
|
||||
command: check
|
||||
|
||||
- name: Run cargo check without default features
|
||||
uses: actions-rs/cargo@v1
|
||||
with:
|
||||
command: check
|
||||
args: --no-default-features
|
||||
|
||||
test:
|
||||
name: Test Suite
|
||||
runs-on: ubuntu-latest
|
||||
|
|
@ -39,7 +33,7 @@ jobs:
|
|||
matrix:
|
||||
rust:
|
||||
- stable
|
||||
- 1.80.0
|
||||
- 1.55.0
|
||||
steps:
|
||||
- name: Checkout sources
|
||||
uses: actions/checkout@v2
|
||||
|
|
|
|||
35
.github/workflows/release.yml
vendored
35
.github/workflows/release.yml
vendored
|
|
@ -61,7 +61,7 @@ jobs:
|
|||
run: echo "${{ env.VERSION }}" > artifacts/release-version
|
||||
|
||||
- name: Upload artifacts
|
||||
uses: actions/upload-artifact@v4
|
||||
uses: actions/upload-artifact@v1
|
||||
with:
|
||||
name: artifacts
|
||||
path: artifacts
|
||||
|
|
@ -75,28 +75,20 @@ jobs:
|
|||
RUST_BACKTRACE: 1
|
||||
strategy:
|
||||
matrix:
|
||||
build: [ linux-amd64, linux-aarch64, macos-aarch64, windows ]
|
||||
build: [ linux-amd64, macos-intel, windows ]
|
||||
include:
|
||||
- build: linux-amd64
|
||||
os: ubuntu-latest
|
||||
os: ubuntu-18.04
|
||||
rust: stable
|
||||
target: x86_64-unknown-linux-musl
|
||||
cross: true
|
||||
- build: linux-aarch64
|
||||
os: ubuntu-latest
|
||||
rust: stable
|
||||
target: aarch64-unknown-linux-musl
|
||||
cross: true
|
||||
- build: macos-aarch64
|
||||
- build: macos-intel
|
||||
os: macos-latest
|
||||
rust: stable
|
||||
target: aarch64-apple-darwin
|
||||
cross: false
|
||||
target: x86_64-apple-darwin
|
||||
- build: windows
|
||||
os: windows-2019
|
||||
rust: stable
|
||||
target: x86_64-pc-windows-msvc
|
||||
cross: false
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
|
|
@ -105,7 +97,7 @@ jobs:
|
|||
fetch-depth: 1
|
||||
|
||||
- name: Install packages (Ubuntu)
|
||||
if: matrix.os == 'ubuntu-latest'
|
||||
if: matrix.os == 'ubuntu-18.04'
|
||||
run: |
|
||||
.github/ci/ubuntu-install-packages
|
||||
- name: Install packages (macOS)
|
||||
|
|
@ -121,7 +113,7 @@ jobs:
|
|||
target: ${{ matrix.target }}
|
||||
|
||||
- name: Get release download URL
|
||||
uses: actions/download-artifact@v4
|
||||
uses: actions/download-artifact@v1
|
||||
with:
|
||||
name: artifacts
|
||||
path: artifacts
|
||||
|
|
@ -134,24 +126,17 @@ jobs:
|
|||
echo "release upload url: $release_upload_url"
|
||||
|
||||
- name: Build onetun binary
|
||||
shell: bash
|
||||
run: |
|
||||
if [ "${{ matrix.cross }}" = "true" ]; then
|
||||
cargo install cross
|
||||
cross build --release --target ${{ matrix.target }}
|
||||
else
|
||||
cargo build --release --target ${{ matrix.target }}
|
||||
fi
|
||||
run: cargo build --release
|
||||
|
||||
- name: Prepare onetun binary
|
||||
shell: bash
|
||||
run: |
|
||||
mkdir -p ci/assets
|
||||
if [ "${{ matrix.build }}" = "windows" ]; then
|
||||
cp "target/${{ matrix.target }}/release/onetun.exe" "ci/assets/onetun.exe"
|
||||
cp "target/release/onetun.exe" "ci/assets/onetun.exe"
|
||||
echo "ASSET=onetun.exe" >> $GITHUB_ENV
|
||||
else
|
||||
cp "target/${{ matrix.target }}/release/onetun" "ci/assets/onetun-${{ matrix.build }}"
|
||||
cp "target/release/onetun" "ci/assets/onetun-${{ matrix.build }}"
|
||||
echo "ASSET=onetun-${{ matrix.build }}" >> $GITHUB_ENV
|
||||
fi
|
||||
|
||||
|
|
|
|||
2
.gitignore
vendored
2
.gitignore
vendored
|
|
@ -2,5 +2,3 @@
|
|||
/.idea
|
||||
.envrc
|
||||
*.log
|
||||
*.pcap
|
||||
.DS_Store
|
||||
|
|
|
|||
1259
Cargo.lock
generated
1259
Cargo.lock
generated
File diff suppressed because it is too large
Load diff
51
Cargo.toml
51
Cargo.toml
|
|
@ -1,48 +1,21 @@
|
|||
[package]
|
||||
name = "onetun"
|
||||
version = "0.3.10"
|
||||
edition = "2021"
|
||||
license = "MIT"
|
||||
description = "A cross-platform, user-space WireGuard port-forwarder that requires no system network configurations."
|
||||
authors = ["Aram Peres <aram.peres@gmail.com>"]
|
||||
repository = "https://github.com/aramperes/onetun"
|
||||
version = "0.2.0"
|
||||
edition = "2018"
|
||||
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
[dependencies]
|
||||
# Required dependencies (bin and lib)
|
||||
boringtun = { version = "0.6.0", default-features = false }
|
||||
boringtun = { git = "https://github.com/cloudflare/boringtun", branch = "master" }
|
||||
clap = { version = "2.33", default-features = false, features = ["suggestions"] }
|
||||
log = "0.4"
|
||||
pretty_env_logger = "0.3"
|
||||
anyhow = "1"
|
||||
tokio = { version = "1", features = [ "rt", "sync", "io-util", "net", "time", "fs", "macros" ] }
|
||||
futures = "0.3"
|
||||
rand = "0.8"
|
||||
smoltcp = { git = "https://github.com/smoltcp-rs/smoltcp", branch = "master" }
|
||||
tokio = { version = "1", features = ["full"] }
|
||||
futures = "0.3.17"
|
||||
rand = "0.8.4"
|
||||
nom = "7"
|
||||
async-trait = "0.1"
|
||||
priority-queue = "2.1"
|
||||
smoltcp = { version = "0.12", default-features = false, features = [
|
||||
"std",
|
||||
"log",
|
||||
"medium-ip",
|
||||
"proto-ipv4",
|
||||
"proto-ipv6",
|
||||
"socket-udp",
|
||||
"socket-tcp",
|
||||
] }
|
||||
bytes = "1"
|
||||
base64 = "0.13"
|
||||
|
||||
# forward boringtuns tracing events to log
|
||||
tracing = { version = "0.1", default-features = false, features = ["log"] }
|
||||
|
||||
# bin-only dependencies
|
||||
clap = { version = "4.4.11", default-features = false, features = ["suggestions", "std", "env", "help", "wrap_help"], optional = true }
|
||||
pretty_env_logger = { version = "0.5", optional = true }
|
||||
async-recursion = "1.0"
|
||||
|
||||
[features]
|
||||
pcap = []
|
||||
default = [ "bin" ]
|
||||
bin = [ "clap", "pretty_env_logger", "pcap", "tokio/rt-multi-thread" ]
|
||||
|
||||
[lib]
|
||||
async-trait = "0.1.51"
|
||||
dashmap = "4.0.2"
|
||||
priority-queue = "1.2.0"
|
||||
|
|
|
|||
|
|
@ -1,11 +1,10 @@
|
|||
FROM rust:1.82.0 as cargo-build
|
||||
FROM rust:1.55 as cargo-build
|
||||
|
||||
WORKDIR /usr/src/onetun
|
||||
COPY Cargo.toml Cargo.toml
|
||||
|
||||
# Placeholder to download dependencies and cache them using layering
|
||||
RUN mkdir src/
|
||||
RUN touch src/lib.rs
|
||||
RUN echo "fn main() {println!(\"if you see this, the build broke\")}" > src/main.rs
|
||||
RUN cargo build --release
|
||||
RUN rm -f target/x86_64-unknown-linux-musl/release/deps/myapp*
|
||||
|
|
@ -15,9 +14,8 @@ COPY . .
|
|||
RUN cargo build --release
|
||||
|
||||
FROM debian:11-slim
|
||||
RUN apt-get update \
|
||||
&& apt-get install dumb-init -y \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
RUN apt-get update
|
||||
RUN apt-get install dumb-init -y
|
||||
|
||||
COPY --from=cargo-build /usr/src/onetun/target/release/onetun /usr/local/bin/onetun
|
||||
|
||||
|
|
|
|||
2
LICENSE
2
LICENSE
|
|
@ -1,6 +1,6 @@
|
|||
MIT License
|
||||
|
||||
Copyright (c) 2025 Aram Peres
|
||||
Copyright (c) 2021 Aram Peres
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
|
|
|
|||
206
README.md
206
README.md
|
|
@ -2,66 +2,38 @@
|
|||
|
||||
# onetun
|
||||
|
||||
A cross-platform, user-space WireGuard port-forwarder that requires **no root-access or system network configurations**.
|
||||
A cross-platform, user-space WireGuard port-forwarder that requires no system network configurations.
|
||||
|
||||
[](https://crates.io/crates/onetun)
|
||||
[](./LICENSE)
|
||||
[](https://github.com/aramperes/onetun/actions)
|
||||
[](https://github.com/aramperes/onetun/releases/latest)
|
||||
|
||||
## Use-case
|
||||
|
||||
Access TCP or UDP services running on your WireGuard network, from devices that don't have WireGuard installed.
|
||||
- You have an existing WireGuard endpoint (router), accessible using its UDP endpoint (typically port 51820); and
|
||||
- You have a peer on the WireGuard network, running a TCP or UDP service on a port accessible to the WireGuard network; and
|
||||
- You want to access this TCP or UDP service from a second computer, on which you can't install WireGuard because you
|
||||
can't (no root access) or don't want to (polluting OS configs).
|
||||
|
||||
For example,
|
||||
|
||||
- Personal or shared computers where you can't install WireGuard (root)
|
||||
- IoT and mobile devices
|
||||
- Root-less containers
|
||||
|
||||
## Download
|
||||
|
||||
onetun is available to install from [crates.io](https://crates.io/crates/onetun) with Rust ≥1.80.0:
|
||||
|
||||
```shell
|
||||
cargo install onetun
|
||||
```
|
||||
|
||||
You can also download the binary for Windows, macOS (Apple Silicon), and Linux (amd64, arm64) from
|
||||
the [Releases](https://github.com/aramperes/onetun/releases) page.
|
||||
|
||||
You can also run onetun using [Docker](https://hub.docker.com/r/aramperes/onetun):
|
||||
|
||||
```shell
|
||||
docker run --rm --name onetun --user 1000 -p 8080:8080 aramperes/onetun \
|
||||
0.0.0.0:8080:192.168.4.2:8080 [...options...]
|
||||
```
|
||||
|
||||
You can also build onetun locally, using Rust ≥1.80.0:
|
||||
|
||||
```shell
|
||||
git clone https://github.com/aramperes/onetun && cd onetun
|
||||
cargo build --release
|
||||
./target/release/onetun
|
||||
```
|
||||
For example, this can be useful to forward a port from a Kubernetes cluster to a server behind WireGuard,
|
||||
without needing to install WireGuard in a Pod.
|
||||
|
||||
## Usage
|
||||
|
||||
**onetun** opens a TCP or UDP port on your local system, from which traffic is forwarded to a port on a peer in your
|
||||
**onetun** opens a TCP or UDP port on your local system, from which traffic is forwarded to a TCP port on a peer in your
|
||||
WireGuard network. It requires no changes to your operating system's network interfaces: you don't need to have `root`
|
||||
access, or install any WireGuard tool on your local system for it to work.
|
||||
|
||||
The only prerequisite is to register a peer IP and public key on the remote WireGuard endpoint; those are necessary for
|
||||
the WireGuard endpoint to trust the onetun peer and for packets to be routed.
|
||||
|
||||
```shell
|
||||
onetun [src_host:]<src_port>:<dst_host>:<dst_port>[:TCP,UDP,...] [...] \
|
||||
```
|
||||
./onetun [src_host:]<src_port>:<dst_host>:<dst_port>[:TCP,UDP,...] [...] \
|
||||
--endpoint-addr <public WireGuard endpoint address> \
|
||||
--endpoint-public-key <the public key of the peer on the endpoint> \
|
||||
--private-key <private key assigned to onetun> \
|
||||
--source-peer-ip <IP assigned to onetun> \
|
||||
--keep-alive <optional persistent keep-alive in seconds> \
|
||||
--log <optional log level, defaults to "info">
|
||||
--log <optional log level, defaults to "info"
|
||||
```
|
||||
|
||||
> Note: you can use environment variables for all of these flags. Use `onetun --help` for details.
|
||||
|
|
@ -70,7 +42,7 @@ onetun [src_host:]<src_port>:<dst_host>:<dst_port>[:TCP,UDP,...] [...] \
|
|||
|
||||
Suppose your WireGuard endpoint has the following configuration, and is accessible from `140.30.3.182:51820`:
|
||||
|
||||
```shell
|
||||
```
|
||||
# /etc/wireguard/wg0.conf
|
||||
|
||||
[Interface]
|
||||
|
|
@ -93,7 +65,7 @@ We want to access a web server on the friendly peer (`192.168.4.2`) on port `808
|
|||
local port, say `127.0.0.1:8080`, that will tunnel through WireGuard to reach the peer web server:
|
||||
|
||||
```shell
|
||||
onetun 127.0.0.1:8080:192.168.4.2:8080 \
|
||||
./onetun 127.0.0.1:8080:192.168.4.2:8080 \
|
||||
--endpoint-addr 140.30.3.182:51820 \
|
||||
--endpoint-public-key 'PUB_****************************************' \
|
||||
--private-key 'PRIV_BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB' \
|
||||
|
|
@ -103,14 +75,14 @@ onetun 127.0.0.1:8080:192.168.4.2:8080 \
|
|||
|
||||
You'll then see this log:
|
||||
|
||||
```shell
|
||||
```
|
||||
INFO onetun > Tunneling TCP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
|
||||
```
|
||||
|
||||
Which means you can now access the port locally!
|
||||
|
||||
```shell
|
||||
curl 127.0.0.1:8080
|
||||
```
|
||||
$ curl 127.0.0.1:8080
|
||||
Hello world!
|
||||
```
|
||||
|
||||
|
|
@ -118,32 +90,24 @@ Hello world!
|
|||
|
||||
**onetun** supports running multiple tunnels in parallel. For example:
|
||||
|
||||
```shell
|
||||
onetun 127.0.0.1:8080:192.168.4.2:8080 127.0.0.1:8081:192.168.4.4:8081
|
||||
```
|
||||
$ ./onetun 127.0.0.1:8080:192.168.4.2:8080 127.0.0.1:8081:192.168.4.4:8081
|
||||
INFO onetun::tunnel > Tunneling TCP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
|
||||
INFO onetun::tunnel > Tunneling TCP [127.0.0.1:8081]->[192.168.4.4:8081] (via [140.30.3.182:51820] as peer 192.168.4.3)
|
||||
```
|
||||
|
||||
... would open TCP ports 8080 and 8081 locally, which forward to their respective ports on the different peers.
|
||||
|
||||
#### Maximum number of tunnels
|
||||
|
||||
`smoltcp` imposes a compile-time limit on the number of IP addresses assigned to an interface. **onetun** increases
|
||||
the default value to support most use-cases. In effect, the default limit on the number of **onetun** peers
|
||||
is **7 per protocol** (TCP and UDP).
|
||||
|
||||
Should you need more unique IP addresses to forward ports to, you can increase the limit in `.cargo/config.toml` and recompile **onetun**.
|
||||
|
||||
### UDP Support
|
||||
|
||||
**onetun** supports UDP forwarding. You can add `:UDP` at the end of the port-forward configuration, or `UDP,TCP` to support
|
||||
both protocols on the same port (note that this opens 2 separate tunnels, just on the same port)
|
||||
|
||||
```shell
|
||||
onetun 127.0.0.1:8080:192.168.4.2:8080:UDP
|
||||
```
|
||||
$ ./onetun 127.0.0.1:8080:192.168.4.2:8080:UDP
|
||||
INFO onetun::tunnel > Tunneling UDP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
|
||||
|
||||
onetun 127.0.0.1:8080:192.168.4.2:8080:UDP,TCP
|
||||
$ ./onetun 127.0.0.1:8080:192.168.4.2:8080:UDP,TCP
|
||||
INFO onetun::tunnel > Tunneling UDP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
|
||||
INFO onetun::tunnel > Tunneling TCP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
|
||||
```
|
||||
|
|
@ -155,77 +119,61 @@ it in any production capacity.
|
|||
|
||||
**onetun** supports both IPv4 and IPv6. In fact, you can use onetun to forward some IP version to another, e.g. 6-to-4:
|
||||
|
||||
```shell
|
||||
onetun [::1]:8080:192.168.4.2:8080
|
||||
```
|
||||
$ ./onetun [::1]:8080:192.168.4.2:8080
|
||||
INFO onetun::tunnel > Tunneling TCP [[::1]:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
|
||||
```
|
||||
|
||||
Note that each tunnel can only support one "source" IP version and one "destination" IP version. If you want to support
|
||||
both IPv4 and IPv6 on the same port, you should create a second port-forward:
|
||||
|
||||
```shell
|
||||
onetun [::1]:8080:192.168.4.2:8080 127.0.0.1:8080:192.168.4.2:8080
|
||||
```
|
||||
$ ./onetun [::1]:8080:192.168.4.2:8080 127.0.0.1:8080:192.168.4.2:8080
|
||||
INFO onetun::tunnel > Tunneling TCP [[::1]:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
|
||||
INFO onetun::tunnel > Tunneling TCP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
|
||||
```
|
||||
|
||||
### Packet Capture
|
||||
## Download
|
||||
|
||||
For debugging purposes, you can enable the capture of IP packets sent between onetun and the WireGuard peer.
|
||||
The output is a libpcap capture file that can be viewed with Wireshark.
|
||||
Normally I would publish `onetun` to crates.io. However, it depends on some features
|
||||
in [smoltcp](https://github.com/smoltcp-rs/smoltcp) and
|
||||
[boringtun](https://github.com/cloudflare/boringtun) that haven't been published yet, so I'm forced to use their Git
|
||||
repos as dependencies for now.
|
||||
|
||||
In the meantime, you can download the binary for Windows, macOS (Intel), and Linux (amd64) from
|
||||
the [Releases](https://github.com/aramperes/onetun/releases) page.
|
||||
|
||||
You can also run onetun using [Docker](https://hub.docker.com/r/aramperes/onetun):
|
||||
|
||||
```shell
|
||||
onetun --pcap wg.pcap 127.0.0.1:8080:192.168.4.2:8080
|
||||
INFO onetun::pcap > Capturing WireGuard IP packets to wg.pcap
|
||||
INFO onetun::tunnel > Tunneling TCP [127.0.0.1:8080]->[192.168.4.2:8080] (via [140.30.3.182:51820] as peer 192.168.4.3)
|
||||
docker run --rm --name onetun --user 1000 -p 8080:8080 aramperes/onetun \
|
||||
0.0.0.0:8080 192.168.4.2:8080 [...options...]
|
||||
```
|
||||
|
||||
To capture packets sent to and from the onetun local port, you must use an external tool like `tcpdump` with root access:
|
||||
You can also build onetun locally, using Rust:
|
||||
|
||||
```shell
|
||||
sudo tcpdump -i lo -w local.pcap 'dst 127.0.0.1 && port 8080'
|
||||
```
|
||||
|
||||
### WireGuard Options
|
||||
|
||||
By default, onetun will create the UDP socket to communicate with the WireGuard endpoint on all interfaces and on a dynamic port,
|
||||
i.e. `0.0.0.0:0` for IPv4 endpoints, or `[::]:0` for IPv6.
|
||||
You can bind to a static address instead using `--endpoint-bind-addr`:
|
||||
|
||||
```shell
|
||||
onetun --endpoint-bind-addr 0.0.0.0:51820 --endpoint-addr 140.30.3.182:51820 [...]
|
||||
```
|
||||
|
||||
The security of the WireGuard connection can be further enhanced with a **pre-shared key** (PSK). You can generate such a key with the `wg genpsk` command, and provide it using `--preshared-key`.
|
||||
The peer must also have this key configured using the `PresharedKey` option.
|
||||
|
||||
```shell
|
||||
onetun --preshared-key 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' [...]
|
||||
$ git clone https://github.com/aramperes/onetun && cd onetun
|
||||
$ cargo build --release
|
||||
$ ./target/release/onetun
|
||||
```
|
||||
|
||||
## Architecture
|
||||
|
||||
**In short:** onetun uses [smoltcp's](https://github.com/smoltcp-rs/smoltcp) TCP/IP and UDP stack to generate IP packets
|
||||
using its state machine ("virtual interface"). The generated IP packets are
|
||||
encrypted by [boringtun](https://github.com/cloudflare/boringtun) and sent to the WireGuard endpoint. Encrypted IP packets received
|
||||
from the WireGuard endpoint are decrypted using boringtun and sent through the smoltcp virtual interface state machine.
|
||||
onetun creates "virtual sockets" in the virtual interface to forward data sent from inbound connections,
|
||||
as well as to receive data from the virtual interface to forward back to the local client.
|
||||
|
||||
---
|
||||
|
||||
onetun uses [tokio](https://github.com/tokio-rs/tokio), the async runtime, to listen for new TCP connections on the
|
||||
given port.
|
||||
|
||||
When a client connects to the onetun's TCP port, a "virtual client" is
|
||||
created in a [smoltcp](https://github.com/smoltcp-rs/smoltcp) "virtual" TCP/IP interface, which runs fully inside the onetun
|
||||
process. An ephemeral "virtual port" is assigned to the "virtual client", which maps back to the local client.
|
||||
When a client connects to the local TCP port, it uses [smoltcp](https://github.com/smoltcp-rs/smoltcp) to
|
||||
create a "virtual interface", with a "virtual client" and a "virtual server" for the connection. These "virtual"
|
||||
components are the crux of how onetun works. They essentially replace the host's TCP/IP stack with smoltcp's, which
|
||||
fully runs inside onetun. An ephemeral "virtual port" is also assigned to the connection, in order to route packets
|
||||
back to the right connection.
|
||||
|
||||
When the real client opens the connection, the virtual client socket opens a TCP connection to the virtual server
|
||||
(a dummy socket bound to the remote host/port). The virtual interface in turn crafts the `SYN` segment and wraps it in an IP packet.
|
||||
When the real client opens the connection, the virtual client socket opens a TCP connection to the virtual server.
|
||||
The virtual interface (implemented by smoltcp) in turn crafts the `SYN` segment and wraps it in an IP packet.
|
||||
Because of how the virtual client and server are configured, the IP packet is crafted with a source address
|
||||
being the configured `source-peer-ip` (`192.168.4.3` in the example above),
|
||||
and the destination address matches the port-forward's configured destination (`192.168.4.2`).
|
||||
and the destination address is the remote peer's (`192.168.4.2`).
|
||||
|
||||
By doing this, we let smoltcp handle the crafting of the IP packets, and the handling of the client's TCP states.
|
||||
Instead of actually sending those packets to the virtual server,
|
||||
|
|
@ -236,8 +184,8 @@ Once the WireGuard endpoint receives an encrypted IP packet, it decrypts it usin
|
|||
It reads the destination address, re-encrypts the IP packet using the matching peer's public key, and sends it off to
|
||||
the peer's UDP endpoint.
|
||||
|
||||
The peer receives the encrypted IP and decrypts it. It can then read the inner payload (the TCP segment),
|
||||
forward it to the server's port, which handles the TCP segment. The TCP server responds with `SYN-ACK`, which goes back through
|
||||
The remote peer receives the encrypted IP and decrypts it. It can then read the inner payload (the TCP segment),
|
||||
forward it to the server's port, which handles the TCP segment. The server responds with `SYN-ACK`, which goes back through
|
||||
the peer's local WireGuard interface, gets encrypted, forwarded to the WireGuard endpoint, and then finally back to onetun's UDP port.
|
||||
|
||||
When onetun receives an encrypted packet from the WireGuard endpoint, it decrypts it using boringtun.
|
||||
|
|
@ -267,56 +215,6 @@ if the least recently used port hasn't been used for a certain amount of time. I
|
|||
|
||||
All in all, I would not recommend using UDP forwarding for public services, since it's most likely prone to simple DoS or DDoS.
|
||||
|
||||
## HTTP/SOCKS Proxy
|
||||
|
||||
**onetun** is a Transport-layer proxy (also known as port forwarding); it is not in scope to provide
|
||||
a HTTP/SOCKS proxy server. However, you can easily chain **onetun** with a proxy server on a remote
|
||||
that is locked down to your WireGuard network.
|
||||
|
||||
For example, you could run [dante-server](https://www.inet.no/dante/) on a peer (ex. `192.168.4.2`) with the following configuration:
|
||||
|
||||
```
|
||||
# /etc/danted.conf
|
||||
|
||||
logoutput: syslog
|
||||
user.privileged: root
|
||||
user.unprivileged: nobody
|
||||
|
||||
internal: 192.168.4.2 port=1080
|
||||
external: eth0
|
||||
|
||||
socksmethod: none
|
||||
clientmethod: none
|
||||
|
||||
# Locks down proxy use to WireGuard peers (192.168.4.x)
|
||||
client pass {
|
||||
from: 192.168.4.0/24 to: 0.0.0.0/0
|
||||
}
|
||||
socks pass {
|
||||
from: 192.168.4.0/24 to: 0.0.0.0/0
|
||||
}
|
||||
```
|
||||
|
||||
Then use **onetun** to expose the SOCKS5 proxy locally:
|
||||
|
||||
```shell
|
||||
onetun 127.0.0.1:1080:192.168.4.2:1080
|
||||
INFO onetun::tunnel > Tunneling TCP [127.0.0.1:1080]->[192.168.4.2:1080] (via [140.30.3.182:51820] as peer 192.168.4.3)
|
||||
```
|
||||
|
||||
Test with `curl` (or configure your browser):
|
||||
|
||||
```shell
|
||||
curl -x socks5://127.0.0.1:1080 https://ifconfig.me
|
||||
```
|
||||
|
||||
## Contributing and Maintenance
|
||||
|
||||
I will gladly accept contributions to onetun, and set aside time to review all pull-requests.
|
||||
Please consider opening a GitHub issue if you are unsure if your contribution is within the scope of the project.
|
||||
|
||||
**Disclaimer**: I do not have enough personal time to actively maintain onetun besides open-source contributions.
|
||||
|
||||
## License
|
||||
|
||||
MIT License. See `LICENSE` for details. Copyright © 2025 Aram Peres.
|
||||
MIT. See `LICENSE` for details.
|
||||
|
|
|
|||
451
src/config.rs
451
src/config.rs
|
|
@ -1,47 +1,34 @@
|
|||
use std::collections::HashSet;
|
||||
use std::convert::TryFrom;
|
||||
use std::fmt::{Display, Formatter};
|
||||
use std::fs::read_to_string;
|
||||
use std::net::{IpAddr, SocketAddr, ToSocketAddrs};
|
||||
use std::sync::Arc;
|
||||
|
||||
use anyhow::{bail, Context};
|
||||
pub use boringtun::x25519::{PublicKey, StaticSecret};
|
||||
use anyhow::Context;
|
||||
use boringtun::crypto::{X25519PublicKey, X25519SecretKey};
|
||||
use clap::{App, Arg};
|
||||
|
||||
const DEFAULT_PORT_FORWARD_SOURCE: &str = "127.0.0.1";
|
||||
|
||||
#[derive(Clone)]
|
||||
#[derive(Clone, Debug)]
|
||||
pub struct Config {
|
||||
pub port_forwards: Vec<PortForwardConfig>,
|
||||
#[allow(dead_code)]
|
||||
pub remote_port_forwards: Vec<PortForwardConfig>,
|
||||
pub private_key: Arc<StaticSecret>,
|
||||
pub endpoint_public_key: Arc<PublicKey>,
|
||||
pub preshared_key: Option<[u8; 32]>,
|
||||
pub endpoint_addr: SocketAddr,
|
||||
pub endpoint_bind_addr: SocketAddr,
|
||||
pub source_peer_ip: IpAddr,
|
||||
pub keepalive_seconds: Option<u16>,
|
||||
pub max_transmission_unit: usize,
|
||||
pub log: String,
|
||||
pub warnings: Vec<String>,
|
||||
pub pcap_file: Option<String>,
|
||||
pub(crate) port_forwards: Vec<PortForwardConfig>,
|
||||
pub(crate) private_key: Arc<X25519SecretKey>,
|
||||
pub(crate) endpoint_public_key: Arc<X25519PublicKey>,
|
||||
pub(crate) endpoint_addr: SocketAddr,
|
||||
pub(crate) source_peer_ip: IpAddr,
|
||||
pub(crate) keepalive_seconds: Option<u16>,
|
||||
pub(crate) log: String,
|
||||
}
|
||||
|
||||
impl Config {
|
||||
#[cfg(feature = "bin")]
|
||||
pub fn from_args() -> anyhow::Result<Self> {
|
||||
use clap::{Arg, Command};
|
||||
|
||||
let mut warnings = vec![];
|
||||
|
||||
let matches = Command::new("onetun")
|
||||
let matches = App::new("onetun")
|
||||
.author("Aram Peres <aram.peres@gmail.com>")
|
||||
.version(env!("CARGO_PKG_VERSION"))
|
||||
.args(&[
|
||||
Arg::new("PORT_FORWARD")
|
||||
Arg::with_name("PORT_FORWARD")
|
||||
.required(false)
|
||||
.num_args(1..)
|
||||
.multiple(true)
|
||||
.takes_value(true)
|
||||
.help("Port forward configurations. The format of each argument is [src_host:]<src_port>:<dst_host>:<dst_port>[:TCP,UDP,...], \
|
||||
where [src_host] is the local IP to listen on, <src_port> is the local port to listen on, <dst_host> is the remote peer IP to forward to, and <dst_port> is the remote port to forward to. \
|
||||
Environment variables of the form 'ONETUN_PORT_FORWARD_[#]' are also accepted, where [#] starts at 1.\n\
|
||||
|
|
@ -55,94 +42,48 @@ impl Config {
|
|||
\tlocalhost:8080:192.168.4.1:8081:TCP\n\
|
||||
\tlocalhost:8080:peer.intranet:8081:TCP\
|
||||
"),
|
||||
Arg::new("private-key")
|
||||
.conflicts_with("private-key-file")
|
||||
.num_args(1)
|
||||
Arg::with_name("private-key")
|
||||
.required(true)
|
||||
.takes_value(true)
|
||||
.long("private-key")
|
||||
.env("ONETUN_PRIVATE_KEY")
|
||||
.help("The private key of this peer. The corresponding public key should be registered in the WireGuard endpoint. \
|
||||
You can also use '--private-key-file' to specify a file containing the key instead."),
|
||||
Arg::new("private-key-file")
|
||||
.num_args(1)
|
||||
.long("private-key-file")
|
||||
.env("ONETUN_PRIVATE_KEY_FILE")
|
||||
.help("The path to a file containing the private key of this peer. The corresponding public key should be registered in the WireGuard endpoint."),
|
||||
Arg::new("endpoint-public-key")
|
||||
.help("The private key of this peer. The corresponding public key should be registered in the Wireguard endpoint."),
|
||||
Arg::with_name("endpoint-public-key")
|
||||
.required(true)
|
||||
.num_args(1)
|
||||
.takes_value(true)
|
||||
.long("endpoint-public-key")
|
||||
.env("ONETUN_ENDPOINT_PUBLIC_KEY")
|
||||
.help("The public key of the WireGuard endpoint (remote)."),
|
||||
Arg::new("preshared-key")
|
||||
.required(false)
|
||||
.num_args(1)
|
||||
.long("preshared-key")
|
||||
.env("ONETUN_PRESHARED_KEY")
|
||||
.help("The pre-shared key (PSK) as configured with the peer."),
|
||||
Arg::new("endpoint-addr")
|
||||
.help("The public key of the Wireguard endpoint (remote)."),
|
||||
Arg::with_name("endpoint-addr")
|
||||
.required(true)
|
||||
.num_args(1)
|
||||
.takes_value(true)
|
||||
.long("endpoint-addr")
|
||||
.env("ONETUN_ENDPOINT_ADDR")
|
||||
.help("The address (IP + port) of the WireGuard endpoint (remote). Example: 1.2.3.4:51820"),
|
||||
Arg::new("endpoint-bind-addr")
|
||||
.required(false)
|
||||
.num_args(1)
|
||||
.long("endpoint-bind-addr")
|
||||
.env("ONETUN_ENDPOINT_BIND_ADDR")
|
||||
.help("The address (IP + port) used to bind the local UDP socket for the WireGuard tunnel. Example: 1.2.3.4:30000. Defaults to 0.0.0.0:0 for IPv4 endpoints, or [::]:0 for IPv6 endpoints."),
|
||||
Arg::new("source-peer-ip")
|
||||
.help("The address (IP + port) of the Wireguard endpoint (remote). Example: 1.2.3.4:51820"),
|
||||
Arg::with_name("source-peer-ip")
|
||||
.required(true)
|
||||
.num_args(1)
|
||||
.takes_value(true)
|
||||
.long("source-peer-ip")
|
||||
.env("ONETUN_SOURCE_PEER_IP")
|
||||
.help("The source IP to identify this peer as (local). Example: 192.168.4.3"),
|
||||
Arg::new("keep-alive")
|
||||
Arg::with_name("keep-alive")
|
||||
.required(false)
|
||||
.num_args(1)
|
||||
.takes_value(true)
|
||||
.long("keep-alive")
|
||||
.env("ONETUN_KEEP_ALIVE")
|
||||
.help("Configures a persistent keep-alive for the WireGuard tunnel, in seconds."),
|
||||
Arg::new("max-transmission-unit")
|
||||
Arg::with_name("log")
|
||||
.required(false)
|
||||
.num_args(1)
|
||||
.long("max-transmission-unit")
|
||||
.env("ONETUN_MTU")
|
||||
.default_value("1420")
|
||||
.help("Configures the max-transmission-unit (MTU) of the WireGuard tunnel."),
|
||||
Arg::new("log")
|
||||
.required(false)
|
||||
.num_args(1)
|
||||
.takes_value(true)
|
||||
.long("log")
|
||||
.env("ONETUN_LOG")
|
||||
.default_value("info")
|
||||
.help("Configures the log level and format."),
|
||||
Arg::new("pcap")
|
||||
.required(false)
|
||||
.num_args(1)
|
||||
.long("pcap")
|
||||
.env("ONETUN_PCAP")
|
||||
.help("Decrypts and captures IP packets on the WireGuard tunnel to a given output file."),
|
||||
Arg::new("remote")
|
||||
.required(false)
|
||||
.num_args(1..)
|
||||
.long("remote")
|
||||
.short('r')
|
||||
.help("Remote port forward configurations. The format of each argument is <src_port>:<dst_host>:<dst_port>[:TCP,UDP,...], \
|
||||
where <src_port> is the port the other peers will reach the server with, <dst_host> is the IP to forward to, and <dst_port> is the port to forward to. \
|
||||
The <src_port> will be bound on onetun's peer IP, as specified by --source-peer-ip. If you pass a different value for <src_host> here, it will be rejected.\n\
|
||||
Note: <dst_host>:<dst_port> must be reachable by onetun. If referring to another WireGuard peer, use --bridge instead (not supported yet).\n\
|
||||
Environment variables of the form 'ONETUN_REMOTE_PORT_FORWARD_[#]' are also accepted, where [#] starts at 1.\n\
|
||||
Examples:\n\
|
||||
\t--remote 8080:localhost:8081:TCP,UDP\n\
|
||||
\t--remote 8080:[::1]:8081:TCP\n\
|
||||
\t--remote 8080:google.com:80\
|
||||
"),
|
||||
.help("Configures the log level and format.")
|
||||
]).get_matches();
|
||||
|
||||
// Combine `PORT_FORWARD` arg and `ONETUN_PORT_FORWARD_#` envs
|
||||
let mut port_forward_strings = HashSet::new();
|
||||
if let Some(values) = matches.get_many::<String>("PORT_FORWARD") {
|
||||
if let Some(values) = matches.values_of("PORT_FORWARD") {
|
||||
for value in values {
|
||||
port_forward_strings.insert(value.to_owned());
|
||||
}
|
||||
|
|
@ -154,186 +95,71 @@ impl Config {
|
|||
break;
|
||||
}
|
||||
}
|
||||
if port_forward_strings.is_empty() {
|
||||
return Err(anyhow::anyhow!("No port forward configurations given."));
|
||||
}
|
||||
|
||||
// Parse `PORT_FORWARD` strings into `PortForwardConfig`
|
||||
let port_forwards: anyhow::Result<Vec<Vec<PortForwardConfig>>> = port_forward_strings
|
||||
.into_iter()
|
||||
.map(|s| PortForwardConfig::from_notation(&s, DEFAULT_PORT_FORWARD_SOURCE))
|
||||
.map(|s| PortForwardConfig::from_notation(&s))
|
||||
.collect();
|
||||
let port_forwards: Vec<PortForwardConfig> = port_forwards
|
||||
.context("Failed to parse port forward config")?
|
||||
.with_context(|| "Failed to parse port forward config")?
|
||||
.into_iter()
|
||||
.flatten()
|
||||
.collect();
|
||||
|
||||
// Read source-peer-ip
|
||||
let source_peer_ip = parse_ip(matches.get_one::<String>("source-peer-ip"))
|
||||
.context("Invalid source peer IP")?;
|
||||
|
||||
// Combined `remote` arg and `ONETUN_REMOTE_PORT_FORWARD_#` envs
|
||||
let mut port_forward_strings = HashSet::new();
|
||||
if let Some(values) = matches.get_many::<String>("remote") {
|
||||
for value in values {
|
||||
port_forward_strings.insert(value.to_owned());
|
||||
}
|
||||
}
|
||||
for n in 1.. {
|
||||
if let Ok(env) = std::env::var(format!("ONETUN_REMOTE_PORT_FORWARD_{}", n)) {
|
||||
port_forward_strings.insert(env);
|
||||
} else {
|
||||
break;
|
||||
}
|
||||
}
|
||||
// Parse `PORT_FORWARD` strings into `PortForwardConfig`
|
||||
let remote_port_forwards: anyhow::Result<Vec<Vec<PortForwardConfig>>> =
|
||||
port_forward_strings
|
||||
.into_iter()
|
||||
.map(|s| {
|
||||
PortForwardConfig::from_notation(
|
||||
&s,
|
||||
matches.get_one::<String>("source-peer-ip").unwrap(),
|
||||
)
|
||||
})
|
||||
.collect();
|
||||
let mut remote_port_forwards: Vec<PortForwardConfig> = remote_port_forwards
|
||||
.context("Failed to parse remote port forward config")?
|
||||
.into_iter()
|
||||
.flatten()
|
||||
.collect();
|
||||
for port_forward in remote_port_forwards.iter_mut() {
|
||||
if port_forward.source.ip() != source_peer_ip {
|
||||
bail!("Remote port forward config <src_host> must match --source-peer-ip ({}), or be omitted.", source_peer_ip);
|
||||
}
|
||||
port_forward.source = SocketAddr::from((source_peer_ip, port_forward.source.port()));
|
||||
port_forward.remote = true;
|
||||
}
|
||||
|
||||
if port_forwards.is_empty() && remote_port_forwards.is_empty() {
|
||||
bail!("No port forward configurations given.");
|
||||
}
|
||||
|
||||
// Read private key from file or CLI argument
|
||||
let (group_readable, world_readable) = matches
|
||||
.get_one::<String>("private-key-file")
|
||||
.and_then(is_file_insecurely_readable)
|
||||
.unwrap_or_default();
|
||||
if group_readable {
|
||||
warnings.push("Private key file is group-readable. This is insecure.".into());
|
||||
}
|
||||
if world_readable {
|
||||
warnings.push("Private key file is world-readable. This is insecure.".into());
|
||||
}
|
||||
|
||||
let private_key = if let Some(private_key_file) =
|
||||
matches.get_one::<String>("private-key-file")
|
||||
{
|
||||
read_to_string(private_key_file)
|
||||
.map(|s| s.trim().to_string())
|
||||
.context("Failed to read private key file")
|
||||
} else {
|
||||
if std::env::var("ONETUN_PRIVATE_KEY").is_err() {
|
||||
warnings.push("Private key was passed using CLI. This is insecure. \
|
||||
Use \"--private-key-file <file containing private key>\", or the \"ONETUN_PRIVATE_KEY\" env variable instead.".into());
|
||||
}
|
||||
matches
|
||||
.get_one::<String>("private-key")
|
||||
.cloned()
|
||||
.context("Missing private key")
|
||||
}?;
|
||||
|
||||
let endpoint_addr = parse_addr(matches.get_one::<String>("endpoint-addr"))
|
||||
.context("Invalid endpoint address")?;
|
||||
|
||||
let endpoint_bind_addr = if let Some(addr) = matches.get_one::<String>("endpoint-bind-addr")
|
||||
{
|
||||
let addr = parse_addr(Some(addr)).context("Invalid bind address")?;
|
||||
// Make sure the bind address and endpoint address are the same IP version
|
||||
if addr.ip().is_ipv4() != endpoint_addr.ip().is_ipv4() {
|
||||
bail!("Endpoint and bind addresses must be the same IP version");
|
||||
}
|
||||
addr
|
||||
} else {
|
||||
// Return the IP version of the endpoint address
|
||||
match endpoint_addr {
|
||||
SocketAddr::V4(_) => parse_addr(Some("0.0.0.0:0"))?,
|
||||
SocketAddr::V6(_) => parse_addr(Some("[::]:0"))?,
|
||||
}
|
||||
};
|
||||
|
||||
Ok(Self {
|
||||
port_forwards,
|
||||
remote_port_forwards,
|
||||
private_key: Arc::new(parse_private_key(&private_key).context("Invalid private key")?),
|
||||
endpoint_public_key: Arc::new(
|
||||
parse_public_key(matches.get_one::<String>("endpoint-public-key"))
|
||||
.context("Invalid endpoint public key")?,
|
||||
private_key: Arc::new(
|
||||
parse_private_key(matches.value_of("private-key"))
|
||||
.with_context(|| "Invalid private key")?,
|
||||
),
|
||||
preshared_key: parse_preshared_key(matches.get_one::<String>("preshared-key"))?,
|
||||
endpoint_addr,
|
||||
endpoint_bind_addr,
|
||||
source_peer_ip,
|
||||
keepalive_seconds: parse_keep_alive(matches.get_one::<String>("keep-alive"))
|
||||
.context("Invalid keep-alive value")?,
|
||||
max_transmission_unit: parse_mtu(matches.get_one::<String>("max-transmission-unit"))
|
||||
.context("Invalid max-transmission-unit value")?,
|
||||
log: matches
|
||||
.get_one::<String>("log")
|
||||
.cloned()
|
||||
.unwrap_or_default(),
|
||||
pcap_file: matches.get_one::<String>("pcap").cloned(),
|
||||
warnings,
|
||||
endpoint_public_key: Arc::new(
|
||||
parse_public_key(matches.value_of("endpoint-public-key"))
|
||||
.with_context(|| "Invalid endpoint public key")?,
|
||||
),
|
||||
endpoint_addr: parse_addr(matches.value_of("endpoint-addr"))
|
||||
.with_context(|| "Invalid endpoint address")?,
|
||||
source_peer_ip: parse_ip(matches.value_of("source-peer-ip"))
|
||||
.with_context(|| "Invalid source peer IP")?,
|
||||
keepalive_seconds: parse_keep_alive(matches.value_of("keep-alive"))
|
||||
.with_context(|| "Invalid keep-alive value")?,
|
||||
log: matches.value_of("log").unwrap_or_default().into(),
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
fn parse_addr<T: AsRef<str>>(s: Option<T>) -> anyhow::Result<SocketAddr> {
|
||||
s.context("Missing address")?
|
||||
.as_ref()
|
||||
fn parse_addr(s: Option<&str>) -> anyhow::Result<SocketAddr> {
|
||||
s.with_context(|| "Missing address")?
|
||||
.to_socket_addrs()
|
||||
.context("Invalid address")?
|
||||
.with_context(|| "Invalid address")?
|
||||
.next()
|
||||
.context("Could not lookup address")
|
||||
.with_context(|| "Could not lookup address")
|
||||
}
|
||||
|
||||
fn parse_ip(s: Option<&String>) -> anyhow::Result<IpAddr> {
|
||||
s.context("Missing IP address")?
|
||||
fn parse_ip(s: Option<&str>) -> anyhow::Result<IpAddr> {
|
||||
s.with_context(|| "Missing IP")?
|
||||
.parse::<IpAddr>()
|
||||
.context("Invalid IP address")
|
||||
.with_context(|| "Invalid IP address")
|
||||
}
|
||||
|
||||
fn parse_private_key(s: &str) -> anyhow::Result<StaticSecret> {
|
||||
let decoded = base64::decode(s).context("Failed to decode private key")?;
|
||||
if let Ok::<[u8; 32], _>(bytes) = decoded.try_into() {
|
||||
Ok(StaticSecret::from(bytes))
|
||||
} else {
|
||||
bail!("Invalid private key")
|
||||
}
|
||||
fn parse_private_key(s: Option<&str>) -> anyhow::Result<X25519SecretKey> {
|
||||
s.with_context(|| "Missing private key")?
|
||||
.parse::<X25519SecretKey>()
|
||||
.map_err(|e| anyhow::anyhow!("{}", e))
|
||||
.with_context(|| "Invalid private key")
|
||||
}
|
||||
|
||||
fn parse_public_key(s: Option<&String>) -> anyhow::Result<PublicKey> {
|
||||
let encoded = s.context("Missing public key")?;
|
||||
let decoded = base64::decode(encoded).context("Failed to decode public key")?;
|
||||
if let Ok::<[u8; 32], _>(bytes) = decoded.try_into() {
|
||||
Ok(PublicKey::from(bytes))
|
||||
} else {
|
||||
bail!("Invalid public key")
|
||||
}
|
||||
fn parse_public_key(s: Option<&str>) -> anyhow::Result<X25519PublicKey> {
|
||||
s.with_context(|| "Missing public key")?
|
||||
.parse::<X25519PublicKey>()
|
||||
.map_err(|e| anyhow::anyhow!("{}", e))
|
||||
.with_context(|| "Invalid public key")
|
||||
}
|
||||
|
||||
fn parse_preshared_key(s: Option<&String>) -> anyhow::Result<Option<[u8; 32]>> {
|
||||
if let Some(s) = s {
|
||||
let decoded = base64::decode(s).context("Failed to decode preshared key")?;
|
||||
if let Ok::<[u8; 32], _>(bytes) = decoded.try_into() {
|
||||
Ok(Some(bytes))
|
||||
} else {
|
||||
bail!("Invalid preshared key")
|
||||
}
|
||||
} else {
|
||||
Ok(None)
|
||||
}
|
||||
}
|
||||
|
||||
fn parse_keep_alive(s: Option<&String>) -> anyhow::Result<Option<u16>> {
|
||||
fn parse_keep_alive(s: Option<&str>) -> anyhow::Result<Option<u16>> {
|
||||
if let Some(s) = s {
|
||||
let parsed: u16 = s.parse().with_context(|| {
|
||||
format!(
|
||||
|
|
@ -347,25 +173,6 @@ fn parse_keep_alive(s: Option<&String>) -> anyhow::Result<Option<u16>> {
|
|||
}
|
||||
}
|
||||
|
||||
fn parse_mtu(s: Option<&String>) -> anyhow::Result<usize> {
|
||||
s.context("Missing MTU")?.parse().context("Invalid MTU")
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
fn is_file_insecurely_readable(path: &String) -> Option<(bool, bool)> {
|
||||
use std::fs::File;
|
||||
use std::os::unix::fs::MetadataExt;
|
||||
|
||||
let mode = File::open(path).ok()?.metadata().ok()?.mode();
|
||||
Some((mode & 0o40 > 0, mode & 0o4 > 0))
|
||||
}
|
||||
|
||||
#[cfg(not(unix))]
|
||||
fn is_file_insecurely_readable(_path: &String) -> Option<(bool, bool)> {
|
||||
// No good way to determine permissions on non-Unix target
|
||||
None
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, Eq, PartialEq)]
|
||||
pub struct PortForwardConfig {
|
||||
/// The source IP and port where the local server will run.
|
||||
|
|
@ -374,8 +181,6 @@ pub struct PortForwardConfig {
|
|||
pub destination: SocketAddr,
|
||||
/// The transport protocol to use for the port (Layer 4).
|
||||
pub protocol: PortProtocol,
|
||||
/// Whether this is a remote port forward.
|
||||
pub remote: bool,
|
||||
}
|
||||
|
||||
impl PortForwardConfig {
|
||||
|
|
@ -398,7 +203,7 @@ impl PortForwardConfig {
|
|||
/// - IPv6 addresses must be prefixed with `[` and suffixed with `]`. Example: `[::1]`.
|
||||
/// - Any `u16` is accepted as `src_port` and `dst_port`
|
||||
/// - Specifying protocols (`PROTO1,PROTO2,...`) is optional and defaults to `TCP`. Values must be separated by commas.
|
||||
pub fn from_notation(s: &str, default_source: &str) -> anyhow::Result<Vec<PortForwardConfig>> {
|
||||
pub fn from_notation(s: &str) -> anyhow::Result<Vec<PortForwardConfig>> {
|
||||
mod parsers {
|
||||
use nom::branch::alt;
|
||||
use nom::bytes::complete::is_not;
|
||||
|
|
@ -476,22 +281,28 @@ impl PortForwardConfig {
|
|||
.1;
|
||||
|
||||
let source = (
|
||||
src_addr.0.unwrap_or(default_source),
|
||||
src_addr.1.parse::<u16>().context("Invalid source port")?,
|
||||
src_addr.0.unwrap_or("127.0.0.1"),
|
||||
src_addr
|
||||
.1
|
||||
.parse::<u16>()
|
||||
.with_context(|| "Invalid source port")?,
|
||||
)
|
||||
.to_socket_addrs()
|
||||
.context("Invalid source address")?
|
||||
.with_context(|| "Invalid source address")?
|
||||
.next()
|
||||
.context("Could not resolve source address")?;
|
||||
.with_context(|| "Could not resolve source address")?;
|
||||
|
||||
let destination = (
|
||||
dst_addr.0,
|
||||
dst_addr.1.parse::<u16>().context("Invalid source port")?,
|
||||
dst_addr
|
||||
.1
|
||||
.parse::<u16>()
|
||||
.with_context(|| "Invalid source port")?,
|
||||
)
|
||||
.to_socket_addrs() // TODO: Pass this as given and use DNS config instead (issue #15)
|
||||
.context("Invalid destination address")?
|
||||
.with_context(|| "Invalid destination address")?
|
||||
.next()
|
||||
.context("Could not resolve destination address")?;
|
||||
.with_context(|| "Could not resolve destination address")?;
|
||||
|
||||
// Parse protocols
|
||||
let protocols = if let Some(protocols) = protocols {
|
||||
|
|
@ -501,7 +312,7 @@ impl PortForwardConfig {
|
|||
} else {
|
||||
Ok(vec![PortProtocol::Tcp])
|
||||
}
|
||||
.context("Failed to parse protocols")?;
|
||||
.with_context(|| "Failed to parse protocols")?;
|
||||
|
||||
// Returns an config for each protocol
|
||||
Ok(protocols
|
||||
|
|
@ -510,7 +321,6 @@ impl PortForwardConfig {
|
|||
source,
|
||||
destination,
|
||||
protocol,
|
||||
remote: false,
|
||||
})
|
||||
.collect())
|
||||
}
|
||||
|
|
@ -518,24 +328,13 @@ impl PortForwardConfig {
|
|||
|
||||
impl Display for PortForwardConfig {
|
||||
fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
|
||||
if self.remote {
|
||||
write!(
|
||||
f,
|
||||
"(remote){}:{}:{}",
|
||||
self.source, self.destination, self.protocol
|
||||
)
|
||||
} else {
|
||||
write!(f, "{}:{}:{}", self.source, self.destination, self.protocol)
|
||||
}
|
||||
write!(f, "{}:{}:{}", self.source, self.destination, self.protocol)
|
||||
}
|
||||
}
|
||||
|
||||
/// Layer 7 protocols for ports.
|
||||
#[derive(Debug, Clone, Copy, Eq, PartialEq, Hash, Ord, PartialOrd)]
|
||||
pub enum PortProtocol {
|
||||
/// TCP
|
||||
Tcp,
|
||||
/// UDP
|
||||
Udp,
|
||||
}
|
||||
|
||||
|
|
@ -574,23 +373,18 @@ mod tests {
|
|||
#[test]
|
||||
fn test_parse_port_forward_config_1() {
|
||||
assert_eq!(
|
||||
PortForwardConfig::from_notation(
|
||||
"192.168.0.1:8080:192.168.4.1:8081:TCP,UDP",
|
||||
DEFAULT_PORT_FORWARD_SOURCE
|
||||
)
|
||||
.expect("Failed to parse"),
|
||||
PortForwardConfig::from_notation("192.168.0.1:8080:192.168.4.1:8081:TCP,UDP")
|
||||
.expect("Failed to parse"),
|
||||
vec![
|
||||
PortForwardConfig {
|
||||
source: SocketAddr::from_str("192.168.0.1:8080").unwrap(),
|
||||
destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
|
||||
protocol: PortProtocol::Tcp,
|
||||
remote: false,
|
||||
protocol: PortProtocol::Tcp
|
||||
},
|
||||
PortForwardConfig {
|
||||
source: SocketAddr::from_str("192.168.0.1:8080").unwrap(),
|
||||
destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
|
||||
protocol: PortProtocol::Udp,
|
||||
remote: false,
|
||||
protocol: PortProtocol::Udp
|
||||
}
|
||||
]
|
||||
);
|
||||
|
|
@ -599,16 +393,12 @@ mod tests {
|
|||
#[test]
|
||||
fn test_parse_port_forward_config_2() {
|
||||
assert_eq!(
|
||||
PortForwardConfig::from_notation(
|
||||
"192.168.0.1:8080:192.168.4.1:8081:TCP",
|
||||
DEFAULT_PORT_FORWARD_SOURCE
|
||||
)
|
||||
.expect("Failed to parse"),
|
||||
PortForwardConfig::from_notation("192.168.0.1:8080:192.168.4.1:8081:TCP")
|
||||
.expect("Failed to parse"),
|
||||
vec![PortForwardConfig {
|
||||
source: SocketAddr::from_str("192.168.0.1:8080").unwrap(),
|
||||
destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
|
||||
protocol: PortProtocol::Tcp,
|
||||
remote: false,
|
||||
protocol: PortProtocol::Tcp
|
||||
}]
|
||||
);
|
||||
}
|
||||
|
|
@ -616,16 +406,12 @@ mod tests {
|
|||
#[test]
|
||||
fn test_parse_port_forward_config_3() {
|
||||
assert_eq!(
|
||||
PortForwardConfig::from_notation(
|
||||
"0.0.0.0:8080:192.168.4.1:8081",
|
||||
DEFAULT_PORT_FORWARD_SOURCE
|
||||
)
|
||||
.expect("Failed to parse"),
|
||||
PortForwardConfig::from_notation("0.0.0.0:8080:192.168.4.1:8081")
|
||||
.expect("Failed to parse"),
|
||||
vec![PortForwardConfig {
|
||||
source: SocketAddr::from_str("0.0.0.0:8080").unwrap(),
|
||||
destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
|
||||
protocol: PortProtocol::Tcp,
|
||||
remote: false,
|
||||
protocol: PortProtocol::Tcp
|
||||
}]
|
||||
);
|
||||
}
|
||||
|
|
@ -633,16 +419,12 @@ mod tests {
|
|||
#[test]
|
||||
fn test_parse_port_forward_config_4() {
|
||||
assert_eq!(
|
||||
PortForwardConfig::from_notation(
|
||||
"[::1]:8080:192.168.4.1:8081",
|
||||
DEFAULT_PORT_FORWARD_SOURCE
|
||||
)
|
||||
.expect("Failed to parse"),
|
||||
PortForwardConfig::from_notation("[::1]:8080:192.168.4.1:8081")
|
||||
.expect("Failed to parse"),
|
||||
vec![PortForwardConfig {
|
||||
source: SocketAddr::from_str("[::1]:8080").unwrap(),
|
||||
destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
|
||||
protocol: PortProtocol::Tcp,
|
||||
remote: false,
|
||||
protocol: PortProtocol::Tcp
|
||||
}]
|
||||
);
|
||||
}
|
||||
|
|
@ -650,13 +432,11 @@ mod tests {
|
|||
#[test]
|
||||
fn test_parse_port_forward_config_5() {
|
||||
assert_eq!(
|
||||
PortForwardConfig::from_notation("8080:192.168.4.1:8081", DEFAULT_PORT_FORWARD_SOURCE)
|
||||
.expect("Failed to parse"),
|
||||
PortForwardConfig::from_notation("8080:192.168.4.1:8081").expect("Failed to parse"),
|
||||
vec![PortForwardConfig {
|
||||
source: SocketAddr::from_str("127.0.0.1:8080").unwrap(),
|
||||
destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
|
||||
protocol: PortProtocol::Tcp,
|
||||
remote: false,
|
||||
protocol: PortProtocol::Tcp
|
||||
}]
|
||||
);
|
||||
}
|
||||
|
|
@ -664,16 +444,11 @@ mod tests {
|
|||
#[test]
|
||||
fn test_parse_port_forward_config_6() {
|
||||
assert_eq!(
|
||||
PortForwardConfig::from_notation(
|
||||
"8080:192.168.4.1:8081:TCP",
|
||||
DEFAULT_PORT_FORWARD_SOURCE
|
||||
)
|
||||
.expect("Failed to parse"),
|
||||
PortForwardConfig::from_notation("8080:192.168.4.1:8081:TCP").expect("Failed to parse"),
|
||||
vec![PortForwardConfig {
|
||||
source: SocketAddr::from_str("127.0.0.1:8080").unwrap(),
|
||||
destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
|
||||
protocol: PortProtocol::Tcp,
|
||||
remote: false,
|
||||
protocol: PortProtocol::Tcp
|
||||
}]
|
||||
);
|
||||
}
|
||||
|
|
@ -681,16 +456,12 @@ mod tests {
|
|||
#[test]
|
||||
fn test_parse_port_forward_config_7() {
|
||||
assert_eq!(
|
||||
PortForwardConfig::from_notation(
|
||||
"localhost:8080:192.168.4.1:8081",
|
||||
DEFAULT_PORT_FORWARD_SOURCE
|
||||
)
|
||||
.expect("Failed to parse"),
|
||||
PortForwardConfig::from_notation("localhost:8080:192.168.4.1:8081")
|
||||
.expect("Failed to parse"),
|
||||
vec![PortForwardConfig {
|
||||
source: "localhost:8080".to_socket_addrs().unwrap().next().unwrap(),
|
||||
destination: SocketAddr::from_str("192.168.4.1:8081").unwrap(),
|
||||
protocol: PortProtocol::Tcp,
|
||||
remote: false,
|
||||
protocol: PortProtocol::Tcp
|
||||
}]
|
||||
);
|
||||
}
|
||||
|
|
@ -698,16 +469,12 @@ mod tests {
|
|||
#[test]
|
||||
fn test_parse_port_forward_config_8() {
|
||||
assert_eq!(
|
||||
PortForwardConfig::from_notation(
|
||||
"localhost:8080:localhost:8081:TCP",
|
||||
DEFAULT_PORT_FORWARD_SOURCE
|
||||
)
|
||||
.expect("Failed to parse"),
|
||||
PortForwardConfig::from_notation("localhost:8080:localhost:8081:TCP")
|
||||
.expect("Failed to parse"),
|
||||
vec![PortForwardConfig {
|
||||
source: "localhost:8080".to_socket_addrs().unwrap().next().unwrap(),
|
||||
destination: "localhost:8081".to_socket_addrs().unwrap().next().unwrap(),
|
||||
protocol: PortProtocol::Tcp,
|
||||
remote: false,
|
||||
protocol: PortProtocol::Tcp
|
||||
}]
|
||||
);
|
||||
}
|
||||
|
|
|
|||
190
src/events.rs
190
src/events.rs
|
|
@ -1,190 +0,0 @@
|
|||
use bytes::Bytes;
|
||||
use std::fmt::{Display, Formatter};
|
||||
use std::sync::atomic::{AtomicU32, Ordering};
|
||||
use std::sync::Arc;
|
||||
|
||||
use crate::config::PortForwardConfig;
|
||||
use crate::virtual_iface::VirtualPort;
|
||||
use crate::PortProtocol;
|
||||
|
||||
/// Events that go on the bus between the local server, smoltcp, and WireGuard.
|
||||
#[derive(Debug, Clone)]
|
||||
pub enum Event {
|
||||
/// Dumb event with no data.
|
||||
Dumb,
|
||||
/// A new connection with the local server was initiated, and the given virtual port was assigned.
|
||||
ClientConnectionInitiated(PortForwardConfig, VirtualPort),
|
||||
/// A connection was dropped from the pool and should be closed in all interfaces.
|
||||
ClientConnectionDropped(VirtualPort),
|
||||
/// Data received by the local server that should be sent to the virtual server.
|
||||
LocalData(PortForwardConfig, VirtualPort, Bytes),
|
||||
/// Data received by the remote server that should be sent to the local client.
|
||||
RemoteData(VirtualPort, Bytes),
|
||||
/// IP packet received from the WireGuard tunnel that should be passed through the corresponding virtual device.
|
||||
InboundInternetPacket(PortProtocol, Bytes),
|
||||
/// IP packet to be sent through the WireGuard tunnel as crafted by the virtual device.
|
||||
OutboundInternetPacket(Bytes),
|
||||
/// Notifies that a virtual device read an IP packet.
|
||||
VirtualDeviceFed(PortProtocol),
|
||||
}
|
||||
|
||||
impl Display for Event {
|
||||
fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
|
||||
match self {
|
||||
Event::Dumb => {
|
||||
write!(f, "Dumb{{}}")
|
||||
}
|
||||
Event::ClientConnectionInitiated(pf, vp) => {
|
||||
write!(f, "ClientConnectionInitiated{{ pf={} vp={} }}", pf, vp)
|
||||
}
|
||||
Event::ClientConnectionDropped(vp) => {
|
||||
write!(f, "ClientConnectionDropped{{ vp={} }}", vp)
|
||||
}
|
||||
Event::LocalData(pf, vp, data) => {
|
||||
let size = data.len();
|
||||
write!(f, "LocalData{{ pf={} vp={} size={} }}", pf, vp, size)
|
||||
}
|
||||
Event::RemoteData(vp, data) => {
|
||||
let size = data.len();
|
||||
write!(f, "RemoteData{{ vp={} size={} }}", vp, size)
|
||||
}
|
||||
Event::InboundInternetPacket(proto, data) => {
|
||||
let size = data.len();
|
||||
write!(
|
||||
f,
|
||||
"InboundInternetPacket{{ proto={} size={} }}",
|
||||
proto, size
|
||||
)
|
||||
}
|
||||
Event::OutboundInternetPacket(data) => {
|
||||
let size = data.len();
|
||||
write!(f, "OutboundInternetPacket{{ size={} }}", size)
|
||||
}
|
||||
Event::VirtualDeviceFed(proto) => {
|
||||
write!(f, "VirtualDeviceFed{{ proto={} }}", proto)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone)]
|
||||
pub struct Bus {
|
||||
counter: Arc<AtomicU32>,
|
||||
bus: Arc<tokio::sync::broadcast::Sender<(u32, Event)>>,
|
||||
}
|
||||
|
||||
impl Bus {
|
||||
/// Creates a new event bus.
|
||||
pub fn new() -> Self {
|
||||
let (bus, _) = tokio::sync::broadcast::channel(1000);
|
||||
let bus = Arc::new(bus);
|
||||
let counter = Arc::new(AtomicU32::default());
|
||||
Self { bus, counter }
|
||||
}
|
||||
|
||||
/// Creates a new endpoint on the event bus.
|
||||
pub fn new_endpoint(&self) -> BusEndpoint {
|
||||
let id = self.counter.fetch_add(1, Ordering::Relaxed);
|
||||
let tx = (*self.bus).clone();
|
||||
let rx = self.bus.subscribe();
|
||||
|
||||
let tx = BusSender { id, tx };
|
||||
BusEndpoint { id, tx, rx }
|
||||
}
|
||||
}
|
||||
|
||||
impl Default for Bus {
|
||||
fn default() -> Self {
|
||||
Self::new()
|
||||
}
|
||||
}
|
||||
|
||||
pub struct BusEndpoint {
|
||||
id: u32,
|
||||
tx: BusSender,
|
||||
rx: tokio::sync::broadcast::Receiver<(u32, Event)>,
|
||||
}
|
||||
|
||||
impl BusEndpoint {
|
||||
/// Sends the event on the bus. Note that the messages sent by this endpoint won't reach itself.
|
||||
pub fn send(&self, event: Event) {
|
||||
self.tx.send(event)
|
||||
}
|
||||
|
||||
/// Returns the unique sequential ID of this endpoint.
|
||||
pub fn id(&self) -> u32 {
|
||||
self.id
|
||||
}
|
||||
|
||||
/// Awaits the next `Event` on the bus to be read.
|
||||
pub async fn recv(&mut self) -> Event {
|
||||
loop {
|
||||
match self.rx.recv().await {
|
||||
Ok((id, event)) => {
|
||||
if id == self.id {
|
||||
// If the event was sent by this endpoint, it is skipped
|
||||
continue;
|
||||
} else {
|
||||
return event;
|
||||
}
|
||||
}
|
||||
Err(_) => {
|
||||
error!("Failed to read event bus from endpoint #{}", self.id);
|
||||
return futures::future::pending().await;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Creates a new sender for this endpoint that can be cloned.
|
||||
pub fn sender(&self) -> BusSender {
|
||||
self.tx.clone()
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone)]
|
||||
pub struct BusSender {
|
||||
id: u32,
|
||||
tx: tokio::sync::broadcast::Sender<(u32, Event)>,
|
||||
}
|
||||
|
||||
impl BusSender {
|
||||
/// Sends the event on the bus. Note that the messages sent by this endpoint won't reach itself.
|
||||
pub fn send(&self, event: Event) {
|
||||
trace!("#{} -> {}", self.id, event);
|
||||
match self.tx.send((self.id, event)) {
|
||||
Ok(_) => {}
|
||||
Err(_) => error!("Failed to send event to bus from endpoint #{}", self.id),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_bus() {
|
||||
let bus = Bus::new();
|
||||
|
||||
let mut endpoint_1 = bus.new_endpoint();
|
||||
let mut endpoint_2 = bus.new_endpoint();
|
||||
let mut endpoint_3 = bus.new_endpoint();
|
||||
|
||||
assert_eq!(endpoint_1.id(), 0);
|
||||
assert_eq!(endpoint_2.id(), 1);
|
||||
assert_eq!(endpoint_3.id(), 2);
|
||||
|
||||
endpoint_1.send(Event::Dumb);
|
||||
let recv_2 = endpoint_2.recv().await;
|
||||
let recv_3 = endpoint_3.recv().await;
|
||||
assert!(matches!(recv_2, Event::Dumb));
|
||||
assert!(matches!(recv_3, Event::Dumb));
|
||||
|
||||
endpoint_2.send(Event::Dumb);
|
||||
let recv_1 = endpoint_1.recv().await;
|
||||
let recv_3 = endpoint_3.recv().await;
|
||||
assert!(matches!(recv_1, Event::Dumb));
|
||||
assert!(matches!(recv_3, Event::Dumb));
|
||||
}
|
||||
}
|
||||
35
src/ip_sink.rs
Normal file
35
src/ip_sink.rs
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
use crate::virtual_device::VirtualIpDevice;
|
||||
use crate::wg::WireGuardTunnel;
|
||||
use smoltcp::iface::InterfaceBuilder;
|
||||
use smoltcp::socket::SocketSet;
|
||||
use std::sync::Arc;
|
||||
use tokio::time::Duration;
|
||||
|
||||
/// A repeating task that processes unroutable IP packets.
|
||||
pub async fn run_ip_sink_interface(wg: Arc<WireGuardTunnel>) -> ! {
|
||||
// Initialize interface
|
||||
let device = VirtualIpDevice::new_sink(wg)
|
||||
.await
|
||||
.expect("Failed to initialize VirtualIpDevice for sink interface");
|
||||
|
||||
// No sockets on sink interface
|
||||
let mut socket_set_entries: [_; 0] = Default::default();
|
||||
let mut socket_set = SocketSet::new(&mut socket_set_entries[..]);
|
||||
let mut virtual_interface = InterfaceBuilder::new(device).ip_addrs([]).finalize();
|
||||
|
||||
loop {
|
||||
let loop_start = smoltcp::time::Instant::now();
|
||||
match virtual_interface.poll(&mut socket_set, loop_start) {
|
||||
Ok(processed) if processed => {
|
||||
trace!("[SINK] Virtual interface polled some packets to be processed",);
|
||||
tokio::time::sleep(Duration::from_millis(1)).await;
|
||||
}
|
||||
Err(e) => {
|
||||
error!("[SINK] Virtual interface poll error: {:?}", e);
|
||||
}
|
||||
_ => {
|
||||
tokio::time::sleep(Duration::from_millis(5)).await;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
122
src/lib.rs
122
src/lib.rs
|
|
@ -1,122 +0,0 @@
|
|||
#[macro_use]
|
||||
extern crate log;
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use anyhow::Context;
|
||||
|
||||
use crate::config::{Config, PortProtocol};
|
||||
use crate::events::Bus;
|
||||
use crate::tunnel::tcp::TcpPortPool;
|
||||
use crate::tunnel::udp::UdpPortPool;
|
||||
use crate::virtual_device::VirtualIpDevice;
|
||||
use crate::virtual_iface::tcp::TcpVirtualInterface;
|
||||
use crate::virtual_iface::udp::UdpVirtualInterface;
|
||||
use crate::virtual_iface::VirtualInterfacePoll;
|
||||
use crate::wg::WireGuardTunnel;
|
||||
|
||||
pub mod config;
|
||||
pub mod events;
|
||||
#[cfg(feature = "pcap")]
|
||||
pub mod pcap;
|
||||
pub mod tunnel;
|
||||
pub mod virtual_device;
|
||||
pub mod virtual_iface;
|
||||
pub mod wg;
|
||||
|
||||
/// Starts the onetun tunnels in separate tokio tasks.
|
||||
///
|
||||
/// Note: This future completes immediately.
|
||||
pub async fn start_tunnels(config: Config, bus: Bus) -> anyhow::Result<()> {
|
||||
// Initialize the port pool for each protocol
|
||||
let tcp_port_pool = TcpPortPool::new();
|
||||
let udp_port_pool = UdpPortPool::new();
|
||||
|
||||
#[cfg(feature = "pcap")]
|
||||
if let Some(pcap_file) = config.pcap_file.clone() {
|
||||
// Start packet capture
|
||||
let bus = bus.clone();
|
||||
tokio::spawn(async move { pcap::capture(pcap_file, bus).await });
|
||||
}
|
||||
|
||||
let wg = WireGuardTunnel::new(&config, bus.clone())
|
||||
.await
|
||||
.context("Failed to initialize WireGuard tunnel")?;
|
||||
let wg = Arc::new(wg);
|
||||
|
||||
{
|
||||
// Start routine task for WireGuard
|
||||
let wg = wg.clone();
|
||||
tokio::spawn(async move { wg.routine_task().await });
|
||||
}
|
||||
|
||||
{
|
||||
// Start consumption task for WireGuard
|
||||
let wg = wg.clone();
|
||||
tokio::spawn(Box::pin(async move { wg.consume_task().await }));
|
||||
}
|
||||
|
||||
{
|
||||
// Start production task for WireGuard
|
||||
let wg = wg.clone();
|
||||
tokio::spawn(async move { wg.produce_task().await });
|
||||
}
|
||||
|
||||
if config
|
||||
.port_forwards
|
||||
.iter()
|
||||
.any(|pf| pf.protocol == PortProtocol::Tcp)
|
||||
{
|
||||
// TCP device
|
||||
let bus = bus.clone();
|
||||
let device =
|
||||
VirtualIpDevice::new(PortProtocol::Tcp, bus.clone(), config.max_transmission_unit);
|
||||
|
||||
// Start TCP Virtual Interface
|
||||
let port_forwards = config.port_forwards.clone();
|
||||
let iface = TcpVirtualInterface::new(port_forwards, bus, config.source_peer_ip);
|
||||
tokio::spawn(async move { iface.poll_loop(device).await });
|
||||
}
|
||||
|
||||
if config
|
||||
.port_forwards
|
||||
.iter()
|
||||
.any(|pf| pf.protocol == PortProtocol::Udp)
|
||||
{
|
||||
// UDP device
|
||||
let bus = bus.clone();
|
||||
let device =
|
||||
VirtualIpDevice::new(PortProtocol::Udp, bus.clone(), config.max_transmission_unit);
|
||||
|
||||
// Start UDP Virtual Interface
|
||||
let port_forwards = config.port_forwards.clone();
|
||||
let iface = UdpVirtualInterface::new(port_forwards, bus, config.source_peer_ip);
|
||||
tokio::spawn(async move { iface.poll_loop(device).await });
|
||||
}
|
||||
|
||||
{
|
||||
let port_forwards = config.port_forwards;
|
||||
let source_peer_ip = config.source_peer_ip;
|
||||
|
||||
port_forwards
|
||||
.into_iter()
|
||||
.map(|pf| {
|
||||
(
|
||||
pf,
|
||||
wg.clone(),
|
||||
tcp_port_pool.clone(),
|
||||
udp_port_pool.clone(),
|
||||
bus.clone(),
|
||||
)
|
||||
})
|
||||
.for_each(move |(pf, wg, tcp_port_pool, udp_port_pool, bus)| {
|
||||
tokio::spawn(async move {
|
||||
tunnel::port_forward(pf, source_peer_ip, tcp_port_pool, udp_port_pool, wg, bus)
|
||||
.await
|
||||
.unwrap_or_else(|e| error!("Port-forward failed for {} : {}", pf, e))
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
83
src/main.rs
83
src/main.rs
|
|
@ -1,36 +1,77 @@
|
|||
#[cfg(feature = "bin")]
|
||||
#[macro_use]
|
||||
extern crate log;
|
||||
|
||||
#[cfg(feature = "bin")]
|
||||
use std::sync::Arc;
|
||||
|
||||
use anyhow::Context;
|
||||
|
||||
use crate::config::Config;
|
||||
use crate::tunnel::tcp::TcpPortPool;
|
||||
use crate::tunnel::udp::UdpPortPool;
|
||||
use crate::wg::WireGuardTunnel;
|
||||
|
||||
pub mod config;
|
||||
pub mod ip_sink;
|
||||
pub mod tunnel;
|
||||
pub mod virtual_device;
|
||||
pub mod virtual_iface;
|
||||
pub mod wg;
|
||||
|
||||
#[tokio::main]
|
||||
async fn main() -> anyhow::Result<()> {
|
||||
use anyhow::Context;
|
||||
use onetun::{config::Config, events::Bus};
|
||||
|
||||
let config = Config::from_args().context("Configuration has errors")?;
|
||||
let config = Config::from_args().with_context(|| "Failed to read config")?;
|
||||
init_logger(&config)?;
|
||||
|
||||
for warning in &config.warnings {
|
||||
warn!("{}", warning);
|
||||
// Initialize the port pool for each protocol
|
||||
let tcp_port_pool = TcpPortPool::new();
|
||||
let udp_port_pool = UdpPortPool::new();
|
||||
|
||||
let wg = WireGuardTunnel::new(&config)
|
||||
.await
|
||||
.with_context(|| "Failed to initialize WireGuard tunnel")?;
|
||||
let wg = Arc::new(wg);
|
||||
|
||||
{
|
||||
// Start routine task for WireGuard
|
||||
let wg = wg.clone();
|
||||
tokio::spawn(async move { wg.routine_task().await });
|
||||
}
|
||||
|
||||
let bus = Bus::default();
|
||||
onetun::start_tunnels(config, bus).await?;
|
||||
{
|
||||
// Start consumption task for WireGuard
|
||||
let wg = wg.clone();
|
||||
tokio::spawn(async move { wg.consume_task().await });
|
||||
}
|
||||
|
||||
{
|
||||
// Start IP sink task for incoming IP packets
|
||||
let wg = wg.clone();
|
||||
tokio::spawn(async move { ip_sink::run_ip_sink_interface(wg).await });
|
||||
}
|
||||
|
||||
{
|
||||
let port_forwards = config.port_forwards;
|
||||
let source_peer_ip = config.source_peer_ip;
|
||||
|
||||
port_forwards
|
||||
.into_iter()
|
||||
.map(|pf| (pf, wg.clone(), tcp_port_pool.clone(), udp_port_pool.clone()))
|
||||
.for_each(move |(pf, wg, tcp_port_pool, udp_port_pool)| {
|
||||
tokio::spawn(async move {
|
||||
tunnel::port_forward(pf, source_peer_ip, tcp_port_pool, udp_port_pool, wg)
|
||||
.await
|
||||
.unwrap_or_else(|e| error!("Port-forward failed for {} : {}", pf, e))
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
futures::future::pending().await
|
||||
}
|
||||
|
||||
#[cfg(not(feature = "bin"))]
|
||||
fn main() -> anyhow::Result<()> {
|
||||
Err(anyhow::anyhow!("Binary compiled without 'bin' feature"))
|
||||
}
|
||||
|
||||
#[cfg(feature = "bin")]
|
||||
fn init_logger(config: &onetun::config::Config) -> anyhow::Result<()> {
|
||||
use anyhow::Context;
|
||||
|
||||
let mut builder = pretty_env_logger::formatted_timed_builder();
|
||||
fn init_logger(config: &Config) -> anyhow::Result<()> {
|
||||
let mut builder = pretty_env_logger::formatted_builder();
|
||||
builder.parse_filters(&config.log);
|
||||
builder.try_init().context("Failed to initialize logger")
|
||||
builder
|
||||
.try_init()
|
||||
.with_context(|| "Failed to initialize logger")
|
||||
}
|
||||
|
|
|
|||
113
src/pcap.rs
113
src/pcap.rs
|
|
@ -1,113 +0,0 @@
|
|||
use crate::events::Event;
|
||||
use crate::Bus;
|
||||
use anyhow::Context;
|
||||
use smoltcp::time::Instant;
|
||||
use tokio::fs::File;
|
||||
use tokio::io::{AsyncWriteExt, BufWriter};
|
||||
|
||||
struct Pcap {
|
||||
writer: BufWriter<File>,
|
||||
}
|
||||
|
||||
/// libpcap file writer
|
||||
/// This is mostly taken from `smoltcp`, but rewritten to be async.
|
||||
impl Pcap {
|
||||
async fn flush(&mut self) -> anyhow::Result<()> {
|
||||
self.writer
|
||||
.flush()
|
||||
.await
|
||||
.context("Failed to flush pcap writer")
|
||||
}
|
||||
|
||||
async fn write(&mut self, data: &[u8]) -> anyhow::Result<usize> {
|
||||
self.writer
|
||||
.write(data)
|
||||
.await
|
||||
.with_context(|| format!("Failed to write {} bytes to pcap writer", data.len()))
|
||||
}
|
||||
|
||||
async fn write_u16(&mut self, value: u16) -> anyhow::Result<()> {
|
||||
self.writer
|
||||
.write_u16(value)
|
||||
.await
|
||||
.context("Failed to write u16 to pcap writer")
|
||||
}
|
||||
|
||||
async fn write_u32(&mut self, value: u32) -> anyhow::Result<()> {
|
||||
self.writer
|
||||
.write_u32(value)
|
||||
.await
|
||||
.context("Failed to write u32 to pcap writer")
|
||||
}
|
||||
|
||||
async fn global_header(&mut self) -> anyhow::Result<()> {
|
||||
self.write_u32(0xa1b2c3d4).await?; // magic number
|
||||
self.write_u16(2).await?; // major version
|
||||
self.write_u16(4).await?; // minor version
|
||||
self.write_u32(0).await?; // timezone (= UTC)
|
||||
self.write_u32(0).await?; // accuracy (not used)
|
||||
self.write_u32(65535).await?; // maximum packet length
|
||||
self.write_u32(101).await?; // link-layer header type (101 = IP)
|
||||
self.flush().await
|
||||
}
|
||||
|
||||
async fn packet_header(&mut self, timestamp: Instant, length: usize) -> anyhow::Result<()> {
|
||||
assert!(length <= 65535);
|
||||
|
||||
self.write_u32(timestamp.secs() as u32).await?; // timestamp seconds
|
||||
self.write_u32(timestamp.micros() as u32).await?; // timestamp microseconds
|
||||
self.write_u32(length as u32).await?; // captured length
|
||||
self.write_u32(length as u32).await?; // original length
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn packet(&mut self, timestamp: Instant, packet: &[u8]) -> anyhow::Result<()> {
|
||||
self.packet_header(timestamp, packet.len())
|
||||
.await
|
||||
.context("Failed to write packet header to pcap writer")?;
|
||||
self.write(packet)
|
||||
.await
|
||||
.context("Failed to write packet to pcap writer")?;
|
||||
self.writer
|
||||
.flush()
|
||||
.await
|
||||
.context("Failed to flush pcap writer")?;
|
||||
self.flush().await
|
||||
}
|
||||
}
|
||||
|
||||
/// Listens on the event bus for IP packets sent from and to the WireGuard tunnel.
|
||||
pub async fn capture(pcap_file: String, bus: Bus) -> anyhow::Result<()> {
|
||||
let mut endpoint = bus.new_endpoint();
|
||||
let file = File::create(&pcap_file)
|
||||
.await
|
||||
.context("Failed to create pcap file")?;
|
||||
let writer = BufWriter::new(file);
|
||||
|
||||
let mut writer = Pcap { writer };
|
||||
writer
|
||||
.global_header()
|
||||
.await
|
||||
.context("Failed to write global header to pcap writer")?;
|
||||
|
||||
info!("Capturing WireGuard IP packets to {}", &pcap_file);
|
||||
loop {
|
||||
match endpoint.recv().await {
|
||||
Event::InboundInternetPacket(_proto, ip) => {
|
||||
let instant = Instant::now();
|
||||
writer
|
||||
.packet(instant, &ip)
|
||||
.await
|
||||
.context("Failed to write inbound IP packet to pcap writer")?;
|
||||
}
|
||||
Event::OutboundInternetPacket(ip) => {
|
||||
let instant = Instant::now();
|
||||
writer
|
||||
.packet(instant, &ip)
|
||||
.await
|
||||
.context("Failed to write output IP packet to pcap writer")?;
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -2,12 +2,12 @@ use std::net::IpAddr;
|
|||
use std::sync::Arc;
|
||||
|
||||
use crate::config::{PortForwardConfig, PortProtocol};
|
||||
use crate::events::Bus;
|
||||
use crate::tunnel::tcp::TcpPortPool;
|
||||
use crate::tunnel::udp::UdpPortPool;
|
||||
use crate::wg::WireGuardTunnel;
|
||||
|
||||
pub mod tcp;
|
||||
#[allow(unused)]
|
||||
pub mod udp;
|
||||
|
||||
pub async fn port_forward(
|
||||
|
|
@ -16,7 +16,6 @@ pub async fn port_forward(
|
|||
tcp_port_pool: TcpPortPool,
|
||||
udp_port_pool: UdpPortPool,
|
||||
wg: Arc<WireGuardTunnel>,
|
||||
bus: Bus,
|
||||
) -> anyhow::Result<()> {
|
||||
info!(
|
||||
"Tunneling {} [{}]->[{}] (via [{}] as peer {})",
|
||||
|
|
@ -28,7 +27,7 @@ pub async fn port_forward(
|
|||
);
|
||||
|
||||
match port_forward.protocol {
|
||||
PortProtocol::Tcp => tcp::tcp_proxy_server(port_forward, tcp_port_pool, bus).await,
|
||||
PortProtocol::Udp => udp::udp_proxy_server(port_forward, udp_port_pool, bus).await,
|
||||
PortProtocol::Tcp => tcp::tcp_proxy_server(port_forward, tcp_port_pool, wg).await,
|
||||
PortProtocol::Udp => udp::udp_proxy_server(port_forward, udp_port_pool, wg).await,
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,18 +1,17 @@
|
|||
use std::collections::VecDeque;
|
||||
use std::ops::Range;
|
||||
use std::sync::Arc;
|
||||
use std::time::Duration;
|
||||
|
||||
use crate::config::{PortForwardConfig, PortProtocol};
|
||||
use crate::virtual_iface::tcp::TcpVirtualInterface;
|
||||
use crate::virtual_iface::{VirtualInterfacePoll, VirtualPort};
|
||||
use crate::wg::WireGuardTunnel;
|
||||
use anyhow::Context;
|
||||
use bytes::BytesMut;
|
||||
use rand::seq::SliceRandom;
|
||||
use rand::thread_rng;
|
||||
use tokio::io::AsyncWriteExt;
|
||||
use std::collections::VecDeque;
|
||||
use std::sync::atomic::{AtomicBool, Ordering};
|
||||
use std::sync::Arc;
|
||||
use tokio::net::{TcpListener, TcpStream};
|
||||
|
||||
use crate::config::{PortForwardConfig, PortProtocol};
|
||||
use crate::events::{Bus, Event};
|
||||
use crate::virtual_iface::VirtualPort;
|
||||
use std::ops::Range;
|
||||
|
||||
use rand::seq::SliceRandom;
|
||||
use rand::thread_rng;
|
||||
|
||||
const MAX_PACKET: usize = 65536;
|
||||
const MIN_PORT: u16 = 1000;
|
||||
|
|
@ -23,18 +22,19 @@ const PORT_RANGE: Range<u16> = MIN_PORT..MAX_PORT;
|
|||
pub async fn tcp_proxy_server(
|
||||
port_forward: PortForwardConfig,
|
||||
port_pool: TcpPortPool,
|
||||
bus: Bus,
|
||||
wg: Arc<WireGuardTunnel>,
|
||||
) -> anyhow::Result<()> {
|
||||
let listener = TcpListener::bind(port_forward.source)
|
||||
.await
|
||||
.context("Failed to listen on TCP proxy server")?;
|
||||
.with_context(|| "Failed to listen on TCP proxy server")?;
|
||||
|
||||
loop {
|
||||
let wg = wg.clone();
|
||||
let port_pool = port_pool.clone();
|
||||
let (socket, peer_addr) = listener
|
||||
.accept()
|
||||
.await
|
||||
.context("Failed to accept connection on TCP proxy server")?;
|
||||
.with_context(|| "Failed to accept connection on TCP proxy server")?;
|
||||
|
||||
// Assign a 'virtual port': this is a unique port number used to route IP packets
|
||||
// received from the WireGuard tunnel. It is the port number that the virtual client will
|
||||
|
|
@ -52,10 +52,10 @@ pub async fn tcp_proxy_server(
|
|||
|
||||
info!("[{}] Incoming connection from {}", virtual_port, peer_addr);
|
||||
|
||||
let bus = bus.clone();
|
||||
tokio::spawn(async move {
|
||||
let port_pool = port_pool.clone();
|
||||
let result = handle_tcp_proxy_connection(socket, virtual_port, port_forward, bus).await;
|
||||
let result =
|
||||
handle_tcp_proxy_connection(socket, virtual_port, port_forward, wg.clone()).await;
|
||||
|
||||
if let Err(e) = result {
|
||||
error!(
|
||||
|
|
@ -66,7 +66,8 @@ pub async fn tcp_proxy_server(
|
|||
info!("[{}] Connection closed by client", virtual_port);
|
||||
}
|
||||
|
||||
tokio::time::sleep(Duration::from_millis(100)).await; // Make sure the other tasks have time to process the event
|
||||
// Release port when connection drops
|
||||
wg.release_virtual_interface(VirtualPort(virtual_port, PortProtocol::Tcp));
|
||||
port_pool.release(virtual_port).await;
|
||||
});
|
||||
}
|
||||
|
|
@ -74,26 +75,72 @@ pub async fn tcp_proxy_server(
|
|||
|
||||
/// Handles a new TCP connection with its assigned virtual port.
|
||||
async fn handle_tcp_proxy_connection(
|
||||
mut socket: TcpStream,
|
||||
virtual_port: VirtualPort,
|
||||
socket: TcpStream,
|
||||
virtual_port: u16,
|
||||
port_forward: PortForwardConfig,
|
||||
bus: Bus,
|
||||
wg: Arc<WireGuardTunnel>,
|
||||
) -> anyhow::Result<()> {
|
||||
let mut endpoint = bus.new_endpoint();
|
||||
endpoint.send(Event::ClientConnectionInitiated(port_forward, virtual_port));
|
||||
// Abort signal for stopping the Virtual Interface
|
||||
let abort = Arc::new(AtomicBool::new(false));
|
||||
|
||||
// Signals that the Virtual Client is ready to send data
|
||||
let (virtual_client_ready_tx, virtual_client_ready_rx) = tokio::sync::oneshot::channel::<()>();
|
||||
|
||||
// data_to_real_client_(tx/rx): This task reads the data from this mpsc channel to send back
|
||||
// to the real client.
|
||||
let (data_to_real_client_tx, mut data_to_real_client_rx) = tokio::sync::mpsc::channel(1_000);
|
||||
|
||||
// data_to_real_server_(tx/rx): This task sends the data received from the real client to the
|
||||
// virtual interface (virtual server socket).
|
||||
let (data_to_virtual_server_tx, data_to_virtual_server_rx) = tokio::sync::mpsc::channel(1_000);
|
||||
|
||||
// Spawn virtual interface
|
||||
{
|
||||
let abort = abort.clone();
|
||||
let virtual_interface = TcpVirtualInterface::new(
|
||||
virtual_port,
|
||||
port_forward,
|
||||
wg,
|
||||
abort.clone(),
|
||||
data_to_real_client_tx,
|
||||
data_to_virtual_server_rx,
|
||||
virtual_client_ready_tx,
|
||||
);
|
||||
|
||||
tokio::spawn(async move {
|
||||
virtual_interface.poll_loop().await.unwrap_or_else(|e| {
|
||||
error!("Virtual interface poll loop failed unexpectedly: {}", e);
|
||||
abort.store(true, Ordering::Relaxed);
|
||||
})
|
||||
});
|
||||
}
|
||||
|
||||
// Wait for virtual client to be ready.
|
||||
virtual_client_ready_rx
|
||||
.await
|
||||
.with_context(|| "Virtual client dropped before being ready.")?;
|
||||
trace!("[{}] Virtual client is ready to send data", virtual_port);
|
||||
|
||||
let mut buffer = BytesMut::with_capacity(MAX_PACKET);
|
||||
loop {
|
||||
tokio::select! {
|
||||
readable_result = socket.readable() => {
|
||||
match readable_result {
|
||||
Ok(_) => {
|
||||
// Buffer for the individual TCP segment.
|
||||
let mut buffer = Vec::with_capacity(MAX_PACKET);
|
||||
match socket.try_read_buf(&mut buffer) {
|
||||
Ok(size) if size > 0 => {
|
||||
let data = Vec::from(&buffer[..size]);
|
||||
endpoint.send(Event::LocalData(port_forward, virtual_port, data.into()));
|
||||
// Reset buffer
|
||||
buffer.clear();
|
||||
let data = &buffer[..size];
|
||||
debug!(
|
||||
"[{}] Read {} bytes of TCP data from real client",
|
||||
virtual_port, size
|
||||
);
|
||||
if let Err(e) = data_to_virtual_server_tx.send(data.to_vec()).await {
|
||||
error!(
|
||||
"[{}] Failed to dispatch data to virtual interface: {:?}",
|
||||
virtual_port, e
|
||||
);
|
||||
}
|
||||
}
|
||||
Err(ref e) if e.kind() == std::io::ErrorKind::WouldBlock => {
|
||||
continue;
|
||||
|
|
@ -116,47 +163,43 @@ async fn handle_tcp_proxy_connection(
|
|||
}
|
||||
}
|
||||
}
|
||||
event = endpoint.recv() => {
|
||||
match event {
|
||||
Event::ClientConnectionDropped(e_vp) if e_vp == virtual_port => {
|
||||
// This connection is supposed to be closed, stop the task.
|
||||
break;
|
||||
}
|
||||
Event::RemoteData(e_vp, data) if e_vp == virtual_port => {
|
||||
// Have remote data to send to the local client
|
||||
if let Err(e) = socket.writable().await {
|
||||
error!("[{}] Failed to check if writable: {:?}", virtual_port, e);
|
||||
data_recv_result = data_to_real_client_rx.recv() => {
|
||||
match data_recv_result {
|
||||
Some(data) => match socket.try_write(&data) {
|
||||
Ok(size) => {
|
||||
debug!(
|
||||
"[{}] Wrote {} bytes of TCP data to real client",
|
||||
virtual_port, size
|
||||
);
|
||||
}
|
||||
let expected = data.len();
|
||||
let mut sent = 0;
|
||||
loop {
|
||||
if sent >= expected {
|
||||
Err(ref e) if e.kind() == std::io::ErrorKind::WouldBlock => {
|
||||
if abort.load(Ordering::Relaxed) {
|
||||
break;
|
||||
}
|
||||
match socket.write(&data[sent..expected]).await {
|
||||
Ok(written) => {
|
||||
debug!("[{}] Sent {} (expected {}) bytes to local client", virtual_port, written, expected);
|
||||
sent += written;
|
||||
if sent < expected {
|
||||
debug!("[{}] Will try to resend remaining {} bytes to local client", virtual_port, (expected - written));
|
||||
}
|
||||
},
|
||||
Err(e) => {
|
||||
error!("[{}] Failed to send {} bytes to local client: {:?}", virtual_port, expected, e);
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
continue;
|
||||
}
|
||||
}
|
||||
}
|
||||
_ => {}
|
||||
Err(e) => {
|
||||
error!(
|
||||
"[{}] Failed to write to client TCP socket: {:?}",
|
||||
virtual_port, e
|
||||
);
|
||||
}
|
||||
},
|
||||
None => {
|
||||
if abort.load(Ordering::Relaxed) {
|
||||
break;
|
||||
} else {
|
||||
continue;
|
||||
}
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Notify other endpoints that this task has closed and no more data is to be sent to the local client
|
||||
endpoint.send(Event::ClientConnectionDropped(virtual_port));
|
||||
|
||||
trace!("[{}] TCP socket handler task terminated", virtual_port);
|
||||
abort.store(true, Ordering::Relaxed);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
|
|
@ -186,20 +229,20 @@ impl TcpPortPool {
|
|||
}
|
||||
}
|
||||
|
||||
/// Requests a free port from the pool. An error is returned if none is available (exhausted max capacity).
|
||||
pub async fn next(&self) -> anyhow::Result<VirtualPort> {
|
||||
/// Requests a free port from the pool. An error is returned if none is available (exhaused max capacity).
|
||||
pub async fn next(&self) -> anyhow::Result<u16> {
|
||||
let mut inner = self.inner.write().await;
|
||||
let port = inner
|
||||
.queue
|
||||
.pop_front()
|
||||
.context("TCP virtual port pool is exhausted")?;
|
||||
Ok(VirtualPort::new(port, PortProtocol::Tcp))
|
||||
.with_context(|| "TCP virtual port pool is exhausted")?;
|
||||
Ok(port)
|
||||
}
|
||||
|
||||
/// Releases a port back into the pool.
|
||||
pub async fn release(&self, port: VirtualPort) {
|
||||
pub async fn release(&self, port: u16) {
|
||||
let mut inner = self.inner.write().await;
|
||||
inner.queue.push_back(port.num());
|
||||
inner.queue.push_back(port);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,19 +1,21 @@
|
|||
use std::collections::{HashMap, VecDeque};
|
||||
use std::collections::{BTreeMap, HashMap, VecDeque};
|
||||
use std::net::{IpAddr, SocketAddr};
|
||||
use std::ops::Range;
|
||||
use std::sync::atomic::{AtomicBool, Ordering};
|
||||
use std::sync::Arc;
|
||||
use std::time::Instant;
|
||||
|
||||
use anyhow::Context;
|
||||
use bytes::Bytes;
|
||||
use priority_queue::double_priority_queue::DoublePriorityQueue;
|
||||
use priority_queue::priority_queue::PriorityQueue;
|
||||
use rand::seq::SliceRandom;
|
||||
use rand::thread_rng;
|
||||
use tokio::net::UdpSocket;
|
||||
|
||||
use crate::config::{PortForwardConfig, PortProtocol};
|
||||
use crate::events::{Bus, Event};
|
||||
use crate::virtual_iface::VirtualPort;
|
||||
use crate::virtual_iface::udp::UdpVirtualInterface;
|
||||
use crate::virtual_iface::{VirtualInterfacePoll, VirtualPort};
|
||||
use crate::wg::WireGuardTunnel;
|
||||
|
||||
const MAX_PACKET: usize = 65536;
|
||||
const MIN_PORT: u16 = 1000;
|
||||
|
|
@ -28,24 +30,61 @@ const UDP_TIMEOUT_SECONDS: u64 = 60;
|
|||
/// TODO: Make this configurable by the CLI
|
||||
const PORTS_PER_IP: usize = 100;
|
||||
|
||||
/// Starts the server that listens on UDP datagrams.
|
||||
pub async fn udp_proxy_server(
|
||||
port_forward: PortForwardConfig,
|
||||
port_pool: UdpPortPool,
|
||||
bus: Bus,
|
||||
wg: Arc<WireGuardTunnel>,
|
||||
) -> anyhow::Result<()> {
|
||||
let mut endpoint = bus.new_endpoint();
|
||||
// Abort signal
|
||||
let abort = Arc::new(AtomicBool::new(false));
|
||||
|
||||
// data_to_real_client_(tx/rx): This task reads the data from this mpsc channel to send back
|
||||
// to the real client.
|
||||
let (data_to_real_client_tx, mut data_to_real_client_rx) =
|
||||
tokio::sync::mpsc::channel::<(VirtualPort, Vec<u8>)>(1_000);
|
||||
|
||||
// data_to_real_server_(tx/rx): This task sends the data received from the real client to the
|
||||
// virtual interface (virtual server socket).
|
||||
let (data_to_virtual_server_tx, data_to_virtual_server_rx) =
|
||||
tokio::sync::mpsc::channel::<(VirtualPort, Vec<u8>)>(1_000);
|
||||
|
||||
{
|
||||
// Spawn virtual interface
|
||||
// Note: contrary to TCP, there is only one UDP virtual interface
|
||||
let virtual_interface = UdpVirtualInterface::new(
|
||||
port_forward,
|
||||
wg,
|
||||
data_to_real_client_tx,
|
||||
data_to_virtual_server_rx,
|
||||
);
|
||||
let abort = abort.clone();
|
||||
tokio::spawn(async move {
|
||||
virtual_interface.poll_loop().await.unwrap_or_else(|e| {
|
||||
error!("Virtual interface poll loop failed unexpectedly: {}", e);
|
||||
abort.store(true, Ordering::Relaxed);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
let socket = UdpSocket::bind(port_forward.source)
|
||||
.await
|
||||
.context("Failed to bind on UDP proxy address")?;
|
||||
.with_context(|| "Failed to bind on UDP proxy address")?;
|
||||
|
||||
let mut buffer = [0u8; MAX_PACKET];
|
||||
loop {
|
||||
if abort.load(Ordering::Relaxed) {
|
||||
break;
|
||||
}
|
||||
tokio::select! {
|
||||
to_send_result = next_udp_datagram(&socket, &mut buffer, port_pool.clone()) => {
|
||||
match to_send_result {
|
||||
Ok(Some((port, data))) => {
|
||||
endpoint.send(Event::LocalData(port_forward, port, data));
|
||||
data_to_virtual_server_tx.send((port, data)).await.unwrap_or_else(|e| {
|
||||
error!(
|
||||
"Failed to dispatch data to UDP virtual interface: {:?}",
|
||||
e
|
||||
);
|
||||
});
|
||||
}
|
||||
Ok(None) => {
|
||||
continue;
|
||||
|
|
@ -59,34 +98,18 @@ pub async fn udp_proxy_server(
|
|||
}
|
||||
}
|
||||
}
|
||||
event = endpoint.recv() => {
|
||||
if let Event::RemoteData(virtual_port, data) = event {
|
||||
if let Some(peer) = port_pool.get_peer_addr(virtual_port).await {
|
||||
// Have remote data to send to the local client
|
||||
if let Err(e) = socket.writable().await {
|
||||
error!("[{}] Failed to check if writable: {:?}", virtual_port, e);
|
||||
data_recv_result = data_to_real_client_rx.recv() => {
|
||||
if let Some((port, data)) = data_recv_result {
|
||||
if let Some(peer_addr) = port_pool.get_peer_addr(port.0).await {
|
||||
if let Err(e) = socket.send_to(&data, peer_addr).await {
|
||||
error!(
|
||||
"[{}] Failed to send UDP datagram to real client ({}): {:?}",
|
||||
port,
|
||||
peer_addr,
|
||||
e,
|
||||
);
|
||||
}
|
||||
let expected = data.len();
|
||||
let mut sent = 0;
|
||||
loop {
|
||||
if sent >= expected {
|
||||
break;
|
||||
}
|
||||
match socket.send_to(&data[sent..expected], peer).await {
|
||||
Ok(written) => {
|
||||
debug!("[{}] Sent {} (expected {}) bytes to local client", virtual_port, written, expected);
|
||||
sent += written;
|
||||
if sent < expected {
|
||||
debug!("[{}] Will try to resend remaining {} bytes to local client", virtual_port, (expected - written));
|
||||
}
|
||||
},
|
||||
Err(e) => {
|
||||
error!("[{}] Failed to send {} bytes to local client: {:?}", virtual_port, expected, e);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
port_pool.update_last_transmit(virtual_port).await;
|
||||
port_pool.update_last_transmit(port.0).await;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -99,11 +122,11 @@ async fn next_udp_datagram(
|
|||
socket: &UdpSocket,
|
||||
buffer: &mut [u8],
|
||||
port_pool: UdpPortPool,
|
||||
) -> anyhow::Result<Option<(VirtualPort, Bytes)>> {
|
||||
) -> anyhow::Result<Option<(VirtualPort, Vec<u8>)>> {
|
||||
let (size, peer_addr) = socket
|
||||
.recv_from(buffer)
|
||||
.await
|
||||
.context("Failed to accept incoming UDP datagram")?;
|
||||
.with_context(|| "Failed to accept incoming UDP datagram")?;
|
||||
|
||||
// Assign a 'virtual port': this is a unique port number used to route IP packets
|
||||
// received from the WireGuard tunnel. It is the port number that the virtual client will
|
||||
|
|
@ -118,16 +141,17 @@ async fn next_udp_datagram(
|
|||
return Ok(None);
|
||||
}
|
||||
};
|
||||
let port = VirtualPort(port, PortProtocol::Udp);
|
||||
|
||||
debug!(
|
||||
"[{}] Received datagram of {} bytes from {}",
|
||||
port, size, peer_addr
|
||||
);
|
||||
|
||||
port_pool.update_last_transmit(port).await;
|
||||
port_pool.update_last_transmit(port.0).await;
|
||||
|
||||
let data = buffer[..size].to_vec();
|
||||
Ok(Some((port, data.into())))
|
||||
Ok(Some((port, data)))
|
||||
}
|
||||
|
||||
/// A pool of virtual ports available for TCP connections.
|
||||
|
|
@ -157,14 +181,14 @@ impl UdpPortPool {
|
|||
}
|
||||
|
||||
/// Requests a free port from the pool. An error is returned if none is available (exhausted max capacity).
|
||||
pub async fn next(&self, peer_addr: SocketAddr) -> anyhow::Result<VirtualPort> {
|
||||
pub async fn next(&self, peer_addr: SocketAddr) -> anyhow::Result<u16> {
|
||||
// A port found to be reused. This is outside of the block because the read lock cannot be upgraded to a write lock.
|
||||
let mut port_reuse: Option<u16> = None;
|
||||
|
||||
{
|
||||
let inner = self.inner.read().await;
|
||||
if let Some(port) = inner.port_by_peer_addr.get(&peer_addr) {
|
||||
return Ok(VirtualPort::new(*port, PortProtocol::Udp));
|
||||
return Ok(*port);
|
||||
}
|
||||
|
||||
// Count how many ports are being used by the peer IP
|
||||
|
|
@ -212,30 +236,30 @@ impl UdpPortPool {
|
|||
None
|
||||
}
|
||||
})
|
||||
.context("Virtual port pool is exhausted")?;
|
||||
.with_context(|| "virtual port pool is exhausted")?;
|
||||
|
||||
inner.port_by_peer_addr.insert(peer_addr, port);
|
||||
inner.peer_addr_by_port.insert(port, peer_addr);
|
||||
Ok(VirtualPort::new(port, PortProtocol::Udp))
|
||||
Ok(port)
|
||||
}
|
||||
|
||||
/// Notify that the given virtual port has received or transmitted a UDP datagram.
|
||||
pub async fn update_last_transmit(&self, port: VirtualPort) {
|
||||
pub async fn update_last_transmit(&self, port: u16) {
|
||||
let mut inner = self.inner.write().await;
|
||||
if let Some(peer) = inner.peer_addr_by_port.get(&port.num()).copied() {
|
||||
let pq: &mut DoublePriorityQueue<u16, Instant> = inner
|
||||
if let Some(peer) = inner.peer_addr_by_port.get(&port).copied() {
|
||||
let mut pq: &mut DoublePriorityQueue<u16, Instant> = inner
|
||||
.peer_port_usage
|
||||
.entry(peer.ip())
|
||||
.or_insert_with(Default::default);
|
||||
pq.push(port.num(), Instant::now());
|
||||
pq.push(port, Instant::now());
|
||||
}
|
||||
let pq: &mut DoublePriorityQueue<u16, Instant> = &mut inner.port_usage;
|
||||
pq.push(port.num(), Instant::now());
|
||||
let mut pq: &mut DoublePriorityQueue<u16, Instant> = &mut inner.port_usage;
|
||||
pq.push(port, Instant::now());
|
||||
}
|
||||
|
||||
pub async fn get_peer_addr(&self, port: VirtualPort) -> Option<SocketAddr> {
|
||||
pub async fn get_peer_addr(&self, port: u16) -> Option<SocketAddr> {
|
||||
let inner = self.inner.read().await;
|
||||
inner.peer_addr_by_port.get(&port.num()).copied()
|
||||
inner.peer_addr_by_port.get(&port).copied()
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,136 +1,116 @@
|
|||
use crate::config::PortProtocol;
|
||||
use crate::events::{BusSender, Event};
|
||||
use crate::Bus;
|
||||
use bytes::{BufMut, Bytes, BytesMut};
|
||||
use smoltcp::{
|
||||
phy::{DeviceCapabilities, Medium},
|
||||
time::Instant,
|
||||
};
|
||||
use std::{
|
||||
collections::VecDeque,
|
||||
sync::{Arc, Mutex},
|
||||
};
|
||||
use crate::virtual_iface::VirtualPort;
|
||||
use crate::wg::{WireGuardTunnel, DISPATCH_CAPACITY};
|
||||
use anyhow::Context;
|
||||
use smoltcp::phy::{Device, DeviceCapabilities, Medium};
|
||||
use smoltcp::time::Instant;
|
||||
use std::sync::Arc;
|
||||
|
||||
/// A virtual device that processes IP packets through smoltcp and WireGuard.
|
||||
/// The max transmission unit for WireGuard.
|
||||
const WG_MTU: usize = 1420;
|
||||
|
||||
/// A virtual device that processes IP packets. IP packets received from the WireGuard endpoint
|
||||
/// are made available to this device using a channel receiver. IP packets sent from this device
|
||||
/// are asynchronously sent out to the WireGuard tunnel.
|
||||
pub struct VirtualIpDevice {
|
||||
/// Max transmission unit (bytes)
|
||||
max_transmission_unit: usize,
|
||||
/// Tunnel to send IP packets to.
|
||||
wg: Arc<WireGuardTunnel>,
|
||||
/// Channel receiver for received IP packets.
|
||||
bus_sender: BusSender,
|
||||
/// Local queue for packets received from the bus that need to go through the smoltcp interface.
|
||||
process_queue: Arc<Mutex<VecDeque<Bytes>>>,
|
||||
ip_dispatch_rx: tokio::sync::mpsc::Receiver<Vec<u8>>,
|
||||
}
|
||||
|
||||
impl VirtualIpDevice {
|
||||
/// Initializes a new virtual IP device.
|
||||
pub fn new(protocol: PortProtocol, bus: Bus, max_transmission_unit: usize) -> Self {
|
||||
let mut bus_endpoint = bus.new_endpoint();
|
||||
let bus_sender = bus_endpoint.sender();
|
||||
let process_queue = Arc::new(Mutex::new(VecDeque::new()));
|
||||
pub fn new(
|
||||
wg: Arc<WireGuardTunnel>,
|
||||
ip_dispatch_rx: tokio::sync::mpsc::Receiver<Vec<u8>>,
|
||||
) -> Self {
|
||||
Self { wg, ip_dispatch_rx }
|
||||
}
|
||||
|
||||
{
|
||||
let process_queue = process_queue.clone();
|
||||
tokio::spawn(async move {
|
||||
loop {
|
||||
match bus_endpoint.recv().await {
|
||||
Event::InboundInternetPacket(ip_proto, data) if ip_proto == protocol => {
|
||||
let mut queue = process_queue
|
||||
.lock()
|
||||
.expect("Failed to acquire process queue lock");
|
||||
queue.push_back(data);
|
||||
bus_endpoint.send(Event::VirtualDeviceFed(ip_proto));
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
/// Registers a virtual IP device for a single virtual client.
|
||||
pub fn new_direct(virtual_port: VirtualPort, wg: Arc<WireGuardTunnel>) -> anyhow::Result<Self> {
|
||||
let (ip_dispatch_tx, ip_dispatch_rx) = tokio::sync::mpsc::channel(DISPATCH_CAPACITY);
|
||||
|
||||
Self {
|
||||
bus_sender,
|
||||
process_queue,
|
||||
max_transmission_unit,
|
||||
}
|
||||
wg.register_virtual_interface(virtual_port, ip_dispatch_tx)
|
||||
.with_context(|| "Failed to register IP dispatch for virtual interface")?;
|
||||
|
||||
Ok(Self { wg, ip_dispatch_rx })
|
||||
}
|
||||
|
||||
pub async fn new_sink(wg: Arc<WireGuardTunnel>) -> anyhow::Result<Self> {
|
||||
let ip_dispatch_rx = wg
|
||||
.register_sink_interface()
|
||||
.await
|
||||
.with_context(|| "Failed to register IP dispatch for sink virtual interface")?;
|
||||
Ok(Self { wg, ip_dispatch_rx })
|
||||
}
|
||||
}
|
||||
|
||||
impl smoltcp::phy::Device for VirtualIpDevice {
|
||||
type RxToken<'a>
|
||||
= RxToken
|
||||
where
|
||||
Self: 'a;
|
||||
type TxToken<'a>
|
||||
= TxToken
|
||||
where
|
||||
Self: 'a;
|
||||
impl<'a> Device<'a> for VirtualIpDevice {
|
||||
type RxToken = RxToken;
|
||||
type TxToken = TxToken;
|
||||
|
||||
fn receive(&mut self, _timestamp: Instant) -> Option<(Self::RxToken<'_>, Self::TxToken<'_>)> {
|
||||
let next = {
|
||||
let mut queue = self
|
||||
.process_queue
|
||||
.lock()
|
||||
.expect("Failed to acquire process queue lock");
|
||||
queue.pop_front()
|
||||
};
|
||||
match next {
|
||||
Some(buffer) => Some((
|
||||
Self::RxToken {
|
||||
buffer: {
|
||||
let mut buf = BytesMut::new();
|
||||
buf.put(buffer);
|
||||
buf
|
||||
},
|
||||
},
|
||||
fn receive(&'a mut self) -> Option<(Self::RxToken, Self::TxToken)> {
|
||||
match self.ip_dispatch_rx.try_recv() {
|
||||
Ok(buffer) => Some((
|
||||
Self::RxToken { buffer },
|
||||
Self::TxToken {
|
||||
sender: self.bus_sender.clone(),
|
||||
wg: self.wg.clone(),
|
||||
},
|
||||
)),
|
||||
None => None,
|
||||
Err(_) => None,
|
||||
}
|
||||
}
|
||||
|
||||
fn transmit(&mut self, _timestamp: Instant) -> Option<Self::TxToken<'_>> {
|
||||
fn transmit(&'a mut self) -> Option<Self::TxToken> {
|
||||
Some(TxToken {
|
||||
sender: self.bus_sender.clone(),
|
||||
wg: self.wg.clone(),
|
||||
})
|
||||
}
|
||||
|
||||
fn capabilities(&self) -> DeviceCapabilities {
|
||||
let mut cap = DeviceCapabilities::default();
|
||||
cap.medium = Medium::Ip;
|
||||
cap.max_transmission_unit = self.max_transmission_unit;
|
||||
cap.max_transmission_unit = WG_MTU;
|
||||
cap
|
||||
}
|
||||
}
|
||||
|
||||
#[doc(hidden)]
|
||||
pub struct RxToken {
|
||||
buffer: BytesMut,
|
||||
buffer: Vec<u8>,
|
||||
}
|
||||
|
||||
impl smoltcp::phy::RxToken for RxToken {
|
||||
fn consume<R, F>(self, f: F) -> R
|
||||
fn consume<R, F>(mut self, _timestamp: Instant, f: F) -> smoltcp::Result<R>
|
||||
where
|
||||
F: FnOnce(&[u8]) -> R,
|
||||
F: FnOnce(&mut [u8]) -> smoltcp::Result<R>,
|
||||
{
|
||||
f(&self.buffer)
|
||||
f(&mut self.buffer)
|
||||
}
|
||||
}
|
||||
|
||||
#[doc(hidden)]
|
||||
pub struct TxToken {
|
||||
sender: BusSender,
|
||||
wg: Arc<WireGuardTunnel>,
|
||||
}
|
||||
|
||||
impl smoltcp::phy::TxToken for TxToken {
|
||||
fn consume<R, F>(self, len: usize, f: F) -> R
|
||||
fn consume<R, F>(self, _timestamp: Instant, len: usize, f: F) -> smoltcp::Result<R>
|
||||
where
|
||||
F: FnOnce(&mut [u8]) -> R,
|
||||
F: FnOnce(&mut [u8]) -> smoltcp::Result<R>,
|
||||
{
|
||||
let mut buffer = vec![0; len];
|
||||
let mut buffer = Vec::new();
|
||||
buffer.resize(len, 0);
|
||||
let result = f(&mut buffer);
|
||||
self.sender
|
||||
.send(Event::OutboundInternetPacket(buffer.into()));
|
||||
tokio::spawn(async move {
|
||||
match self.wg.send_ip_packet(&buffer).await {
|
||||
Ok(_) => {}
|
||||
Err(e) => {
|
||||
error!("Failed to send IP packet to WireGuard endpoint: {:?}", e);
|
||||
}
|
||||
}
|
||||
});
|
||||
result
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@ pub mod tcp;
|
|||
pub mod udp;
|
||||
|
||||
use crate::config::PortProtocol;
|
||||
use crate::VirtualIpDevice;
|
||||
use async_trait::async_trait;
|
||||
use std::fmt::{Display, Formatter};
|
||||
|
||||
|
|
@ -10,56 +9,15 @@ use std::fmt::{Display, Formatter};
|
|||
pub trait VirtualInterfacePoll {
|
||||
/// Initializes the virtual interface and processes incoming data to be dispatched
|
||||
/// to the WireGuard tunnel and to the real client.
|
||||
async fn poll_loop(mut self, device: VirtualIpDevice) -> anyhow::Result<()>;
|
||||
async fn poll_loop(mut self) -> anyhow::Result<()>;
|
||||
}
|
||||
|
||||
/// Virtual port.
|
||||
#[derive(Copy, Clone, Debug, Hash, Eq, PartialEq, Ord, PartialOrd)]
|
||||
pub struct VirtualPort(u16, PortProtocol);
|
||||
|
||||
impl VirtualPort {
|
||||
/// Create a new `VirtualPort` instance, with the given port number and associated protocol.
|
||||
pub fn new(port: u16, proto: PortProtocol) -> Self {
|
||||
VirtualPort(port, proto)
|
||||
}
|
||||
|
||||
/// The port number
|
||||
pub fn num(&self) -> u16 {
|
||||
self.0
|
||||
}
|
||||
|
||||
/// The protocol of this port.
|
||||
pub fn proto(&self) -> PortProtocol {
|
||||
self.1
|
||||
}
|
||||
}
|
||||
|
||||
impl From<VirtualPort> for u16 {
|
||||
fn from(port: VirtualPort) -> Self {
|
||||
port.num()
|
||||
}
|
||||
}
|
||||
|
||||
impl From<&VirtualPort> for u16 {
|
||||
fn from(port: &VirtualPort) -> Self {
|
||||
port.num()
|
||||
}
|
||||
}
|
||||
|
||||
impl From<VirtualPort> for PortProtocol {
|
||||
fn from(port: VirtualPort) -> Self {
|
||||
port.proto()
|
||||
}
|
||||
}
|
||||
|
||||
impl From<&VirtualPort> for PortProtocol {
|
||||
fn from(port: &VirtualPort) -> Self {
|
||||
port.proto()
|
||||
}
|
||||
}
|
||||
pub struct VirtualPort(pub u16, pub PortProtocol);
|
||||
|
||||
impl Display for VirtualPort {
|
||||
fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
|
||||
write!(f, "[{}:{}]", self.num(), self.proto())
|
||||
write!(f, "[{}:{}]", self.0, self.1)
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,257 +1,282 @@
|
|||
use crate::config::{PortForwardConfig, PortProtocol};
|
||||
use crate::events::Event;
|
||||
use crate::virtual_device::VirtualIpDevice;
|
||||
use crate::virtual_iface::{VirtualInterfacePoll, VirtualPort};
|
||||
use crate::Bus;
|
||||
use crate::wg::WireGuardTunnel;
|
||||
use anyhow::Context;
|
||||
use async_trait::async_trait;
|
||||
use bytes::Bytes;
|
||||
use smoltcp::iface::PollResult;
|
||||
use smoltcp::{
|
||||
iface::{Config, Interface, SocketHandle, SocketSet},
|
||||
socket::tcp,
|
||||
time::Instant,
|
||||
wire::{HardwareAddress, IpAddress, IpCidr, IpVersion},
|
||||
};
|
||||
use std::{
|
||||
collections::{HashMap, HashSet, VecDeque},
|
||||
net::IpAddr,
|
||||
time::Duration,
|
||||
};
|
||||
use smoltcp::iface::InterfaceBuilder;
|
||||
use smoltcp::socket::{SocketSet, TcpSocket, TcpSocketBuffer, TcpState};
|
||||
use smoltcp::wire::{IpAddress, IpCidr};
|
||||
use std::sync::atomic::{AtomicBool, Ordering};
|
||||
use std::sync::Arc;
|
||||
use std::time::Duration;
|
||||
|
||||
const MAX_PACKET: usize = 65536;
|
||||
|
||||
/// A virtual interface for proxying Layer 7 data to Layer 3 packets, and vice-versa.
|
||||
pub struct TcpVirtualInterface {
|
||||
source_peer_ip: IpAddr,
|
||||
port_forwards: Vec<PortForwardConfig>,
|
||||
bus: Bus,
|
||||
sockets: SocketSet<'static>,
|
||||
/// The virtual port assigned to the virtual client, used to
|
||||
/// route Layer 4 segments/datagrams to and from the WireGuard tunnel.
|
||||
virtual_port: u16,
|
||||
/// The overall port-forward configuration: used for the destination address (on which
|
||||
/// the virtual server listens) and the protocol in use.
|
||||
port_forward: PortForwardConfig,
|
||||
/// The WireGuard tunnel to send IP packets to.
|
||||
wg: Arc<WireGuardTunnel>,
|
||||
/// Abort signal to shutdown the virtual interface and its parent task.
|
||||
abort: Arc<AtomicBool>,
|
||||
/// Channel sender for pushing Layer 7 data back to the real client.
|
||||
data_to_real_client_tx: tokio::sync::mpsc::Sender<Vec<u8>>,
|
||||
/// Channel receiver for processing Layer 7 data through the virtual interface.
|
||||
data_to_virtual_server_rx: tokio::sync::mpsc::Receiver<Vec<u8>>,
|
||||
/// One-shot sender to notify the parent task that the virtual client is ready to send Layer 7 data.
|
||||
virtual_client_ready_tx: tokio::sync::oneshot::Sender<()>,
|
||||
}
|
||||
|
||||
impl TcpVirtualInterface {
|
||||
/// Initialize the parameters for a new virtual interface.
|
||||
/// Use the `poll_loop()` future to start the virtual interface poll loop.
|
||||
pub fn new(port_forwards: Vec<PortForwardConfig>, bus: Bus, source_peer_ip: IpAddr) -> Self {
|
||||
pub fn new(
|
||||
virtual_port: u16,
|
||||
port_forward: PortForwardConfig,
|
||||
wg: Arc<WireGuardTunnel>,
|
||||
abort: Arc<AtomicBool>,
|
||||
data_to_real_client_tx: tokio::sync::mpsc::Sender<Vec<u8>>,
|
||||
data_to_virtual_server_rx: tokio::sync::mpsc::Receiver<Vec<u8>>,
|
||||
virtual_client_ready_tx: tokio::sync::oneshot::Sender<()>,
|
||||
) -> Self {
|
||||
Self {
|
||||
port_forwards: port_forwards
|
||||
.into_iter()
|
||||
.filter(|f| matches!(f.protocol, PortProtocol::Tcp))
|
||||
.collect(),
|
||||
source_peer_ip,
|
||||
bus,
|
||||
sockets: SocketSet::new([]),
|
||||
virtual_port,
|
||||
port_forward,
|
||||
wg,
|
||||
abort,
|
||||
data_to_real_client_tx,
|
||||
data_to_virtual_server_rx,
|
||||
virtual_client_ready_tx,
|
||||
}
|
||||
}
|
||||
|
||||
fn new_server_socket(port_forward: PortForwardConfig) -> anyhow::Result<tcp::Socket<'static>> {
|
||||
static mut TCP_SERVER_RX_DATA: [u8; 0] = [];
|
||||
static mut TCP_SERVER_TX_DATA: [u8; 0] = [];
|
||||
|
||||
let tcp_rx_buffer = tcp::SocketBuffer::new(unsafe { &mut TCP_SERVER_RX_DATA[..] });
|
||||
let tcp_tx_buffer = tcp::SocketBuffer::new(unsafe { &mut TCP_SERVER_TX_DATA[..] });
|
||||
let mut socket = tcp::Socket::new(tcp_rx_buffer, tcp_tx_buffer);
|
||||
|
||||
socket
|
||||
.listen((
|
||||
IpAddress::from(port_forward.destination.ip()),
|
||||
port_forward.destination.port(),
|
||||
))
|
||||
.context("Virtual server socket failed to listen")?;
|
||||
|
||||
Ok(socket)
|
||||
}
|
||||
|
||||
fn new_client_socket() -> anyhow::Result<tcp::Socket<'static>> {
|
||||
let rx_data = vec![0u8; MAX_PACKET];
|
||||
let tx_data = vec![0u8; MAX_PACKET];
|
||||
let tcp_rx_buffer = tcp::SocketBuffer::new(rx_data);
|
||||
let tcp_tx_buffer = tcp::SocketBuffer::new(tx_data);
|
||||
let socket = tcp::Socket::new(tcp_rx_buffer, tcp_tx_buffer);
|
||||
Ok(socket)
|
||||
}
|
||||
|
||||
fn addresses(&self) -> Vec<IpCidr> {
|
||||
let mut addresses = HashSet::new();
|
||||
addresses.insert(IpAddress::from(self.source_peer_ip));
|
||||
for config in self.port_forwards.iter() {
|
||||
addresses.insert(IpAddress::from(config.destination.ip()));
|
||||
}
|
||||
addresses
|
||||
.into_iter()
|
||||
.map(|addr| IpCidr::new(addr, addr_length(&addr)))
|
||||
.collect()
|
||||
}
|
||||
}
|
||||
|
||||
#[async_trait]
|
||||
impl VirtualInterfacePoll for TcpVirtualInterface {
|
||||
async fn poll_loop(mut self, mut device: VirtualIpDevice) -> anyhow::Result<()> {
|
||||
// Create CIDR block for source peer IP + each port forward IP
|
||||
let addresses = self.addresses();
|
||||
let config = Config::new(HardwareAddress::Ip);
|
||||
async fn poll_loop(self) -> anyhow::Result<()> {
|
||||
let mut virtual_client_ready_tx = Some(self.virtual_client_ready_tx);
|
||||
let mut data_to_virtual_server_rx = self.data_to_virtual_server_rx;
|
||||
let source_peer_ip = self.wg.source_peer_ip;
|
||||
|
||||
// Create virtual interface (contains smoltcp state machine)
|
||||
let mut iface = Interface::new(config, &mut device, Instant::now());
|
||||
iface.update_ip_addrs(|ip_addrs| {
|
||||
addresses.into_iter().for_each(|addr| {
|
||||
ip_addrs
|
||||
.push(addr)
|
||||
.expect("maximum number of IPs in TCP interface reached");
|
||||
});
|
||||
});
|
||||
// Create a device and interface to simulate IP packets
|
||||
// In essence:
|
||||
// * TCP packets received from the 'real' client are 'sent' to the 'virtual server' via the 'virtual client'
|
||||
// * Those TCP packets generate IP packets, which are captured from the interface and sent to the WireGuardTunnel
|
||||
// * IP packets received by the WireGuardTunnel (from the endpoint) are fed into this 'virtual interface'
|
||||
// * The interface processes those IP packets and routes them to the 'virtual client' (the rest is discarded)
|
||||
// * The TCP data read by the 'virtual client' is sent to the 'real' TCP client
|
||||
|
||||
// Create virtual server for each port forward
|
||||
for port_forward in self.port_forwards.iter() {
|
||||
let server_socket = TcpVirtualInterface::new_server_socket(*port_forward)?;
|
||||
self.sockets.add(server_socket);
|
||||
}
|
||||
// Consumer for IP packets to send through the virtual interface
|
||||
// Initialize the interface
|
||||
let device =
|
||||
VirtualIpDevice::new_direct(VirtualPort(self.virtual_port, PortProtocol::Tcp), self.wg)
|
||||
.with_context(|| "Failed to initialize TCP VirtualIpDevice")?;
|
||||
let mut virtual_interface = InterfaceBuilder::new(device)
|
||||
.ip_addrs([
|
||||
// Interface handles IP packets for the sender and recipient
|
||||
IpCidr::new(IpAddress::from(source_peer_ip), 32),
|
||||
IpCidr::new(IpAddress::from(self.port_forward.destination.ip()), 32),
|
||||
])
|
||||
.finalize();
|
||||
|
||||
// The next time to poll the interface. Can be None for instant poll.
|
||||
let mut next_poll: Option<tokio::time::Instant> = None;
|
||||
// Server socket: this is a placeholder for the interface to route new connections to.
|
||||
let server_socket: anyhow::Result<TcpSocket> = {
|
||||
static mut TCP_SERVER_RX_DATA: [u8; 0] = [];
|
||||
static mut TCP_SERVER_TX_DATA: [u8; 0] = [];
|
||||
let tcp_rx_buffer = TcpSocketBuffer::new(unsafe { &mut TCP_SERVER_RX_DATA[..] });
|
||||
let tcp_tx_buffer = TcpSocketBuffer::new(unsafe { &mut TCP_SERVER_TX_DATA[..] });
|
||||
let mut socket = TcpSocket::new(tcp_rx_buffer, tcp_tx_buffer);
|
||||
|
||||
// Bus endpoint to read events
|
||||
let mut endpoint = self.bus.new_endpoint();
|
||||
socket
|
||||
.listen((
|
||||
IpAddress::from(self.port_forward.destination.ip()),
|
||||
self.port_forward.destination.port(),
|
||||
))
|
||||
.with_context(|| "Virtual server socket failed to listen")?;
|
||||
|
||||
// Maps virtual port to its client socket handle
|
||||
let mut port_client_handle_map: HashMap<VirtualPort, SocketHandle> = HashMap::new();
|
||||
Ok(socket)
|
||||
};
|
||||
|
||||
// Data packets to send from a virtual client
|
||||
let mut send_queue: HashMap<VirtualPort, VecDeque<Bytes>> = HashMap::new();
|
||||
let client_socket: anyhow::Result<TcpSocket> = {
|
||||
let rx_data = vec![0u8; MAX_PACKET];
|
||||
let tx_data = vec![0u8; MAX_PACKET];
|
||||
let tcp_rx_buffer = TcpSocketBuffer::new(rx_data);
|
||||
let tcp_tx_buffer = TcpSocketBuffer::new(tx_data);
|
||||
let socket = TcpSocket::new(tcp_rx_buffer, tcp_tx_buffer);
|
||||
Ok(socket)
|
||||
};
|
||||
|
||||
// Socket set: there are always 2 sockets: 1 virtual client and 1 virtual server.
|
||||
let mut socket_set_entries: [_; 2] = Default::default();
|
||||
let mut socket_set = SocketSet::new(&mut socket_set_entries[..]);
|
||||
let _server_handle = socket_set.add(server_socket?);
|
||||
let client_handle = socket_set.add(client_socket?);
|
||||
|
||||
// Any data that wasn't sent because it was over the sending buffer limit
|
||||
let mut tx_extra = Vec::new();
|
||||
|
||||
// Counts the connection attempts by the virtual client
|
||||
let mut connection_attempts = 0;
|
||||
// Whether the client has successfully connected before. Prevents the case of connecting again.
|
||||
let mut has_connected = false;
|
||||
|
||||
loop {
|
||||
tokio::select! {
|
||||
_ = match (next_poll, port_client_handle_map.len()) {
|
||||
(None, 0) => tokio::time::sleep(Duration::MAX),
|
||||
(None, _) => tokio::time::sleep(Duration::ZERO),
|
||||
(Some(until), _) => tokio::time::sleep_until(until),
|
||||
} => {
|
||||
let loop_start = smoltcp::time::Instant::now();
|
||||
let loop_start = smoltcp::time::Instant::now();
|
||||
|
||||
// Find closed sockets
|
||||
port_client_handle_map.retain(|virtual_port, client_handle| {
|
||||
let client_socket = self.sockets.get_mut::<tcp::Socket>(*client_handle);
|
||||
if client_socket.state() == tcp::State::Closed {
|
||||
endpoint.send(Event::ClientConnectionDropped(*virtual_port));
|
||||
send_queue.remove(virtual_port);
|
||||
self.sockets.remove(*client_handle);
|
||||
false
|
||||
} else {
|
||||
// Not closed, retain
|
||||
true
|
||||
}
|
||||
});
|
||||
// Shutdown occurs when the real client closes the connection,
|
||||
// or if the client was in a CLOSE-WAIT state (after a server FIN) and had no data to send anymore.
|
||||
// One last poll-loop iteration is executed so that the RST segment can be dispatched.
|
||||
let shutdown = self.abort.load(Ordering::Relaxed);
|
||||
|
||||
if iface.poll(loop_start, &mut device, &mut self.sockets) == PollResult::SocketStateChanged {
|
||||
log::trace!("TCP virtual interface polled some packets to be processed");
|
||||
}
|
||||
if shutdown {
|
||||
// Shutdown: sends a RST packet.
|
||||
trace!("[{}] Shutting down virtual interface", self.virtual_port);
|
||||
let mut client_socket = socket_set.get::<TcpSocket>(client_handle);
|
||||
client_socket.abort();
|
||||
}
|
||||
|
||||
for (virtual_port, client_handle) in port_client_handle_map.iter() {
|
||||
let client_socket = self.sockets.get_mut::<tcp::Socket>(*client_handle);
|
||||
if client_socket.can_send() {
|
||||
if let Some(send_queue) = send_queue.get_mut(virtual_port) {
|
||||
let to_transfer = send_queue.pop_front();
|
||||
if let Some(to_transfer_slice) = to_transfer.as_deref() {
|
||||
let total = to_transfer_slice.len();
|
||||
match client_socket.send_slice(to_transfer_slice) {
|
||||
Ok(sent) => {
|
||||
if sent < total {
|
||||
// Sometimes only a subset is sent, so the rest needs to be sent on the next poll
|
||||
let tx_extra = Vec::from(&to_transfer_slice[sent..total]);
|
||||
send_queue.push_front(tx_extra.into());
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
error!(
|
||||
"Failed to send slice via virtual client socket: {:?}", e
|
||||
);
|
||||
}
|
||||
}
|
||||
} else if client_socket.state() == tcp::State::CloseWait {
|
||||
client_socket.close();
|
||||
}
|
||||
}
|
||||
}
|
||||
if client_socket.can_recv() {
|
||||
match client_socket.recv(|buffer| (buffer.len(), Bytes::from(buffer.to_vec()))) {
|
||||
Ok(data) => {
|
||||
debug!("[{}] Received {} bytes from virtual server", virtual_port, data.len());
|
||||
if !data.is_empty() {
|
||||
endpoint.send(Event::RemoteData(*virtual_port, data));
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
error!(
|
||||
"Failed to read from virtual client socket: {:?}", e
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The virtual interface determines the next time to poll (this is to reduce unnecessary polls)
|
||||
next_poll = match iface.poll_delay(loop_start, &self.sockets) {
|
||||
Some(smoltcp::time::Duration::ZERO) => None,
|
||||
Some(delay) => {
|
||||
trace!("TCP Virtual interface delayed next poll by {}", delay);
|
||||
Some(tokio::time::Instant::now() + Duration::from_millis(delay.total_millis()))
|
||||
},
|
||||
None => None,
|
||||
};
|
||||
match virtual_interface.poll(&mut socket_set, loop_start) {
|
||||
Ok(processed) if processed => {
|
||||
trace!(
|
||||
"[{}] Virtual interface polled some packets to be processed",
|
||||
self.virtual_port
|
||||
);
|
||||
}
|
||||
event = endpoint.recv() => {
|
||||
match event {
|
||||
Event::ClientConnectionInitiated(port_forward, virtual_port) => {
|
||||
let client_socket = TcpVirtualInterface::new_client_socket()?;
|
||||
let client_handle = self.sockets.add(client_socket);
|
||||
Err(e) => {
|
||||
error!(
|
||||
"[{}] Virtual interface poll error: {:?}",
|
||||
self.virtual_port, e
|
||||
);
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
|
||||
// Add handle to map
|
||||
port_client_handle_map.insert(virtual_port, client_handle);
|
||||
send_queue.insert(virtual_port, VecDeque::new());
|
||||
{
|
||||
let mut client_socket = socket_set.get::<TcpSocket>(client_handle);
|
||||
|
||||
let client_socket = self.sockets.get_mut::<tcp::Socket>(client_handle);
|
||||
let context = iface.context();
|
||||
|
||||
client_socket
|
||||
.connect(
|
||||
context,
|
||||
(
|
||||
IpAddress::from(port_forward.destination.ip()),
|
||||
port_forward.destination.port(),
|
||||
),
|
||||
(IpAddress::from(self.source_peer_ip), virtual_port.num()),
|
||||
)
|
||||
.context("Virtual server socket failed to listen")?;
|
||||
|
||||
next_poll = None;
|
||||
if !shutdown && client_socket.state() == TcpState::Closed && !has_connected {
|
||||
// Not shutting down, but the client socket is closed, and the client never successfully connected.
|
||||
if connection_attempts < 10 {
|
||||
// Try to connect
|
||||
client_socket
|
||||
.connect(
|
||||
(
|
||||
IpAddress::from(self.port_forward.destination.ip()),
|
||||
self.port_forward.destination.port(),
|
||||
),
|
||||
(IpAddress::from(source_peer_ip), self.virtual_port),
|
||||
)
|
||||
.with_context(|| "Virtual server socket failed to listen")?;
|
||||
if connection_attempts > 0 {
|
||||
debug!(
|
||||
"[{}] Virtual client retrying connection in 500ms",
|
||||
self.virtual_port
|
||||
);
|
||||
// Not our first connection attempt, wait a little bit.
|
||||
tokio::time::sleep(Duration::from_millis(500)).await;
|
||||
}
|
||||
Event::ClientConnectionDropped(virtual_port) => {
|
||||
if let Some(client_handle) = port_client_handle_map.get(&virtual_port) {
|
||||
let client_socket = self.sockets.get_mut::<tcp::Socket>(*client_handle);
|
||||
client_socket.close();
|
||||
next_poll = None;
|
||||
} else {
|
||||
// Too many connection attempts
|
||||
self.abort.store(true, Ordering::Relaxed);
|
||||
}
|
||||
connection_attempts += 1;
|
||||
continue;
|
||||
}
|
||||
|
||||
if client_socket.state() == TcpState::Established {
|
||||
// Prevent reconnection if the server later closes.
|
||||
has_connected = true;
|
||||
}
|
||||
|
||||
if client_socket.can_recv() {
|
||||
match client_socket.recv(|buffer| (buffer.len(), buffer.to_vec())) {
|
||||
Ok(data) => {
|
||||
trace!(
|
||||
"[{}] Virtual client received {} bytes of data",
|
||||
self.virtual_port,
|
||||
data.len()
|
||||
);
|
||||
// Send it to the real client
|
||||
if let Err(e) = self.data_to_real_client_tx.send(data).await {
|
||||
error!("[{}] Failed to dispatch data from virtual client to real client: {:?}", self.virtual_port, e);
|
||||
}
|
||||
}
|
||||
Event::LocalData(_, virtual_port, data) if send_queue.contains_key(&virtual_port) => {
|
||||
if let Some(send_queue) = send_queue.get_mut(&virtual_port) {
|
||||
send_queue.push_back(data);
|
||||
next_poll = None;
|
||||
Err(e) => {
|
||||
error!(
|
||||
"[{}] Failed to read from virtual client socket: {:?}",
|
||||
self.virtual_port, e
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
if client_socket.can_send() {
|
||||
if let Some(virtual_client_ready_tx) = virtual_client_ready_tx.take() {
|
||||
virtual_client_ready_tx
|
||||
.send(())
|
||||
.expect("Failed to notify real client that virtual client is ready");
|
||||
}
|
||||
|
||||
let mut to_transfer = None;
|
||||
|
||||
if tx_extra.is_empty() {
|
||||
// The payload segment from the previous loop is complete,
|
||||
// we can now read the next payload in the queue.
|
||||
if let Ok(data) = data_to_virtual_server_rx.try_recv() {
|
||||
to_transfer = Some(data);
|
||||
} else if client_socket.state() == TcpState::CloseWait {
|
||||
// No data to be sent in this loop. If the client state is CLOSE-WAIT (because of a server FIN),
|
||||
// the interface is shutdown.
|
||||
trace!("[{}] Shutting down virtual interface because client sent no more data, and server sent FIN (CLOSE-WAIT)", self.virtual_port);
|
||||
self.abort.store(true, Ordering::Relaxed);
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
let to_transfer_slice = to_transfer.as_ref().unwrap_or(&tx_extra).as_slice();
|
||||
if !to_transfer_slice.is_empty() {
|
||||
let total = to_transfer_slice.len();
|
||||
match client_socket.send_slice(to_transfer_slice) {
|
||||
Ok(sent) => {
|
||||
trace!(
|
||||
"[{}] Sent {}/{} bytes via virtual client socket",
|
||||
self.virtual_port,
|
||||
sent,
|
||||
total,
|
||||
);
|
||||
tx_extra = Vec::from(&to_transfer_slice[sent..total]);
|
||||
}
|
||||
Err(e) => {
|
||||
error!(
|
||||
"[{}] Failed to send slice via virtual client socket: {:?}",
|
||||
self.virtual_port, e
|
||||
);
|
||||
}
|
||||
}
|
||||
Event::VirtualDeviceFed(PortProtocol::Tcp) => {
|
||||
next_poll = None;
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const fn addr_length(addr: &IpAddress) -> u8 {
|
||||
match addr.version() {
|
||||
IpVersion::Ipv4 => 32,
|
||||
IpVersion::Ipv6 => 128,
|
||||
if shutdown {
|
||||
break;
|
||||
}
|
||||
|
||||
match virtual_interface.poll_delay(&socket_set, loop_start) {
|
||||
Some(smoltcp::time::Duration::ZERO) => {
|
||||
continue;
|
||||
}
|
||||
_ => {
|
||||
tokio::time::sleep(Duration::from_millis(1)).await;
|
||||
}
|
||||
}
|
||||
}
|
||||
trace!("[{}] Virtual interface task terminated", self.virtual_port);
|
||||
self.abort.store(true, Ordering::Relaxed);
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,227 +1,201 @@
|
|||
use anyhow::Context;
|
||||
use std::collections::HashMap;
|
||||
use std::sync::Arc;
|
||||
use std::time::Duration;
|
||||
|
||||
use async_trait::async_trait;
|
||||
use smoltcp::iface::InterfaceBuilder;
|
||||
use smoltcp::socket::{SocketHandle, SocketSet, UdpPacketMetadata, UdpSocket, UdpSocketBuffer};
|
||||
use smoltcp::wire::{IpAddress, IpCidr};
|
||||
|
||||
use crate::config::PortForwardConfig;
|
||||
use crate::events::Event;
|
||||
use crate::virtual_device::VirtualIpDevice;
|
||||
use crate::virtual_iface::{VirtualInterfacePoll, VirtualPort};
|
||||
use crate::{Bus, PortProtocol};
|
||||
use anyhow::Context;
|
||||
use async_trait::async_trait;
|
||||
use bytes::Bytes;
|
||||
use smoltcp::iface::PollResult;
|
||||
use smoltcp::{
|
||||
iface::{Config, Interface, SocketHandle, SocketSet},
|
||||
socket::udp::{self, UdpMetadata},
|
||||
time::Instant,
|
||||
wire::{HardwareAddress, IpAddress, IpCidr, IpVersion},
|
||||
};
|
||||
use std::{
|
||||
collections::{HashMap, HashSet, VecDeque},
|
||||
net::IpAddr,
|
||||
time::Duration,
|
||||
};
|
||||
use crate::wg::{WireGuardTunnel, DISPATCH_CAPACITY};
|
||||
|
||||
const MAX_PACKET: usize = 65536;
|
||||
|
||||
pub struct UdpVirtualInterface {
|
||||
source_peer_ip: IpAddr,
|
||||
port_forwards: Vec<PortForwardConfig>,
|
||||
bus: Bus,
|
||||
sockets: SocketSet<'static>,
|
||||
port_forward: PortForwardConfig,
|
||||
wg: Arc<WireGuardTunnel>,
|
||||
data_to_real_client_tx: tokio::sync::mpsc::Sender<(VirtualPort, Vec<u8>)>,
|
||||
data_to_virtual_server_rx: tokio::sync::mpsc::Receiver<(VirtualPort, Vec<u8>)>,
|
||||
}
|
||||
|
||||
impl UdpVirtualInterface {
|
||||
/// Initialize the parameters for a new virtual interface.
|
||||
/// Use the `poll_loop()` future to start the virtual interface poll loop.
|
||||
pub fn new(port_forwards: Vec<PortForwardConfig>, bus: Bus, source_peer_ip: IpAddr) -> Self {
|
||||
pub fn new(
|
||||
port_forward: PortForwardConfig,
|
||||
wg: Arc<WireGuardTunnel>,
|
||||
data_to_real_client_tx: tokio::sync::mpsc::Sender<(VirtualPort, Vec<u8>)>,
|
||||
data_to_virtual_server_rx: tokio::sync::mpsc::Receiver<(VirtualPort, Vec<u8>)>,
|
||||
) -> Self {
|
||||
Self {
|
||||
port_forwards: port_forwards
|
||||
.into_iter()
|
||||
.filter(|f| matches!(f.protocol, PortProtocol::Udp))
|
||||
.collect(),
|
||||
source_peer_ip,
|
||||
bus,
|
||||
sockets: SocketSet::new([]),
|
||||
port_forward,
|
||||
wg,
|
||||
data_to_real_client_tx,
|
||||
data_to_virtual_server_rx,
|
||||
}
|
||||
}
|
||||
|
||||
fn new_server_socket(port_forward: PortForwardConfig) -> anyhow::Result<udp::Socket<'static>> {
|
||||
static mut UDP_SERVER_RX_META: [udp::PacketMetadata; 0] = [];
|
||||
static mut UDP_SERVER_RX_DATA: [u8; 0] = [];
|
||||
static mut UDP_SERVER_TX_META: [udp::PacketMetadata; 0] = [];
|
||||
static mut UDP_SERVER_TX_DATA: [u8; 0] = [];
|
||||
let udp_rx_buffer =
|
||||
udp::PacketBuffer::new(unsafe { &mut UDP_SERVER_RX_META[..] }, unsafe {
|
||||
&mut UDP_SERVER_RX_DATA[..]
|
||||
});
|
||||
let udp_tx_buffer =
|
||||
udp::PacketBuffer::new(unsafe { &mut UDP_SERVER_TX_META[..] }, unsafe {
|
||||
&mut UDP_SERVER_TX_DATA[..]
|
||||
});
|
||||
let mut socket = udp::Socket::new(udp_rx_buffer, udp_tx_buffer);
|
||||
socket
|
||||
.bind((
|
||||
IpAddress::from(port_forward.destination.ip()),
|
||||
port_forward.destination.port(),
|
||||
))
|
||||
.context("UDP virtual server socket failed to bind")?;
|
||||
Ok(socket)
|
||||
}
|
||||
|
||||
fn new_client_socket(
|
||||
source_peer_ip: IpAddr,
|
||||
client_port: VirtualPort,
|
||||
) -> anyhow::Result<udp::Socket<'static>> {
|
||||
let rx_meta = vec![udp::PacketMetadata::EMPTY; 10];
|
||||
let tx_meta = vec![udp::PacketMetadata::EMPTY; 10];
|
||||
let rx_data = vec![0u8; MAX_PACKET];
|
||||
let tx_data = vec![0u8; MAX_PACKET];
|
||||
let udp_rx_buffer = udp::PacketBuffer::new(rx_meta, rx_data);
|
||||
let udp_tx_buffer = udp::PacketBuffer::new(tx_meta, tx_data);
|
||||
let mut socket = udp::Socket::new(udp_rx_buffer, udp_tx_buffer);
|
||||
socket
|
||||
.bind((IpAddress::from(source_peer_ip), client_port.num()))
|
||||
.context("UDP virtual client failed to bind")?;
|
||||
Ok(socket)
|
||||
}
|
||||
|
||||
fn addresses(&self) -> Vec<IpCidr> {
|
||||
let mut addresses = HashSet::new();
|
||||
addresses.insert(IpAddress::from(self.source_peer_ip));
|
||||
for config in self.port_forwards.iter() {
|
||||
addresses.insert(IpAddress::from(config.destination.ip()));
|
||||
}
|
||||
addresses
|
||||
.into_iter()
|
||||
.map(|addr| IpCidr::new(addr, addr_length(&addr)))
|
||||
.collect()
|
||||
}
|
||||
}
|
||||
|
||||
#[async_trait]
|
||||
impl VirtualInterfacePoll for UdpVirtualInterface {
|
||||
async fn poll_loop(mut self, mut device: VirtualIpDevice) -> anyhow::Result<()> {
|
||||
// Create CIDR block for source peer IP + each port forward IP
|
||||
let addresses = self.addresses();
|
||||
let config = Config::new(HardwareAddress::Ip);
|
||||
async fn poll_loop(self) -> anyhow::Result<()> {
|
||||
// Data receiver to dispatch using virtual client sockets
|
||||
let mut data_to_virtual_server_rx = self.data_to_virtual_server_rx;
|
||||
|
||||
// Create virtual interface (contains smoltcp state machine)
|
||||
let mut iface = Interface::new(config, &mut device, Instant::now());
|
||||
iface.update_ip_addrs(|ip_addrs| {
|
||||
addresses.into_iter().for_each(|addr| {
|
||||
ip_addrs
|
||||
.push(addr)
|
||||
.expect("maximum number of IPs in UDP interface reached");
|
||||
});
|
||||
});
|
||||
// The IP to bind client sockets to
|
||||
let source_peer_ip = self.wg.source_peer_ip;
|
||||
|
||||
// Create virtual server for each port forward
|
||||
for port_forward in self.port_forwards.iter() {
|
||||
let server_socket = UdpVirtualInterface::new_server_socket(*port_forward)?;
|
||||
self.sockets.add(server_socket);
|
||||
}
|
||||
// The IP/port to bind the server socket to
|
||||
let destination = self.port_forward.destination;
|
||||
|
||||
// The next time to poll the interface. Can be None for instant poll.
|
||||
// Initialize a channel for IP packets.
|
||||
// The "base transmitted" is cloned so that each virtual port can register a sender in the tunnel.
|
||||
// The receiver is given to the device so that the Virtual Interface can process incoming IP packets from the tunnel.
|
||||
let (base_ip_dispatch_tx, ip_dispatch_rx) = tokio::sync::mpsc::channel(DISPATCH_CAPACITY);
|
||||
|
||||
let device = VirtualIpDevice::new(self.wg.clone(), ip_dispatch_rx);
|
||||
let mut virtual_interface = InterfaceBuilder::new(device)
|
||||
.ip_addrs([
|
||||
// Interface handles IP packets for the sender and recipient
|
||||
IpCidr::new(source_peer_ip.into(), 32),
|
||||
IpCidr::new(destination.ip().into(), 32),
|
||||
])
|
||||
.finalize();
|
||||
|
||||
// Server socket: this is a placeholder for the interface.
|
||||
let server_socket: anyhow::Result<UdpSocket> = {
|
||||
static mut UDP_SERVER_RX_META: [UdpPacketMetadata; 0] = [];
|
||||
static mut UDP_SERVER_RX_DATA: [u8; 0] = [];
|
||||
static mut UDP_SERVER_TX_META: [UdpPacketMetadata; 0] = [];
|
||||
static mut UDP_SERVER_TX_DATA: [u8; 0] = [];
|
||||
let udp_rx_buffer =
|
||||
UdpSocketBuffer::new(unsafe { &mut UDP_SERVER_RX_META[..] }, unsafe {
|
||||
&mut UDP_SERVER_RX_DATA[..]
|
||||
});
|
||||
let udp_tx_buffer =
|
||||
UdpSocketBuffer::new(unsafe { &mut UDP_SERVER_TX_META[..] }, unsafe {
|
||||
&mut UDP_SERVER_TX_DATA[..]
|
||||
});
|
||||
let mut socket = UdpSocket::new(udp_rx_buffer, udp_tx_buffer);
|
||||
|
||||
socket
|
||||
.bind((IpAddress::from(destination.ip()), destination.port()))
|
||||
.with_context(|| "UDP virtual server socket failed to listen")?;
|
||||
|
||||
Ok(socket)
|
||||
};
|
||||
|
||||
let mut socket_set = SocketSet::new(vec![]);
|
||||
let _server_handle = socket_set.add(server_socket?);
|
||||
|
||||
// A map of virtual port to client socket.
|
||||
let mut client_sockets: HashMap<VirtualPort, SocketHandle> = HashMap::new();
|
||||
|
||||
// The next instant required to poll the virtual interface
|
||||
// None means "immediate poll required".
|
||||
let mut next_poll: Option<tokio::time::Instant> = None;
|
||||
|
||||
// Bus endpoint to read events
|
||||
let mut endpoint = self.bus.new_endpoint();
|
||||
|
||||
// Maps virtual port to its client socket handle
|
||||
let mut port_client_handle_map: HashMap<VirtualPort, SocketHandle> = HashMap::new();
|
||||
|
||||
// Data packets to send from a virtual client
|
||||
let mut send_queue: HashMap<VirtualPort, VecDeque<(PortForwardConfig, Bytes)>> =
|
||||
HashMap::new();
|
||||
|
||||
loop {
|
||||
let wg = self.wg.clone();
|
||||
tokio::select! {
|
||||
_ = match (next_poll, port_client_handle_map.len()) {
|
||||
(None, 0) => tokio::time::sleep(Duration::MAX),
|
||||
(None, _) => tokio::time::sleep(Duration::ZERO),
|
||||
(Some(until), _) => tokio::time::sleep_until(until),
|
||||
// Wait the recommended amount of time by smoltcp, and poll again.
|
||||
_ = match next_poll {
|
||||
None => tokio::time::sleep(Duration::ZERO),
|
||||
Some(until) => tokio::time::sleep_until(until)
|
||||
} => {
|
||||
let loop_start = smoltcp::time::Instant::now();
|
||||
|
||||
if iface.poll(loop_start, &mut device, &mut self.sockets) == PollResult::SocketStateChanged {
|
||||
log::trace!("UDP virtual interface polled some packets to be processed");
|
||||
}
|
||||
|
||||
for (virtual_port, client_handle) in port_client_handle_map.iter() {
|
||||
let client_socket = self.sockets.get_mut::<udp::Socket>(*client_handle);
|
||||
if client_socket.can_send() {
|
||||
if let Some(send_queue) = send_queue.get_mut(virtual_port) {
|
||||
let to_transfer = send_queue.pop_front();
|
||||
if let Some((port_forward, data)) = to_transfer {
|
||||
client_socket
|
||||
.send_slice(
|
||||
&data,
|
||||
UdpMetadata::from(port_forward.destination),
|
||||
)
|
||||
.unwrap_or_else(|e| {
|
||||
error!(
|
||||
"[{}] Failed to send data to virtual server: {:?}",
|
||||
virtual_port, e
|
||||
);
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
if client_socket.can_recv() {
|
||||
match client_socket.recv() {
|
||||
Ok((data, _peer)) => {
|
||||
if !data.is_empty() {
|
||||
endpoint.send(Event::RemoteData(*virtual_port, data.to_vec().into()));
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
error!(
|
||||
"Failed to read from virtual client socket: {:?}", e
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The virtual interface determines the next time to poll (this is to reduce unnecessary polls)
|
||||
next_poll = match iface.poll_delay(loop_start, &self.sockets) {
|
||||
Some(smoltcp::time::Duration::ZERO) => None,
|
||||
Some(delay) => {
|
||||
trace!("UDP Virtual interface delayed next poll by {}", delay);
|
||||
Some(tokio::time::Instant::now() + Duration::from_millis(delay.total_millis()))
|
||||
},
|
||||
None => None,
|
||||
};
|
||||
}
|
||||
event = endpoint.recv() => {
|
||||
match event {
|
||||
Event::LocalData(port_forward, virtual_port, data) => {
|
||||
if let Some(send_queue) = send_queue.get_mut(&virtual_port) {
|
||||
// Client socket already exists
|
||||
send_queue.push_back((port_forward, data));
|
||||
} else {
|
||||
// Client socket does not exist
|
||||
let client_socket = UdpVirtualInterface::new_client_socket(self.source_peer_ip, virtual_port)?;
|
||||
let client_handle = self.sockets.add(client_socket);
|
||||
|
||||
// Add handle to map
|
||||
port_client_handle_map.insert(virtual_port, client_handle);
|
||||
send_queue.insert(virtual_port, VecDeque::from(vec![(port_forward, data)]));
|
||||
}
|
||||
next_poll = None;
|
||||
}
|
||||
Event::VirtualDeviceFed(PortProtocol::Udp) => {
|
||||
next_poll = None;
|
||||
match virtual_interface.poll(&mut socket_set, loop_start) {
|
||||
Ok(processed) if processed => {
|
||||
trace!("UDP virtual interface polled some packets to be processed");
|
||||
}
|
||||
Err(e) => error!("UDP virtual interface poll error: {:?}", e),
|
||||
_ => {}
|
||||
}
|
||||
|
||||
// Loop through each client socket and check if there is any data to send back
|
||||
// to the real client.
|
||||
for (virtual_port, client_socket_handle) in client_sockets.iter() {
|
||||
let mut client_socket = socket_set.get::<UdpSocket>(*client_socket_handle);
|
||||
match client_socket.recv() {
|
||||
Ok((data, _peer)) => {
|
||||
// Send the data back to the real client using MPSC channel
|
||||
self.data_to_real_client_tx
|
||||
.send((*virtual_port, data.to_vec()))
|
||||
.await
|
||||
.unwrap_or_else(|e| {
|
||||
error!(
|
||||
"[{}] Failed to dispatch data from virtual client to real client: {:?}",
|
||||
virtual_port, e
|
||||
);
|
||||
});
|
||||
}
|
||||
Err(smoltcp::Error::Exhausted) => {}
|
||||
Err(e) => {
|
||||
error!(
|
||||
"[{}] Failed to read from virtual client socket: {:?}",
|
||||
virtual_port, e
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
next_poll = match virtual_interface.poll_delay(&socket_set, loop_start) {
|
||||
Some(smoltcp::time::Duration::ZERO) => None,
|
||||
Some(delay) => Some(tokio::time::Instant::now() + Duration::from_millis(delay.millis())),
|
||||
None => None,
|
||||
}
|
||||
}
|
||||
// Wait for data to be received from the real client
|
||||
data_recv_result = data_to_virtual_server_rx.recv() => {
|
||||
if let Some((client_port, data)) = data_recv_result {
|
||||
// Register the socket in WireGuard Tunnel (overrides any previous registration as well)
|
||||
wg.register_virtual_interface(client_port, base_ip_dispatch_tx.clone())
|
||||
.unwrap_or_else(|e| {
|
||||
error!(
|
||||
"[{}] Failed to register UDP socket in WireGuard tunnel: {:?}",
|
||||
client_port, e
|
||||
);
|
||||
});
|
||||
|
||||
let client_socket_handle = client_sockets.entry(client_port).or_insert_with(|| {
|
||||
let rx_meta = vec![UdpPacketMetadata::EMPTY; 10];
|
||||
let tx_meta = vec![UdpPacketMetadata::EMPTY; 10];
|
||||
let rx_data = vec![0u8; MAX_PACKET];
|
||||
let tx_data = vec![0u8; MAX_PACKET];
|
||||
let udp_rx_buffer = UdpSocketBuffer::new(rx_meta, rx_data);
|
||||
let udp_tx_buffer = UdpSocketBuffer::new(tx_meta, tx_data);
|
||||
let mut socket = UdpSocket::new(udp_rx_buffer, udp_tx_buffer);
|
||||
|
||||
socket
|
||||
.bind((IpAddress::from(wg.source_peer_ip), client_port.0))
|
||||
.unwrap_or_else(|e| {
|
||||
error!(
|
||||
"[{}] UDP virtual client socket failed to bind: {:?}",
|
||||
client_port, e
|
||||
);
|
||||
});
|
||||
|
||||
socket_set.add(socket)
|
||||
});
|
||||
|
||||
let mut client_socket = socket_set.get::<UdpSocket>(*client_socket_handle);
|
||||
client_socket
|
||||
.send_slice(
|
||||
&data,
|
||||
(IpAddress::from(destination.ip()), destination.port()).into(),
|
||||
)
|
||||
.unwrap_or_else(|e| {
|
||||
error!(
|
||||
"[{}] Failed to send data to virtual server: {:?}",
|
||||
client_port, e
|
||||
);
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const fn addr_length(addr: &IpAddress) -> u8 {
|
||||
match addr.version() {
|
||||
IpVersion::Ipv4 => 32,
|
||||
IpVersion::Ipv6 => 128,
|
||||
}
|
||||
}
|
||||
|
|
|
|||
311
src/wg.rs
311
src/wg.rs
|
|
@ -1,18 +1,15 @@
|
|||
use std::net::{IpAddr, SocketAddr};
|
||||
use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
|
||||
use std::time::Duration;
|
||||
|
||||
use crate::Bus;
|
||||
use anyhow::Context;
|
||||
use async_recursion::async_recursion;
|
||||
use boringtun::noise::errors::WireGuardError;
|
||||
use boringtun::noise::{Tunn, TunnResult};
|
||||
use log::Level;
|
||||
use smoltcp::wire::{IpProtocol, IpVersion, Ipv4Packet, Ipv6Packet};
|
||||
use smoltcp::wire::{IpProtocol, IpVersion, Ipv4Packet, Ipv6Packet, TcpPacket, UdpPacket};
|
||||
use tokio::net::UdpSocket;
|
||||
use tokio::sync::Mutex;
|
||||
use tokio::sync::RwLock;
|
||||
|
||||
use crate::config::{Config, PortProtocol};
|
||||
use crate::events::Event;
|
||||
use crate::virtual_iface::VirtualPort;
|
||||
|
||||
/// The capacity of the channel for received IP packets.
|
||||
pub const DISPATCH_CAPACITY: usize = 1_000;
|
||||
|
|
@ -24,31 +21,35 @@ const MAX_PACKET: usize = 65536;
|
|||
pub struct WireGuardTunnel {
|
||||
pub(crate) source_peer_ip: IpAddr,
|
||||
/// `boringtun` peer/tunnel implementation, used for crypto & WG protocol.
|
||||
peer: Mutex<Box<Tunn>>,
|
||||
peer: Box<Tunn>,
|
||||
/// The UDP socket for the public WireGuard endpoint to connect to.
|
||||
udp: UdpSocket,
|
||||
/// The address of the public WireGuard endpoint (UDP).
|
||||
pub(crate) endpoint: SocketAddr,
|
||||
/// Event bus
|
||||
bus: Bus,
|
||||
/// Maps virtual ports to the corresponding IP packet dispatcher.
|
||||
virtual_port_ip_tx: dashmap::DashMap<VirtualPort, tokio::sync::mpsc::Sender<Vec<u8>>>,
|
||||
/// IP packet dispatcher for unroutable packets. `None` if not initialized.
|
||||
sink_ip_tx: RwLock<Option<tokio::sync::mpsc::Sender<Vec<u8>>>>,
|
||||
}
|
||||
|
||||
impl WireGuardTunnel {
|
||||
/// Initialize a new WireGuard tunnel.
|
||||
pub async fn new(config: &Config, bus: Bus) -> anyhow::Result<Self> {
|
||||
pub async fn new(config: &Config) -> anyhow::Result<Self> {
|
||||
let source_peer_ip = config.source_peer_ip;
|
||||
let peer = Mutex::new(Box::new(Self::create_tunnel(config)?));
|
||||
let endpoint = config.endpoint_addr;
|
||||
let udp = UdpSocket::bind(config.endpoint_bind_addr)
|
||||
let peer = Self::create_tunnel(config)?;
|
||||
let udp = UdpSocket::bind("0.0.0.0:0")
|
||||
.await
|
||||
.context("Failed to create UDP socket for WireGuard connection")?;
|
||||
.with_context(|| "Failed to create UDP socket for WireGuard connection")?;
|
||||
let endpoint = config.endpoint_addr;
|
||||
let virtual_port_ip_tx = Default::default();
|
||||
|
||||
Ok(Self {
|
||||
source_peer_ip,
|
||||
peer,
|
||||
udp,
|
||||
endpoint,
|
||||
bus,
|
||||
virtual_port_ip_tx,
|
||||
sink_ip_tx: RwLock::new(None),
|
||||
})
|
||||
}
|
||||
|
||||
|
|
@ -56,16 +57,12 @@ impl WireGuardTunnel {
|
|||
pub async fn send_ip_packet(&self, packet: &[u8]) -> anyhow::Result<()> {
|
||||
trace_ip_packet("Sending IP packet", packet);
|
||||
let mut send_buf = [0u8; MAX_PACKET];
|
||||
let encapsulate_result = {
|
||||
let mut peer = self.peer.lock().await;
|
||||
peer.encapsulate(packet, &mut send_buf)
|
||||
};
|
||||
match encapsulate_result {
|
||||
match self.peer.encapsulate(packet, &mut send_buf) {
|
||||
TunnResult::WriteToNetwork(packet) => {
|
||||
self.udp
|
||||
.send_to(packet, self.endpoint)
|
||||
.await
|
||||
.context("Failed to send encrypted IP packet to WireGuard endpoint.")?;
|
||||
.with_context(|| "Failed to send encrypted IP packet to WireGuard endpoint.")?;
|
||||
debug!(
|
||||
"Sent {} bytes to WireGuard endpoint (encrypted IP packet)",
|
||||
packet.len()
|
||||
|
|
@ -87,20 +84,31 @@ impl WireGuardTunnel {
|
|||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn produce_task(&self) -> ! {
|
||||
trace!("Starting WireGuard production task");
|
||||
let mut endpoint = self.bus.new_endpoint();
|
||||
/// Register a virtual interface (using its assigned virtual port) with the given IP packet `Sender`.
|
||||
pub fn register_virtual_interface(
|
||||
&self,
|
||||
virtual_port: VirtualPort,
|
||||
sender: tokio::sync::mpsc::Sender<Vec<u8>>,
|
||||
) -> anyhow::Result<()> {
|
||||
self.virtual_port_ip_tx.insert(virtual_port, sender);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
loop {
|
||||
if let Event::OutboundInternetPacket(data) = endpoint.recv().await {
|
||||
match self.send_ip_packet(&data).await {
|
||||
Ok(_) => {}
|
||||
Err(e) => {
|
||||
error!("{:?}", e);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
/// Register a virtual interface (using its assigned virtual port) with the given IP packet `Sender`.
|
||||
pub async fn register_sink_interface(
|
||||
&self,
|
||||
) -> anyhow::Result<tokio::sync::mpsc::Receiver<Vec<u8>>> {
|
||||
let (sender, receiver) = tokio::sync::mpsc::channel(DISPATCH_CAPACITY);
|
||||
|
||||
let mut sink_ip_tx = self.sink_ip_tx.write().await;
|
||||
*sink_ip_tx = Some(sender);
|
||||
|
||||
Ok(receiver)
|
||||
}
|
||||
|
||||
/// Releases the virtual interface from IP dispatch.
|
||||
pub fn release_virtual_interface(&self, virtual_port: VirtualPort) {
|
||||
self.virtual_port_ip_tx.remove(&virtual_port);
|
||||
}
|
||||
|
||||
/// WireGuard Routine task. Handles Handshake, keep-alive, etc.
|
||||
|
|
@ -109,62 +117,43 @@ impl WireGuardTunnel {
|
|||
|
||||
loop {
|
||||
let mut send_buf = [0u8; MAX_PACKET];
|
||||
let tun_result = { self.peer.lock().await.update_timers(&mut send_buf) };
|
||||
self.handle_routine_tun_result(tun_result).await;
|
||||
match self.peer.update_timers(&mut send_buf) {
|
||||
TunnResult::WriteToNetwork(packet) => {
|
||||
debug!(
|
||||
"Sending routine packet of {} bytes to WireGuard endpoint",
|
||||
packet.len()
|
||||
);
|
||||
match self.udp.send_to(packet, self.endpoint).await {
|
||||
Ok(_) => {}
|
||||
Err(e) => {
|
||||
error!(
|
||||
"Failed to send routine packet to WireGuard endpoint: {:?}",
|
||||
e
|
||||
);
|
||||
}
|
||||
};
|
||||
}
|
||||
TunnResult::Err(e) => {
|
||||
error!(
|
||||
"Failed to prepare routine packet for WireGuard endpoint: {:?}",
|
||||
e
|
||||
);
|
||||
}
|
||||
TunnResult::Done => {
|
||||
// Sleep for a bit
|
||||
tokio::time::sleep(Duration::from_millis(1)).await;
|
||||
}
|
||||
other => {
|
||||
warn!("Unexpected WireGuard routine task state: {:?}", other);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[async_recursion]
|
||||
async fn handle_routine_tun_result<'a: 'async_recursion>(&self, result: TunnResult<'a>) -> () {
|
||||
match result {
|
||||
TunnResult::WriteToNetwork(packet) => {
|
||||
debug!(
|
||||
"Sending routine packet of {} bytes to WireGuard endpoint",
|
||||
packet.len()
|
||||
);
|
||||
match self.udp.send_to(packet, self.endpoint).await {
|
||||
Ok(_) => {}
|
||||
Err(e) => {
|
||||
error!(
|
||||
"Failed to send routine packet to WireGuard endpoint: {:?}",
|
||||
e
|
||||
);
|
||||
}
|
||||
};
|
||||
}
|
||||
TunnResult::Err(WireGuardError::ConnectionExpired) => {
|
||||
warn!("Wireguard handshake has expired!");
|
||||
|
||||
let mut buf = vec![0u8; MAX_PACKET];
|
||||
let result = self
|
||||
.peer
|
||||
.lock()
|
||||
.await
|
||||
.format_handshake_initiation(&mut buf[..], false);
|
||||
|
||||
self.handle_routine_tun_result(result).await
|
||||
}
|
||||
TunnResult::Err(e) => {
|
||||
error!(
|
||||
"Failed to prepare routine packet for WireGuard endpoint: {:?}",
|
||||
e
|
||||
);
|
||||
}
|
||||
TunnResult::Done => {
|
||||
// Sleep for a bit
|
||||
tokio::time::sleep(Duration::from_millis(1)).await;
|
||||
}
|
||||
other => {
|
||||
warn!("Unexpected WireGuard routine task state: {:?}", other);
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
/// WireGuard consumption task. Receives encrypted packets from the WireGuard endpoint,
|
||||
/// decapsulates them, and dispatches newly received IP packets.
|
||||
pub async fn consume_task(&self) -> ! {
|
||||
trace!("Starting WireGuard consumption task");
|
||||
let endpoint = self.bus.new_endpoint();
|
||||
|
||||
loop {
|
||||
let mut recv_buf = [0u8; MAX_PACKET];
|
||||
|
|
@ -181,11 +170,7 @@ impl WireGuardTunnel {
|
|||
};
|
||||
|
||||
let data = &recv_buf[..size];
|
||||
let decapsulate_result = {
|
||||
let mut peer = self.peer.lock().await;
|
||||
peer.decapsulate(None, data, &mut send_buf)
|
||||
};
|
||||
match decapsulate_result {
|
||||
match self.peer.decapsulate(None, data, &mut send_buf) {
|
||||
TunnResult::WriteToNetwork(packet) => {
|
||||
match self.udp.send_to(packet, self.endpoint).await {
|
||||
Ok(_) => {}
|
||||
|
|
@ -194,10 +179,9 @@ impl WireGuardTunnel {
|
|||
continue;
|
||||
}
|
||||
};
|
||||
let mut peer = self.peer.lock().await;
|
||||
loop {
|
||||
let mut send_buf = [0u8; MAX_PACKET];
|
||||
match peer.decapsulate(None, &[], &mut send_buf) {
|
||||
match self.peer.decapsulate(None, &[], &mut send_buf) {
|
||||
TunnResult::WriteToNetwork(packet) => {
|
||||
match self.udp.send_to(packet, self.endpoint).await {
|
||||
Ok(_) => {}
|
||||
|
|
@ -222,8 +206,38 @@ impl WireGuardTunnel {
|
|||
// For debugging purposes: parse packet
|
||||
trace_ip_packet("Received IP packet", packet);
|
||||
|
||||
if let Some(proto) = self.route_protocol(packet) {
|
||||
endpoint.send(Event::InboundInternetPacket(proto, packet.to_vec().into()));
|
||||
match self.route_ip_packet(packet) {
|
||||
RouteResult::Dispatch(port) => {
|
||||
let sender = self.virtual_port_ip_tx.get(&port);
|
||||
if let Some(sender_guard) = sender {
|
||||
let sender = sender_guard.value();
|
||||
match sender.send(packet.to_vec()).await {
|
||||
Ok(_) => {
|
||||
trace!(
|
||||
"Dispatched received IP packet to virtual port {}",
|
||||
port
|
||||
);
|
||||
}
|
||||
Err(e) => {
|
||||
error!(
|
||||
"Failed to dispatch received IP packet to virtual port {}: {}",
|
||||
port, e
|
||||
);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
warn!("[{}] Race condition: failed to get virtual port sender after it was dispatched", port);
|
||||
}
|
||||
}
|
||||
RouteResult::Sink => {
|
||||
trace!("Sending unroutable IP packet received from WireGuard endpoint to sink interface");
|
||||
self.route_ip_sink(packet).await.unwrap_or_else(|e| {
|
||||
error!("Failed to send unroutable IP packet to sink: {:?}", e)
|
||||
});
|
||||
}
|
||||
RouteResult::Drop => {
|
||||
trace!("Dropped unroutable IP packet received from WireGuard endpoint");
|
||||
}
|
||||
}
|
||||
}
|
||||
_ => {}
|
||||
|
|
@ -231,46 +245,102 @@ impl WireGuardTunnel {
|
|||
}
|
||||
}
|
||||
|
||||
fn create_tunnel(config: &Config) -> anyhow::Result<Tunn> {
|
||||
let private = config.private_key.as_ref().clone();
|
||||
let public = *config.endpoint_public_key.as_ref();
|
||||
|
||||
fn create_tunnel(config: &Config) -> anyhow::Result<Box<Tunn>> {
|
||||
Tunn::new(
|
||||
private,
|
||||
public,
|
||||
config.preshared_key,
|
||||
config.private_key.clone(),
|
||||
config.endpoint_public_key.clone(),
|
||||
None,
|
||||
config.keepalive_seconds,
|
||||
0,
|
||||
None,
|
||||
)
|
||||
.map_err(|s| anyhow::anyhow!("{}", s))
|
||||
.context("Failed to initialize boringtun Tunn")
|
||||
.with_context(|| "Failed to initialize boringtun Tunn")
|
||||
}
|
||||
|
||||
/// Determine the inner protocol of the incoming IP packet (TCP/UDP).
|
||||
fn route_protocol(&self, packet: &[u8]) -> Option<PortProtocol> {
|
||||
/// Makes a decision on the handling of an incoming IP packet.
|
||||
fn route_ip_packet(&self, packet: &[u8]) -> RouteResult {
|
||||
match IpVersion::of_packet(packet) {
|
||||
Ok(IpVersion::Ipv4) => Ipv4Packet::new_checked(&packet)
|
||||
.ok()
|
||||
// Only care if the packet is destined for this tunnel
|
||||
.filter(|packet| packet.dst_addr() == self.source_peer_ip)
|
||||
.and_then(|packet| match packet.next_header() {
|
||||
IpProtocol::Tcp => Some(PortProtocol::Tcp),
|
||||
IpProtocol::Udp => Some(PortProtocol::Udp),
|
||||
.filter(|packet| Ipv4Addr::from(packet.dst_addr()) == self.source_peer_ip)
|
||||
.map(|packet| match packet.protocol() {
|
||||
IpProtocol::Tcp => Some(self.route_tcp_segment(packet.payload())),
|
||||
IpProtocol::Udp => Some(self.route_udp_datagram(packet.payload())),
|
||||
// Unrecognized protocol, so we cannot determine where to route
|
||||
_ => None,
|
||||
}),
|
||||
_ => Some(RouteResult::Drop),
|
||||
})
|
||||
.flatten()
|
||||
.unwrap_or(RouteResult::Drop),
|
||||
Ok(IpVersion::Ipv6) => Ipv6Packet::new_checked(&packet)
|
||||
.ok()
|
||||
// Only care if the packet is destined for this tunnel
|
||||
.filter(|packet| packet.dst_addr() == self.source_peer_ip)
|
||||
.and_then(|packet| match packet.next_header() {
|
||||
IpProtocol::Tcp => Some(PortProtocol::Tcp),
|
||||
IpProtocol::Udp => Some(PortProtocol::Udp),
|
||||
.filter(|packet| Ipv6Addr::from(packet.dst_addr()) == self.source_peer_ip)
|
||||
.map(|packet| match packet.next_header() {
|
||||
IpProtocol::Tcp => Some(self.route_tcp_segment(packet.payload())),
|
||||
IpProtocol::Udp => Some(self.route_udp_datagram(packet.payload())),
|
||||
// Unrecognized protocol, so we cannot determine where to route
|
||||
_ => None,
|
||||
}),
|
||||
_ => None,
|
||||
_ => Some(RouteResult::Drop),
|
||||
})
|
||||
.flatten()
|
||||
.unwrap_or(RouteResult::Drop),
|
||||
_ => RouteResult::Drop,
|
||||
}
|
||||
}
|
||||
|
||||
/// Makes a decision on the handling of an incoming TCP segment.
|
||||
fn route_tcp_segment(&self, segment: &[u8]) -> RouteResult {
|
||||
TcpPacket::new_checked(segment)
|
||||
.ok()
|
||||
.map(|tcp| {
|
||||
if self
|
||||
.virtual_port_ip_tx
|
||||
.get(&VirtualPort(tcp.dst_port(), PortProtocol::Tcp))
|
||||
.is_some()
|
||||
{
|
||||
RouteResult::Dispatch(VirtualPort(tcp.dst_port(), PortProtocol::Tcp))
|
||||
} else if tcp.rst() {
|
||||
RouteResult::Drop
|
||||
} else {
|
||||
RouteResult::Sink
|
||||
}
|
||||
})
|
||||
.unwrap_or(RouteResult::Drop)
|
||||
}
|
||||
|
||||
/// Makes a decision on the handling of an incoming UDP datagram.
|
||||
fn route_udp_datagram(&self, datagram: &[u8]) -> RouteResult {
|
||||
UdpPacket::new_checked(datagram)
|
||||
.ok()
|
||||
.map(|udp| {
|
||||
if self
|
||||
.virtual_port_ip_tx
|
||||
.get(&VirtualPort(udp.dst_port(), PortProtocol::Udp))
|
||||
.is_some()
|
||||
{
|
||||
RouteResult::Dispatch(VirtualPort(udp.dst_port(), PortProtocol::Udp))
|
||||
} else {
|
||||
RouteResult::Drop
|
||||
}
|
||||
})
|
||||
.unwrap_or(RouteResult::Drop)
|
||||
}
|
||||
|
||||
/// Route a packet to the IP sink interface.
|
||||
async fn route_ip_sink(&self, packet: &[u8]) -> anyhow::Result<()> {
|
||||
let ip_sink_tx = self.sink_ip_tx.read().await;
|
||||
|
||||
if let Some(ip_sink_tx) = &*ip_sink_tx {
|
||||
ip_sink_tx
|
||||
.send(packet.to_vec())
|
||||
.await
|
||||
.with_context(|| "Failed to dispatch IP packet to sink interface")
|
||||
} else {
|
||||
warn!(
|
||||
"Could not dispatch unroutable IP packet to sink because interface is not active."
|
||||
);
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -294,3 +364,12 @@ fn trace_ip_packet(message: &str, packet: &[u8]) {
|
|||
}
|
||||
}
|
||||
}
|
||||
|
||||
enum RouteResult {
|
||||
/// Dispatch the packet to the virtual port.
|
||||
Dispatch(VirtualPort),
|
||||
/// The packet is not routable, and should be sent to the sink interface.
|
||||
Sink,
|
||||
/// The packet is not routable, and can be safely ignored.
|
||||
Drop,
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue