diff --git a/controller/src/ctl/mod.rs b/controller/src/ctl/mod.rs index 25c90d1..85b071b 100644 --- a/controller/src/ctl/mod.rs +++ b/controller/src/ctl/mod.rs @@ -89,6 +89,7 @@ impl Controller { address: format!("{}/24", ipv4), gateway: "192.168.42.1".to_string(), }, + ipv6: None, }), env, run, diff --git a/network/bin/network.rs b/network/bin/network.rs index c44ae6f..460b5df 100644 --- a/network/bin/network.rs +++ b/network/bin/network.rs @@ -5,15 +5,18 @@ use hyphanet::NetworkService; #[derive(Parser, Debug)] struct NetworkArgs { - #[arg(short, long, default_value = "192.168.42.1/24")] - network: String, + #[arg(long, default_value = "192.168.42.1/24")] + ipv4_network: String, + + #[arg(long, default_value = "fe80::1/10")] + ipv6_network: String, } #[tokio::main] async fn main() -> Result<()> { env_logger::Builder::from_env(Env::default().default_filter_or("warn")).init(); let args = NetworkArgs::parse(); - let mut service = NetworkService::new(args.network)?; + let mut service = NetworkService::new(args.ipv4_network, args.ipv6_network)?; service.watch().await?; Ok(()) } diff --git a/network/src/backend.rs b/network/src/backend.rs index dea8e1d..2ae051b 100644 --- a/network/src/backend.rs +++ b/network/src/backend.rs @@ -17,7 +17,8 @@ use tokio::sync::mpsc::{channel, Receiver}; #[derive(Clone)] pub struct NetworkBackend { - network: String, + ipv4: String, + ipv6: String, interface: String, } @@ -71,9 +72,10 @@ impl NetworkStack<'_> { } impl NetworkBackend { - pub fn new(network: &str, interface: &str) -> Result { + pub fn new(ipv4: &str, ipv6: &str, interface: &str) -> Result { Ok(Self { - network: network.to_string(), + ipv4: ipv4.to_string(), + ipv6: ipv6.to_string(), interface: interface.to_string(), }) } @@ -110,9 +112,11 @@ impl NetworkBackend { fn create_network_stack(&self) -> Result { let proxy = Box::new(ProxyNatHandlerFactory::new()); - let address = IpCidr::from_str(&self.network) - .map_err(|_| anyhow!("failed to parse cidr: {}", self.network))?; - let addresses: Vec = vec![address]; + let ipv4 = IpCidr::from_str(&self.ipv4) + .map_err(|_| anyhow!("failed to parse ipv4 cidr: {}", self.ipv4))?; + let ipv6 = IpCidr::from_str(&self.ipv4) + .map_err(|_| anyhow!("failed to parse ipv6 cidr: {}", self.ipv6))?; + let addresses: Vec = vec![ipv4, ipv6]; let mut kdev = AsyncRawSocket::bound_to_interface(&self.interface, RawSocketProtocol::Ethernet)?; let mtu = kdev.mtu_of_interface(&self.interface)?; diff --git a/network/src/chandev.rs b/network/src/chandev.rs index 1aac5ab..2a2cc49 100644 --- a/network/src/chandev.rs +++ b/network/src/chandev.rs @@ -1,5 +1,5 @@ -use log::warn; // Referenced https://github.com/vi/wgslirpy/blob/master/crates/libwgslirpy/src/channelized_smoltcp_device.rs +use log::warn; use smoltcp::phy::{Checksum, Device}; use tokio::sync::mpsc::Sender; diff --git a/network/src/lib.rs b/network/src/lib.rs index 8782629..9f82b46 100644 --- a/network/src/lib.rs +++ b/network/src/lib.rs @@ -16,12 +16,13 @@ pub mod proxynat; pub mod raw_socket; pub struct NetworkService { - pub network: String, + pub ipv4: String, + pub ipv6: String, } impl NetworkService { - pub fn new(network: String) -> Result { - Ok(NetworkService { network }) + pub fn new(ipv4: String, ipv6: String) -> Result { + Ok(NetworkService { ipv4, ipv6 }) } } @@ -77,7 +78,7 @@ impl NetworkService { spawned: Arc>>, ) -> Result<()> { let interface = interface.to_string(); - let mut network = NetworkBackend::new(&self.network, &interface)?; + let mut network = NetworkBackend::new(&self.ipv4, &self.ipv6, &interface)?; info!("initializing network backend for interface {}", interface); network.init().await?; tokio::time::sleep(Duration::from_secs(1)).await; diff --git a/network/src/nat.rs b/network/src/nat.rs index 4dcd837..a831c10 100644 --- a/network/src/nat.rs +++ b/network/src/nat.rs @@ -12,6 +12,7 @@ use etherparse::NetSlice; use etherparse::SlicedPacket; use etherparse::TcpHeaderSlice; use etherparse::UdpHeaderSlice; +use log::warn; use log::{debug, trace}; use smoltcp::wire::EthernetAddress; use smoltcp::wire::IpAddress; @@ -50,6 +51,27 @@ impl Display for NatKey { } } +pub struct NatHandlerContext { + pub key: NatKey, + tx_sender: Sender>, + reclaim_sender: Sender, +} + +impl NatHandlerContext { + pub fn try_send(&self, buffer: Vec) -> Result<()> { + self.tx_sender.try_send(buffer)?; + Ok(()) + } +} + +impl Drop for NatHandlerContext { + fn drop(&mut self) { + if let Err(error) = self.reclaim_sender.try_send(self.key) { + warn!("failed to reclaim nat key: {}", error); + } + } +} + #[async_trait] pub trait NatHandler: Send { async fn receive(&self, packet: &[u8]) -> Result<()>; @@ -57,12 +79,7 @@ pub trait NatHandler: Send { #[async_trait] pub trait NatHandlerFactory: Send { - async fn nat( - &self, - key: NatKey, - tx_sender: Sender>, - reclaim_sender: Sender, - ) -> Option>; + async fn nat(&self, context: NatHandlerContext) -> Option>; } pub struct NatTable { @@ -285,14 +302,15 @@ impl NatRouter { } } + let context = NatHandlerContext { + key, + tx_sender: self.tx_sender.clone(), + reclaim_sender: self.reclaim_sender.clone(), + }; let handler: Option<&mut Box> = match self.table.inner.entry(key) { Entry::Occupied(entry) => Some(entry.into_mut()), Entry::Vacant(entry) => { - if let Some(handler) = self - .factory - .nat(key, self.tx_sender.clone(), self.reclaim_sender.clone()) - .await - { + if let Some(handler) = self.factory.nat(context).await { debug!("creating nat entry for key: {}", key); Some(entry.insert(handler)) } else { diff --git a/network/src/proxynat/icmp.rs b/network/src/proxynat/icmp.rs index 9ddf834..cbec0cc 100644 --- a/network/src/proxynat/icmp.rs +++ b/network/src/proxynat/icmp.rs @@ -3,8 +3,8 @@ use std::{net::IpAddr, time::Duration}; use anyhow::{anyhow, Result}; use async_trait::async_trait; use etherparse::{ - Icmpv4Header, Icmpv4Type, Icmpv6Header, Icmpv6Type, IpNumber, NetSlice, PacketBuilder, - SlicedPacket, + Icmpv4Header, Icmpv4Type, Icmpv6Header, Icmpv6Type, IpNumber, Ipv4Slice, Ipv6Slice, NetSlice, + PacketBuilder, SlicedPacket, }; use log::{debug, warn}; use smoltcp::wire::IpAddress; @@ -15,14 +15,13 @@ use tokio::{ use crate::{ icmp::{IcmpClient, IcmpProtocol, IcmpReply}, - nat::{NatHandler, NatKey}, + nat::{NatHandler, NatHandlerContext}, }; const ICMP_PING_TIMEOUT_SECS: u64 = 20; const ICMP_TIMEOUT_SECS: u64 = 30; pub struct ProxyIcmpHandler { - key: NatKey, rx_sender: Sender>, } @@ -40,22 +39,18 @@ enum ProxyIcmpSelect { } impl ProxyIcmpHandler { - pub fn new(key: NatKey, rx_sender: Sender>) -> Self { - ProxyIcmpHandler { key, rx_sender } + pub fn new(rx_sender: Sender>) -> Self { + ProxyIcmpHandler { rx_sender } } pub async fn spawn( &mut self, + context: NatHandlerContext, rx_receiver: Receiver>, - tx_sender: Sender>, - reclaim_sender: Sender, ) -> Result<()> { let client = IcmpClient::new(IcmpProtocol::Icmp4)?; - let key = self.key; tokio::spawn(async move { - if let Err(error) = - ProxyIcmpHandler::process(client, key, rx_receiver, tx_sender, reclaim_sender).await - { + if let Err(error) = ProxyIcmpHandler::process(client, rx_receiver, context).await { warn!("processing of icmp proxy failed: {}", error); } }); @@ -64,10 +59,8 @@ impl ProxyIcmpHandler { async fn process( client: IcmpClient, - key: NatKey, mut rx_receiver: Receiver>, - tx_sender: Sender>, - reclaim_sender: Sender, + context: NatHandlerContext, ) -> Result<()> { loop { let deadline = tokio::time::sleep(Duration::from_secs(ICMP_TIMEOUT_SECS)); @@ -89,107 +82,16 @@ impl ProxyIcmpHandler { match net { NetSlice::Ipv4(ipv4) => { - if ipv4.header().protocol() != IpNumber::ICMP { - continue; - } - - let (header, payload) = - Icmpv4Header::from_slice(ipv4.payload().payload)?; - if let Icmpv4Type::EchoRequest(echo) = header.icmp_type { - let IpAddr::V4(external_ipv4) = key.external_ip.addr.into() else { - continue; - }; - - let Some(IcmpReply::Icmp4 { - header: _, - echo, - payload, - }) = client - .ping4( - external_ipv4, - echo.id, - echo.seq, - payload, - Duration::from_secs(ICMP_PING_TIMEOUT_SECS), - ) - .await? - else { - continue; - }; - - let packet = - PacketBuilder::ethernet2(key.local_mac.0, key.client_mac.0); - let packet = match (key.external_ip.addr, key.client_ip.addr) { - ( - IpAddress::Ipv4(external_addr), - IpAddress::Ipv4(client_addr), - ) => packet.ipv4(external_addr.0, client_addr.0, 20), - _ => { - return Err(anyhow!("IP endpoint mismatch")); - } - }; - let packet = packet.icmpv4_echo_reply(echo.id, echo.seq); - let mut buffer: Vec = Vec::new(); - packet.write(&mut buffer, &payload)?; - if let Err(error) = tx_sender.try_send(buffer) { - debug!("failed to transmit icmp packet: {}", error); - } - } + ProxyIcmpHandler::process_ipv4(&context, ipv4, &client).await? } NetSlice::Ipv6(ipv6) => { - if ipv6.header().next_header() != IpNumber::ICMP { - continue; - } - - let (header, payload) = - Icmpv6Header::from_slice(ipv6.payload().payload)?; - if let Icmpv6Type::EchoRequest(echo) = header.icmp_type { - let IpAddr::V6(external_ipv6) = key.external_ip.addr.into() else { - continue; - }; - - let Some(IcmpReply::Icmp6 { - header: _, - echo, - payload, - }) = client - .ping6( - external_ipv6, - echo.id, - echo.seq, - payload, - Duration::from_secs(ICMP_PING_TIMEOUT_SECS), - ) - .await? - else { - continue; - }; - - let packet = - PacketBuilder::ethernet2(key.local_mac.0, key.client_mac.0); - let packet = match (key.external_ip.addr, key.client_ip.addr) { - ( - IpAddress::Ipv6(external_addr), - IpAddress::Ipv6(client_addr), - ) => packet.ipv6(external_addr.0, client_addr.0, 20), - _ => { - return Err(anyhow!("IP endpoint mismatch")); - } - }; - let packet = packet.icmpv6_echo_reply(echo.id, echo.seq); - let mut buffer: Vec = Vec::new(); - packet.write(&mut buffer, &payload)?; - if let Err(error) = tx_sender.try_send(buffer) { - debug!("failed to transmit icmp packet: {}", error); - } - } + ProxyIcmpHandler::process_ipv6(&context, ipv6, &client).await? } } } ProxyIcmpSelect::Close => { - reclaim_sender.send(key).await?; break; } } @@ -197,4 +99,109 @@ impl ProxyIcmpHandler { Ok(()) } + + async fn process_ipv4( + context: &NatHandlerContext, + ipv4: &Ipv4Slice<'_>, + client: &IcmpClient, + ) -> Result<()> { + if ipv4.header().protocol() != IpNumber::ICMP { + return Ok(()); + } + + let (header, payload) = Icmpv4Header::from_slice(ipv4.payload().payload)?; + if let Icmpv4Type::EchoRequest(echo) = header.icmp_type { + let IpAddr::V4(external_ipv4) = context.key.external_ip.addr.into() else { + return Ok(()); + }; + + let Some(IcmpReply::Icmp4 { + header: _, + echo, + payload, + }) = client + .ping4( + external_ipv4, + echo.id, + echo.seq, + payload, + Duration::from_secs(ICMP_PING_TIMEOUT_SECS), + ) + .await? + else { + return Ok(()); + }; + + let packet = + PacketBuilder::ethernet2(context.key.local_mac.0, context.key.client_mac.0); + let packet = match (context.key.external_ip.addr, context.key.client_ip.addr) { + (IpAddress::Ipv4(external_addr), IpAddress::Ipv4(client_addr)) => { + packet.ipv4(external_addr.0, client_addr.0, 20) + } + _ => { + return Err(anyhow!("IP endpoint mismatch")); + } + }; + let packet = packet.icmpv4_echo_reply(echo.id, echo.seq); + let mut buffer: Vec = Vec::new(); + packet.write(&mut buffer, &payload)?; + if let Err(error) = context.try_send(buffer) { + debug!("failed to transmit icmp packet: {}", error); + } + } + Ok(()) + } + + async fn process_ipv6( + context: &NatHandlerContext, + ipv6: &Ipv6Slice<'_>, + client: &IcmpClient, + ) -> Result<()> { + if ipv6.header().next_header() != IpNumber::ICMP { + return Ok(()); + } + + let (header, payload) = Icmpv6Header::from_slice(ipv6.payload().payload)?; + if let Icmpv6Type::EchoRequest(echo) = header.icmp_type { + let IpAddr::V6(external_ipv6) = context.key.external_ip.addr.into() else { + return Ok(()); + }; + + let Some(IcmpReply::Icmp6 { + header: _, + echo, + payload, + }) = client + .ping6( + external_ipv6, + echo.id, + echo.seq, + payload, + Duration::from_secs(ICMP_PING_TIMEOUT_SECS), + ) + .await? + else { + return Ok(()); + }; + + let packet = + PacketBuilder::ethernet2(context.key.local_mac.0, context.key.client_mac.0); + let packet = match (context.key.external_ip.addr, context.key.client_ip.addr) { + (IpAddress::Ipv6(external_addr), IpAddress::Ipv6(client_addr)) => { + packet.ipv6(external_addr.0, client_addr.0, 20) + } + _ => { + return Err(anyhow!("IP endpoint mismatch")); + } + }; + let packet = packet.icmpv6_echo_reply(echo.id, echo.seq); + let mut buffer: Vec = Vec::new(); + packet.write(&mut buffer, &payload)?; + if let Err(error) = context.try_send(buffer) { + debug!("failed to transmit icmp packet: {}", error); + } + } + + Ok(()) + } } diff --git a/network/src/proxynat/mod.rs b/network/src/proxynat/mod.rs index 7a9407d..2f38ee7 100644 --- a/network/src/proxynat/mod.rs +++ b/network/src/proxynat/mod.rs @@ -3,11 +3,11 @@ use async_trait::async_trait; use log::warn; use tokio::sync::mpsc::channel; -use tokio::sync::mpsc::Sender; +use crate::nat::NatHandlerContext; use crate::proxynat::udp::ProxyUdpHandler; -use crate::nat::{NatHandler, NatHandlerFactory, NatKey, NatKeyProtocol}; +use crate::nat::{NatHandler, NatHandlerFactory, NatKeyProtocol}; use self::icmp::ProxyIcmpHandler; @@ -30,18 +30,13 @@ impl ProxyNatHandlerFactory { #[async_trait] impl NatHandlerFactory for ProxyNatHandlerFactory { - async fn nat( - &self, - key: NatKey, - tx_sender: Sender>, - reclaim_sender: Sender, - ) -> Option> { - match key.protocol { + async fn nat(&self, context: NatHandlerContext) -> Option> { + match context.key.protocol { NatKeyProtocol::Udp => { let (rx_sender, rx_receiver) = channel::>(4); - let mut handler = ProxyUdpHandler::new(key, rx_sender); + let mut handler = ProxyUdpHandler::new(rx_sender); - if let Err(error) = handler.spawn(rx_receiver, tx_sender, reclaim_sender).await { + if let Err(error) = handler.spawn(context, rx_receiver).await { warn!("unable to spawn udp proxy handler: {}", error); None } else { @@ -51,9 +46,9 @@ impl NatHandlerFactory for ProxyNatHandlerFactory { NatKeyProtocol::Icmp => { let (rx_sender, rx_receiver) = channel::>(4); - let mut handler = ProxyIcmpHandler::new(key, rx_sender); + let mut handler = ProxyIcmpHandler::new(rx_sender); - if let Err(error) = handler.spawn(rx_receiver, tx_sender, reclaim_sender).await { + if let Err(error) = handler.spawn(context, rx_receiver).await { warn!("unable to spawn icmp proxy handler: {}", error); None } else { diff --git a/network/src/proxynat/udp.rs b/network/src/proxynat/udp.rs index 0cf7dc8..d437d1b 100644 --- a/network/src/proxynat/udp.rs +++ b/network/src/proxynat/udp.rs @@ -15,12 +15,11 @@ use tokio::{ use tokio::{sync::mpsc::Receiver, sync::mpsc::Sender}; use udp_stream::UdpStream; -use crate::nat::{NatHandler, NatKey}; +use crate::nat::{NatHandler, NatHandlerContext}; const UDP_TIMEOUT_SECS: u64 = 60; pub struct ProxyUdpHandler { - key: NatKey, rx_sender: Sender>, } @@ -39,31 +38,27 @@ enum ProxyUdpSelect { } impl ProxyUdpHandler { - pub fn new(key: NatKey, rx_sender: Sender>) -> Self { - ProxyUdpHandler { key, rx_sender } + pub fn new(rx_sender: Sender>) -> Self { + ProxyUdpHandler { rx_sender } } pub async fn spawn( &mut self, + context: NatHandlerContext, rx_receiver: Receiver>, - tx_sender: Sender>, - reclaim_sender: Sender, ) -> Result<()> { - let external_addr = match self.key.external_ip.addr { + let external_addr = match context.key.external_ip.addr { IpAddress::Ipv4(addr) => { - SocketAddr::new(IpAddr::V4(addr.0.into()), self.key.external_ip.port) + SocketAddr::new(IpAddr::V4(addr.0.into()), context.key.external_ip.port) } IpAddress::Ipv6(addr) => { - SocketAddr::new(IpAddr::V6(addr.0.into()), self.key.external_ip.port) + SocketAddr::new(IpAddr::V6(addr.0.into()), context.key.external_ip.port) } }; let socket = UdpStream::connect(external_addr).await?; - let key = self.key; tokio::spawn(async move { - if let Err(error) = - ProxyUdpHandler::process(key, socket, rx_receiver, tx_sender, reclaim_sender).await - { + if let Err(error) = ProxyUdpHandler::process(context, socket, rx_receiver).await { warn!("processing of udp proxy failed: {}", error); } }); @@ -71,11 +66,9 @@ impl ProxyUdpHandler { } async fn process( - key: NatKey, + context: NatHandlerContext, mut socket: UdpStream, mut rx_receiver: Receiver>, - tx_sender: Sender>, - reclaim_sender: Sender, ) -> Result<()> { let mut external_buffer = vec![0u8; 2048]; @@ -94,8 +87,9 @@ impl ProxyUdpHandler { match selection { ProxyUdpSelect::External(size) => { let data = &external_buffer[0..size]; - let packet = PacketBuilder::ethernet2(key.local_mac.0, key.client_mac.0); - let packet = match (key.external_ip.addr, key.client_ip.addr) { + let packet = + PacketBuilder::ethernet2(context.key.local_mac.0, context.key.client_mac.0); + let packet = match (context.key.external_ip.addr, context.key.client_ip.addr) { (IpAddress::Ipv4(external_addr), IpAddress::Ipv4(client_addr)) => { packet.ipv4(external_addr.0, client_addr.0, 20) } @@ -106,10 +100,11 @@ impl ProxyUdpHandler { return Err(anyhow!("IP endpoint mismatch")); } }; - let packet = packet.udp(key.external_ip.port, key.client_ip.port); + let packet = + packet.udp(context.key.external_ip.port, context.key.client_ip.port); let mut buffer: Vec = Vec::new(); packet.write(&mut buffer, data)?; - if let Err(error) = tx_sender.try_send(buffer) { + if let Err(error) = context.try_send(buffer) { debug!("failed to transmit udp packet: {}", error); } } @@ -128,7 +123,6 @@ impl ProxyUdpHandler { } ProxyUdpSelect::Close => { drop(socket); - reclaim_sender.send(key).await?; break; } } diff --git a/shared/src/lib.rs b/shared/src/lib.rs index 8c020a2..4567233 100644 --- a/shared/src/lib.rs +++ b/shared/src/lib.rs @@ -6,10 +6,17 @@ pub struct LaunchNetworkIpv4 { pub gateway: String, } +#[derive(Serialize, Deserialize, Debug)] +pub struct LaunchNetworkIpv6 { + pub address: String, + pub gateway: String, +} + #[derive(Serialize, Deserialize, Debug)] pub struct LaunchNetwork { pub link: String, pub ipv4: LaunchNetworkIpv4, + pub ipv6: Option, } #[derive(Serialize, Deserialize, Debug)]