network: cleanup NAT code and start on IPv6 support

network/src/backend.rs

@@ -17,7 +17,8 @@ use tokio::sync::mpsc::{channel, Receiver};
 
 #[derive(Clone)]
 pub struct NetworkBackend {
-    network: String,
+    ipv4: String,
+    ipv6: String,
     interface: String,
 }
 
@@ -71,9 +72,10 @@ impl NetworkStack<'_> {
 }
 
 impl NetworkBackend {
-    pub fn new(network: &str, interface: &str) -> Result<Self> {
+    pub fn new(ipv4: &str, ipv6: &str, interface: &str) -> Result<Self> {
         Ok(Self {
-            network: network.to_string(),
+            ipv4: ipv4.to_string(),
+            ipv6: ipv6.to_string(),
             interface: interface.to_string(),
         })
     }
@@ -110,9 +112,11 @@ impl NetworkBackend {
 
     fn create_network_stack(&self) -> Result<NetworkStack> {
         let proxy = Box::new(ProxyNatHandlerFactory::new());
-        let address = IpCidr::from_str(&self.network)
-            .map_err(|_| anyhow!("failed to parse cidr: {}", self.network))?;
-        let addresses: Vec<IpCidr> = vec![address];
+        let ipv4 = IpCidr::from_str(&self.ipv4)
+            .map_err(|_| anyhow!("failed to parse ipv4 cidr: {}", self.ipv4))?;
+        let ipv6 = IpCidr::from_str(&self.ipv4)
+            .map_err(|_| anyhow!("failed to parse ipv6 cidr: {}", self.ipv6))?;
+        let addresses: Vec<IpCidr> = vec![ipv4, ipv6];
         let mut kdev =
             AsyncRawSocket::bound_to_interface(&self.interface, RawSocketProtocol::Ethernet)?;
         let mtu = kdev.mtu_of_interface(&self.interface)?;

network/src/chandev.rs

@@ -1,5 +1,5 @@
-use log::warn;
 // Referenced https://github.com/vi/wgslirpy/blob/master/crates/libwgslirpy/src/channelized_smoltcp_device.rs
+use log::warn;
 use smoltcp::phy::{Checksum, Device};
 use tokio::sync::mpsc::Sender;
 

network/src/lib.rs

@@ -16,12 +16,13 @@ pub mod proxynat;
 pub mod raw_socket;
 
 pub struct NetworkService {
-    pub network: String,
+    pub ipv4: String,
+    pub ipv6: String,
 }
 
 impl NetworkService {
-    pub fn new(network: String) -> Result<NetworkService> {
-        Ok(NetworkService { network })
+    pub fn new(ipv4: String, ipv6: String) -> Result<NetworkService> {
+        Ok(NetworkService { ipv4, ipv6 })
     }
 }
 
@@ -77,7 +78,7 @@ impl NetworkService {
         spawned: Arc<Mutex<Vec<String>>>,
     ) -> Result<()> {
         let interface = interface.to_string();
-        let mut network = NetworkBackend::new(&self.network, &interface)?;
+        let mut network = NetworkBackend::new(&self.ipv4, &self.ipv6, &interface)?;
         info!("initializing network backend for interface {}", interface);
         network.init().await?;
         tokio::time::sleep(Duration::from_secs(1)).await;

network/src/nat.rs

@@ -12,6 +12,7 @@ use etherparse::NetSlice;
 use etherparse::SlicedPacket;
 use etherparse::TcpHeaderSlice;
 use etherparse::UdpHeaderSlice;
+use log::warn;
 use log::{debug, trace};
 use smoltcp::wire::EthernetAddress;
 use smoltcp::wire::IpAddress;
@@ -50,6 +51,27 @@ impl Display for NatKey {
     }
 }
 
+pub struct NatHandlerContext {
+    pub key: NatKey,
+    tx_sender: Sender<Vec<u8>>,
+    reclaim_sender: Sender<NatKey>,
+}
+
+impl NatHandlerContext {
+    pub fn try_send(&self, buffer: Vec<u8>) -> Result<()> {
+        self.tx_sender.try_send(buffer)?;
+        Ok(())
+    }
+}
+
+impl Drop for NatHandlerContext {
+    fn drop(&mut self) {
+        if let Err(error) = self.reclaim_sender.try_send(self.key) {
+            warn!("failed to reclaim nat key: {}", error);
+        }
+    }
+}
+
 #[async_trait]
 pub trait NatHandler: Send {
     async fn receive(&self, packet: &[u8]) -> Result<()>;
@@ -57,12 +79,7 @@ pub trait NatHandler: Send {
 
 #[async_trait]
 pub trait NatHandlerFactory: Send {
-    async fn nat(
-        &self,
-        key: NatKey,
-        tx_sender: Sender<Vec<u8>>,
-        reclaim_sender: Sender<NatKey>,
-    ) -> Option<Box<dyn NatHandler>>;
+    async fn nat(&self, context: NatHandlerContext) -> Option<Box<dyn NatHandler>>;
 }
 
 pub struct NatTable {
@@ -285,14 +302,15 @@ impl NatRouter {
             }
         }
 
+        let context = NatHandlerContext {
+            key,
+            tx_sender: self.tx_sender.clone(),
+            reclaim_sender: self.reclaim_sender.clone(),
+        };
         let handler: Option<&mut Box<dyn NatHandler>> = match self.table.inner.entry(key) {
             Entry::Occupied(entry) => Some(entry.into_mut()),
             Entry::Vacant(entry) => {
-                if let Some(handler) = self
-                    .factory
-                    .nat(key, self.tx_sender.clone(), self.reclaim_sender.clone())
-                    .await
-                {
+                if let Some(handler) = self.factory.nat(context).await {
                     debug!("creating nat entry for key: {}", key);
                     Some(entry.insert(handler))
                 } else {

network/src/proxynat/icmp.rs

@@ -3,8 +3,8 @@ use std::{net::IpAddr, time::Duration};
 use anyhow::{anyhow, Result};
 use async_trait::async_trait;
 use etherparse::{
-    Icmpv4Header, Icmpv4Type, Icmpv6Header, Icmpv6Type, IpNumber, NetSlice, PacketBuilder,
-    SlicedPacket,
+    Icmpv4Header, Icmpv4Type, Icmpv6Header, Icmpv6Type, IpNumber, Ipv4Slice, Ipv6Slice, NetSlice,
+    PacketBuilder, SlicedPacket,
 };
 use log::{debug, warn};
 use smoltcp::wire::IpAddress;
@@ -15,14 +15,13 @@ use tokio::{
 
 use crate::{
     icmp::{IcmpClient, IcmpProtocol, IcmpReply},
-    nat::{NatHandler, NatKey},
+    nat::{NatHandler, NatHandlerContext},
 };
 
 const ICMP_PING_TIMEOUT_SECS: u64 = 20;
 const ICMP_TIMEOUT_SECS: u64 = 30;
 
 pub struct ProxyIcmpHandler {
-    key: NatKey,
     rx_sender: Sender<Vec<u8>>,
 }
 
@@ -40,22 +39,18 @@ enum ProxyIcmpSelect {
 }
 
 impl ProxyIcmpHandler {
-    pub fn new(key: NatKey, rx_sender: Sender<Vec<u8>>) -> Self {
-        ProxyIcmpHandler { key, rx_sender }
+    pub fn new(rx_sender: Sender<Vec<u8>>) -> Self {
+        ProxyIcmpHandler { rx_sender }
     }
 
     pub async fn spawn(
         &mut self,
+        context: NatHandlerContext,
         rx_receiver: Receiver<Vec<u8>>,
-        tx_sender: Sender<Vec<u8>>,
-        reclaim_sender: Sender<NatKey>,
     ) -> Result<()> {
         let client = IcmpClient::new(IcmpProtocol::Icmp4)?;
-        let key = self.key;
         tokio::spawn(async move {
-            if let Err(error) =
-                ProxyIcmpHandler::process(client, key, rx_receiver, tx_sender, reclaim_sender).await
-            {
+            if let Err(error) = ProxyIcmpHandler::process(client, rx_receiver, context).await {
                 warn!("processing of icmp proxy failed: {}", error);
             }
         });
@@ -64,10 +59,8 @@ impl ProxyIcmpHandler {
 
     async fn process(
         client: IcmpClient,
-        key: NatKey,
         mut rx_receiver: Receiver<Vec<u8>>,
-        tx_sender: Sender<Vec<u8>>,
-        reclaim_sender: Sender<NatKey>,
+        context: NatHandlerContext,
     ) -> Result<()> {
         loop {
             let deadline = tokio::time::sleep(Duration::from_secs(ICMP_TIMEOUT_SECS));
@@ -89,107 +82,16 @@ impl ProxyIcmpHandler {
 
                     match net {
                         NetSlice::Ipv4(ipv4) => {
-                            if ipv4.header().protocol() != IpNumber::ICMP {
-                                continue;
-                            }
-
-                            let (header, payload) =
-                                Icmpv4Header::from_slice(ipv4.payload().payload)?;
-                            if let Icmpv4Type::EchoRequest(echo) = header.icmp_type {
-                                let IpAddr::V4(external_ipv4) = key.external_ip.addr.into() else {
-                                    continue;
-                                };
-
-                                let Some(IcmpReply::Icmp4 {
-                                    header: _,
-                                    echo,
-                                    payload,
-                                }) = client
-                                    .ping4(
-                                        external_ipv4,
-                                        echo.id,
-                                        echo.seq,
-                                        payload,
-                                        Duration::from_secs(ICMP_PING_TIMEOUT_SECS),
-                                    )
-                                    .await?
-                                else {
-                                    continue;
-                                };
-
-                                let packet =
-                                    PacketBuilder::ethernet2(key.local_mac.0, key.client_mac.0);
-                                let packet = match (key.external_ip.addr, key.client_ip.addr) {
-                                    (
-                                        IpAddress::Ipv4(external_addr),
-                                        IpAddress::Ipv4(client_addr),
-                                    ) => packet.ipv4(external_addr.0, client_addr.0, 20),
-                                    _ => {
-                                        return Err(anyhow!("IP endpoint mismatch"));
-                                    }
-                                };
-                                let packet = packet.icmpv4_echo_reply(echo.id, echo.seq);
-                                let mut buffer: Vec<u8> = Vec::new();
-                                packet.write(&mut buffer, &payload)?;
-                                if let Err(error) = tx_sender.try_send(buffer) {
-                                    debug!("failed to transmit icmp packet: {}", error);
-                                }
-                            }
+                            ProxyIcmpHandler::process_ipv4(&context, ipv4, &client).await?
                         }
 
                         NetSlice::Ipv6(ipv6) => {
-                            if ipv6.header().next_header() != IpNumber::ICMP {
-                                continue;
-                            }
-
-                            let (header, payload) =
-                                Icmpv6Header::from_slice(ipv6.payload().payload)?;
-                            if let Icmpv6Type::EchoRequest(echo) = header.icmp_type {
-                                let IpAddr::V6(external_ipv6) = key.external_ip.addr.into() else {
-                                    continue;
-                                };
-
-                                let Some(IcmpReply::Icmp6 {
-                                    header: _,
-                                    echo,
-                                    payload,
-                                }) = client
-                                    .ping6(
-                                        external_ipv6,
-                                        echo.id,
-                                        echo.seq,
-                                        payload,
-                                        Duration::from_secs(ICMP_PING_TIMEOUT_SECS),
-                                    )
-                                    .await?
-                                else {
-                                    continue;
-                                };
-
-                                let packet =
-                                    PacketBuilder::ethernet2(key.local_mac.0, key.client_mac.0);
-                                let packet = match (key.external_ip.addr, key.client_ip.addr) {
-                                    (
-                                        IpAddress::Ipv6(external_addr),
-                                        IpAddress::Ipv6(client_addr),
-                                    ) => packet.ipv6(external_addr.0, client_addr.0, 20),
-                                    _ => {
-                                        return Err(anyhow!("IP endpoint mismatch"));
-                                    }
-                                };
-                                let packet = packet.icmpv6_echo_reply(echo.id, echo.seq);
-                                let mut buffer: Vec<u8> = Vec::new();
-                                packet.write(&mut buffer, &payload)?;
-                                if let Err(error) = tx_sender.try_send(buffer) {
-                                    debug!("failed to transmit icmp packet: {}", error);
-                                }
-                            }
+                            ProxyIcmpHandler::process_ipv6(&context, ipv6, &client).await?
                         }
                     }
                 }
 
                 ProxyIcmpSelect::Close => {
-                    reclaim_sender.send(key).await?;
                     break;
                 }
             }
@@ -197,4 +99,109 @@ impl ProxyIcmpHandler {
 
         Ok(())
     }
+
+    async fn process_ipv4(
+        context: &NatHandlerContext,
+        ipv4: &Ipv4Slice<'_>,
+        client: &IcmpClient,
+    ) -> Result<()> {
+        if ipv4.header().protocol() != IpNumber::ICMP {
+            return Ok(());
+        }
+
+        let (header, payload) = Icmpv4Header::from_slice(ipv4.payload().payload)?;
+        if let Icmpv4Type::EchoRequest(echo) = header.icmp_type {
+            let IpAddr::V4(external_ipv4) = context.key.external_ip.addr.into() else {
+                return Ok(());
+            };
+
+            let Some(IcmpReply::Icmp4 {
+                header: _,
+                echo,
+                payload,
+            }) = client
+                .ping4(
+                    external_ipv4,
+                    echo.id,
+                    echo.seq,
+                    payload,
+                    Duration::from_secs(ICMP_PING_TIMEOUT_SECS),
+                )
+                .await?
+            else {
+                return Ok(());
+            };
+
+            let packet =
+                PacketBuilder::ethernet2(context.key.local_mac.0, context.key.client_mac.0);
+            let packet = match (context.key.external_ip.addr, context.key.client_ip.addr) {
+                (IpAddress::Ipv4(external_addr), IpAddress::Ipv4(client_addr)) => {
+                    packet.ipv4(external_addr.0, client_addr.0, 20)
+                }
+                _ => {
+                    return Err(anyhow!("IP endpoint mismatch"));
+                }
+            };
+            let packet = packet.icmpv4_echo_reply(echo.id, echo.seq);
+            let mut buffer: Vec<u8> = Vec::new();
+            packet.write(&mut buffer, &payload)?;
+            if let Err(error) = context.try_send(buffer) {
+                debug!("failed to transmit icmp packet: {}", error);
+            }
+        }
+        Ok(())
+    }
+
+    async fn process_ipv6(
+        context: &NatHandlerContext,
+        ipv6: &Ipv6Slice<'_>,
+        client: &IcmpClient,
+    ) -> Result<()> {
+        if ipv6.header().next_header() != IpNumber::ICMP {
+            return Ok(());
+        }
+
+        let (header, payload) = Icmpv6Header::from_slice(ipv6.payload().payload)?;
+        if let Icmpv6Type::EchoRequest(echo) = header.icmp_type {
+            let IpAddr::V6(external_ipv6) = context.key.external_ip.addr.into() else {
+                return Ok(());
+            };
+
+            let Some(IcmpReply::Icmp6 {
+                header: _,
+                echo,
+                payload,
+            }) = client
+                .ping6(
+                    external_ipv6,
+                    echo.id,
+                    echo.seq,
+                    payload,
+                    Duration::from_secs(ICMP_PING_TIMEOUT_SECS),
+                )
+                .await?
+            else {
+                return Ok(());
+            };
+
+            let packet =
+                PacketBuilder::ethernet2(context.key.local_mac.0, context.key.client_mac.0);
+            let packet = match (context.key.external_ip.addr, context.key.client_ip.addr) {
+                (IpAddress::Ipv6(external_addr), IpAddress::Ipv6(client_addr)) => {
+                    packet.ipv6(external_addr.0, client_addr.0, 20)
+                }
+                _ => {
+                    return Err(anyhow!("IP endpoint mismatch"));
+                }
+            };
+            let packet = packet.icmpv6_echo_reply(echo.id, echo.seq);
+            let mut buffer: Vec<u8> = Vec::new();
+            packet.write(&mut buffer, &payload)?;
+            if let Err(error) = context.try_send(buffer) {
+                debug!("failed to transmit icmp packet: {}", error);
+            }
+        }
+
+        Ok(())
+    }
 }

network/src/proxynat/mod.rs

@@ -3,11 +3,11 @@ use async_trait::async_trait;
 use log::warn;
 
 use tokio::sync::mpsc::channel;
-use tokio::sync::mpsc::Sender;
 
+use crate::nat::NatHandlerContext;
 use crate::proxynat::udp::ProxyUdpHandler;
 
-use crate::nat::{NatHandler, NatHandlerFactory, NatKey, NatKeyProtocol};
+use crate::nat::{NatHandler, NatHandlerFactory, NatKeyProtocol};
 
 use self::icmp::ProxyIcmpHandler;
 
@@ -30,18 +30,13 @@ impl ProxyNatHandlerFactory {
 
 #[async_trait]
 impl NatHandlerFactory for ProxyNatHandlerFactory {
-    async fn nat(
-        &self,
-        key: NatKey,
-        tx_sender: Sender<Vec<u8>>,
-        reclaim_sender: Sender<NatKey>,
-    ) -> Option<Box<dyn NatHandler>> {
-        match key.protocol {
+    async fn nat(&self, context: NatHandlerContext) -> Option<Box<dyn NatHandler>> {
+        match context.key.protocol {
             NatKeyProtocol::Udp => {
                 let (rx_sender, rx_receiver) = channel::<Vec<u8>>(4);
-                let mut handler = ProxyUdpHandler::new(key, rx_sender);
+                let mut handler = ProxyUdpHandler::new(rx_sender);
 
-                if let Err(error) = handler.spawn(rx_receiver, tx_sender, reclaim_sender).await {
+                if let Err(error) = handler.spawn(context, rx_receiver).await {
                     warn!("unable to spawn udp proxy handler: {}", error);
                     None
                 } else {
@@ -51,9 +46,9 @@ impl NatHandlerFactory for ProxyNatHandlerFactory {
 
             NatKeyProtocol::Icmp => {
                 let (rx_sender, rx_receiver) = channel::<Vec<u8>>(4);
-                let mut handler = ProxyIcmpHandler::new(key, rx_sender);
+                let mut handler = ProxyIcmpHandler::new(rx_sender);
 
-                if let Err(error) = handler.spawn(rx_receiver, tx_sender, reclaim_sender).await {
+                if let Err(error) = handler.spawn(context, rx_receiver).await {
                     warn!("unable to spawn icmp proxy handler: {}", error);
                     None
                 } else {

network/src/proxynat/udp.rs

@@ -15,12 +15,11 @@ use tokio::{
 use tokio::{sync::mpsc::Receiver, sync::mpsc::Sender};
 use udp_stream::UdpStream;
 
-use crate::nat::{NatHandler, NatKey};
+use crate::nat::{NatHandler, NatHandlerContext};
 
 const UDP_TIMEOUT_SECS: u64 = 60;
 
 pub struct ProxyUdpHandler {
-    key: NatKey,
     rx_sender: Sender<Vec<u8>>,
 }
 
@@ -39,31 +38,27 @@ enum ProxyUdpSelect {
 }
 
 impl ProxyUdpHandler {
-    pub fn new(key: NatKey, rx_sender: Sender<Vec<u8>>) -> Self {
-        ProxyUdpHandler { key, rx_sender }
+    pub fn new(rx_sender: Sender<Vec<u8>>) -> Self {
+        ProxyUdpHandler { rx_sender }
     }
 
     pub async fn spawn(
         &mut self,
+        context: NatHandlerContext,
         rx_receiver: Receiver<Vec<u8>>,
-        tx_sender: Sender<Vec<u8>>,
-        reclaim_sender: Sender<NatKey>,
     ) -> Result<()> {
-        let external_addr = match self.key.external_ip.addr {
+        let external_addr = match context.key.external_ip.addr {
             IpAddress::Ipv4(addr) => {
-                SocketAddr::new(IpAddr::V4(addr.0.into()), self.key.external_ip.port)
+                SocketAddr::new(IpAddr::V4(addr.0.into()), context.key.external_ip.port)
             }
             IpAddress::Ipv6(addr) => {
-                SocketAddr::new(IpAddr::V6(addr.0.into()), self.key.external_ip.port)
+                SocketAddr::new(IpAddr::V6(addr.0.into()), context.key.external_ip.port)
             }
         };
 
         let socket = UdpStream::connect(external_addr).await?;
-        let key = self.key;
         tokio::spawn(async move {
-            if let Err(error) =
-                ProxyUdpHandler::process(key, socket, rx_receiver, tx_sender, reclaim_sender).await
-            {
+            if let Err(error) = ProxyUdpHandler::process(context, socket, rx_receiver).await {
                 warn!("processing of udp proxy failed: {}", error);
             }
         });
@@ -71,11 +66,9 @@ impl ProxyUdpHandler {
     }
 
     async fn process(
-        key: NatKey,
+        context: NatHandlerContext,
         mut socket: UdpStream,
         mut rx_receiver: Receiver<Vec<u8>>,
-        tx_sender: Sender<Vec<u8>>,
-        reclaim_sender: Sender<NatKey>,
     ) -> Result<()> {
         let mut external_buffer = vec![0u8; 2048];
 
@@ -94,8 +87,9 @@ impl ProxyUdpHandler {
             match selection {
                 ProxyUdpSelect::External(size) => {
                     let data = &external_buffer[0..size];
-                    let packet = PacketBuilder::ethernet2(key.local_mac.0, key.client_mac.0);
-                    let packet = match (key.external_ip.addr, key.client_ip.addr) {
+                    let packet =
+                        PacketBuilder::ethernet2(context.key.local_mac.0, context.key.client_mac.0);
+                    let packet = match (context.key.external_ip.addr, context.key.client_ip.addr) {
                         (IpAddress::Ipv4(external_addr), IpAddress::Ipv4(client_addr)) => {
                             packet.ipv4(external_addr.0, client_addr.0, 20)
                         }
@@ -106,10 +100,11 @@ impl ProxyUdpHandler {
                             return Err(anyhow!("IP endpoint mismatch"));
                         }
                     };
-                    let packet = packet.udp(key.external_ip.port, key.client_ip.port);
+                    let packet =
+                        packet.udp(context.key.external_ip.port, context.key.client_ip.port);
                     let mut buffer: Vec<u8> = Vec::new();
                     packet.write(&mut buffer, data)?;
-                    if let Err(error) = tx_sender.try_send(buffer) {
+                    if let Err(error) = context.try_send(buffer) {
                         debug!("failed to transmit udp packet: {}", error);
                     }
                 }
@@ -128,7 +123,6 @@ impl ProxyUdpHandler {
                 }
                 ProxyUdpSelect::Close => {
                     drop(socket);
-                    reclaim_sender.send(key).await?;
                     break;
                 }
             }