network: begin work on ICMP

Cargo.toml

@@ -53,6 +53,7 @@ udp-stream = "0.0.11"
 smoltcp = "0.11.0"
 etherparse = "0.14.2"
 async-trait = "0.1.77"
+async-ping = "0.2.1"
 
 [workspace.dependencies.uuid]
 version = "1.6.1"
@@ -73,3 +74,7 @@ features = ["macros", "rt", "rt-multi-thread"]
 [workspace.dependencies.serde]
 version = "1.0.196"
 features = ["derive"]
+
+[workspace.dependencies.icmp-client]
+version = "0.2"
+features = ["impl_tokio"]

network/Cargo.toml

@@ -18,6 +18,8 @@ udp-stream = { workspace = true }
 smoltcp = { workspace = true }
 etherparse = { workspace = true }
 async-trait = { workspace = true }
+async-ping = { workspace = true }
+icmp-client = { workspace = true }
 
 [dependencies.advmac]
 path = "../libs/advmac"

network/src/nat.rs

@@ -1,6 +1,8 @@
 use anyhow::Result;
 use async_trait::async_trait;
 use etherparse::Ethernet2Slice;
+use etherparse::Icmpv4Header;
+use etherparse::Icmpv4Type;
 use etherparse::IpNumber;
 use etherparse::IpPayloadSlice;
 use etherparse::Ipv4Slice;
@@ -26,6 +28,7 @@ use tokio::sync::mpsc::Sender;
 pub enum NatKeyProtocol {
     Tcp,
     Udp,
+    Icmp,
 }
 
 #[derive(Debug, Copy, Clone, Eq, PartialEq, PartialOrd, Ord, Hash)]
@@ -164,6 +167,11 @@ impl NatRouter {
                     .await?;
             }
 
+            IpNumber::ICMP => {
+                self.process_icmpv4(data, ether, source_addr, dest_addr, ipv4.payload())
+                    .await?;
+            }
+
             _ => {}
         }
 
@@ -239,6 +247,31 @@ impl NatRouter {
         Ok(())
     }
 
+    pub async fn process_icmpv4<'a>(
+        &mut self,
+        data: &'a [u8],
+        ether: &Ethernet2Slice<'a>,
+        source_addr: IpAddress,
+        dest_addr: IpAddress,
+        payload: &IpPayloadSlice<'a>,
+    ) -> Result<()> {
+        let (header, _) = Icmpv4Header::from_slice(payload.payload)?;
+        let Icmpv4Type::EchoRequest(_) = header.icmp_type else {
+            return Ok(());
+        };
+        let source = IpEndpoint::new(source_addr, 0);
+        let dest = IpEndpoint::new(dest_addr, 0);
+        let key = NatKey {
+            protocol: NatKeyProtocol::Icmp,
+            client_mac: EthernetAddress(ether.source()),
+            local_mac: EthernetAddress(ether.destination()),
+            client_ip: source,
+            external_ip: dest,
+        };
+        self.process_nat(data, key).await?;
+        Ok(())
+    }
+
     pub async fn process_nat(&mut self, data: &[u8], key: NatKey) -> Result<()> {
         for cidr in &self.local_cidrs {
             if cidr.contains_addr(&key.external_ip.addr) {

network/src/proxynat/icmp.rs

@@ -0,0 +1,166 @@
+use std::time::Duration;
+
+use anyhow::{anyhow, Result};
+use async_ping::{
+    icmp_client::Config,
+    icmp_packet::{Icmp, Icmpv4},
+    PingClient,
+};
+use async_trait::async_trait;
+use etherparse::{Icmpv4Header, Icmpv4Type, IpNumber, PacketBuilder, SlicedPacket};
+use log::{debug, warn};
+use smoltcp::wire::IpAddress;
+use tokio::{
+    select,
+    sync::mpsc::{Receiver, Sender},
+};
+
+use crate::nat::{NatHandler, NatKey};
+
+const ICMP_PING_TIMEOUT_SECS: u64 = 20;
+const ICMP_TIMEOUT_SECS: u64 = 30;
+
+pub struct ProxyIcmpHandler {
+    key: NatKey,
+    rx_sender: Sender<Vec<u8>>,
+}
+
+#[async_trait]
+impl NatHandler for ProxyIcmpHandler {
+    async fn receive(&self, data: &[u8]) -> Result<()> {
+        self.rx_sender.try_send(data.to_vec())?;
+        Ok(())
+    }
+}
+
+enum ProxyIcmpSelect {
+    Internal(Vec<u8>),
+    Close,
+}
+
+impl ProxyIcmpHandler {
+    pub fn new(key: NatKey, rx_sender: Sender<Vec<u8>>) -> Self {
+        ProxyIcmpHandler { key, rx_sender }
+    }
+
+    pub async fn spawn(
+        &mut self,
+        rx_receiver: Receiver<Vec<u8>>,
+        tx_sender: Sender<Vec<u8>>,
+        reclaim_sender: Sender<NatKey>,
+    ) -> Result<()> {
+        let client = PingClient::<icmp_client::impl_tokio::Client>::new(Some(Config::new()), None)?;
+
+        {
+            let client = client.clone();
+            tokio::spawn(async move {
+                client.handle_v4_recv_from().await;
+            });
+        }
+
+        let key = self.key;
+        tokio::spawn(async move {
+            if let Err(error) =
+                ProxyIcmpHandler::process(client, key, rx_receiver, tx_sender, reclaim_sender).await
+            {
+                warn!("processing of icmp proxy failed: {}", error);
+            }
+        });
+        Ok(())
+    }
+
+    async fn process(
+        client: PingClient<icmp_client::impl_tokio::Client>,
+        key: NatKey,
+        mut rx_receiver: Receiver<Vec<u8>>,
+        tx_sender: Sender<Vec<u8>>,
+        reclaim_sender: Sender<NatKey>,
+    ) -> Result<()> {
+        loop {
+            let deadline = tokio::time::sleep(Duration::from_secs(ICMP_TIMEOUT_SECS));
+            let selection = select! {
+                x = rx_receiver.recv() => if let Some(data) = x {
+                    ProxyIcmpSelect::Internal(data)
+                } else {
+                    ProxyIcmpSelect::Close
+                },
+                _ =  deadline => ProxyIcmpSelect::Close,
+            };
+
+            match selection {
+                ProxyIcmpSelect::Internal(data) => {
+                    let packet = SlicedPacket::from_ethernet(&data)?;
+                    let Some(ref net) = packet.net else {
+                        continue;
+                    };
+
+                    let Some(ip) = net.ip_payload_ref() else {
+                        continue;
+                    };
+
+                    if ip.ip_number != IpNumber::ICMP {
+                        continue;
+                    }
+
+                    let (header, payload) = Icmpv4Header::from_slice(ip.payload)?;
+                    if let Icmpv4Type::EchoRequest(echo) = header.icmp_type {
+                        let result = client
+                            .ping(
+                                key.external_ip.addr.into(),
+                                Some(echo.id),
+                                Some(echo.seq),
+                                payload,
+                                Duration::from_secs(ICMP_PING_TIMEOUT_SECS),
+                            )
+                            .await;
+                        match result {
+                            Ok((icmp, _)) => match icmp {
+                                Icmp::V4(Icmpv4::EchoReply(reply)) => {
+                                    let packet =
+                                        PacketBuilder::ethernet2(key.local_mac.0, key.client_mac.0);
+                                    let packet = match (key.external_ip.addr, key.client_ip.addr) {
+                                        (
+                                            IpAddress::Ipv4(external_addr),
+                                            IpAddress::Ipv4(client_addr),
+                                        ) => packet.ipv4(external_addr.0, client_addr.0, 20),
+                                        (
+                                            IpAddress::Ipv6(external_addr),
+                                            IpAddress::Ipv6(client_addr),
+                                        ) => packet.ipv6(external_addr.0, client_addr.0, 20),
+                                        _ => {
+                                            return Err(anyhow!("IP endpoint mismatch"));
+                                        }
+                                    };
+                                    let packet = packet.icmpv4_echo_reply(
+                                        reply.identifier.0,
+                                        reply.sequence_number.0,
+                                    );
+                                    let mut buffer: Vec<u8> = Vec::new();
+                                    packet.write(&mut buffer, &reply.payload)?;
+                                    if let Err(error) = tx_sender.try_send(buffer) {
+                                        debug!("failed to transmit icmp packet: {}", error);
+                                    }
+                                }
+
+                                Icmp::V4(Icmpv4::Other(_type, _code, _payload)) => {}
+
+                                _ => {}
+                            },
+
+                            Err(error) => {
+                                debug!("proxy for icmp failed to emulate ICMP ping: {}", error);
+                            }
+                        }
+                    }
+                }
+
+                ProxyIcmpSelect::Close => {
+                    reclaim_sender.send(key).await?;
+                    break;
+                }
+            }
+        }
+
+        Ok(())
+    }
+}

network/src/proxynat/mod.rs

@@ -9,6 +9,9 @@ use crate::proxynat::udp::ProxyUdpHandler;
 
 use crate::nat::{NatHandler, NatHandlerFactory, NatKey, NatKeyProtocol};
 
+use self::icmp::ProxyIcmpHandler;
+
+mod icmp;
 mod udp;
 
 pub struct ProxyNatHandlerFactory {}
@@ -40,13 +43,19 @@ impl NatHandlerFactory for ProxyNatHandlerFactory {
                 }
             }
 
+            NatKeyProtocol::Icmp => {
+                let (rx_sender, rx_receiver) = channel::<Vec<u8>>(4);
+                let mut handler = ProxyIcmpHandler::new(key, rx_sender);
+
+                if let Err(error) = handler.spawn(rx_receiver, tx_sender, reclaim_sender).await {
+                    warn!("unable to spawn icmp proxy handler: {}", error);
+                    None
+                } else {
+                    Some(Box::new(handler))
+                }
+            }
+
             _ => None,
         }
     }
 }
-
-pub(crate) enum ProxyNatSelect {
-    External(usize),
-    Internal(Vec<u8>),
-    Close,
-}

network/src/proxynat/udp.rs

@@ -17,8 +17,6 @@ use udp_stream::UdpStream;
 
 use crate::nat::{NatHandler, NatKey};
 
-use super::ProxyNatSelect;
-
 const UDP_TIMEOUT_SECS: u64 = 60;
 
 pub struct ProxyUdpHandler {
@@ -34,6 +32,12 @@ impl NatHandler for ProxyUdpHandler {
     }
 }
 
+enum ProxyUdpSelect {
+    External(usize),
+    Internal(Vec<u8>),
+    Close,
+}
+
 impl ProxyUdpHandler {
     pub fn new(key: NatKey, rx_sender: Sender<Vec<u8>>) -> Self {
         ProxyUdpHandler { key, rx_sender }
@@ -79,16 +83,16 @@ impl ProxyUdpHandler {
             let deadline = tokio::time::sleep(Duration::from_secs(UDP_TIMEOUT_SECS));
             let selection = select! {
                 x = rx_receiver.recv() => if let Some(data) = x {
-                    ProxyNatSelect::Internal(data)
+                    ProxyUdpSelect::Internal(data)
                 } else {
-                    ProxyNatSelect::Close
+                    ProxyUdpSelect::Close
                 },
-                x = socket.read(&mut external_buffer) => ProxyNatSelect::External(x?),
-                _ = deadline => ProxyNatSelect::Close,
+                x = socket.read(&mut external_buffer) => ProxyUdpSelect::External(x?),
+                _ = deadline => ProxyUdpSelect::Close,
             };
 
             match selection {
-                ProxyNatSelect::External(size) => {
+                ProxyUdpSelect::External(size) => {
                     let data = &external_buffer[0..size];
                     let packet = PacketBuilder::ethernet2(key.local_mac.0, key.client_mac.0);
                     let packet = match (key.external_ip.addr, key.client_ip.addr) {
@@ -109,7 +113,7 @@ impl ProxyUdpHandler {
                         debug!("failed to transmit udp packet: {}", error);
                     }
                 }
-                ProxyNatSelect::Internal(data) => {
+                ProxyUdpSelect::Internal(data) => {
                     let packet = SlicedPacket::from_ethernet(&data)?;
                     let Some(ref net) = packet.net else {
                         continue;
@@ -122,7 +126,7 @@ impl ProxyUdpHandler {
                     let udp = UdpSlice::from_slice(ip.payload)?;
                     socket.write_all(udp.payload()).await?;
                 }
-                ProxyNatSelect::Close => {
+                ProxyUdpSelect::Close => {
                     drop(socket);
                     reclaim_sender.send(key).await?;
                     break;