rust-next

Cargo.toml

@@ -4,12 +4,11 @@ version = "0.1.0"
 edition = "2021"
 
 [dependencies]
-tun = "0.7"
-socket2 = { version = "0.5.8", features = ["all"] }
-pnet = "0.35.0"
-serde = { version = "1.0.217", features = ["derive"] }
+tun = "0.8"
+socket2 = { version = "0.6.1", features = ["all"] }
+serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0"
 base64 = "0.22.1"
 crossbeam = "0.8.4"
-crossbeam-utils = "0.8.20"
-grouping_by = "0.2.2"
+crossbeam-utils = "0.8.21"
+libc = "0.2.178"

Dockerfile

-FROM rust:1.84-alpine3.21 as builder
+FROM rust:1.91-alpine3.22 as chef
 RUN apk add --no-cache musl-dev
+RUN cargo install cargo-chef
 WORKDIR /usr/src/app
 
-COPY Cargo.toml Cargo.lock ./
-RUN mkdir src && \
-    echo 'fn main() {}' > src/main.rs && \
-    cargo build --release && \
-    cargo clean --package $(awk '/name/ {gsub(/"/,""); print $3}' Cargo.toml | sed ':a;N;$!ba;s/\n//g' | tr -d '\r') && \
-    rm -rf src
+FROM chef as planner
+COPY Cargo.toml Cargo.lock src ./
+RUN cargo chef prepare --recipe-path recipe.json
 
-COPY src src
+FROM chef as builder
+COPY --from=planner /usr/src/app/recipe.json recipe.json
+RUN cargo chef cook --release --recipe-path recipe.json
+COPY Cargo.toml Cargo.lock src ./
 RUN cargo build --release
 
-FROM alpine:3.21
+FROM alpine:3.22
 RUN apk --no-cache add libgcc libstdc++ bash iproute2 iptables iptables-legacy ipset netcat-openbsd jq
 COPY --from=builder /usr/src/app/target/release/tun1 /usr/local/bin/tun
 COPY ./entrypoint.sh /entrypoint.sh

src/main.rs

 mod router;
-
-use crate::router::{Router, RouterReader, RouterWriter, SECRET_LENGTH};
-use std::collections::HashMap;
+use crate::router::{Router, SECRET_LENGTH};
 use std::env;
 use std::error::Error;
-use std::intrinsics::transmute;
 use std::io::{Read, Write};
 use std::mem::MaybeUninit;
-use std::sync::Arc;
+use std::mem::{size_of, transmute};
+use std::sync::atomic::Ordering;
+use crossbeam_utils::thread;
 
 #[repr(C)]
 pub struct Meta {
@@ -18,10 +17,16 @@ pub struct Meta {
 
 use serde::Deserialize;
 
+#[derive(Deserialize)]
+pub struct Config {
+    pub local_id: u8,
+    pub local_secret: String,
+    pub routers: Vec<ConfigRouter>,
+}
 #[derive(Deserialize)]
 pub struct ConfigRouter {
     pub remote_id: u8,
-    pub proto: i32,
+    pub proto: u8,
     pub family: u8,
     pub mark: u32,
     pub endpoint: String,
@@ -30,105 +35,81 @@ pub struct ConfigRouter {
     pub up: String,
 }
 
-#[derive(Deserialize)]
-pub struct Config {
-    pub local_id: u8,
-    pub local_secret: String,
-    pub routers: Vec<ConfigRouter>,
-}
-use crossbeam_utils::thread;
-use grouping_by::GroupingBy;
-use pnet::packet::ipv4::Ipv4Packet;
-use socket2::Socket;
-
 fn main() -> Result<(), Box<dyn Error>> {
+    println!("Starting");
     let config: Config = serde_json::from_str(env::args().nth(1).ok_or("need param")?.as_str())?;
     let local_secret: [u8; SECRET_LENGTH] = Router::create_secret(config.local_secret.as_str())?;
-    let mut sockets: HashMap<u16, Arc<Socket>> = HashMap::new();
-    let routers: HashMap<u8, Router> = config
+    let routers: Vec<Router> = config
         .routers
-        .iter()
-        .map(|c| Router::new(c, &mut sockets).map(|router| (c.remote_id, router)))
-        .collect::<Result<_, _>>()?;
-    let (mut router_readers, router_writers): (
-        HashMap<u8, RouterReader>,
-        HashMap<u8, RouterWriter>,
-    ) = routers
-        .into_iter()
-        .map(|(id, router)| {
-            let (reader, writer) = router.split();
-            ((id, reader), (id, writer))
-        })
-        .unzip();
-    let router_writers3: Vec<(Arc<Socket>, HashMap<u8, RouterWriter>)> = router_writers
-        .into_iter()
-        .grouping_by(|(_, v)| v.key())
         .into_iter()
-        .map(|(k, v)| {
-            (
-                Arc::clone(sockets.get_mut(&k).unwrap()),
-                v.into_iter().collect(),
-            )
-        })
-        .collect();
+        .map(|c| Router::new(c, config.local_id))
+        .collect::<Result<Vec<_>, _>>()?;
+
     println!("created tuns");
+    const META_SIZE: usize = size_of::<Meta>();
 
     thread::scope(|s| {
-        for router in router_readers.values_mut() {
-            s.spawn(|_| {
+        for router in routers {
+            let (mut reader, mut writer) = router.split();
+
+            s.spawn(move |_| {
                 let mut buffer = [0u8; 1500 - 20]; // minus typical IP header space
-                let meta_size = size_of::<Meta>();
 
                 // Pre-initialize with our Meta header (local -> remote)
                 let meta = Meta {
                     src_id: config.local_id,
-                    dst_id: router.config.remote_id,
+                    dst_id: reader.config.remote_id,
                     reversed: 0,
                 };
                 // Turn the Meta struct into bytes
-                let meta_bytes = unsafe {
-                    std::slice::from_raw_parts(&meta as *const Meta as *const u8, meta_size)
-                };
-                buffer[..meta_size].copy_from_slice(meta_bytes);
+                let meta_bytes: &[u8; META_SIZE] =
+                    unsafe { &*(&meta as *const Meta as *const [u8; META_SIZE]) };
+                buffer[..META_SIZE].copy_from_slice(meta_bytes);
 
                 loop {
-                    let n = router.tun_reader.read(&mut buffer[meta_size..]).unwrap();
-                    if let Some(ref addr) = *router.endpoint.read().unwrap() {
-                        router.encrypt(&mut buffer[meta_size..meta_size + n]);
-                        #[cfg(target_os = "linux")]
-                        let _ = router.socket.set_mark(router.config.mark);
-                        let _ = router.socket.send_to(&buffer[..meta_size + n], addr);
+                    let n = reader.tun_reader.read(&mut buffer[META_SIZE..]).unwrap();
+                    let guard = crossbeam::epoch::pin();
+                    let shared = reader.endpoint.load(Ordering::Acquire, &guard);
+                    if let Some(addr) = unsafe { shared.as_ref() } {
+                        reader.encrypt(&mut buffer[META_SIZE..META_SIZE + n]);
+                        let _ = reader.socket.send_to(&buffer[..META_SIZE + n], addr);
                     }
                 }
             });
-        }
 
-        for (socket, mut router_writers) in router_writers3 {
             s.spawn(move |_| {
                 let mut recv_buf = [MaybeUninit::uninit(); 1500];
                 loop {
                     let _ = (|| {
-                        let (len, addr) = socket.recv_from(&mut recv_buf).unwrap();
-                        let data: &mut [u8] = unsafe { transmute(&mut recv_buf[..len]) };
+                        let (len, addr) = writer.socket.recv_from(&mut recv_buf).unwrap();
 
-                        let packet = Ipv4Packet::new(data).ok_or("malformed packet")?;
-                        let header_len = packet.get_header_length() as usize * 4;
-                        let (_ip_header, rest) = data
-                            .split_at_mut_checked(header_len)
-                            .ok_or("malformed packet")?;
-                        let (meta_bytes, payload) = rest
-                            .split_at_mut_checked(size_of::<Meta>())
-                            .ok_or("malformed packet")?;
-                        let meta: &Meta = unsafe { transmute(meta_bytes.as_ptr()) };
-                        if meta.dst_id == config.local_id && meta.reversed == 0 {
-                            let router = router_writers
-                                .get_mut(&meta.src_id)
-                                .ok_or("missing router")?;
-                            *router.endpoint.write().unwrap() = Some(addr);
-                            router.decrypt(payload, &local_secret);
-                            router.tun_writer.write_all(payload)?;
+                        let guard = crossbeam::epoch::pin();
+                        let current_shared = writer.endpoint.load(Ordering::SeqCst, &guard);
+                        let is_same = unsafe { current_shared.as_ref() }
+                            .map(|c| *c == addr)
+                            .unwrap_or(false);
+                        if !is_same {
+                            let new_shared = crossbeam::epoch::Owned::new(addr).into_shared(&guard);
+                            let old_shared =
+                                writer.endpoint.swap(new_shared, Ordering::SeqCst, &guard);
+                            unsafe {
+                                guard.defer_destroy(old_shared);
+                            }
                         }
 
+                        let packet: &mut [u8] = unsafe { transmute(&mut recv_buf[..len]) };
+                        let version = packet[0] >> 4;
+                        let ip_header_len = match version {
+                            4 => (packet[0] & 0x0f) as usize * 4,
+                            6 => 40,
+                            _ => Err(format!("Unknown IP version: {}", version))?,
+                        };
+                        let offset = ip_header_len + META_SIZE;
+
+                        let payload = &mut packet[offset..];
+                        writer.decrypt(payload, &local_secret);
+                        writer.tun_writer.write_all(payload)?;
+
                         Ok::<(), Box<dyn Error>>(())
                     })();
                 }

src/router.rs

-use socket2::{Domain, Protocol, SockAddr, Socket, Type};
-use std::collections::hash_map::Entry;
-use std::collections::HashMap;
+use base64::prelude::BASE64_STANDARD;
+use base64::Engine;
+use socket2::{Domain, Protocol, SockAddr, SockFilter, Socket, Type};
 use std::net::ToSocketAddrs;
 use std::process::{Command, ExitStatus};
-use std::sync::{Arc, RwLock};
+use std::sync::Arc;
 use tun::{Reader, Writer};
 pub const SECRET_LENGTH: usize = 32;
-use crate::ConfigRouter;
-use base64::prelude::*;
+use crate::{ConfigRouter, Meta};
+use crossbeam::epoch::Atomic;
 
 // tun -> raw
-pub struct RouterReader<'a> {
-    pub config: &'a ConfigRouter,
+pub struct RouterReader {
+    pub config: ConfigRouter,
     pub secret: [u8; SECRET_LENGTH],
     pub tun_reader: Reader,
     pub socket: Arc<Socket>,
-    pub endpoint: Arc<RwLock<Option<SockAddr>>>,
+    pub endpoint: Arc<Atomic<SockAddr>>,
 }
 
-impl<'a> RouterReader<'a> {
+impl RouterReader {
     pub(crate) fn encrypt(&self, data: &mut [u8]) {
         for (i, b) in data.iter_mut().enumerate() {
             *b ^= self.secret[i % SECRET_LENGTH];
@@ -27,34 +27,30 @@ impl<'a> RouterReader<'a> {
 }
 
 // raw -> tun
-pub struct RouterWriter<'a> {
-    pub config: &'a ConfigRouter,
+pub struct RouterWriter {
     pub tun_writer: Writer,
-    pub endpoint: Arc<RwLock<Option<SockAddr>>>,
+    pub socket: Arc<Socket>,
+    pub endpoint: Arc<Atomic<SockAddr>>,
 }
 
-impl<'a> RouterWriter<'a> {
+impl RouterWriter {
     pub(crate) fn decrypt(&self, data: &mut [u8], secret: &[u8; SECRET_LENGTH]) {
         for (i, b) in data.iter_mut().enumerate() {
             *b ^= secret[i % SECRET_LENGTH];
         }
     }
-
-    pub(crate) fn key(&self) -> u16 {
-        Router::key(self.config)
-    }
 }
 
-pub struct Router<'a> {
-    pub config: &'a ConfigRouter,
+pub struct Router {
+    pub config: ConfigRouter,
     pub secret: [u8; SECRET_LENGTH],
     pub tun_reader: Reader,
     pub tun_writer: Writer,
     pub socket: Arc<Socket>,
-    pub endpoint: Arc<RwLock<Option<SockAddr>>>,
+    pub endpoint: Arc<Atomic<SockAddr>>,
 }
 
-impl<'a> Router<'a> {
+impl Router {
     pub(crate) fn create_secret(
         config: &str,
     ) -> Result<[u8; SECRET_LENGTH], Box<dyn std::error::Error>> {
@@ -65,30 +61,108 @@ impl<'a> Router<'a> {
         Ok(secret)
     }
 
-    fn key(config: &ConfigRouter) -> u16 {
-        (config.family as u16) << 8 | config.proto as u16
-    }
     fn create_raw_socket(
         config: &ConfigRouter,
-        sockets: &mut HashMap<u16, Arc<Socket>>,
-    ) -> Result<Arc<Socket>, Box<dyn std::error::Error>> {
-        let key = Router::key(config);
-        let result = match sockets.entry(key) {
-            Entry::Occupied(entry) => entry.get().clone(),
-            Entry::Vacant(entry) => entry
-                .insert(Arc::new(Socket::new(
+        local_id: u8,
+    ) -> Result<Arc<Socket>, std::io::Error> {
+        let result = Socket::new(
             if config.family == 6 {
                 Domain::IPV6
             } else {
                 Domain::IPV4
             },
             Type::RAW,
-                    Some(Protocol::from(config.proto)),
-                )?))
-                .clone(),
+            Some(Protocol::from(config.proto as i32)),
+        )?;
+        #[cfg(target_os = "linux")]
+        result.set_mark(config.mark)?;
+        Self::attach_readable_filter(config, local_id, &result)?;
+        Ok(Arc::new(result))
+    }
+
+    fn attach_readable_filter(
+        config: &ConfigRouter,
+        local_id: u8,
+        socket: &Socket,
+    ) -> std::io::Result<()> {
+        // 由于多个对端可能会使用相同的 ipprpto 号，这里确保每个 socket 上只会收到自己对应的对端发来的消息
+        const META_SIZE: usize = size_of::<Meta>();
+        let meta = Meta {
+            src_id: config.remote_id,
+            dst_id: local_id,
+            reversed: 0,
         };
-        Ok(result)
+        let meta_bytes: [u8; META_SIZE] =
+            unsafe { *(&meta as *const Meta as *const [u8; META_SIZE]) };
+        let target_val = u32::from_be_bytes(meta_bytes);
+
+        // 如果你的协议是 UDP，这里必须是 8 (跳过 UDP 头: SrcPort(2)+DstPort(2)+Len(2)+Sum(2))
+        // 如果是纯自定义 IP 协议，这里是 0
+        let payload_offset = 0;
+
+        // 假设 socket 是 SOCK_RAW 或 SOCK_DGRAM (L3 层，无以太网头)
+        // 报文偏移 0 即为 IP 头起始位置
+        socket.attach_filter(&[
+            // -------------------------------------------------------------------
+            // 1. 【检查 IP 版本】
+            // -------------------------------------------------------------------
+            // 加载第 0 字节到累加器 A
+            bpf_stmt(libc::BPF_LD | libc::BPF_B | libc::BPF_ABS, 0),
+            // 取高 4 位 (Version)
+            bpf_stmt(libc::BPF_ALU | libc::BPF_AND | libc::BPF_K, 0xF0),
+
+            // -------------------------------------------------------------------
+            // 2. 【IPv4 处理分支】
+            // -------------------------------------------------------------------
+            // 判断是否为 IPv4 (0x40)
+            // jt=0 (继续执行下一条); jf=2 (跳过下面2条，去检查 IPv6)
+            bpf_jump(libc::BPF_JMP | libc::BPF_JEQ | libc::BPF_K, 0x40, 0, 2),
+
+            // [IPv4] 计算 IPv4 头长度: X = 4 * (IP[0] & 0xf)
+            bpf_stmt(libc::BPF_LDX | libc::BPF_B | libc::BPF_MSH, 0),
+
+            // [IPv4] 处理完毕，跳转到“加载 Payload”步骤
+            // 跳过接下来的 2 条指令 (IPv6 检查 和 IPv6 设置 X)
+            bpf_jump(libc::BPF_JMP | libc::BPF_JA, 2, 0, 0),
+
+            // -------------------------------------------------------------------
+            // 3. 【IPv6 处理分支】
+            // -------------------------------------------------------------------
+            // 判断是否为 IPv6 (0x60)
+            // jt=0 (继续执行); jf=4 (跳过下面4条指令，直接跳到 Reject)
+            bpf_jump(libc::BPF_JMP | libc::BPF_JEQ | libc::BPF_K, 0x60, 0, 4),
+
+            // [IPv6] 设置头长度为固定 40 字节
+            // BPF_LDX (Load X) | BPF_IMM (Immediate value)
+            bpf_stmt(libc::BPF_LDX | libc::BPF_IMM, 40),
+
+            // -------------------------------------------------------------------
+            // 4. 【公共逻辑：读取数据】(Target Label)
+            // -------------------------------------------------------------------
+            // 此时寄存器 X 中已保存了正确的 IP 头长度 (IPv4 动态计算值 或 IPv6 固定40)
+            // A = Packet[X + payload_offset]
+            bpf_stmt(libc::BPF_LD | libc::BPF_W | libc::BPF_IND, payload_offset),
+
+            // -------------------------------------------------------------------
+            // 5. 【比较并跳转】
+            // -------------------------------------------------------------------
+            // if (A == target_val) goto Accept; else goto Reject;
+            bpf_jump(libc::BPF_JMP | libc::BPF_JEQ | libc::BPF_K, target_val, 0, 1),
+
+            // -------------------------------------------------------------------
+            // 6. 【接受 (True 路径)】
+            // -------------------------------------------------------------------
+            bpf_stmt(libc::BPF_RET | libc::BPF_K, u32::MAX),
+
+            // -------------------------------------------------------------------
+            // 7. 【拒绝 (False 路径)】
+            // -------------------------------------------------------------------
+            bpf_stmt(libc::BPF_RET | libc::BPF_K, 0),
+        ])?;
+
+        Ok(())
     }
+
     fn create_tun_device(
         config: &ConfigRouter,
     ) -> Result<(Reader, Writer), Box<dyn std::error::Error>> {
@@ -104,21 +178,18 @@ impl<'a> Router<'a> {
 
     fn create_endpoint(
         config: &ConfigRouter,
-    ) -> Result<Arc<RwLock<Option<SockAddr>>>, Box<dyn std::error::Error>> {
+    ) -> Result<Arc<Atomic<SockAddr>>, Box<dyn std::error::Error>> {
         let parsed = (config.endpoint.clone(), 0u16)
             .to_socket_addrs()?
             .next()
             .ok_or(config.endpoint.clone())?;
-        Ok(Arc::new(RwLock::new(Some(parsed.into()))))
+        Ok(Arc::new(Atomic::new(parsed.into())))
     }
 
-    pub fn new(
-        config: &'a ConfigRouter,
-        sockets: &mut HashMap<u16, Arc<Socket>>,
-    ) -> Result<Router<'a>, Box<dyn std::error::Error>> {
+    pub fn new(config: ConfigRouter, local_id: u8) -> Result<Router, Box<dyn std::error::Error>> {
         let secret = Self::create_secret(config.remote_secret.as_str())?;
         let endpoint = Self::create_endpoint(&config)?;
-        let socket = Self::create_raw_socket(&config, sockets)?;
+        let socket = Self::create_raw_socket(&config, local_id)?;
         let (tun_reader, tun_writer) = Self::create_tun_device(&config)?;
         Self::run_up_script(&config)?;
 
@@ -134,11 +205,11 @@ impl<'a> Router<'a> {
         Ok(router)
     }
 
-    pub fn split(self) -> (RouterReader<'a>, RouterWriter<'a>) {
+    pub fn split(self) -> (RouterReader, RouterWriter) {
         let writer = RouterWriter {
-            config: self.config,
-            endpoint: Arc::clone(&self.endpoint),
+            endpoint: self.endpoint.clone(),
             tun_writer: self.tun_writer,
+            socket: self.socket.clone(),
         };
 
         let reader = RouterReader {
@@ -152,3 +223,11 @@ impl<'a> Router<'a> {
         (reader, writer)
     }
 }
+
+fn bpf_stmt(code: u32, k: u32) -> SockFilter {
+    SockFilter::new(code as u16, 0, 0, k)
+}
+
+fn bpf_jump(code: u32, k: u32, jt: u8, jf: u8) -> SockFilter {
+    SockFilter::new(code as u16, jt, jf, k)
+}