Skip to content

T
tun
Commit 7dcbbb26 authored by nanamicat's avatar nanamicat
Browse files
Options

rust-next

parent f5ffc9fe
Pipeline #41903 failed with stages
      in 38 seconds
      Expand all Hide whitespace changes
      Inline Side-by-side
      Showing with 619 additions and 655 deletions
      .gitignore
      View file @ 7dcbbb26
      /.idea/
      /target
      /.idea/
      /target
      .gitlab-ci.yml
      View file @ 7dcbbb26
      stages:
      - build
      - deploy
      variables:
      GIT_DEPTH: "1"
      before_script:
      - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
      .build-image:
      stage: build
      script:
      - docker build --pull -t $TARGET_IMAGE .
      - docker push $TARGET_IMAGE
      build-x86:
      extends: .build-image
      tags:
      - docker
      variables:
      TARGET_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-x86
      build-arm:
      extends: .build-image
      tags:
      - docker-arm
      variables:
      TARGET_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-arm
      .deploy:
      stage: deploy
      tags:
      - docker
      script:
      - docker pull $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-x86
      - docker pull $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-arm
      - docker manifest create $TARGET_IMAGE --amend $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-x86 --amend
      $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-arm
      - docker manifest push $TARGET_IMAGE
      deploy_latest:
      extends: .deploy
      variables:
      TARGET_IMAGE: $CI_REGISTRY_IMAGE:latest
      only:
      - master
      deploy_branch:
      extends: .deploy
      variables:
      TARGET_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
      stages:
      - build
      - deploy
      variables:
      GIT_DEPTH: "1"
      before_script:
      - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
      .build-image:
      stage: build
      script:
      - docker build --pull -t $TARGET_IMAGE .
      - docker push $TARGET_IMAGE
      build-x86:
      extends: .build-image
      tags:
      - docker
      variables:
      TARGET_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-x86
      build-arm:
      extends: .build-image
      tags:
      - docker-arm
      variables:
      TARGET_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-arm
      .deploy:
      stage: deploy
      tags:
      - docker
      script:
      - docker pull $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-x86
      - docker pull $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-arm
      - docker manifest create $TARGET_IMAGE --amend $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-x86 --amend
      $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG-arm
      - docker manifest push $TARGET_IMAGE
      deploy_latest:
      extends: .deploy
      variables:
      TARGET_IMAGE: $CI_REGISTRY_IMAGE:latest
      only:
      - master
      deploy_branch:
      extends: .deploy
      variables:
      TARGET_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
      Cargo.lock
      View file @ 7dcbbb26
      This diff is collapsed.
      Cargo.toml
      View file @ 7dcbbb26
      ......@@ -4,12 +4,11 @@ version = "0.1.0"
      edition = "2021"
      [dependencies]
      tun = "0.7"
      socket2 = { version = "0.5.8", features = ["all"] }
      pnet = "0.35.0"
      serde = { version = "1.0.217", features = ["derive"] }
      tun = "0.8"
      socket2 = { version = "0.6.1", features = ["all"] }
      serde = { version = "1.0.228", features = ["derive"] }
      serde_json = "1.0"
      base64 = "0.22.1"
      crossbeam = "0.8.4"
      crossbeam-utils = "0.8.20"
      grouping_by = "0.2.2"
      crossbeam-utils = "0.8.21"
      libc = "0.2.178"
      Dockerfile
      View file @ 7dcbbb26
      FROM rust:1.84-alpine3.21 as builder
      RUN apk add --no-cache musl-dev
      WORKDIR /usr/src/app
      COPY Cargo.toml Cargo.lock ./
      RUN mkdir src && \
      echo 'fn main() {}' > src/main.rs && \
      cargo build --release && \
      cargo clean --package $(awk '/name/ {gsub(/"/,""); print $3}' Cargo.toml | sed ':a;N;$!ba;s/\n//g' | tr -d '\r') && \
      rm -rf src
      COPY src src
      RUN cargo build --release
      FROM alpine:3.21
      RUN apk --no-cache add libgcc libstdc++ bash iproute2 iptables iptables-legacy ipset netcat-openbsd jq
      COPY --from=builder /usr/src/app/target/release/tun1 /usr/local/bin/tun
      COPY ./entrypoint.sh /entrypoint.sh
      ENTRYPOINT ["/entrypoint.sh"]
      CMD ["tun"]
      FROM rust:1.84-alpine3.21 as builder
      RUN apk add --no-cache musl-dev
      WORKDIR /usr/src/app
      COPY Cargo.toml Cargo.lock ./
      RUN mkdir src && \
      echo 'fn main() {}' > src/main.rs && \
      cargo build --release && \
      echo $(awk '/name/ {gsub(/"/,""); print $3}' Cargo.toml | sed ':a;N;$!ba;s/\n//g' | tr -d '\r') && \
      cargo clean --package $(awk '/name/ {gsub(/"/,""); print $3}' Cargo.toml | sed ':a;N;$!ba;s/\n//g' | tr -d '\r') && \
      rm -rf src
      COPY src src
      RUN cargo build --release
      FROM alpine:3.22
      RUN apk --no-cache add libgcc libstdc++ bash iproute2 iptables iptables-legacy ipset netcat-openbsd jq
      COPY --from=builder /usr/src/app/target/release/tun1 /usr/local/bin/tun
      COPY ./entrypoint.sh /entrypoint.sh
      ENTRYPOINT ["/entrypoint.sh"]
      CMD ["tun"]
      entrypoint.sh
      View file @ 7dcbbb26
      #!/bin/bash
      pid=0
      down=$(echo "$1" | jq -r '.routers | .[].down')
      echo "$down"
      run_stop() {
      signalCode=$1
      if [ -n "$down" ]; then
      eval "$down"
      fi
      if [ $pid -ne 0 ]; then
      kill "-$signalCode" "$pid"
      wait "$pid"
      fi
      exit $((128 + signalCode));
      }
      trap 'kill ${!}; run_stop 2' SIGTERM
      trap 'kill ${!}; run_stop 15' SIGINT
      tun "$@" &
      pid="$!"
      # wait forever
      wait "$pid"
      pid=0
      run_stop 1
      #!/bin/bash
      pid=0
      down=$(echo "$1" | jq -r '.routers | .[].down')
      echo "$down"
      run_stop() {
      signalCode=$1
      if [ -n "$down" ]; then
      eval "$down"
      fi
      if [ $pid -ne 0 ]; then
      kill "-$signalCode" "$pid"
      wait "$pid"
      fi
      exit $((128 + signalCode));
      }
      trap 'kill ${!}; run_stop 2' SIGTERM
      trap 'kill ${!}; run_stop 15' SIGINT
      tun "$@" &
      pid="$!"
      # wait forever
      wait "$pid"
      pid=0
      run_stop 1
      src/main.rs
      View file @ 7dcbbb26
      mod router;
      use crate::router::{Router, RouterReader, RouterWriter, SECRET_LENGTH};
      use std::collections::HashMap;
      use std::env;
      use std::error::Error;
      use std::intrinsics::transmute;
      use std::io::{Read, Write};
      use std::mem::MaybeUninit;
      use std::sync::Arc;
      #[repr(C)]
      pub struct Meta {
      pub src_id: u8,
      pub dst_id: u8,
      pub reversed: u16,
      }
      use serde::Deserialize;
      #[derive(Deserialize)]
      pub struct ConfigRouter {
      pub remote_id: u8,
      pub proto: i32,
      pub family: u8,
      pub mark: u32,
      pub endpoint: String,
      pub remote_secret: String,
      pub dev: String,
      pub up: String,
      }
      #[derive(Deserialize)]
      pub struct Config {
      pub local_id: u8,
      pub local_secret: String,
      pub routers: Vec<ConfigRouter>,
      }
      use crossbeam_utils::thread;
      use grouping_by::GroupingBy;
      use pnet::packet::ipv4::Ipv4Packet;
      use socket2::Socket;
      fn main() -> Result<(), Box<dyn Error>> {
      let config: Config = serde_json::from_str(env::args().nth(1).ok_or("need param")?.as_str())?;
      let local_secret: [u8; SECRET_LENGTH] = Router::create_secret(config.local_secret.as_str())?;
      let mut sockets: HashMap<u16, Arc<Socket>> = HashMap::new();
      let routers: HashMap<u8, Router> = config
      .routers
      .iter()
      .map(|c| Router::new(c, &mut sockets).map(|router| (c.remote_id, router)))
      .collect::<Result<_, _>>()?;
      let (mut router_readers, router_writers): (
      HashMap<u8, RouterReader>,
      HashMap<u8, RouterWriter>,
      ) = routers
      .into_iter()
      .map(|(id, router)| {
      let (reader, writer) = router.split();
      ((id, reader), (id, writer))
      })
      .unzip();
      let router_writers3: Vec<(Arc<Socket>, HashMap<u8, RouterWriter>)> = router_writers
      .into_iter()
      .grouping_by(|(_, v)| v.key())
      .into_iter()
      .map(|(k, v)| {
      (
      Arc::clone(sockets.get_mut(&k).unwrap()),
      v.into_iter().collect(),
      )
      })
      .collect();
      println!("created tuns");
      thread::scope(|s| {
      for router in router_readers.values_mut() {
      s.spawn(|_| {
      let mut buffer = [0u8; 1500 - 20]; // minus typical IP header space
      let meta_size = size_of::<Meta>();
      // Pre-initialize with our Meta header (local -> remote)
      let meta = Meta {
      src_id: config.local_id,
      dst_id: router.config.remote_id,
      reversed: 0,
      };
      // Turn the Meta struct into bytes
      let meta_bytes = unsafe {
      std::slice::from_raw_parts(&meta as *const Meta as *const u8, meta_size)
      };
      buffer[..meta_size].copy_from_slice(meta_bytes);
      loop {
      let n = router.tun_reader.read(&mut buffer[meta_size..]).unwrap();
      if let Some(ref addr) = *router.endpoint.read().unwrap() {
      router.encrypt(&mut buffer[meta_size..meta_size + n]);
      #[cfg(target_os = "linux")]
      let _ = router.socket.set_mark(router.config.mark);
      let _ = router.socket.send_to(&buffer[..meta_size + n], addr);
      }
      }
      });
      }
      for (socket, mut router_writers) in router_writers3 {
      s.spawn(move |_| {
      let mut recv_buf = [MaybeUninit::uninit(); 1500];
      loop {
      let _ = (|| {
      let (len, addr) = socket.recv_from(&mut recv_buf).unwrap();
      let data: &mut [u8] = unsafe { transmute(&mut recv_buf[..len]) };
      let packet = Ipv4Packet::new(data).ok_or("malformed packet")?;
      let header_len = packet.get_header_length() as usize * 4;
      let (_ip_header, rest) = data
      .split_at_mut_checked(header_len)
      .ok_or("malformed packet")?;
      let (meta_bytes, payload) = rest
      .split_at_mut_checked(size_of::<Meta>())
      .ok_or("malformed packet")?;
      let meta: &Meta = unsafe { transmute(meta_bytes.as_ptr()) };
      if meta.dst_id == config.local_id && meta.reversed == 0 {
      let router = router_writers
      .get_mut(&meta.src_id)
      .ok_or("missing router")?;
      *router.endpoint.write().unwrap() = Some(addr);
      router.decrypt(payload, &local_secret);
      router.tun_writer.write_all(payload)?;
      }
      Ok::<(), Box<dyn Error>>(())
      })();
      }
      });
      }
      })
      .unwrap();
      Ok(())
      }
      mod router;
      use crate::router::{Router, SECRET_LENGTH};
      use std::env;
      use std::error::Error;
      use std::io::{Read, Write};
      use std::mem::MaybeUninit;
      use std::mem::{size_of, transmute};
      use std::sync::atomic::Ordering;
      use crossbeam_utils::thread;
      #[repr(C)]
      pub struct Meta {
      pub src_id: u8,
      pub dst_id: u8,
      pub reversed: u16,
      }
      use serde::Deserialize;
      #[derive(Deserialize)]
      pub struct Config {
      pub local_id: u8,
      pub local_secret: String,
      pub routers: Vec<ConfigRouter>,
      }
      #[derive(Deserialize)]
      pub struct ConfigRouter {
      pub remote_id: u8,
      pub proto: u8,
      pub family: u8,
      pub mark: u32,
      pub endpoint: String,
      pub remote_secret: String,
      pub dev: String,
      pub up: String,
      }
      fn main() -> Result<(), Box<dyn Error>> {
      println!("Starting");
      let config: Config = serde_json::from_str(env::args().nth(1).ok_or("need param")?.as_str())?;
      let local_secret: [u8; SECRET_LENGTH] = Router::create_secret(config.local_secret.as_str())?;
      let routers: Vec<Router> = config
      .routers
      .into_iter()
      .map(|c| Router::new(c, config.local_id))
      .collect::<Result<Vec<_>, _>>()?;
      println!("created tuns");
      const META_SIZE: usize = size_of::<Meta>();
      thread::scope(|s| {
      for router in routers {
      let (mut reader, mut writer) = router.split();
      s.spawn(move |_| {
      let mut buffer = [0u8; 1500 - 20]; // minus typical IP header space
      // Pre-initialize with our Meta header (local -> remote)
      let meta = Meta {
      src_id: config.local_id,
      dst_id: reader.config.remote_id,
      reversed: 0,
      };
      // Turn the Meta struct into bytes
      let meta_bytes: &[u8; META_SIZE] =
      unsafe { &*(&meta as *const Meta as *const [u8; META_SIZE]) };
      buffer[..META_SIZE].copy_from_slice(meta_bytes);
      loop {
      let n = reader.tun_reader.read(&mut buffer[META_SIZE..]).unwrap();
      let guard = crossbeam::epoch::pin();
      let shared = reader.endpoint.load(Ordering::Acquire, &guard);
      if let Some(addr) = unsafe { shared.as_ref() } {
      reader.encrypt(&mut buffer[META_SIZE..META_SIZE + n]);
      let _ = reader.socket.send_to(&buffer[..META_SIZE + n], addr);
      }
      }
      });
      s.spawn(move |_| {
      let mut recv_buf = [MaybeUninit::uninit(); 1500];
      loop {
      let _ = (|| {
      let (len, addr) = writer.socket.recv_from(&mut recv_buf).unwrap();
      let guard = crossbeam::epoch::pin();
      let current_shared = writer.endpoint.load(Ordering::SeqCst, &guard);
      let is_same = unsafe { current_shared.as_ref() }
      .map(|c| *c == addr)
      .unwrap_or(false);
      if !is_same {
      let new_shared = crossbeam::epoch::Owned::new(addr).into_shared(&guard);
      let old_shared =
      writer.endpoint.swap(new_shared, Ordering::SeqCst, &guard);
      unsafe {
      guard.defer_destroy(old_shared);
      }
      }
      let packet: &mut [u8] = unsafe { transmute(&mut recv_buf[..len]) };
      let version = packet[0] >> 4;
      let ip_header_len = match version {
      4 => (packet[0] & 0x0f) as usize * 4,
      6 => 40,
      _ => Err(format!("Unknown IP version: {}", version))?,
      };
      let offset = ip_header_len + META_SIZE;
      let payload = &mut packet[offset..];
      writer.decrypt(payload, &local_secret);
      writer.tun_writer.write_all(payload)?;
      Ok::<(), Box<dyn Error>>(())
      })();
      }
      });
      }
      })
      .unwrap();
      Ok(())
      }
      src/router.rs
      View file @ 7dcbbb26
      This diff is collapsed.
      Markdown is supported
      0% or
      You are about to add 0 people to the discussion. Proceed with caution.
      Finish editing this message first!
      Please register or to comment