Deuxfleurs
/
diplonat
24
4
Fork 1
Code Issues 8 Pull Requests Releases Wiki Activity

Merge pull request 'public IP address autodiscovery' (#20) from stun into main 

Reviewed-on: #20
This commit is contained in:
Alex 2023-04-21 09:56:21 +00:00
parent e64be9e881 f5fc635b75
commit 05872634a4
17 changed files with 2733 additions and 1039 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
.rustfmt.toml
View File

@ -1,75 +0,0 @@
unstable_features = true
array_width = 60
attr_fn_like_width = 70
binop_separator = "Front"
blank_lines_lower_bound = 0
blank_lines_upper_bound = 1
brace_style = "SameLineWhere"
chain_width = 60
color = "Auto"
combine_control_expr = true
comment_width = 80
condense_wildcard_suffixes = true
control_brace_style = "AlwaysSameLine"
disable_all_formatting = false
empty_item_single_line = true
enum_discrim_align_threshold = 0
error_on_line_overflow = true
error_on_unformatted = true
fn_args_layout = "Tall"
fn_call_width = 60
fn_single_line = true
force_explicit_abi = true
force_multiline_blocks = false
format_code_in_doc_comments = true
# format_generated_files = true
format_macro_matchers = true
format_macro_bodies = true
format_strings = true
hard_tabs = false
#hex_literal_case = "Lower"
hide_parse_errors = false
ignore = []
imports_indent = "Block"
imports_layout = "Mixed"
indent_style = "Block"
inline_attribute_width = 0
license_template_path = ""
match_arm_blocks = true
match_arm_leading_pipes = "Never"
match_block_trailing_comma = false
max_width = 100
merge_derives = true
imports_granularity = "Crate"
newline_style = "Unix"
normalize_comments = true
normalize_doc_attributes = true
overflow_delimited_expr = false
remove_nested_parens = true
reorder_impl_items = true
reorder_imports = true
group_imports = "StdExternalCrate"
reorder_modules = true
report_fixme = "Unnumbered"
report_todo = "Unnumbered"
required_version = "1.4.37"
skip_children = false
single_line_if_else_max_width = 50
space_after_colon = true
space_before_colon = false
#space_around_ranges = false
struct_field_align_threshold = 0
struct_lit_single_line = true
struct_lit_width = 18
struct_variant_width = 35
tab_spaces = 2
trailing_comma = "Vertical"
trailing_semicolon = false
type_punctuation_density = "Wide"
use_field_init_shorthand = false
use_small_heuristics = "Off"
use_try_shorthand = true
version = "Two"
where_single_line = true
wrap_comments = true

866
Cargo.lock generated
View File

File diff suppressed because it is too large Load Diff

1265
Cargo.nix
View File

File diff suppressed because it is too large Load Diff

1
Cargo.toml
View File

@ -21,3 +21,4 @@ serde = { version = "1.0.107", features = ["derive"] }
serde-lexpr = "0.1.1"
serde_json = "1.0.53"
tokio = { version = "1", features = ["sync", "rt-multi-thread", "net", "macros"] }
stun-client = "0.1.2"

5
src/config/mod.rs
View File

@ -3,11 +3,12 @@ mod options;
mod options_test;
mod runtime;
pub use options::{ConfigOpts, ConfigOptsAcme, ConfigOptsBase, ConfigOptsConsul};
pub use options::{ConfigOpts, ConfigOptsBase, ConfigOptsConsul};
pub use runtime::{
RuntimeConfig, RuntimeConfigAcme, RuntimeConfigConsul, RuntimeConfigFirewall, RuntimeConfigIgd,
RuntimeConfig, RuntimeConfigConsul, RuntimeConfigFirewall, RuntimeConfigIgd, RuntimeConfigStun,
};
pub const EXPIRATION_TIME: u16 = 300;
pub const REFRESH_TIME: u16 = 60;
pub const CONSUL_URL: &str = "http://127.0.0.1:8500";
pub const STUN_SERVER: &str = "stun.nextcloud.com:443";

24
src/config/options.rs
View File

@ -17,17 +17,11 @@ pub struct ConfigOptsBase {
pub expiration_time: Option<u16>,
/// Refresh time for IGD and Firewall rules [default: 300]
pub refresh_time: Option<u16>,
}
/// ACME configuration options
#[derive(Clone, Default, Deserialize)]
pub struct ConfigOptsAcme {
/// Whether ACME is enabled [default: false]
/// STUN server [default: stun.nextcloud.com:443]
pub stun_server: Option<String>,
/// IPv6-only mode (disables IGD, IPv4 firewall and IPv4 address autodiscovery) [default: false]
#[serde(default)]
pub enable: bool,
/// The default domain holder's e-mail [default: None]
pub email: Option<String>,
pub ipv6_only: bool,
}
/// Consul configuration options
@ -51,7 +45,6 @@ pub struct ConfigOptsConsul {
/// Model of all potential configuration options
pub struct ConfigOpts {
pub base: ConfigOptsBase,
pub acme: ConfigOptsAcme,
pub consul: ConfigOptsConsul,
}
@ -59,29 +52,26 @@ impl ConfigOpts {
pub fn from_env() -> Result<RuntimeConfig> {
let base: ConfigOptsBase = envy::prefixed("DIPLONAT_").from_env()?;
let consul: ConfigOptsConsul = envy::prefixed("DIPLONAT_CONSUL_").from_env()?;
let acme: ConfigOptsAcme = envy::prefixed("DIPLONAT_ACME_").from_env()?;
RuntimeConfig::new(Self {
base: base,
consul: consul,
acme: acme,
})
}
// Currently only used in tests
#[allow(dead_code)]
#[cfg(test)]
pub fn from_iter<Iter: Clone>(iter: Iter) -> Result<RuntimeConfig>
where
Iter: IntoIterator<Item = (String, String)>,
{
let base: ConfigOptsBase = envy::prefixed("DIPLONAT_").from_iter(iter.clone())?;
let consul: ConfigOptsConsul = envy::prefixed("DIPLONAT_CONSUL_").from_iter(iter.clone())?;
let acme: ConfigOptsAcme = envy::prefixed("DIPLONAT_ACME_").from_iter(iter.clone())?;
let consul: ConfigOptsConsul =
envy::prefixed("DIPLONAT_CONSUL_").from_iter(iter.clone())?;
RuntimeConfig::new(Self {
base: base,
consul: consul,
acme: acme,
})
}
}

35
src/config/options_test.rs
View File

@ -20,9 +20,13 @@ fn minimal_valid_options() -> HashMap<String, String> {
fn all_valid_options() -> HashMap<String, String> {
let mut opts = minimal_valid_options();
opts.insert("DIPLONAT_EXPIRATION_TIME".to_string(), "30".to_string());
opts.insert(
"DIPLONAT_STUN_SERVER".to_string(),
"stun.nextcloud.com:443".to_string(),
);
opts.insert(
"DIPLONAT_PRIVATE_IP".to_string(),
"172.123.43.555".to_string(),
"172.123.43.55".to_string(),
);
opts.insert("DIPLONAT_REFRESH_TIME".to_string(), "10".to_string());
opts.insert(
@ -49,7 +53,6 @@ fn ok_from_iter_minimal_valid_options() {
let opts = minimal_valid_options();
let rt_config = ConfigOpts::from_iter(opts.clone()).unwrap();
assert!(rt_config.acme.is_none());
assert_eq!(
&rt_config.consul.node_name,
opts.get(&"DIPLONAT_CONSUL_NODE_NAME".to_string()).unwrap()
@ -59,15 +62,13 @@ fn ok_from_iter_minimal_valid_options() {
rt_config.firewall.refresh_time,
Duration::from_secs(REFRESH_TIME.into())
);
assert!(rt_config.igd.private_ip.is_none());
let igd = rt_config.igd.unwrap();
assert!(igd.private_ip.is_none());
assert_eq!(
rt_config.igd.expiration_time,
igd.expiration_time,
Duration::from_secs(EXPIRATION_TIME.into())
);
assert_eq!(
rt_config.igd.refresh_time,
Duration::from_secs(REFRESH_TIME.into())
);
assert_eq!(igd.refresh_time, Duration::from_secs(REFRESH_TIME.into()));
}
#[test]
@ -85,27 +86,20 @@ fn ok_from_iter_all_valid_options() {
let rt_config = ConfigOpts::from_iter(opts.clone()).unwrap();
let expiration_time = Duration::from_secs(
opts
.get(&"DIPLONAT_EXPIRATION_TIME".to_string())
opts.get(&"DIPLONAT_EXPIRATION_TIME".to_string())
.unwrap()
.parse::<u64>()
.unwrap()
.into(),
);
let refresh_time = Duration::from_secs(
opts
.get(&"DIPLONAT_REFRESH_TIME".to_string())
opts.get(&"DIPLONAT_REFRESH_TIME".to_string())
.unwrap()
.parse::<u64>()
.unwrap()
.into(),
);
assert!(rt_config.acme.is_some());
assert_eq!(
&rt_config.acme.unwrap().email,
opts.get(&"DIPLONAT_ACME_EMAIL".to_string()).unwrap()
);
assert_eq!(
&rt_config.consul.node_name,
opts.get(&"DIPLONAT_CONSUL_NODE_NAME".to_string()).unwrap()
@ -115,10 +109,11 @@ fn ok_from_iter_all_valid_options() {
opts.get(&"DIPLONAT_CONSUL_URL".to_string()).unwrap()
);
assert_eq!(rt_config.firewall.refresh_time, refresh_time);
let igd = rt_config.igd.unwrap();
assert_eq!(
&rt_config.igd.private_ip.unwrap(),
&igd.private_ip.unwrap().to_string(),
opts.get(&"DIPLONAT_PRIVATE_IP".to_string()).unwrap()
);
assert_eq!(rt_config.igd.expiration_time, expiration_time);
assert_eq!(rt_config.igd.refresh_time, refresh_time);
assert_eq!(igd.expiration_time, expiration_time);
assert_eq!(igd.refresh_time, refresh_time);
}

118
src/config/runtime.rs
View File

@ -1,21 +1,17 @@
use std::fs::File;
use std::io::Read;
use std::net::{Ipv4Addr, SocketAddr, ToSocketAddrs};
use std::time::Duration;
use anyhow::{anyhow, bail, Result};
use anyhow::{anyhow, bail, Context, Result};
use crate::config::{ConfigOpts, ConfigOptsAcme, ConfigOptsBase, ConfigOptsConsul};
use crate::config::{ConfigOpts, ConfigOptsBase, ConfigOptsConsul};
// This code is inspired by the Trunk crate (https://github.com/thedodd/trunk)
// In this file, we take ConfigOpts and transform them into ready-to-use
// RuntimeConfig. We apply default values and business logic.
#[derive(Debug)]
pub struct RuntimeConfigAcme {
pub email: String,
}
#[derive(Debug)]
pub struct RuntimeConfigConsul {
pub node_name: String,
@ -25,54 +21,51 @@ pub struct RuntimeConfigConsul {
#[derive(Debug)]
pub struct RuntimeConfigFirewall {
pub ipv6_only: bool,
pub refresh_time: Duration,
}
#[derive(Debug)]
pub struct RuntimeConfigIgd {
pub private_ip: Option<String>,
pub private_ip: Option<Ipv4Addr>,
pub expiration_time: Duration,
pub refresh_time: Duration,
}
#[derive(Debug)]
pub struct RuntimeConfigStun {
pub stun_server_v4: Option<SocketAddr>,
pub stun_server_v6: SocketAddr,
pub refresh_time: Duration,
}
#[derive(Debug)]
pub struct RuntimeConfig {
pub acme: Option<RuntimeConfigAcme>,
pub consul: RuntimeConfigConsul,
pub firewall: RuntimeConfigFirewall,
pub igd: RuntimeConfigIgd,
pub igd: Option<RuntimeConfigIgd>,
pub stun: RuntimeConfigStun,
}
impl RuntimeConfig {
pub fn new(opts: ConfigOpts) -> Result<Self> {
let acme = RuntimeConfigAcme::new(opts.acme.clone())?;
let consul = RuntimeConfigConsul::new(opts.consul.clone())?;
let firewall = RuntimeConfigFirewall::new(opts.base.clone())?;
let igd = RuntimeConfigIgd::new(opts.base.clone())?;
let consul = RuntimeConfigConsul::new(opts.consul)?;
let firewall = RuntimeConfigFirewall::new(&opts.base)?;
let igd = match opts.base.ipv6_only {
false => Some(RuntimeConfigIgd::new(&opts.base)?),
true => None,
};
let stun = RuntimeConfigStun::new(&opts.base)?;
Ok(Self {
acme,
consul,
firewall,
igd,
stun,
})
}
}
impl RuntimeConfigAcme {
pub fn new(opts: ConfigOptsAcme) -> Result<Option<Self>> {
if !opts.enable {
return Ok(None);
}
let email = opts.email.expect(
"'DIPLONAT_ACME_EMAIL' environment variable is required if 'DIPLONAT_ACME_ENABLE' == 'true'",
);
Ok(Some(Self { email }))
}
}
impl RuntimeConfigConsul {
pub(super) fn new(opts: ConfigOptsConsul) -> Result<Self> {
let node_name = opts
@ -97,8 +90,9 @@ impl RuntimeConfigConsul {
let mut client_key_buf = vec![];
File::open(client_key)?.read_to_end(&mut client_key_buf)?;
let ident =
reqwest::Identity::from_pem(&[&client_cert_buf[..], &client_key_buf[..]].concat()[..])?;
let ident = reqwest::Identity::from_pem(
&[&client_cert_buf[..], &client_key_buf[..]].concat()[..],
)?;
Some((cert, opts.tls_skip_verify, ident))
}
@ -115,23 +109,32 @@ impl RuntimeConfigConsul {
}
impl RuntimeConfigFirewall {
pub(super) fn new(opts: ConfigOptsBase) -> Result<Self> {
let refresh_time = Duration::from_secs(opts.refresh_time.unwrap_or(super::REFRESH_TIME).into());
pub(super) fn new(opts: &ConfigOptsBase) -> Result<Self> {
let refresh_time =
Duration::from_secs(opts.refresh_time.unwrap_or(super::REFRESH_TIME).into());
Ok(Self { refresh_time })
Ok(Self {
refresh_time,
ipv6_only: opts.ipv6_only,
})
}
}
impl RuntimeConfigIgd {
pub(super) fn new(opts: ConfigOptsBase) -> Result<Self> {
let private_ip = opts.private_ip;
pub(super) fn new(opts: &ConfigOptsBase) -> Result<Self> {
let private_ip = opts
.private_ip
.as_ref()
.map(|x| x.parse())
.transpose()
.context("parse private_ip")?;
let expiration_time = Duration::from_secs(
opts
.expiration_time
opts.expiration_time
.unwrap_or(super::EXPIRATION_TIME)
.into(),
);
let refresh_time = Duration::from_secs(opts.refresh_time.unwrap_or(super::REFRESH_TIME).into());
let refresh_time =
Duration::from_secs(opts.refresh_time.unwrap_or(super::REFRESH_TIME).into());
if refresh_time.as_secs() * 2 > expiration_time.as_secs() {
return Err(anyhow!(
@ -149,3 +152,40 @@ impl RuntimeConfigIgd {
})
}
}
impl RuntimeConfigStun {
pub(super) fn new(opts: &ConfigOptsBase) -> Result<Self> {
let mut stun_server_v4 = None;
let mut stun_server_v6 = None;
for addr in opts
.stun_server
.as_deref()
.unwrap_or(super::STUN_SERVER)
.to_socket_addrs()?
{
if addr.is_ipv4() {
stun_server_v4 = Some(addr);
}
if addr.is_ipv6() {
stun_server_v6 = Some(addr);
}
}
let refresh_time =
Duration::from_secs(opts.refresh_time.unwrap_or(super::REFRESH_TIME).into());
let stun_server_v4 = match opts.ipv6_only {
false => Some(
stun_server_v4.ok_or(anyhow!("Unable to resolve STUN server's IPv4 address"))?,
),
true => None,
};
Ok(Self {
stun_server_v4,
stun_server_v6: stun_server_v6
.ok_or(anyhow!("Unable to resolve STUN server's IPv6 address"))?,
refresh_time,
})
}
}

19
src/consul.rs
View File

@ -7,12 +7,14 @@ use crate::config::RuntimeConfigConsul;
#[derive(Serialize, Deserialize, Debug)]
pub struct ServiceEntry {
pub Tags: Vec<String>,
#[serde(rename = "Tags")]
pub tags: Vec<String>,
}
#[derive(Serialize, Deserialize, Debug)]
#[derive(Serialize, Deserialize, Debug, Default)]
pub struct CatalogNode {
pub Services: HashMap<String, ServiceEntry>,
#[serde(rename = "Services")]
pub services: HashMap<String, ServiceEntry>,
}
pub struct Consul {
@ -71,7 +73,14 @@ impl Consul {
None => return Err(anyhow!("X-Consul-Index header not found")),
};
let resp: CatalogNode = http.json().await?;
return Ok(resp);
let resp: Option<CatalogNode> = http.json().await?;
return Ok(resp.unwrap_or_default());
}
pub async fn kv_put(&self, key: &str, bytes: Vec<u8>) -> Result<()> {
let url = format!("{}/v1/kv/{}", self.url, key);
let http = self.client.put(&url).body(bytes).send().await?;
http.error_for_status()?;
Ok(())
}
}

19
src/consul_actor.rs
View File

@ -11,13 +11,16 @@ use crate::{consul, messages};
#[derive(Serialize, Deserialize, Debug)]
pub enum DiplonatParameter {
tcp_port(HashSet<u16>),
udp_port(HashSet<u16>),
#[serde(rename = "tcp_port")]
TcpPort(HashSet<u16>),
#[serde(rename = "udp_port")]
UdpPort(HashSet<u16>),
}
#[derive(Serialize, Deserialize, Debug)]
pub enum DiplonatConsul {
diplonat(Vec<DiplonatParameter>),
#[serde(rename = "diplonat")]
Diplonat(Vec<DiplonatParameter>),
}
pub struct ConsulActor {
@ -42,8 +45,8 @@ fn retry_to_time(retries: u32, max_time: Duration) -> Duration {
fn to_parameters(catalog: &consul::CatalogNode) -> Vec<DiplonatConsul> {
let mut r = Vec::new();
for (_, service_info) in &catalog.Services {
for tag in &service_info.Tags {
for (_, service_info) in &catalog.services {
for tag in &service_info.tags {
let diplo_conf: error::Result<DiplonatConsul> = from_str(tag);
match diplo_conf {
Ok(conf) => r.push(conf),
@ -62,11 +65,11 @@ fn to_open_ports(params: &Vec<DiplonatConsul>) -> messages::PublicExposedPorts {
};
for conf in params {
let DiplonatConsul::diplonat(c) = conf;
let DiplonatConsul::Diplonat(c) = conf;
for parameter in c {
match parameter {
DiplonatParameter::tcp_port(p) => op.tcp_ports.extend(p),
DiplonatParameter::udp_port(p) => op.udp_ports.extend(p),
DiplonatParameter::TcpPort(p) => op.tcp_ports.extend(p),
DiplonatParameter::UdpPort(p) => op.udp_ports.extend(p),
};
}
}

59
src/diplonat.rs
View File

@ -1,49 +1,78 @@
use anyhow::Result;
use anyhow::{Context, Result};
use futures::future::FutureExt;
use tokio::try_join;
use crate::{
config::ConfigOpts, consul_actor::ConsulActor, fw_actor::FirewallActor, igd_actor::IgdActor,
stun_actor::StunActor,
};
pub struct Diplonat {
consul: ConsulActor,
firewall: FirewallActor,
igd: IgdActor,
igd: Option<IgdActor>,
stun: StunActor,
}
impl Diplonat {
pub async fn new() -> Result<Self> {
let rt_cfg = ConfigOpts::from_env()?;
let rt_cfg = ConfigOpts::from_env().context("Parse configuration")?;
println!("{:#?}", rt_cfg);
let ca = ConsulActor::new(&rt_cfg.consul, &rt_cfg.consul.node_name);
let fw = FirewallActor::new(rt_cfg.firewall.refresh_time, &ca.rx_open_ports).await?;
let ia = IgdActor::new(
rt_cfg.igd.private_ip.as_ref().map(String::as_str),
rt_cfg.igd.refresh_time,
rt_cfg.igd.expiration_time,
let fw = FirewallActor::new(
rt_cfg.firewall.ipv6_only,
rt_cfg.firewall.refresh_time,
&ca.rx_open_ports,
)
.await?;
.await
.context("Setup fireall actor")?;
let ia = match rt_cfg.igd {
Some(igdc) => Some(
IgdActor::new(
igdc.private_ip,
igdc.refresh_time,
igdc.expiration_time,
&ca.rx_open_ports,
)
.await
.context("Setup IGD actor")?,
),
None => None,
};
let sa = StunActor::new(&rt_cfg.consul, &rt_cfg.stun, &rt_cfg.consul.node_name);
let ctx = Self {
consul: ca,
igd: ia,
firewall: fw,
stun: sa,
};
return Ok(ctx);
Ok(ctx)
}
pub async fn listen(&mut self) -> Result<()> {
let igd_opt = &mut self.igd;
try_join!(
self.consul.listen(),
self.igd.listen(),
self.firewall.listen()
self.consul.listen().map(|x| x.context("Run consul actor")),
async {
if let Some(igd) = igd_opt {
igd.listen().await.context("Run IGD actor")
} else {
Ok(())
}
},
self.firewall
.listen()
.map(|x| x.context("Run firewall actor")),
self.stun.listen().map(|x| x.context("Run STUN actor")),
)?;
return Ok(());
Ok(())
}
}

38
src/fw.rs
View File

@ -11,11 +11,10 @@ pub fn setup(ipt: &iptables::IPTables) -> Result<()> {
// ensure we start from a clean state without any rule already set
cleanup(ipt)?;
ipt
.new_chain("filter", "DIPLONAT")
info!("{}: creating DIPLONAT chain", ipt.cmd);
ipt.new_chain("filter", "DIPLONAT")
.context("Failed to create new chain")?;
ipt
.insert_unique("filter", "INPUT", "-j DIPLONAT", 1)
ipt.insert_unique("filter", "INPUT", "-j DIPLONAT", 1)
.context("Failed to insert jump rule")?;
Ok(())
@ -23,8 +22,8 @@ pub fn setup(ipt: &iptables::IPTables) -> Result<()> {
pub fn open_ports(ipt: &iptables::IPTables, ports: messages::PublicExposedPorts) -> Result<()> {
for p in ports.tcp_ports {
ipt
.append(
info!("{}: opening TCP port {}", ipt.cmd, p);
ipt.append(
"filter",
"DIPLONAT",
&format!("-p tcp --dport {} -j ACCEPT", p),
@ -33,8 +32,8 @@ pub fn open_ports(ipt: &iptables::IPTables, ports: messages::PublicExposedPorts)
}
for p in ports.udp_ports {
ipt
.append(
info!("{}: opening UDP port {}", ipt.cmd, p);
ipt.append(
"filter",
"DIPLONAT",
&format!("-p udp --dport {} -j ACCEPT", p),
@ -55,6 +54,7 @@ pub fn get_opened_ports(ipt: &iptables::IPTables) -> Result<messages::PublicExpo
let re = Regex::new(r"\-A.*? \-p (\w+).*\-\-dport (\d+).*?\-j ACCEPT")
.context("Regex matching open ports encountered an unexpected rule")?;
for i in list {
debug!("{} list DIPLONAT: got {}", ipt.cmd, i);
let caps = re.captures(&i);
match caps {
Some(c) => {
@ -62,36 +62,40 @@ pub fn get_opened_ports(ipt: &iptables::IPTables) -> Result<messages::PublicExpo
let proto = String::from(raw_proto.as_str());
let number = String::from(raw_port.as_str()).parse::<u16>()?;
if proto == "tcp" {
if proto == "tcp" || proto == "6" {
ports.tcp_ports.insert(number);
} else {
} else if proto == "udp" || proto == "17" {
ports.udp_ports.insert(number);
} else {
error!("Unexpected protocol in iptables rule: {}", proto);
}
} else {
error!("Unexpected rule found in DIPLONAT chain")
}
}
_ => {}
_ => {
debug!("{} rule not parsed: {}", ipt.cmd, i);
}
}
}
debug!("{} ports already openned: {:?}", ipt.cmd, ports);
Ok(ports)
}
pub fn cleanup(ipt: &iptables::IPTables) -> Result<()> {
if ipt.chain_exists("filter", "DIPLONAT")? {
ipt
.flush_chain("filter", "DIPLONAT")
info!("{}: removing old DIPLONAT chain", ipt.cmd);
ipt.flush_chain("filter", "DIPLONAT")
.context("Failed to flush the DIPLONAT chain")?;
if ipt.exists("filter", "INPUT", "-j DIPLONAT")? {
ipt
.delete("filter", "INPUT", "-j DIPLONAT")
ipt.delete("filter", "INPUT", "-j DIPLONAT")
.context("Failed to delete jump rule")?;
}
ipt
.delete_chain("filter", "DIPLONAT")
ipt.delete_chain("filter", "DIPLONAT")
.context("Failed to delete chain")?;
}

22
src/fw_actor.rs
View File

@ -12,7 +12,7 @@ use tokio::{
use crate::{fw, messages};
pub struct FirewallActor {
pub ipt_v4: iptables::IPTables,
pub ipt_v4: Option<iptables::IPTables>,
pub ipt_v6: iptables::IPTables,
rx_ports: watch::Receiver<messages::PublicExposedPorts>,
last_ports: messages::PublicExposedPorts,
@ -21,18 +21,24 @@ pub struct FirewallActor {
impl FirewallActor {
pub async fn new(
ipv6_only: bool,
refresh: Duration,
rxp: &watch::Receiver<messages::PublicExposedPorts>,
) -> Result<Self> {
let ctx = Self {
ipt_v4: iptables::new(false)?,
ipt_v4: match ipv6_only {
false => Some(iptables::new(false)?),
true => None,
},
ipt_v6: iptables::new(true)?,
rx_ports: rxp.clone(),
last_ports: messages::PublicExposedPorts::new(),
refresh,
};
fw::setup(&ctx.ipt_v4)?;
if let Some(ipt_v4) = &ctx.ipt_v4 {
fw::setup(ipt_v4)?;
}
fw::setup(&ctx.ipt_v6)?;
return Ok(ctx);
@ -62,7 +68,14 @@ impl FirewallActor {
}
pub async fn do_fw_update(&self) -> Result<()> {
for ipt in [&self.ipt_v4, &self.ipt_v6] {
if let Some(ipt_v4) = &self.ipt_v4 {
self.do_fw_update_on(ipt_v4).await?;
}
self.do_fw_update_on(&self.ipt_v6).await?;
Ok(())
}
pub async fn do_fw_update_on(&self, ipt: &iptables::IPTables) -> Result<()> {
let curr_opened_ports = fw::get_opened_ports(ipt)?;
let diff_tcp = self
@ -84,7 +97,6 @@ impl FirewallActor {
};
fw::open_ports(ipt, ports_to_open)?;
}
return Ok(());
}

32
src/igd_actor.rs
View File

@ -1,4 +1,4 @@
use std::net::SocketAddrV4;
use std::net::{Ipv4Addr, SocketAddrV4};
use anyhow::{Context, Result};
use igd::{aio::*, PortMappingProtocol};
@ -17,12 +17,12 @@ pub struct IgdActor {
gateway: Gateway,
refresh: Duration,
expire: Duration,
private_ip: String,
private_ip: Ipv4Addr,
}
impl IgdActor {
pub async fn new(
priv_ip: Option<&str>,
priv_ip: Option<Ipv4Addr>,
refresh: Duration,
expire: Duration,
rxp: &watch::Receiver<messages::PublicExposedPorts>,
@ -34,7 +34,7 @@ impl IgdActor {
let private_ip = if let Some(ip) = priv_ip {
info!("Using private IP from config: {}", ip);
ip.to_string()
ip
} else {
info!("Trying to automatically detect private IP");
let gwa = gw.addr.ip().octets();
@ -46,18 +46,18 @@ impl IgdActor {
gw.addr.ip()
),
};
let public_ip = get_if_addrs::get_if_addrs()?
#[allow(unused_parens)]
let private_ip = get_if_addrs::get_if_addrs()?
.into_iter()
.map(|i| i.addr.ip())
.filter(|a| match a {
std::net::IpAddr::V4(a4) => (a4.octets()[..cmplen] == gwa[..cmplen]),
_ => false,
.filter_map(|a| match a {
std::net::IpAddr::V4(a4) if a4.octets()[..cmplen] == gwa[..cmplen] => Some(a4),
_ => None,
})
.next()
.expect("No interface has an IP on same subnet as gateway")
.to_string();
info!("Found private IP: {}", public_ip);
public_ip
.expect("No interface has an IP on same subnet as gateway");
info!("Autodetected private IP: {}", private_ip);
private_ip
};
let ctx = Self {
@ -103,12 +103,8 @@ impl IgdActor {
for (proto, list) in actions.iter() {
for port in *list {
let service_str = format!("{}:{}", self.private_ip, port);
let service = service_str
.parse::<SocketAddrV4>()
.context("Invalid socket address")?;
self
.gateway
let service = SocketAddrV4::new(self.private_ip, *port);
self.gateway
.add_port(
*proto,
*port,

9
src/main.rs
View File

@ -6,6 +6,7 @@ mod fw;
mod fw_actor;
mod igd_actor;
mod messages;
mod stun_actor;
use diplonat::Diplonat;
use log::*;
@ -15,6 +16,10 @@ async fn main() {
pretty_env_logger::init();
info!("Starting Diplonat");
let mut diplo = Diplonat::new().await.expect("Setup failed");
diplo.listen().await.expect("A runtime error occured");
Diplonat::new()
.await
.expect("Setup failed")
.listen()
.await
.expect("A runtime error occured");
}

147
src/stun_actor.rs Normal file
View File

@ -0,0 +1,147 @@
use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
use std::time::{Duration, SystemTime};
use anyhow::{anyhow, bail, Result};
use log::*;
use serde::{Deserialize, Serialize};
use crate::config::{RuntimeConfigConsul, RuntimeConfigStun};
use crate::consul;
pub struct StunActor {
node: String,
consul: consul::Consul,
stun_server_v4: Option<SocketAddr>,
stun_server_v6: SocketAddr,
refresh_time: Duration,
}
#[derive(Serialize, Deserialize, Debug)]
pub struct AutodiscoverResult {
pub timestamp: u64,
pub address: Option<IpAddr>,
}
impl StunActor {
pub fn new(
consul_config: &RuntimeConfigConsul,
stun_config: &RuntimeConfigStun,
node: &str,
) -> Self {
assert!(stun_config
.stun_server_v4
.map(|x| x.is_ipv4())
.unwrap_or(true));
assert!(stun_config.stun_server_v6.is_ipv6());
Self {
consul: consul::Consul::new(consul_config),
node: node.to_string(),
stun_server_v4: stun_config.stun_server_v4,
stun_server_v6: stun_config.stun_server_v6,
refresh_time: stun_config.refresh_time,
}
}
pub async fn listen(&mut self) -> Result<()> {
loop {
let ipv4_result = match self.stun_server_v4 {
Some(stun_server_v4) => self.autodiscover_ip(stun_server_v4).await,
None => self.autodiscover_none_ipv4().await,
};
if let Err(e) = ipv4_result {
error!("Unable to autodiscover IPv4 address: {}", e);
}
if let Err(e) = self.autodiscover_ip(self.stun_server_v6).await {
error!("Unable to autodiscover IPv6 address: {}", e);
}
tokio::time::sleep(self.refresh_time).await;
}
}
async fn autodiscover_ip(&self, stun_server: SocketAddr) -> Result<()> {
let binding_ip = match stun_server.is_ipv4() {
true => IpAddr::V4(Ipv4Addr::UNSPECIFIED), // 0.0.0.0
false => IpAddr::V6(Ipv6Addr::UNSPECIFIED), // [::]
};
let binding_addr = SocketAddr::new(binding_ip, 0);
let discovered_addr = get_mapped_addr(stun_server, binding_addr)
.await?
.map(|x| x.ip());
let consul_key = match stun_server.is_ipv4() {
true => {
debug!("Autodiscovered IPv4: {:?}", discovered_addr);
format!("diplonat/autodiscovery/ipv4/{}", self.node)
}
false => {
debug!("Autodiscovered IPv6: {:?}", discovered_addr);
format!("diplonat/autodiscovery/ipv6/{}", self.node)
}
};
self.consul
.kv_put(
&consul_key,
serde_json::to_vec(&AutodiscoverResult {
timestamp: timestamp(),
address: discovered_addr,
})?,
)
.await?;
Ok(())
}
async fn autodiscover_none_ipv4(&self) -> Result<()> {
let consul_key = format!("diplonat/autodiscovery/ipv4/{}", self.node);
self.consul
.kv_put(
&consul_key,
serde_json::to_vec(&AutodiscoverResult {
timestamp: timestamp(),
address: None,
})?,
)
.await?;
Ok(())
}
}
async fn get_mapped_addr(
stun_server: SocketAddr,
binding_addr: SocketAddr,
) -> Result<Option<SocketAddr>> {
use stun_client::*;
let mut client = Client::new(binding_addr, None).await?;
let res = match client.binding_request(stun_server, None).await {
Err(e) => {
info!(
"STUN binding request to {} failed, assuming no address (error: {})",
binding_addr, e
);
return Ok(None);
}
Ok(r) => r,
};
if res.get_class() != Class::SuccessResponse {
bail!("STUN server did not responde with a success response");
}
let xor_mapped_addr = Attribute::get_xor_mapped_address(&res)
.ok_or(anyhow!("no XorMappedAddress found in STUN response"))?;
Ok(Some(xor_mapped_addr))
}
fn timestamp() -> u64 {
SystemTime::now()
.duration_since(SystemTime::UNIX_EPOCH)
.expect("clock error")
.as_secs()
}