.rustfmt.toml

@@ -1,75 +0,0 @@
-unstable_features = true
-
-array_width = 60
-attr_fn_like_width = 70
-binop_separator = "Front"
-blank_lines_lower_bound = 0
-blank_lines_upper_bound = 1
-brace_style = "SameLineWhere"
-chain_width = 60
-color = "Auto"
-combine_control_expr = true
-comment_width = 80
-condense_wildcard_suffixes = true
-control_brace_style = "AlwaysSameLine"
-disable_all_formatting = false
-empty_item_single_line = true
-enum_discrim_align_threshold = 0
-error_on_line_overflow = true
-error_on_unformatted = true
-fn_args_layout = "Tall"
-fn_call_width = 60
-fn_single_line = true
-force_explicit_abi = true
-force_multiline_blocks = false
-format_code_in_doc_comments = true
-# format_generated_files = true
-format_macro_matchers = true
-format_macro_bodies = true
-format_strings = true
-hard_tabs = false
-#hex_literal_case = "Lower"
-hide_parse_errors = false
-ignore = []
-imports_indent = "Block"
-imports_layout = "Mixed"
-indent_style = "Block"
-inline_attribute_width = 0
-license_template_path = ""
-match_arm_blocks = true
-match_arm_leading_pipes = "Never"
-match_block_trailing_comma = false
-max_width = 100
-merge_derives = true
-imports_granularity = "Crate"
-newline_style = "Unix"
-normalize_comments = true
-normalize_doc_attributes = true
-overflow_delimited_expr = false
-remove_nested_parens = true
-reorder_impl_items = true
-reorder_imports = true
-group_imports = "StdExternalCrate"
-reorder_modules = true
-report_fixme = "Unnumbered"
-report_todo = "Unnumbered"
-required_version = "1.4.37"
-skip_children = false
-single_line_if_else_max_width = 50
-space_after_colon = true
-space_before_colon = false
-#space_around_ranges = false
-struct_field_align_threshold = 0
-struct_lit_single_line = true
-struct_lit_width = 18
-struct_variant_width = 35
-tab_spaces = 2
-trailing_comma = "Vertical"
-trailing_semicolon = false
-type_punctuation_density = "Wide"
-use_field_init_shorthand = false
-use_small_heuristics = "Off"
-use_try_shorthand = true
-version = "Two"
-where_single_line = true
-wrap_comments = true

Cargo.toml

@@ -21,3 +21,4 @@ serde = { version = "1.0.107", features = ["derive"] }
 serde-lexpr = "0.1.1"
 serde_json = "1.0.53"
 tokio = { version = "1", features = ["sync", "rt-multi-thread", "net", "macros"] }
+stun-client = "0.1.2"

src/config/mod.rs

@@ -3,11 +3,12 @@ mod options;
 mod options_test;
 mod runtime;
 
-pub use options::{ConfigOpts, ConfigOptsAcme, ConfigOptsBase, ConfigOptsConsul};
+pub use options::{ConfigOpts, ConfigOptsBase, ConfigOptsConsul};
 pub use runtime::{
-  RuntimeConfig, RuntimeConfigAcme, RuntimeConfigConsul, RuntimeConfigFirewall, RuntimeConfigIgd,
+    RuntimeConfig, RuntimeConfigConsul, RuntimeConfigFirewall, RuntimeConfigIgd, RuntimeConfigStun,
 };
 
 pub const EXPIRATION_TIME: u16 = 300;
 pub const REFRESH_TIME: u16 = 60;
 pub const CONSUL_URL: &str = "http://127.0.0.1:8500";
+pub const STUN_SERVER: &str = "stun.nextcloud.com:443";

src/config/options.rs

@@ -17,17 +17,11 @@ pub struct ConfigOptsBase {
     pub expiration_time: Option<u16>,
     /// Refresh time for IGD and Firewall rules [default: 300]
     pub refresh_time: Option<u16>,
-}
+    /// STUN server [default: stun.nextcloud.com:443]
-
+    pub stun_server: Option<String>,
-/// ACME configuration options
+    /// IPv6-only mode (disables IGD, IPv4 firewall and IPv4 address autodiscovery) [default: false]
-#[derive(Clone, Default, Deserialize)]
-pub struct ConfigOptsAcme {
-  /// Whether ACME is enabled [default: false]
     #[serde(default)]
-  pub enable: bool,
+    pub ipv6_only: bool,
-
-  /// The default domain holder's e-mail [default: None]
-  pub email: Option<String>,
 }
 
 /// Consul configuration options
@@ -51,7 +45,6 @@ pub struct ConfigOptsConsul {
 /// Model of all potential configuration options
 pub struct ConfigOpts {
     pub base: ConfigOptsBase,
-  pub acme: ConfigOptsAcme,
     pub consul: ConfigOptsConsul,
 }
 
@@ -59,29 +52,26 @@ impl ConfigOpts {
     pub fn from_env() -> Result<RuntimeConfig> {
         let base: ConfigOptsBase = envy::prefixed("DIPLONAT_").from_env()?;
         let consul: ConfigOptsConsul = envy::prefixed("DIPLONAT_CONSUL_").from_env()?;
-    let acme: ConfigOptsAcme = envy::prefixed("DIPLONAT_ACME_").from_env()?;
 
         RuntimeConfig::new(Self {
             base: base,
             consul: consul,
-      acme: acme,
         })
     }
 
     // Currently only used in tests
-  #[allow(dead_code)]
+    #[cfg(test)]
     pub fn from_iter<Iter: Clone>(iter: Iter) -> Result<RuntimeConfig>
     where
         Iter: IntoIterator<Item = (String, String)>,
     {
         let base: ConfigOptsBase = envy::prefixed("DIPLONAT_").from_iter(iter.clone())?;
-    let consul: ConfigOptsConsul = envy::prefixed("DIPLONAT_CONSUL_").from_iter(iter.clone())?;
+        let consul: ConfigOptsConsul =
-    let acme: ConfigOptsAcme = envy::prefixed("DIPLONAT_ACME_").from_iter(iter.clone())?;
+            envy::prefixed("DIPLONAT_CONSUL_").from_iter(iter.clone())?;
 
         RuntimeConfig::new(Self {
             base: base,
             consul: consul,
-      acme: acme,
         })
     }
 }

src/config/options_test.rs

@@ -20,9 +20,13 @@ fn minimal_valid_options() -> HashMap<String, String> {
 fn all_valid_options() -> HashMap<String, String> {
     let mut opts = minimal_valid_options();
     opts.insert("DIPLONAT_EXPIRATION_TIME".to_string(), "30".to_string());
+    opts.insert(
+        "DIPLONAT_STUN_SERVER".to_string(),
+        "stun.nextcloud.com:443".to_string(),
+    );
     opts.insert(
         "DIPLONAT_PRIVATE_IP".to_string(),
-    "172.123.43.555".to_string(),
+        "172.123.43.55".to_string(),
     );
     opts.insert("DIPLONAT_REFRESH_TIME".to_string(), "10".to_string());
     opts.insert(
@@ -49,7 +53,6 @@ fn ok_from_iter_minimal_valid_options() {
     let opts = minimal_valid_options();
     let rt_config = ConfigOpts::from_iter(opts.clone()).unwrap();
 
-  assert!(rt_config.acme.is_none());
     assert_eq!(
         &rt_config.consul.node_name,
         opts.get(&"DIPLONAT_CONSUL_NODE_NAME".to_string()).unwrap()
@@ -59,15 +62,13 @@ fn ok_from_iter_minimal_valid_options() {
         rt_config.firewall.refresh_time,
         Duration::from_secs(REFRESH_TIME.into())
     );
-  assert!(rt_config.igd.private_ip.is_none());
+    let igd = rt_config.igd.unwrap();
+    assert!(igd.private_ip.is_none());
     assert_eq!(
-    rt_config.igd.expiration_time,
+        igd.expiration_time,
         Duration::from_secs(EXPIRATION_TIME.into())
     );
-  assert_eq!(
+    assert_eq!(igd.refresh_time, Duration::from_secs(REFRESH_TIME.into()));
-    rt_config.igd.refresh_time,
-    Duration::from_secs(REFRESH_TIME.into())
-  );
 }
 
 #[test]
@@ -85,27 +86,20 @@ fn ok_from_iter_all_valid_options() {
     let rt_config = ConfigOpts::from_iter(opts.clone()).unwrap();
 
     let expiration_time = Duration::from_secs(
-    opts
+        opts.get(&"DIPLONAT_EXPIRATION_TIME".to_string())
-      .get(&"DIPLONAT_EXPIRATION_TIME".to_string())
             .unwrap()
             .parse::<u64>()
             .unwrap()
             .into(),
     );
     let refresh_time = Duration::from_secs(
-    opts
+        opts.get(&"DIPLONAT_REFRESH_TIME".to_string())
-      .get(&"DIPLONAT_REFRESH_TIME".to_string())
             .unwrap()
             .parse::<u64>()
             .unwrap()
             .into(),
     );
 
-  assert!(rt_config.acme.is_some());
-  assert_eq!(
-    &rt_config.acme.unwrap().email,
-    opts.get(&"DIPLONAT_ACME_EMAIL".to_string()).unwrap()
-  );
     assert_eq!(
         &rt_config.consul.node_name,
         opts.get(&"DIPLONAT_CONSUL_NODE_NAME".to_string()).unwrap()
@@ -115,10 +109,11 @@ fn ok_from_iter_all_valid_options() {
         opts.get(&"DIPLONAT_CONSUL_URL".to_string()).unwrap()
     );
     assert_eq!(rt_config.firewall.refresh_time, refresh_time);
+    let igd = rt_config.igd.unwrap();
     assert_eq!(
-    &rt_config.igd.private_ip.unwrap(),
+        &igd.private_ip.unwrap().to_string(),
         opts.get(&"DIPLONAT_PRIVATE_IP".to_string()).unwrap()
     );
-  assert_eq!(rt_config.igd.expiration_time, expiration_time);
+    assert_eq!(igd.expiration_time, expiration_time);
-  assert_eq!(rt_config.igd.refresh_time, refresh_time);
+    assert_eq!(igd.refresh_time, refresh_time);
 }

src/config/runtime.rs

@@ -1,21 +1,17 @@
 use std::fs::File;
 use std::io::Read;
+use std::net::{Ipv4Addr, SocketAddr, ToSocketAddrs};
 use std::time::Duration;
 
-use anyhow::{anyhow, bail, Result};
+use anyhow::{anyhow, bail, Context, Result};
 
-use crate::config::{ConfigOpts, ConfigOptsAcme, ConfigOptsBase, ConfigOptsConsul};
+use crate::config::{ConfigOpts, ConfigOptsBase, ConfigOptsConsul};
 
 // This code is inspired by the Trunk crate (https://github.com/thedodd/trunk)
 
 // In this file, we take ConfigOpts and transform them into ready-to-use
 // RuntimeConfig. We apply default values and business logic.
 
-#[derive(Debug)]
-pub struct RuntimeConfigAcme {
-  pub email: String,
-}
-
 #[derive(Debug)]
 pub struct RuntimeConfigConsul {
     pub node_name: String,
@@ -25,54 +21,51 @@ pub struct RuntimeConfigConsul {
 
 #[derive(Debug)]
 pub struct RuntimeConfigFirewall {
+    pub ipv6_only: bool,
     pub refresh_time: Duration,
 }
 
 #[derive(Debug)]
 pub struct RuntimeConfigIgd {
-  pub private_ip: Option<String>,
+    pub private_ip: Option<Ipv4Addr>,
     pub expiration_time: Duration,
     pub refresh_time: Duration,
 }
 
+#[derive(Debug)]
+pub struct RuntimeConfigStun {
+    pub stun_server_v4: Option<SocketAddr>,
+    pub stun_server_v6: SocketAddr,
+    pub refresh_time: Duration,
+}
+
 #[derive(Debug)]
 pub struct RuntimeConfig {
-  pub acme: Option<RuntimeConfigAcme>,
     pub consul: RuntimeConfigConsul,
     pub firewall: RuntimeConfigFirewall,
-  pub igd: RuntimeConfigIgd,
+    pub igd: Option<RuntimeConfigIgd>,
+    pub stun: RuntimeConfigStun,
 }
 
 impl RuntimeConfig {
     pub fn new(opts: ConfigOpts) -> Result<Self> {
-    let acme = RuntimeConfigAcme::new(opts.acme.clone())?;
+        let consul = RuntimeConfigConsul::new(opts.consul)?;
-    let consul = RuntimeConfigConsul::new(opts.consul.clone())?;
+        let firewall = RuntimeConfigFirewall::new(&opts.base)?;
-    let firewall = RuntimeConfigFirewall::new(opts.base.clone())?;
+        let igd = match opts.base.ipv6_only {
-    let igd = RuntimeConfigIgd::new(opts.base.clone())?;
+            false => Some(RuntimeConfigIgd::new(&opts.base)?),
+            true => None,
+        };
+        let stun = RuntimeConfigStun::new(&opts.base)?;
 
         Ok(Self {
-      acme,
             consul,
             firewall,
             igd,
+            stun,
         })
     }
 }
 
-impl RuntimeConfigAcme {
-  pub fn new(opts: ConfigOptsAcme) -> Result<Option<Self>> {
-    if !opts.enable {
-      return Ok(None);
-    }
-
-    let email = opts.email.expect(
-      "'DIPLONAT_ACME_EMAIL' environment variable is required if 'DIPLONAT_ACME_ENABLE' == 'true'",
-    );
-
-    Ok(Some(Self { email }))
-  }
-}
-
 impl RuntimeConfigConsul {
     pub(super) fn new(opts: ConfigOptsConsul) -> Result<Self> {
         let node_name = opts
@@ -97,8 +90,9 @@ impl RuntimeConfigConsul {
                 let mut client_key_buf = vec![];
                 File::open(client_key)?.read_to_end(&mut client_key_buf)?;
 
-        let ident =
+                let ident = reqwest::Identity::from_pem(
-          reqwest::Identity::from_pem(&[&client_cert_buf[..], &client_key_buf[..]].concat()[..])?;
+                    &[&client_cert_buf[..], &client_key_buf[..]].concat()[..],
+                )?;
 
                 Some((cert, opts.tls_skip_verify, ident))
             }
@@ -115,23 +109,32 @@ impl RuntimeConfigConsul {
 }
 
 impl RuntimeConfigFirewall {
-  pub(super) fn new(opts: ConfigOptsBase) -> Result<Self> {
+    pub(super) fn new(opts: &ConfigOptsBase) -> Result<Self> {
-    let refresh_time = Duration::from_secs(opts.refresh_time.unwrap_or(super::REFRESH_TIME).into());
+        let refresh_time =
+            Duration::from_secs(opts.refresh_time.unwrap_or(super::REFRESH_TIME).into());
 
-    Ok(Self { refresh_time })
+        Ok(Self {
+            refresh_time,
+            ipv6_only: opts.ipv6_only,
+        })
     }
 }
 
 impl RuntimeConfigIgd {
-  pub(super) fn new(opts: ConfigOptsBase) -> Result<Self> {
+    pub(super) fn new(opts: &ConfigOptsBase) -> Result<Self> {
-    let private_ip = opts.private_ip;
+        let private_ip = opts
+            .private_ip
+            .as_ref()
+            .map(|x| x.parse())
+            .transpose()
+            .context("parse private_ip")?;
         let expiration_time = Duration::from_secs(
-      opts
+            opts.expiration_time
-        .expiration_time
                 .unwrap_or(super::EXPIRATION_TIME)
                 .into(),
         );
-    let refresh_time = Duration::from_secs(opts.refresh_time.unwrap_or(super::REFRESH_TIME).into());
+        let refresh_time =
+            Duration::from_secs(opts.refresh_time.unwrap_or(super::REFRESH_TIME).into());
 
         if refresh_time.as_secs() * 2 > expiration_time.as_secs() {
             return Err(anyhow!(
@@ -149,3 +152,40 @@ impl RuntimeConfigIgd {
         })
     }
 }
+
+impl RuntimeConfigStun {
+    pub(super) fn new(opts: &ConfigOptsBase) -> Result<Self> {
+        let mut stun_server_v4 = None;
+        let mut stun_server_v6 = None;
+        for addr in opts
+            .stun_server
+            .as_deref()
+            .unwrap_or(super::STUN_SERVER)
+            .to_socket_addrs()?
+        {
+            if addr.is_ipv4() {
+                stun_server_v4 = Some(addr);
+            }
+            if addr.is_ipv6() {
+                stun_server_v6 = Some(addr);
+            }
+        }
+
+        let refresh_time =
+            Duration::from_secs(opts.refresh_time.unwrap_or(super::REFRESH_TIME).into());
+
+        let stun_server_v4 = match opts.ipv6_only {
+            false => Some(
+                stun_server_v4.ok_or(anyhow!("Unable to resolve STUN server's IPv4 address"))?,
+            ),
+            true => None,
+        };
+
+        Ok(Self {
+            stun_server_v4,
+            stun_server_v6: stun_server_v6
+                .ok_or(anyhow!("Unable to resolve STUN server's IPv6 address"))?,
+            refresh_time,
+        })
+    }
+}

src/consul.rs

@@ -7,12 +7,14 @@ use crate::config::RuntimeConfigConsul;
 
 #[derive(Serialize, Deserialize, Debug)]
 pub struct ServiceEntry {
-  pub Tags: Vec<String>,
+    #[serde(rename = "Tags")]
+    pub tags: Vec<String>,
 }
 
-#[derive(Serialize, Deserialize, Debug)]
+#[derive(Serialize, Deserialize, Debug, Default)]
 pub struct CatalogNode {
-  pub Services: HashMap<String, ServiceEntry>,
+    #[serde(rename = "Services")]
+    pub services: HashMap<String, ServiceEntry>,
 }
 
 pub struct Consul {
@@ -71,7 +73,14 @@ impl Consul {
             None => return Err(anyhow!("X-Consul-Index header not found")),
         };
 
-    let resp: CatalogNode = http.json().await?;
+        let resp: Option<CatalogNode> = http.json().await?;
-    return Ok(resp);
+        return Ok(resp.unwrap_or_default());
+    }
+
+    pub async fn kv_put(&self, key: &str, bytes: Vec<u8>) -> Result<()> {
+        let url = format!("{}/v1/kv/{}", self.url, key);
+        let http = self.client.put(&url).body(bytes).send().await?;
+        http.error_for_status()?;
+        Ok(())
     }
 }

src/consul_actor.rs

@@ -11,13 +11,16 @@ use crate::{consul, messages};
 
 #[derive(Serialize, Deserialize, Debug)]
 pub enum DiplonatParameter {
-  tcp_port(HashSet<u16>),
+    #[serde(rename = "tcp_port")]
-  udp_port(HashSet<u16>),
+    TcpPort(HashSet<u16>),
+    #[serde(rename = "udp_port")]
+    UdpPort(HashSet<u16>),
 }
 
 #[derive(Serialize, Deserialize, Debug)]
 pub enum DiplonatConsul {
-  diplonat(Vec<DiplonatParameter>),
+    #[serde(rename = "diplonat")]
+    Diplonat(Vec<DiplonatParameter>),
 }
 
 pub struct ConsulActor {
@@ -42,8 +45,8 @@ fn retry_to_time(retries: u32, max_time: Duration) -> Duration {
 fn to_parameters(catalog: &consul::CatalogNode) -> Vec<DiplonatConsul> {
     let mut r = Vec::new();
 
-  for (_, service_info) in &catalog.Services {
+    for (_, service_info) in &catalog.services {
-    for tag in &service_info.Tags {
+        for tag in &service_info.tags {
             let diplo_conf: error::Result<DiplonatConsul> = from_str(tag);
             match diplo_conf {
                 Ok(conf) => r.push(conf),
@@ -62,11 +65,11 @@ fn to_open_ports(params: &Vec<DiplonatConsul>) -> messages::PublicExposedPorts {
     };
 
     for conf in params {
-    let DiplonatConsul::diplonat(c) = conf;
+        let DiplonatConsul::Diplonat(c) = conf;
         for parameter in c {
             match parameter {
-        DiplonatParameter::tcp_port(p) => op.tcp_ports.extend(p),
+                DiplonatParameter::TcpPort(p) => op.tcp_ports.extend(p),
-        DiplonatParameter::udp_port(p) => op.udp_ports.extend(p),
+                DiplonatParameter::UdpPort(p) => op.udp_ports.extend(p),
             };
         }
     }

src/diplonat.rs

@@ -1,49 +1,78 @@
-use anyhow::Result;
+use anyhow::{Context, Result};
+use futures::future::FutureExt;
 use tokio::try_join;
 
 use crate::{
     config::ConfigOpts, consul_actor::ConsulActor, fw_actor::FirewallActor, igd_actor::IgdActor,
+    stun_actor::StunActor,
 };
 
 pub struct Diplonat {
     consul: ConsulActor,
     firewall: FirewallActor,
-  igd: IgdActor,
+    igd: Option<IgdActor>,
+    stun: StunActor,
 }
 
 impl Diplonat {
     pub async fn new() -> Result<Self> {
-    let rt_cfg = ConfigOpts::from_env()?;
+        let rt_cfg = ConfigOpts::from_env().context("Parse configuration")?;
         println!("{:#?}", rt_cfg);
 
         let ca = ConsulActor::new(&rt_cfg.consul, &rt_cfg.consul.node_name);
 
-    let fw = FirewallActor::new(rt_cfg.firewall.refresh_time, &ca.rx_open_ports).await?;
+        let fw = FirewallActor::new(
-
+            rt_cfg.firewall.ipv6_only,
-    let ia = IgdActor::new(
+            rt_cfg.firewall.refresh_time,
-      rt_cfg.igd.private_ip.as_ref().map(String::as_str),
-      rt_cfg.igd.refresh_time,
-      rt_cfg.igd.expiration_time,
             &ca.rx_open_ports,
         )
-    .await?;
+        .await
+        .context("Setup fireall actor")?;
+
+        let ia = match rt_cfg.igd {
+            Some(igdc) => Some(
+                IgdActor::new(
+                    igdc.private_ip,
+                    igdc.refresh_time,
+                    igdc.expiration_time,
+                    &ca.rx_open_ports,
+                )
+                .await
+                .context("Setup IGD actor")?,
+            ),
+            None => None,
+        };
+
+        let sa = StunActor::new(&rt_cfg.consul, &rt_cfg.stun, &rt_cfg.consul.node_name);
 
         let ctx = Self {
             consul: ca,
             igd: ia,
             firewall: fw,
+            stun: sa,
         };
 
-    return Ok(ctx);
+        Ok(ctx)
     }
 
     pub async fn listen(&mut self) -> Result<()> {
+        let igd_opt = &mut self.igd;
+
         try_join!(
-      self.consul.listen(),
+            self.consul.listen().map(|x| x.context("Run consul actor")),
-      self.igd.listen(),
+            async {
-      self.firewall.listen()
+                if let Some(igd) = igd_opt {
+                    igd.listen().await.context("Run IGD actor")
+                } else {
+                    Ok(())
+                }
+            },
+            self.firewall
+                .listen()
+                .map(|x| x.context("Run firewall actor")),
+            self.stun.listen().map(|x| x.context("Run STUN actor")),
         )?;
 
-    return Ok(());
+        Ok(())
     }
 }

src/fw.rs

@@ -11,11 +11,10 @@ pub fn setup(ipt: &iptables::IPTables) -> Result<()> {
     // ensure we start from a clean state without any rule already set
     cleanup(ipt)?;
 
-  ipt
+    info!("{}: creating DIPLONAT chain", ipt.cmd);
-    .new_chain("filter", "DIPLONAT")
+    ipt.new_chain("filter", "DIPLONAT")
         .context("Failed to create new chain")?;
-  ipt
+    ipt.insert_unique("filter", "INPUT", "-j DIPLONAT", 1)
-    .insert_unique("filter", "INPUT", "-j DIPLONAT", 1)
         .context("Failed to insert jump rule")?;
 
     Ok(())
@@ -23,8 +22,8 @@ pub fn setup(ipt: &iptables::IPTables) -> Result<()> {
 
 pub fn open_ports(ipt: &iptables::IPTables, ports: messages::PublicExposedPorts) -> Result<()> {
     for p in ports.tcp_ports {
-    ipt
+        info!("{}: opening TCP port {}", ipt.cmd, p);
-      .append(
+        ipt.append(
             "filter",
             "DIPLONAT",
             &format!("-p tcp --dport {} -j ACCEPT", p),
@@ -33,8 +32,8 @@ pub fn open_ports(ipt: &iptables::IPTables, ports: messages::PublicExposedPorts)
     }
 
     for p in ports.udp_ports {
-    ipt
+        info!("{}: opening UDP port {}", ipt.cmd, p);
-      .append(
+        ipt.append(
             "filter",
             "DIPLONAT",
             &format!("-p udp --dport {} -j ACCEPT", p),
@@ -55,6 +54,7 @@ pub fn get_opened_ports(ipt: &iptables::IPTables) -> Result<messages::PublicExpo
     let re = Regex::new(r"\-A.*? \-p (\w+).*\-\-dport (\d+).*?\-j ACCEPT")
         .context("Regex matching open ports encountered an unexpected rule")?;
     for i in list {
+        debug!("{} list DIPLONAT: got {}", ipt.cmd, i);
         let caps = re.captures(&i);
         match caps {
             Some(c) => {
@@ -62,36 +62,40 @@ pub fn get_opened_ports(ipt: &iptables::IPTables) -> Result<messages::PublicExpo
                     let proto = String::from(raw_proto.as_str());
                     let number = String::from(raw_port.as_str()).parse::<u16>()?;
 
-          if proto == "tcp" {
+                    if proto == "tcp" || proto == "6" {
                         ports.tcp_ports.insert(number);
-          } else {
+                    } else if proto == "udp" || proto == "17" {
                         ports.udp_ports.insert(number);
+                    } else {
+                        error!("Unexpected protocol in iptables rule: {}", proto);
                     }
                 } else {
                     error!("Unexpected rule found in DIPLONAT chain")
                 }
             }
-      _ => {}
+            _ => {
+                debug!("{} rule not parsed: {}", ipt.cmd, i);
             }
         }
+    }
+
+    debug!("{} ports already openned: {:?}", ipt.cmd, ports);
 
     Ok(ports)
 }
 
 pub fn cleanup(ipt: &iptables::IPTables) -> Result<()> {
     if ipt.chain_exists("filter", "DIPLONAT")? {
-    ipt
+        info!("{}: removing old DIPLONAT chain", ipt.cmd);
-      .flush_chain("filter", "DIPLONAT")
+        ipt.flush_chain("filter", "DIPLONAT")
             .context("Failed to flush the DIPLONAT chain")?;
 
         if ipt.exists("filter", "INPUT", "-j DIPLONAT")? {
-      ipt
+            ipt.delete("filter", "INPUT", "-j DIPLONAT")
-        .delete("filter", "INPUT", "-j DIPLONAT")
                 .context("Failed to delete jump rule")?;
         }
 
-    ipt
+        ipt.delete_chain("filter", "DIPLONAT")
-      .delete_chain("filter", "DIPLONAT")
             .context("Failed to delete chain")?;
     }
 

src/fw_actor.rs

@@ -12,7 +12,7 @@ use tokio::{
 use crate::{fw, messages};
 
 pub struct FirewallActor {
-  pub ipt_v4: iptables::IPTables,
+    pub ipt_v4: Option<iptables::IPTables>,
     pub ipt_v6: iptables::IPTables,
     rx_ports: watch::Receiver<messages::PublicExposedPorts>,
     last_ports: messages::PublicExposedPorts,
@@ -21,18 +21,24 @@ pub struct FirewallActor {
 
 impl FirewallActor {
     pub async fn new(
+        ipv6_only: bool,
         refresh: Duration,
         rxp: &watch::Receiver<messages::PublicExposedPorts>,
     ) -> Result<Self> {
         let ctx = Self {
-      ipt_v4: iptables::new(false)?,
+            ipt_v4: match ipv6_only {
+                false => Some(iptables::new(false)?),
+                true => None,
+            },
             ipt_v6: iptables::new(true)?,
             rx_ports: rxp.clone(),
             last_ports: messages::PublicExposedPorts::new(),
             refresh,
         };
 
-    fw::setup(&ctx.ipt_v4)?;
+        if let Some(ipt_v4) = &ctx.ipt_v4 {
+            fw::setup(ipt_v4)?;
+        }
         fw::setup(&ctx.ipt_v6)?;
 
         return Ok(ctx);
@@ -62,7 +68,14 @@ impl FirewallActor {
     }
 
     pub async fn do_fw_update(&self) -> Result<()> {
-    for ipt in [&self.ipt_v4, &self.ipt_v6] {
+        if let Some(ipt_v4) = &self.ipt_v4 {
+            self.do_fw_update_on(ipt_v4).await?;
+        }
+        self.do_fw_update_on(&self.ipt_v6).await?;
+        Ok(())
+    }
+
+    pub async fn do_fw_update_on(&self, ipt: &iptables::IPTables) -> Result<()> {
         let curr_opened_ports = fw::get_opened_ports(ipt)?;
 
         let diff_tcp = self
@@ -84,7 +97,6 @@ impl FirewallActor {
         };
 
         fw::open_ports(ipt, ports_to_open)?;
-    }
 
         return Ok(());
     }

src/igd_actor.rs

@@ -1,4 +1,4 @@
-use std::net::SocketAddrV4;
+use std::net::{Ipv4Addr, SocketAddrV4};
 
 use anyhow::{Context, Result};
 use igd::{aio::*, PortMappingProtocol};
@@ -17,12 +17,12 @@ pub struct IgdActor {
     gateway: Gateway,
     refresh: Duration,
     expire: Duration,
-  private_ip: String,
+    private_ip: Ipv4Addr,
 }
 
 impl IgdActor {
     pub async fn new(
-    priv_ip: Option<&str>,
+        priv_ip: Option<Ipv4Addr>,
         refresh: Duration,
         expire: Duration,
         rxp: &watch::Receiver<messages::PublicExposedPorts>,
@@ -34,7 +34,7 @@ impl IgdActor {
 
         let private_ip = if let Some(ip) = priv_ip {
             info!("Using private IP from config: {}", ip);
-      ip.to_string()
+            ip
         } else {
             info!("Trying to automatically detect private IP");
             let gwa = gw.addr.ip().octets();
@@ -46,18 +46,18 @@ impl IgdActor {
                     gw.addr.ip()
                 ),
             };
-      let public_ip = get_if_addrs::get_if_addrs()?
+            #[allow(unused_parens)]
+            let private_ip = get_if_addrs::get_if_addrs()?
                 .into_iter()
                 .map(|i| i.addr.ip())
-        .filter(|a| match a {
+                .filter_map(|a| match a {
-          std::net::IpAddr::V4(a4) => (a4.octets()[..cmplen] == gwa[..cmplen]),
+                    std::net::IpAddr::V4(a4) if a4.octets()[..cmplen] == gwa[..cmplen] => Some(a4),
-          _ => false,
+                    _ => None,
                 })
                 .next()
-        .expect("No interface has an IP on same subnet as gateway")
+                .expect("No interface has an IP on same subnet as gateway");
-        .to_string();
+            info!("Autodetected private IP: {}", private_ip);
-      info!("Found private IP: {}", public_ip);
+            private_ip
-      public_ip
         };
 
         let ctx = Self {
@@ -103,12 +103,8 @@ impl IgdActor {
 
         for (proto, list) in actions.iter() {
             for port in *list {
-        let service_str = format!("{}:{}", self.private_ip, port);
+                let service = SocketAddrV4::new(self.private_ip, *port);
-        let service = service_str
+                self.gateway
-          .parse::<SocketAddrV4>()
-          .context("Invalid socket address")?;
-        self
-          .gateway
                     .add_port(
                         *proto,
                         *port,

src/main.rs

@@ -6,6 +6,7 @@ mod fw;
 mod fw_actor;
 mod igd_actor;
 mod messages;
+mod stun_actor;
 
 use diplonat::Diplonat;
 use log::*;
@@ -15,6 +16,10 @@ async fn main() {
     pretty_env_logger::init();
     info!("Starting Diplonat");
 
-  let mut diplo = Diplonat::new().await.expect("Setup failed");
+    Diplonat::new()
-  diplo.listen().await.expect("A runtime error occured");
+        .await
+        .expect("Setup failed")
+        .listen()
+        .await
+        .expect("A runtime error occured");
 }

src/stun_actor.rs

@@ -0,0 +1,147 @@
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
+use std::time::{Duration, SystemTime};
+
+use anyhow::{anyhow, bail, Result};
+use log::*;
+use serde::{Deserialize, Serialize};
+
+use crate::config::{RuntimeConfigConsul, RuntimeConfigStun};
+use crate::consul;
+
+pub struct StunActor {
+    node: String,
+    consul: consul::Consul,
+    stun_server_v4: Option<SocketAddr>,
+    stun_server_v6: SocketAddr,
+    refresh_time: Duration,
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+pub struct AutodiscoverResult {
+    pub timestamp: u64,
+    pub address: Option<IpAddr>,
+}
+
+impl StunActor {
+    pub fn new(
+        consul_config: &RuntimeConfigConsul,
+        stun_config: &RuntimeConfigStun,
+        node: &str,
+    ) -> Self {
+        assert!(stun_config
+            .stun_server_v4
+            .map(|x| x.is_ipv4())
+            .unwrap_or(true));
+        assert!(stun_config.stun_server_v6.is_ipv6());
+
+        Self {
+            consul: consul::Consul::new(consul_config),
+            node: node.to_string(),
+            stun_server_v4: stun_config.stun_server_v4,
+            stun_server_v6: stun_config.stun_server_v6,
+            refresh_time: stun_config.refresh_time,
+        }
+    }
+
+    pub async fn listen(&mut self) -> Result<()> {
+        loop {
+            let ipv4_result = match self.stun_server_v4 {
+                Some(stun_server_v4) => self.autodiscover_ip(stun_server_v4).await,
+                None => self.autodiscover_none_ipv4().await,
+            };
+            if let Err(e) = ipv4_result {
+                error!("Unable to autodiscover IPv4 address: {}", e);
+            }
+            if let Err(e) = self.autodiscover_ip(self.stun_server_v6).await {
+                error!("Unable to autodiscover IPv6 address: {}", e);
+            }
+            tokio::time::sleep(self.refresh_time).await;
+        }
+    }
+
+    async fn autodiscover_ip(&self, stun_server: SocketAddr) -> Result<()> {
+        let binding_ip = match stun_server.is_ipv4() {
+            true => IpAddr::V4(Ipv4Addr::UNSPECIFIED),  // 0.0.0.0
+            false => IpAddr::V6(Ipv6Addr::UNSPECIFIED), // [::]
+        };
+        let binding_addr = SocketAddr::new(binding_ip, 0);
+
+        let discovered_addr = get_mapped_addr(stun_server, binding_addr)
+            .await?
+            .map(|x| x.ip());
+
+        let consul_key = match stun_server.is_ipv4() {
+            true => {
+                debug!("Autodiscovered IPv4: {:?}", discovered_addr);
+                format!("diplonat/autodiscovery/ipv4/{}", self.node)
+            }
+            false => {
+                debug!("Autodiscovered IPv6: {:?}", discovered_addr);
+                format!("diplonat/autodiscovery/ipv6/{}", self.node)
+            }
+        };
+
+        self.consul
+            .kv_put(
+                &consul_key,
+                serde_json::to_vec(&AutodiscoverResult {
+                    timestamp: timestamp(),
+                    address: discovered_addr,
+                })?,
+            )
+            .await?;
+
+        Ok(())
+    }
+
+    async fn autodiscover_none_ipv4(&self) -> Result<()> {
+        let consul_key = format!("diplonat/autodiscovery/ipv4/{}", self.node);
+
+        self.consul
+            .kv_put(
+                &consul_key,
+                serde_json::to_vec(&AutodiscoverResult {
+                    timestamp: timestamp(),
+                    address: None,
+                })?,
+            )
+            .await?;
+
+        Ok(())
+    }
+}
+
+async fn get_mapped_addr(
+    stun_server: SocketAddr,
+    binding_addr: SocketAddr,
+) -> Result<Option<SocketAddr>> {
+    use stun_client::*;
+
+    let mut client = Client::new(binding_addr, None).await?;
+    let res = match client.binding_request(stun_server, None).await {
+        Err(e) => {
+            info!(
+                "STUN binding request to {} failed, assuming no address (error: {})",
+                binding_addr, e
+            );
+            return Ok(None);
+        }
+        Ok(r) => r,
+    };
+
+    if res.get_class() != Class::SuccessResponse {
+        bail!("STUN server did not responde with a success response");
+    }
+
+    let xor_mapped_addr = Attribute::get_xor_mapped_address(&res)
+        .ok_or(anyhow!("no XorMappedAddress found in STUN response"))?;
+
+    Ok(Some(xor_mapped_addr))
+}
+
+fn timestamp() -> u64 {
+    SystemTime::now()
+        .duration_since(SystemTime::UNIX_EPOCH)
+        .expect("clock error")
+        .as_secs()
+}