mirror
/
tun2proxy-mirror
mirror of https://github.com/tun2proxy/tun2proxy
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Enable automated setup for private IP addresses

pull/21/head
B. Blechschmidt 3 years ago
parent
e78a3f9a73
commit
3c79fa6071
2 changed files with 85 additions and 114 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 7
      src/main.rs
  2. 192
      src/setup.rs

7
src/main.rs
View File

@ -69,7 +69,12 @@ fn main() -> ExitCode {
Some(addr) => addr,
None => args.proxy.addr.ip(),
};
setup = Setup::new(&args.tun, &bypass_tun_ip, get_default_cidrs());
setup = Setup::new(
&args.tun,
&bypass_tun_ip,
get_default_cidrs(),
args.setup_ip.is_some(),
);
if let Err(e) = setup.setup() {
log::error!("{e}");
return ExitCode::FAILURE;

192
src/setup.rs
View File

@ -12,9 +12,11 @@ use std::str::FromStr;
#[derive(Clone)]
pub struct Setup {
routes: Vec<IpCidr>,
proxy_addr: IpAddr,
tunnel_bypass_addr: IpAddr,
allow_private: bool,
tun: String,
set_up: bool,
delete_proxy_route: bool,
}
pub fn get_default_cidrs() -> [IpCidr; 4] {
@ -63,89 +65,26 @@ where
}
}
fn ipv4_addr_is_shared(addr: &Ipv4Addr) -> bool {
addr.octets()[0] == 100 && (addr.octets()[1] & 0b1100_0000 == 0b0100_0000)
}
fn ipv4_addr_is_benchmarking(addr: &Ipv4Addr) -> bool {
addr.octets()[0] == 198 && (addr.octets()[1] & 0xfe) == 18
}
fn ipv4_addr_is_reserved(addr: &Ipv4Addr) -> bool {
addr.octets()[0] & 240 == 240 && !addr.is_broadcast()
}
fn ipv4_addr_is_global(addr: &Ipv4Addr) -> bool {
!(addr.octets()[0] == 0 // "This network"
|| addr.is_private()
|| ipv4_addr_is_shared(addr)
|| addr.is_loopback()
|| addr.is_link_local()
// addresses reserved for future protocols (`192.0.0.0/24`)
||(addr.octets()[0] == 192 && addr.octets()[1] == 0 && addr.octets()[2] == 0)
|| addr.is_documentation()
|| ipv4_addr_is_benchmarking(addr)
|| ipv4_addr_is_reserved(addr)
|| addr.is_broadcast())
}
fn ipv6_addr_is_documentation(addr: &Ipv6Addr) -> bool {
(addr.segments()[0] == 0x2001) && (addr.segments()[1] == 0xdb8)
}
fn ipv6_addr_is_unique_local(addr: &Ipv6Addr) -> bool {
(addr.segments()[0] & 0xfe00) == 0xfc00
}
fn ipv6_addr_is_unicast_link_local(addr: &Ipv6Addr) -> bool {
(addr.segments()[0] & 0xffc0) == 0xfe80
}
fn ipv6_addr_is_global(addr: &Ipv6Addr) -> bool {
!(addr.is_unspecified()
|| addr.is_loopback()
// IPv4-mapped Address (`::ffff:0:0/96`)
|| matches!(addr.segments(), [0, 0, 0, 0, 0, 0xffff, _, _])
// IPv4-IPv6 Translat. (`64:ff9b:1::/48`)
|| matches!(addr.segments(), [0x64, 0xff9b, 1, _, _, _, _, _])
// Discard-Only Address Block (`100::/64`)
|| matches!(addr.segments(), [0x100, 0, 0, 0, _, _, _, _])
// IETF Protocol Assignments (`2001::/23`)
|| (matches!(addr.segments(), [0x2001, b, _, _, _, _, _, _] if b < 0x200)
&& !(
// Port Control Protocol Anycast (`2001:1::1`)
u128::from_be_bytes(addr.octets()) == 0x2001_0001_0000_0000_0000_0000_0000_0001
// Traversal Using Relays around NAT Anycast (`2001:1::2`)
|| u128::from_be_bytes(addr.octets()) == 0x2001_0001_0000_0000_0000_0000_0000_0002
// AMT (`2001:3::/32`)
|| matches!(addr.segments(), [0x2001, 3, _, _, _, _, _, _])
// AS112-v6 (`2001:4:112::/48`)
|| matches!(addr.segments(), [0x2001, 4, 0x112, _, _, _, _, _])
// ORCHIDv2 (`2001:20::/28`)
|| matches!(addr.segments(), [0x2001, b, _, _, _, _, _, _] if (0x20..=0x2F).contains(&b))
))
|| ipv6_addr_is_documentation(addr)
|| ipv6_addr_is_unique_local(addr)
|| ipv6_addr_is_unicast_link_local(addr))
}
impl Setup {
pub fn new(
tun: impl Into<String>,
proxy_addr: &IpAddr,
tunnel_bypass_addr: &IpAddr,
routes: impl IntoIterator<Item = IpCidr>,
allow_private: bool,
) -> Self {
let routes_cidr = routes.into_iter().collect();
Self {
tun: tun.into(),
proxy_addr: *proxy_addr,
tunnel_bypass_addr: *tunnel_bypass_addr,
allow_private,
routes: routes_cidr,
set_up: false,
delete_proxy_route: false,
}
}
fn clone_default_route(&mut self) -> Result<(), Error> {
let route_show_args = if self.proxy_addr.is_ipv6() {
fn route_proxy_address(&mut self) -> Result<bool, Error> {
let route_show_args = if self.tunnel_bypass_addr.is_ipv6() {
["ip", "-6", "route", "show"]
} else {
["ip", "-4", "route", "show"]
@ -153,33 +92,58 @@ impl Setup {
let routes = run_iproute(route_show_args, "failed to get routing table", true)?;
// Equivalent of `ip route | grep '^default' | cut -d ' ' -f 2-`
let mut default_route_args = Vec::<String>::new();
for result in routes.stdout.lines() {
let line = result.unwrap();
let split = line.split_whitespace();
for (i, route_component) in split.enumerate() {
if i == 0 && route_component != "default" {
break;
} else if i == 0 {
continue;
let mut route_info = Vec::<(IpCidr, Vec<String>)>::new();
for line in routes.stdout.lines() {
if line.is_err() {
break;
}
let line = line.unwrap();
if line.starts_with([' ', '\t']) {
continue;
}
let mut split = line.split_whitespace();
let mut dst_str = split.next().unwrap();
if dst_str == "default" {
dst_str = if self.tunnel_bypass_addr.is_ipv6() {
"::/0"
} else {
"0.0.0.0/0"
}
default_route_args.push(String::from(route_component));
}
if !default_route_args.is_empty() {
let (addr_str, prefix_len_str) = dst_str.split_once(['/']).unwrap();
let cidr: IpCidr = IpCidr::new(
std::net::IpAddr::from_str(addr_str).unwrap().into(),
u8::from_str(prefix_len_str).unwrap(),
);
let route_components: Vec<String> = split.map(String::from).collect();
route_info.push((cidr, route_components))
}
// Sort routes by prefix length, the most specific route comes first.
route_info.sort_by(|entry1, entry2| entry2.0.prefix_len().cmp(&entry1.0.prefix_len()));
for (cidr, route_components) in route_info {
if !cidr.contains_addr(&smoltcp::wire::IpAddress::from(self.tunnel_bypass_addr)) {
continue;
}
// The IP address is routed through a more specific route than the default route.
// In this case, there is nothing to do.
if cidr.prefix_len() != 0 {
break;
}
}
let mut proxy_route = vec!["ip".into(), "route".into(), "add".into()];
proxy_route.push(self.proxy_addr.to_string());
proxy_route.extend(default_route_args.into_iter());
run_iproute(
proxy_route,
"failed to clone default route for proxy",
false,
)?;
Ok(())
let mut proxy_route = vec!["ip".into(), "route".into(), "add".into()];
proxy_route.push(self.tunnel_bypass_addr.to_string());
proxy_route.extend(route_components.into_iter());
run_iproute(proxy_route, "failed to clone route for proxy", false)?;
return Ok(true);
}
Ok(false)
}
fn setup_resolv_conf() -> Result<(), Error> {
@ -234,15 +198,17 @@ impl Setup {
if !self.set_up {
return;
}
Self::shutdown_with_args(&self.tun, self.proxy_addr);
Self::shutdown_with_args(&self.tun, self.tunnel_bypass_addr, self.delete_proxy_route);
}
fn shutdown_with_args(tun_name: &str, proxy_ip: IpAddr) {
fn shutdown_with_args(tun_name: &str, proxy_ip: IpAddr, delete_proxy_route: bool) {
log::info!("Restoring network configuration");
let _ = Command::new("ip").args(["link", "del", tun_name]).output();
let _ = Command::new("ip")
.args(["route", "del", proxy_ip.to_string().as_str()])
.output();
if delete_proxy_route {
let _ = Command::new("ip")
.args(["route", "del", proxy_ip.to_string().as_str()])
.output();
}
unsafe {
let umount_path = CString::new("/etc/resolv.conf").unwrap();
libc::umount(umount_path.as_ptr());
@ -256,14 +222,12 @@ impl Setup {
}
}
let global = match self.proxy_addr {
IpAddr::V4(addr) => ipv4_addr_is_global(&addr),
IpAddr::V6(addr) => ipv6_addr_is_global(&addr),
};
if !global {
return Err(format!("The proxy address {} is not a global address. Please specify the setup IP address manually", self.proxy_addr)
.into());
if self.tunnel_bypass_addr.is_loopback() && !self.allow_private {
log::warn!(
"The proxy address {} is a loopback address. You may need to manually \
provide --setup-ip to specify the server IP bypassing the tunnel",
self.tunnel_bypass_addr
)
}
run_iproute(
@ -282,12 +246,7 @@ impl Setup {
self.set_up = true;
let tun_name = self.tun.clone();
let proxy_ip = self.proxy_addr;
// TODO: This is not optimal.
ctrlc::set_handler(move || {
Self::shutdown_with_args(&tun_name, proxy_ip);
std::process::exit(0);
})?;
let proxy_ip = self.tunnel_bypass_addr;
run_iproute(
["ip", "link", "set", self.tun.as_str(), "up"],
@ -295,7 +254,14 @@ impl Setup {
true,
)?;
self.clone_default_route()?;
// If the proxy address is a private address, we assume that there already is a more
// specific route to that address than the default route.
let delete_proxy_route = self.route_proxy_address()?;
self.delete_proxy_route = delete_proxy_route;
ctrlc::set_handler(move || {
Self::shutdown_with_args(&tun_name, proxy_ip, delete_proxy_route);
std::process::exit(0);
})?;
Self::setup_resolv_conf()?;
self.add_tunnel_routes()?;

Write Preview
Loading…
Cancel
Save