diff --git a/easytier-web/frontend-lib/src/locales/cn.yaml b/easytier-web/frontend-lib/src/locales/cn.yaml
index 96511d55f..ac8af2bd2 100644
--- a/easytier-web/frontend-lib/src/locales/cn.yaml
+++ b/easytier-web/frontend-lib/src/locales/cn.yaml
@@ -45,7 +45,7 @@ logging_copy_dir: 复制日志路径
disable_auto_launch: 关闭开机自启
enable_auto_launch: 开启开机自启
exit: 退出
-chips_placeholder: 例如： {0}, 按回车添加
+chips_placeholder: 例如： {0}, 输入后在下拉框中选择生效
hostname_placeholder: '留空默认为主机名: {0}'
dev_name_placeholder: 注意：当多个网络同时使用相同的TUN接口名称时，将会在设置TUN的IP时产生冲突，留空以自动生成随机名称
off_text: 点击关闭
@@ -83,6 +83,9 @@ latency_first_help: 忽略中转跳数，选择总延迟最低的路径
use_smoltcp: 使用用户态协议栈
use_smoltcp_help: 使用用户态 TCP/IP 协议栈，避免操作系统防火墙问题导致无法子网代理 / KCP代理。
+disable_ipv6: 禁用IPv6
+disable_ipv6_help: 禁用此节点的IPv6功能，仅使用IPv4进行网络通信。
+
enable_kcp_proxy: 启用 KCP 代理
enable_kcp_proxy_help: 将 TCP 流量转为 KCP 流量，降低传输延迟，提升传输速度。
@@ -147,6 +150,12 @@ socks5_help: |
exit_nodes: 出口节点列表
exit_nodes_help: 转发所有流量的出口节点，虚拟IPv4地址，优先级由列表顺序决定
+
+port_forwards: 端口转发
+port_forwards_help: "将本地端口转发到虚拟网络中的远程端口。例如：udp://0.0.0.0:12345/10.126.126.1:23456，表示将本地UDP端口12345转发到虚拟网络中的10.126.126.1:23456。可以指定多个。"
+port_forwards_bind_addr: "绑定地址，如：0.0.0.0"
+port_forwards_dst_addr: "目标地址，如：10.126.126.1"
+port_forwards_add_btn: "添加"
mtu: MTU
mtu_help: |
diff --git a/easytier-web/frontend-lib/src/locales/en.yaml b/easytier-web/frontend-lib/src/locales/en.yaml
index e27aca893..a887eb44d 100644
--- a/easytier-web/frontend-lib/src/locales/en.yaml
+++ b/easytier-web/frontend-lib/src/locales/en.yaml
@@ -46,7 +46,7 @@ disable_auto_launch: Disable Launch on Reboot
enable_auto_launch: Enable Launch on Reboot
exit: Exit
use_latency_first: Latency First Mode
-chips_placeholder: 'e.g: {0}, press Enter to add'
+chips_placeholder: 'e.g: {0}, select from the dropdown after input'
hostname_placeholder: 'Leave blank and default to host name: {0}'
dev_name_placeholder: 'Note: When multiple networks use the same TUN interface name at the same time, there will be a conflict when setting the TUN''s IP. Leave blank to automatically generate a random name.'
off_text: Press to disable
@@ -82,6 +82,9 @@ latency_first_help: Ignore hop count and select the path with the lowest total l
use_smoltcp: Use User-Space Protocol Stack
use_smoltcp_help: Use a user-space TCP/IP stack to avoid issues with operating system firewalls blocking subnet or KCP proxy functionality.
+disable_ipv6: Disable IPv6
+disable_ipv6_help: Disable IPv6 functionality for this node, only use IPv4 for network communication.
+
enable_kcp_proxy: Enable KCP Proxy
enable_kcp_proxy_help: Convert TCP traffic to KCP traffic to reduce latency and boost transmission speed.
@@ -148,6 +151,12 @@ socks5_help: |
exit_nodes: Exit Nodes
exit_nodes_help: Exit nodes to forward all traffic to, a virtual ipv4 address, priority is determined by the order of the list
+port_forwards: Port Forward
+port_forwards_help: "forward local port to remote port in virtual network. e.g.: udp://0.0.0.0:12345/10.126.126.1:23456, means forward local udp port 12345 to 10.126.126.1:23456 in the virtual network. can specify multiple."
+port_forwards_bind_addr: "Bind address, e.g.: 0.0.0.0"
+port_forwards_dst_addr: "Destination address, e.g.: 10.126.126.1"
+port_forwards_add_btn: "Add"
+
mtu: MTU
mtu_help: |
MTU of the TUN device, default is 1380 for non-encryption, 1360 for encryption. Range:400-1380
diff --git a/easytier-web/frontend-lib/src/types/network.ts b/easytier-web/frontend-lib/src/types/network.ts
index 6487fc7ee..b6d1d4492 100644
--- a/easytier-web/frontend-lib/src/types/network.ts
+++ b/easytier-web/frontend-lib/src/types/network.ts
@@ -37,6 +37,7 @@ export interface NetworkConfig {
dev_name: string
use_smoltcp?: boolean
+ disable_ipv6?: boolean
enable_kcp_proxy?: boolean
disable_kcp_input?: boolean
enable_quic_proxy?: boolean
@@ -69,6 +70,8 @@ export interface NetworkConfig {
enable_private_mode?: boolean
rpc_portal_whitelists: string[]
+
+ port_forwards: PortForwardConfig[]
}
export function DEFAULT_NETWORK_CONFIG(): NetworkConfig {
@@ -105,6 +108,7 @@ export function DEFAULT_NETWORK_CONFIG(): NetworkConfig {
dev_name: '',
use_smoltcp: false,
+ disable_ipv6: false,
enable_kcp_proxy: false,
disable_kcp_input: false,
enable_quic_proxy: false,
@@ -130,6 +134,7 @@ export function DEFAULT_NETWORK_CONFIG(): NetworkConfig {
enable_magic_dns: false,
enable_private_mode: false,
rpc_portal_whitelists: [],
+ port_forwards: [],
}
}
@@ -253,6 +258,30 @@ export interface PeerConnStats {
latency_us: number
}
+export interface PortForwardConfig {
+ bind_ip: string,
+ bind_port: number,
+ dst_ip: string,
+ dst_port: number,
+ proto: string
+}
+
+// 添加新行
+export const addRow = (rows: PortForwardConfig[]) => {
+ rows.push({
+ proto: 'tcp',
+ bind_ip: '',
+ bind_port: 65535,
+ dst_ip: '',
+ dst_port: 65535,
+ });
+};
+
+// 删除行
+export const removeRow = (index: number, rows: PortForwardConfig[]) => {
+ rows.splice(index, 1);
+};
+
export enum EventType {
TunDeviceReady = 'TunDeviceReady', // string
TunDeviceError = 'TunDeviceError', // string
diff --git a/easytier-web/src/client_manager/mod.rs b/easytier-web/src/client_manager/mod.rs
index 21458e855..f9e08024a 100644
--- a/easytier-web/src/client_manager/mod.rs
+++ b/easytier-web/src/client_manager/mod.rs
@@ -25,7 +25,7 @@ fn load_geoip_db(geoip_db: Option
) -> Option>>
match maxminddb::Reader::open_readfile(&path) {
Ok(reader) => {
tracing::info!("Successfully loaded GeoIP2 database from {}", path);
- return Some(reader);
+ Some(reader)
}
Err(err) => {
tracing::debug!("Failed to load GeoIP2 database from {}: {}", path, err);
@@ -207,10 +207,8 @@ impl ClientManager {
let region = city.subdivisions.map(|r| {
r.iter()
- .map(|x| x.names.as_ref())
- .flatten()
- .map(|x| x.get("zh-CN").or_else(|| x.get("en")))
- .flatten()
+ .filter_map(|x| x.names.as_ref())
+ .filter_map(|x| x.get("zh-CN").or_else(|| x.get("en")))
.map(|x| x.to_string())
.collect::>()
.join(",")
diff --git a/easytier-web/src/client_manager/session.rs b/easytier-web/src/client_manager/session.rs
index 877e7ce1f..97a22598c 100644
--- a/easytier-web/src/client_manager/session.rs
+++ b/easytier-web/src/client_manager/session.rs
@@ -94,14 +94,10 @@ impl SessionRpcService {
return Ok(HeartbeatResponse {});
};
- let machine_id: uuid::Uuid =
+ let machine_id: uuid::Uuid = req.machine_id.map(Into::into).ok_or(anyhow::anyhow!(
+ "Machine id is not set correctly, expect uuid but got: {:?}",
req.machine_id
- .clone()
- .map(Into::into)
- .ok_or(anyhow::anyhow!(
- "Machine id is not set correctly, expect uuid but got: {:?}",
- req.machine_id
- ))?;
+ ))?;
let user_id = storage
.db()
@@ -121,7 +117,7 @@ impl SessionRpcService {
if data.req.replace(req.clone()).is_none() {
assert!(data.storage_token.is_none());
data.storage_token = Some(StorageToken {
- token: req.user_token.clone().into(),
+ token: req.user_token.clone(),
client_url: data.client_url.clone(),
machine_id,
user_id,
diff --git a/easytier-web/src/client_manager/storage.rs b/easytier-web/src/client_manager/storage.rs
index 9acf6f610..cbbac7215 100644
--- a/easytier-web/src/client_manager/storage.rs
+++ b/easytier-web/src/client_manager/storage.rs
@@ -34,7 +34,7 @@ impl TryFrom for Storage {
type Error = ();
fn try_from(weak: Weak) -> Result {
- weak.upgrade().map(|inner| Storage(inner)).ok_or(())
+ weak.upgrade().map(Storage).ok_or(())
}
}
@@ -51,9 +51,7 @@ impl Storage {
machine_id: &uuid::Uuid,
client_url: &url::Url,
) {
- map.remove_if(&machine_id, |_, v| {
- v.storage_token.client_url == *client_url
- });
+ map.remove_if(machine_id, |_, v| v.storage_token.client_url == *client_url);
}
fn update_mid_to_client_info_map(
@@ -74,11 +72,7 @@ impl Storage {
}
pub fn update_client(&self, stoken: StorageToken, report_time: i64) {
- let inner = self
- .0
- .user_clients_map
- .entry(stoken.user_id)
- .or_insert_with(DashMap::new);
+ let inner = self.0.user_clients_map.entry(stoken.user_id).or_default();
let client_info = ClientInfo {
storage_token: stoken.clone(),
diff --git a/easytier-web/src/main.rs b/easytier-web/src/main.rs
index a238bbf35..b5949567e 100644
--- a/easytier-web/src/main.rs
+++ b/easytier-web/src/main.rs
@@ -151,7 +151,7 @@ async fn get_dual_stack_listener(
} else {
None
};
- let v4_listener = if let Ok(_) = local_ipv4().await {
+ let v4_listener = if local_ipv4().await.is_ok() {
get_listener_by_url(&format!("{}://0.0.0.0:{}", protocol, port).parse().unwrap()).ok()
} else {
None
diff --git a/easytier-web/src/restful/auth.rs b/easytier-web/src/restful/auth.rs
index 8bb3aad0c..9d0fffefd 100644
--- a/easytier-web/src/restful/auth.rs
+++ b/easytier-web/src/restful/auth.rs
@@ -137,7 +137,7 @@ mod post {
mod get {
use crate::restful::{
captcha::{
- captcha::spec::SpecCaptcha,
+ builder::spec::SpecCaptcha,
extension::{axum_tower_sessions::CaptchaAxumTowerSessionExt as _, CaptchaUtil},
NewCaptcha as _,
},
diff --git a/easytier-web/src/restful/captcha/base/captcha.rs b/easytier-web/src/restful/captcha/base/captcha.rs
index c7e45c875..3bed68e70 100644
--- a/easytier-web/src/restful/captcha/base/captcha.rs
+++ b/easytier-web/src/restful/captcha/base/captcha.rs
@@ -46,22 +46,22 @@ pub(crate) struct Captcha {
/// 验证码文本类型 The character type of the captcha
pub enum CaptchaType {
/// 字母数字混合
- TypeDefault = 1,
+ Default = 1,
/// 纯数字
- TypeOnlyNumber,
+ OnlyNumber,
/// 纯字母
- TypeOnlyChar,
+ OnlyChar,
/// 纯大写字母
- TypeOnlyUpper,
+ OnlyUpper,
/// 纯小写字母
- TypeOnlyLower,
+ OnlyLower,
/// 数字大写字母
- TypeNumAndUpper,
+ NumAndUpper,
}
/// 内置字体 Fonts shipped with the library
@@ -92,29 +92,29 @@ impl Captcha {
/// 生成随机验证码
pub fn alphas(&mut self) -> Vec {
let mut cs = vec!['\0'; self.len];
- for i in 0..self.len {
+ for cs_i in cs.iter_mut() {
match self.char_type {
- CaptchaType::TypeDefault => cs[i] = self.randoms.alpha(),
- CaptchaType::TypeOnlyNumber => {
- cs[i] = self.randoms.alpha_under(self.randoms.num_max_index)
+ CaptchaType::Default => *cs_i = self.randoms.alpha(),
+ CaptchaType::OnlyNumber => {
+ *cs_i = self.randoms.alpha_under(self.randoms.num_max_index)
}
- CaptchaType::TypeOnlyChar => {
- cs[i] = self
+ CaptchaType::OnlyChar => {
+ *cs_i = self
.randoms
.alpha_between(self.randoms.char_min_index, self.randoms.char_max_index)
}
- CaptchaType::TypeOnlyUpper => {
- cs[i] = self
+ CaptchaType::OnlyUpper => {
+ *cs_i = self
.randoms
.alpha_between(self.randoms.upper_min_index, self.randoms.upper_max_index)
}
- CaptchaType::TypeOnlyLower => {
- cs[i] = self
+ CaptchaType::OnlyLower => {
+ *cs_i = self
.randoms
.alpha_between(self.randoms.lower_min_index, self.randoms.lower_max_index)
}
- CaptchaType::TypeNumAndUpper => {
- cs[i] = self.randoms.alpha_under(self.randoms.upper_max_index)
+ CaptchaType::NumAndUpper => {
+ *cs_i = self.randoms.alpha_under(self.randoms.upper_max_index)
}
}
}
@@ -142,7 +142,7 @@ impl Captcha {
}
}
- pub fn get_font(&mut self) -> Arc {
+ pub fn get_font(&'_ mut self) -> Arc> {
if let Some(font) = font::get_font(&self.font_name) {
font
} else {
@@ -185,6 +185,7 @@ where
/// 特别地/In particular:
///
/// - 对算术验证码[ArithmeticCaptcha](crate::captcha::arithmetic::ArithmeticCaptcha)而言，这里的`len`是验证码中数字的数量。
+ ///
/// For [ArithmeticCaptcha](crate::captcha::arithmetic::ArithmeticCaptcha), the `len` presents the count of the digits
/// in the Captcha.
fn with_size_and_len(width: i32, height: i32, len: usize) -> Self;
@@ -226,7 +227,7 @@ impl NewCaptcha for Captcha {
let len = 5;
let width = 130;
let height = 48;
- let char_type = CaptchaType::TypeDefault;
+ let char_type = CaptchaType::Default;
let chars = None;
Self {
diff --git a/easytier-web/src/restful/captcha/base/randoms.rs b/easytier-web/src/restful/captcha/base/randoms.rs
index ed78579c7..956616d06 100644
--- a/easytier-web/src/restful/captcha/base/randoms.rs
+++ b/easytier-web/src/restful/captcha/base/randoms.rs
@@ -1,6 +1,4 @@
-
-use rand::{random};
-
+use rand::random;
/// 随机数工具类
pub(crate) struct Randoms {
diff --git a/easytier-web/src/restful/captcha/captcha/mod.rs b/easytier-web/src/restful/captcha/builder/mod.rs
similarity index 100%
rename from easytier-web/src/restful/captcha/captcha/mod.rs
rename to easytier-web/src/restful/captcha/builder/mod.rs
diff --git a/easytier-web/src/restful/captcha/captcha/spec.rs b/easytier-web/src/restful/captcha/builder/spec.rs
similarity index 100%
rename from easytier-web/src/restful/captcha/captcha/spec.rs
rename to easytier-web/src/restful/captcha/builder/spec.rs
diff --git a/easytier-web/src/restful/captcha/extension/axum_tower_sessions.rs b/easytier-web/src/restful/captcha/extension/axum_tower_sessions.rs
index 81597dbe9..a630282b3 100644
--- a/easytier-web/src/restful/captcha/extension/axum_tower_sessions.rs
+++ b/easytier-web/src/restful/captcha/extension/axum_tower_sessions.rs
@@ -10,7 +10,7 @@ use axum::response::Response;
use std::fmt::Debug;
use tower_sessions::Session;
-const CAPTCHA_KEY: &'static str = "ez-captcha";
+const CAPTCHA_KEY: &str = "ez-captcha";
/// Axum & Tower_Sessions
#[async_trait]
@@ -32,7 +32,7 @@ pub trait CaptchaAxumTowerSessionStaticExt {
/// Verify the Captcha code, and return whether user's code is correct.
async fn ver(code: &str, session: &Session) -> bool {
match session.get::(CAPTCHA_KEY).await {
- Ok(Some(ans)) => ans.to_ascii_lowercase() == code.to_ascii_lowercase(),
+ Ok(Some(ans)) => ans.eq_ignore_ascii_case(code),
_ => false,
}
}
diff --git a/easytier-web/src/restful/captcha/extension/mod.rs b/easytier-web/src/restful/captcha/extension/mod.rs
index c11a9766f..ada8a980b 100644
--- a/easytier-web/src/restful/captcha/extension/mod.rs
+++ b/easytier-web/src/restful/captcha/extension/mod.rs
@@ -1,7 +1,7 @@
pub mod axum_tower_sessions;
use super::base::captcha::AbstractCaptcha;
-use super::captcha::spec::SpecCaptcha;
+use super::builder::spec::SpecCaptcha;
use super::{CaptchaFont, NewCaptcha};
/// 验证码工具类 - Captcha Utils
diff --git a/easytier-web/src/restful/captcha/mod.rs b/easytier-web/src/restful/captcha/mod.rs
index 6f504e4d5..9fed9d914 100644
--- a/easytier-web/src/restful/captcha/mod.rs
+++ b/easytier-web/src/restful/captcha/mod.rs
@@ -117,7 +117,7 @@
#![allow(dead_code)]
pub(crate) mod base;
-pub mod captcha;
+pub mod builder;
pub mod extension;
mod utils;
diff --git a/easytier-web/src/restful/captcha/utils/color.rs b/easytier-web/src/restful/captcha/utils/color.rs
index a5345c787..bf9bde4c9 100644
--- a/easytier-web/src/restful/captcha/utils/color.rs
+++ b/easytier-web/src/restful/captcha/utils/color.rs
@@ -32,21 +32,24 @@ impl From<(u8, u8, u8)> for Color {
}
}
-impl Into<(u8, u8, u8, u8)> for Color {
- fn into(self) -> (u8, u8, u8, u8) {
+impl From for (u8, u8, u8, u8) {
+ fn from(val: Color) -> Self {
(
- (self.0 * 255.0) as u8,
- (self.1 * 255.0) as u8,
- (self.2 * 255.0) as u8,
- (self.3 * 255.0) as u8,
+ (val.0 * 255.0) as u8,
+ (val.1 * 255.0) as u8,
+ (val.2 * 255.0) as u8,
+ (val.3 * 255.0) as u8,
)
}
}
-impl Into for Color {
- fn into(self) -> u32 {
- let color: (u8, u8, u8, u8) = self.into();
- (color.0 as u32) << 24 + (color.1 as u32) << 16 + (color.2 as u32) << 8 + (color.3 as u32)
+impl From for u32 {
+ fn from(val: Color) -> Self {
+ let color: (u8, u8, u8, u8) = val.into();
+ (color.0 as u32)
+ << (24 + (color.1 as u32))
+ << (16 + (color.2 as u32))
+ << (8 + (color.3 as u32))
}
}
diff --git a/easytier-web/src/restful/captcha/utils/font.rs b/easytier-web/src/restful/captcha/utils/font.rs
index 6bce05ce0..5294fd320 100644
--- a/easytier-web/src/restful/captcha/utils/font.rs
+++ b/easytier-web/src/restful/captcha/utils/font.rs
@@ -11,7 +11,7 @@ struct FontAssets;
// pub(crate) static ref FONTS: RwLock>> = Default::default();
// }
-pub fn get_font(font_name: &str) -> Option> {
+pub fn get_font(font_name: &'_ str) -> Option>> {
// let fonts_cell = FONTS.get_or_init(|| Default::default());
// let guard = fonts_cell.read();
//
@@ -31,7 +31,7 @@ pub fn get_font(font_name: &str) -> Option> {
// }
}
-pub fn load_font(font_name: &str) -> Result, Box> {
+pub fn load_font(font_name: &'_ str) -> Result>, Box> {
match FontAssets::get(font_name) {
Some(assets) => {
let font = Font::try_from_vec(Vec::from(assets.data)).unwrap();
diff --git a/easytier-web/src/restful/mod.rs b/easytier-web/src/restful/mod.rs
index d21709179..ba29da685 100644
--- a/easytier-web/src/restful/mod.rs
+++ b/easytier-web/src/restful/mod.rs
@@ -143,7 +143,7 @@ impl RestfulServer {
return Err((StatusCode::UNAUTHORIZED, other_error("No such user").into()));
};
- let machines = client_mgr.list_machine_by_user_id(user.id().clone()).await;
+ let machines = client_mgr.list_machine_by_user_id(user.id()).await;
Ok(GetSummaryJsonResp {
device_count: machines.len() as u32,
diff --git a/easytier-web/src/restful/network.rs b/easytier-web/src/restful/network.rs
index e8b08d16d..9a103cc53 100644
--- a/easytier-web/src/restful/network.rs
+++ b/easytier-web/src/restful/network.rs
@@ -8,7 +8,7 @@ use axum_login::AuthUser;
use easytier::launcher::NetworkConfig;
use easytier::proto::common::Void;
use easytier::proto::rpc_types::controller::BaseController;
-use easytier::proto::web::*;
+use easytier::proto::{self, web::*};
use crate::client_manager::session::{Location, Session};
use crate::client_manager::ClientManager;
@@ -85,7 +85,7 @@ impl NetworkApi {
let Some(user_id) = auth_session.user.as_ref().map(|x| x.id()) else {
return Err((
StatusCode::UNAUTHORIZED,
- other_error(format!("No user id found")).into(),
+ other_error("No user id found".to_string()).into(),
));
};
Ok(user_id)
@@ -108,7 +108,7 @@ impl NetworkApi {
let Some(token) = result.get_token().await else {
return Err((
StatusCode::UNAUTHORIZED,
- other_error(format!("No token reported")).into(),
+ other_error("No token reported".to_string()).into(),
));
};
@@ -120,7 +120,7 @@ impl NetworkApi {
{
return Err((
StatusCode::FORBIDDEN,
- other_error(format!("Token mismatch")).into(),
+ other_error("Token mismatch".to_string()).into(),
));
}
@@ -177,7 +177,7 @@ impl NetworkApi {
.insert_or_update_user_network_config(
auth_session.user.as_ref().unwrap().id(),
machine_id,
- resp.inst_id.clone().unwrap_or_default().into(),
+ resp.inst_id.unwrap_or_default().into(),
serde_json::to_string(&config).unwrap(),
)
.await
@@ -248,7 +248,7 @@ impl NetworkApi {
.await
.map_err(convert_rpc_error)?;
- let running_inst_ids = ret.inst_ids.clone().into_iter().map(Into::into).collect();
+ let running_inst_ids = ret.inst_ids.clone().into_iter().collect();
// collect networks that are disabled
let disabled_inst_ids = client_mgr
@@ -261,7 +261,7 @@ impl NetworkApi {
.await
.map_err(convert_db_error)?
.iter()
- .filter_map(|x| x.network_instance_id.clone().try_into().ok())
+ .map(|x| Into::::into(x.network_instance_id.clone()))
.collect::>();
Ok(ListNetworkInstanceIdsJsonResp {
@@ -330,9 +330,8 @@ impl NetworkApi {
// not implement disable all
return Err((
StatusCode::NOT_IMPLEMENTED,
- other_error(format!("Not implemented")).into(),
- ))
- .into();
+ other_error("Not implemented".to_string()).into(),
+ ));
};
let sess = Self::get_session_by_machine_id(&auth_session, &client_mgr, &machine_id).await?;
diff --git a/easytier-web/src/restful/users.rs b/easytier-web/src/restful/users.rs
index 1e879ae50..b489a1454 100644
--- a/easytier-web/src/restful/users.rs
+++ b/easytier-web/src/restful/users.rs
@@ -76,32 +76,32 @@ impl Backend {
pub async fn register_new_user(&self, new_user: &RegisterNewUser) -> anyhow::Result<()> {
let hashed_password = password_auth::generate_hash(new_user.credentials.password.as_str());
- let mut txn = self.db.orm_db().begin().await?;
+ let txn = self.db.orm_db().begin().await?;
entity::users::ActiveModel {
username: Set(new_user.credentials.username.clone()),
password: Set(hashed_password.clone()),
..Default::default()
}
- .save(&mut txn)
+ .save(&txn)
.await?;
entity::users_groups::ActiveModel {
user_id: Set(entity::users::Entity::find()
.filter(entity::users::Column::Username.eq(new_user.credentials.username.as_str()))
- .one(&mut txn)
+ .one(&txn)
.await?
.unwrap()
.id),
group_id: Set(entity::groups::Entity::find()
.filter(entity::groups::Column::Name.eq("users"))
- .one(&mut txn)
+ .one(&txn)
.await?
.unwrap()
.id),
..Default::default()
}
- .save(&mut txn)
+ .save(&txn)
.await?;
txn.commit().await?;
diff --git a/easytier-web/src/web/mod.rs b/easytier-web/src/web/mod.rs
index 7f0590d10..eabe307ec 100644
--- a/easytier-web/src/web/mod.rs
+++ b/easytier-web/src/web/mod.rs
@@ -52,9 +52,7 @@ pub fn build_router(api_host: Option) -> Router {
router
};
- let router = router.fallback_service(service);
-
- router
+ router.fallback_service(service)
}
pub struct WebServer {
diff --git a/easytier/Cargo.toml b/easytier/Cargo.toml
index 247f5c3b1..57b3298ac 100644
--- a/easytier/Cargo.toml
+++ b/easytier/Cargo.toml
@@ -3,12 +3,12 @@ name = "easytier"
description = "A full meshed p2p VPN, connecting all your devices in one network with one command."
homepage = "https://github.com/EasyTier/EasyTier"
repository = "https://github.com/EasyTier/EasyTier"
-version = "2.3.2"
+version = "2.4.2"
edition = "2021"
authors = ["kkrainbow"]
keywords = ["vpn", "p2p", "network", "easytier"]
categories = ["network-programming", "command-line-utilities"]
-rust-version = "1.84.0"
+rust-version = "1.89.0"
license-file = "LICENSE"
readme = "README.md"
@@ -27,6 +27,7 @@ readme = "README.md"
name = "easytier"
path = "src/lib.rs"
crate-type = ["cdylib"]
+test = false
[dependencies]
lazy_static = "1.4.0"
@@ -43,6 +44,7 @@ tracing-appender = "0.2.3"
thiserror = "1.0"
auto_impl = "1.1.0"
crossbeam = "0.8.4"
+arc-swap = "1.7"
time = "0.3"
toml = "0.8.12"
chrono = { version = "0.4.37", features = ["serde"] }
@@ -88,11 +90,11 @@ http = { version = "1", default-features = false, features = [
tokio-rustls = { version = "0.26", default-features = false, optional = true }
# for tap device
-tun = { package = "tun-easytier", version = "1.1.1", features = [
+tun = { package = "tun-easytier", git="https://github.com/EasyTier/rust-tun", features = [
"async",
], optional = true }
# for net ns
-nix = { version = "0.29.0", features = ["sched", "socket", "ioctl", "net"] }
+nix = { version = "0.29.0", features = ["sched", "socket", "ioctl", "net", "fs"] }
uuid = { version = "1.5.0", features = [
"v4",
@@ -117,7 +119,7 @@ byteorder = "1.5.0"
# for proxy
cidr = { version = "0.2.2", features = ["serde"] }
-socket2 = "0.5.5"
+socket2 = { version = "0.5.10", features = ["all"] }
# for hole punching
stun_codec = "0.3.4"
@@ -135,6 +137,7 @@ clap = { version = "4.5.30", features = [
"wrap_help",
"env",
] }
+clap_complete = { version = "4.5.55" }
async-recursion = "1.0.5"
@@ -151,6 +154,7 @@ boringtun = { package = "boringtun-easytier", version = "0.6.1", optional = true
ring = { version = "0.17", optional = true }
bitflags = "2.5"
aes-gcm = { version = "0.10.3", optional = true }
+openssl = { version = "0.10", optional = true, features = ["vendored"] }
# for cli
tabled = "0.16"
@@ -192,7 +196,7 @@ service-manager = { git = "https://github.com/chipsenkbeil/service-manager-rs.gi
zstd = { version = "0.13" }
-kcp-sys = { git = "https://github.com/EasyTier/kcp-sys" }
+kcp-sys = { git = "https://github.com/EasyTier/kcp-sys", rev = "0f0a0558391ba391c089806c23f369651f6c9eeb" }
prost-reflect = { version = "0.14.5", default-features = false, features = [
"derive",
@@ -215,14 +219,6 @@ humantime-serde = "1.1.1"
multimap = "0.10.0"
version-compare = "0.2.0"
-jemallocator = { version = "0.5.4", optional = true }
-jemalloc-ctl = { version = "0.5.4", optional = true }
-jemalloc-sys = { version = "0.5.4", features = [
- "stats",
- "profiling",
- "unprefixed_malloc_on_supported_platforms",
-], optional = true }
-
[target.'cfg(any(target_os = "linux", target_os = "macos", target_os = "windows", target_os = "freebsd"))'.dependencies]
machine-uid = "0.5.3"
@@ -249,6 +245,24 @@ windows = { version = "0.52.0", features = [
encoding = "0.2"
winreg = "0.52"
windows-service = "0.7.0"
+windows-sys = { version = "0.52", features = [
+ "Win32_NetworkManagement_IpHelper",
+ "Win32_NetworkManagement_Ndis",
+ "Win32_Networking_WinSock",
+ "Win32_Foundation"
+]}
+winapi = { version = "0.3.9", features = ["impl-default"] }
+
+[target.'cfg(not(windows))'.dependencies]
+jemallocator = { package = "tikv-jemallocator", version = "0.6.0", optional = true, features = [
+ "unprefixed_malloc_on_supported_platforms"
+] }
+jemalloc-ctl = { package = "tikv-jemalloc-ctl", version = "0.6.0", optional = true, features = [
+] }
+jemalloc-sys = { package = "tikv-jemalloc-sys", version = "0.6.0", features = [
+ "background_threads_runtime_support",
+ "background_threads",
+], optional = true }
[build-dependencies]
tonic-build = "0.12"
@@ -284,12 +298,12 @@ tokio-socks = "0.5.2"
[features]
-default = ["wireguard", "mimalloc", "websocket", "smoltcp", "tun", "socks5", "quic"]
+default = ["wireguard", "websocket", "smoltcp", "tun", "socks5", "quic"]
full = [
"websocket",
"wireguard",
- "mimalloc",
"aes-gcm",
+ "openssl-crypto", # need openssl-dev libs
"smoltcp",
"tun",
"socks5",
@@ -298,6 +312,7 @@ wireguard = ["dep:boringtun", "dep:ring"]
quic = ["dep:quinn", "dep:rustls", "dep:rcgen"]
mimalloc = ["dep:mimalloc"]
aes-gcm = ["dep:aes-gcm"]
+openssl-crypto = ["dep:openssl"]
tun = ["dep:tun"]
websocket = [
"dep:tokio-websockets",
@@ -308,4 +323,5 @@ websocket = [
]
smoltcp = ["dep:smoltcp", "dep:parking_lot"]
socks5 = ["dep:smoltcp"]
-jemalloc = ["dep:jemallocator", "dep:jemalloc-ctl", "dep:jemalloc-sys"]
+jemalloc = ["dep:jemallocator", "dep:jemalloc-sys"]
+jemalloc-prof = ["jemalloc", "dep:jemalloc-ctl", "jemalloc-ctl/stats", "jemalloc-sys/profiling", "jemalloc-sys/stats"]
diff --git a/easytier/build.rs b/easytier/build.rs
index aed1655b8..682738709 100644
--- a/easytier/build.rs
+++ b/easytier/build.rs
@@ -116,7 +116,7 @@ fn check_locale() {
if let Ok(globs) = globwalk::glob(locale_path) {
for entry in globs {
if let Err(e) = entry {
- println!("cargo:i18n-error={}", e);
+ println!("cargo:i18n-error={e}");
continue;
}
@@ -147,15 +147,17 @@ fn main() -> Result<(), Box> {
"src/proto/cli.proto",
"src/proto/web.proto",
"src/proto/magic_dns.proto",
+ "src/proto/acl.proto",
];
for proto_file in proto_files.iter().chain(proto_files_reflect.iter()) {
- println!("cargo:rerun-if-changed={}", proto_file);
+ println!("cargo:rerun-if-changed={proto_file}");
}
let mut config = prost_build::Config::new();
config
.protoc_arg("--experimental_allow_proto3_optional")
+ .type_attribute(".acl", "#[derive(serde::Serialize, serde::Deserialize)]")
.type_attribute(".common", "#[derive(serde::Serialize, serde::Deserialize)]")
.type_attribute(".error", "#[derive(serde::Serialize, serde::Deserialize)]")
.type_attribute(".cli", "#[derive(serde::Serialize, serde::Deserialize)]")
@@ -171,7 +173,7 @@ fn main() -> Result<(), Box> {
.field_attribute(".web.NetworkConfig", "#[serde(default)]")
.service_generator(Box::new(rpc_build::ServiceGenerator::new()))
.btree_map(["."])
- .skip_debug(&[".common.Ipv4Addr", ".common.Ipv6Addr", ".common.UUID"]);
+ .skip_debug([".common.Ipv4Addr", ".common.Ipv6Addr", ".common.UUID"]);
config.compile_protos(&proto_files, &["src/proto/"])?;
diff --git a/easytier/locales/app.yml b/easytier/locales/app.yml
index fd840074c..67a07437c 100644
--- a/easytier/locales/app.yml
+++ b/easytier/locales/app.yml
@@ -18,6 +18,9 @@ core_clap:
config_file:
en: "path to the config file, NOTE: the options set by cmdline args will override options in config file"
zh-CN: "配置文件路径，注意：命令行中的配置的选项会覆盖配置文件中的选项"
+ generate_completions:
+ en: "generate shell completions"
+ zh-CN: "生成 shell 补全脚本"
network_name:
en: "network name to identify this vpn network"
zh-CN: "用于标识此VPN网络的网络名称"
@@ -27,6 +30,9 @@ core_clap:
ipv4:
en: "ipv4 address of this vpn node, if empty, this node will only forward packets and no TUN device will be created"
zh-CN: "此VPN节点的IPv4地址，如果为空，则此节点将仅转发数据包，不会创建TUN设备"
+ ipv6:
+ en: "ipv6 address of this vpn node, can be used together with ipv4 for dual-stack operation"
+ zh-CN: "此VPN节点的IPv6地址，可与IPv4一起使用以进行双栈操作"
dhcp:
en: "automatically determine and set IP address by Easytier, and the IP address starts from 10.0.0.1 by default. Warning, if there is an IP conflict in the network when using DHCP, the IP will be automatically changed."
zh-CN: "由Easytier自动确定并设置IP地址，默认从10.0.0.1开始。警告：在使用DHCP时，如果网络中出现IP冲突，IP将自动更改。"
@@ -89,9 +95,15 @@ core_clap:
disable_encryption:
en: "disable encryption for peers communication, default is false, must be same with peers"
zh-CN: "禁用对等节点通信的加密，默认为false，必须与对等节点相同"
+ encryption_algorithm:
+ en: "encryption algorithm to use, supported: '', 'xor', 'chacha20', 'aes-gcm', 'aes-gcm-256', 'openssl-aes128-gcm', 'openssl-aes256-gcm', 'openssl-chacha20'. Empty string means default (aes-gcm)"
+ zh-CN: "要使用的加密算法，支持：''（默认aes-gcm）、'xor'、'chacha20'、'aes-gcm'、'aes-gcm-256'、'openssl-aes128-gcm'、'openssl-aes256-gcm'、'openssl-chacha20'"
multi_thread:
en: "use multi-thread runtime, default is single-thread"
zh-CN: "使用多线程运行时，默认为单线程"
+ multi_thread_count:
+ en: "the number of threads to use, default is 2, only effective when multi-thread is enabled, must be greater than 2"
+ zh-CN: "使用的线程数，默认为2，仅在多线程模式下有效。取值必须大于2"
disable_ipv6:
en: "do not use ipv6"
zh-CN: "不使用IPv6"
@@ -178,6 +190,21 @@ core_clap:
private_mode:
en: "if true, nodes with different network names or passwords from this network are not allowed to perform handshake or relay through this node."
zh-CN: "如果为true，则不允许使用了与本网络不相同的网络名称和密码的节点通过本节点进行握手或中转"
+ foreign_relay_bps_limit:
+ en: "the maximum bps limit for foreign network relay, default is no limit. unit: BPS (bytes per second)"
+ zh-CN: "作为共享节点时，限制非本地网络的流量转发速率，默认无限制，单位 BPS （字节每秒）"
+ tcp_whitelist:
+ en: "tcp port whitelist. Supports single ports (80) and ranges (8000-9000)"
+ zh-CN: "TCP 端口白名单。支持单个端口（80）和范围（8000-9000）"
+ udp_whitelist:
+ en: "udp port whitelist. Supports single ports (53) and ranges (5000-6000)"
+ zh-CN: "UDP 端口白名单。支持单个端口（53）和范围（5000-6000）"
+ disable_relay_kcp:
+ en: "if true, disable relay kcp packets. avoid consuming too many bandwidth. default is false"
+ zh-CN: "如果为true，则禁止节点转发 KCP 数据包，防止过度消耗流量。默认值为false"
+ enable_relay_foreign_network_kcp:
+ en: "if true, allow relay kcp packets from foreign network. default is false (not forward foreign network kcp packets)"
+ zh-CN: "如果为true，则作为共享节点时也可以转发其他网络的 KCP 数据包。默认值为false（不转发）"
core_app:
panic_backtrace_save:
diff --git a/easytier/src/arch/windows.rs b/easytier/src/arch/windows.rs
index 904de872c..1c7799cad 100644
--- a/easytier/src/arch/windows.rs
+++ b/easytier/src/arch/windows.rs
@@ -7,8 +7,9 @@ use windows::{
Win32::{
Foundation::{BOOL, FALSE},
NetworkManagement::WindowsFirewall::{
- INetFwPolicy2, INetFwRule, NET_FW_ACTION_ALLOW, NET_FW_PROFILE2_PRIVATE,
- NET_FW_PROFILE2_PUBLIC, NET_FW_RULE_DIR_IN, NET_FW_RULE_DIR_OUT,
+ INetFwPolicy2, INetFwRule, NET_FW_ACTION_ALLOW, NET_FW_PROFILE2_DOMAIN,
+ NET_FW_PROFILE2_PRIVATE, NET_FW_PROFILE2_PUBLIC, NET_FW_RULE_DIR_IN,
+ NET_FW_RULE_DIR_OUT,
},
Networking::WinSock::{
htonl, setsockopt, WSAGetLastError, WSAIoctl, IPPROTO_IP, IPPROTO_IPV6,
@@ -164,7 +165,7 @@ impl Drop for ComInitializer {
pub fn do_add_self_to_firewall_allowlist(inbound: bool) -> anyhow::Result<()> {
let _com = ComInitializer::new()?;
- // 创建防火墙策略实例
+ // Create firewall policy instance
let policy: INetFwPolicy2 = unsafe {
CoCreateInstance(
&windows::Win32::NetworkManagement::WindowsFirewall::NetFwPolicy2,
@@ -173,7 +174,7 @@ pub fn do_add_self_to_firewall_allowlist(inbound: bool) -> anyhow::Result<()> {
)
}?;
- // 创建防火墙规则实例
+ // Create firewall rule instance
let rule: INetFwRule = unsafe {
CoCreateInstance(
&windows::Win32::NetworkManagement::WindowsFirewall::NetFwRule,
@@ -182,7 +183,7 @@ pub fn do_add_self_to_firewall_allowlist(inbound: bool) -> anyhow::Result<()> {
)
}?;
- // 设置规则属性
+ // Set rule properties
let exe_path = std::env::current_exe()
.with_context(|| "Failed to get current executable path when adding firewall rule")?
.to_string_lossy()
@@ -202,17 +203,19 @@ pub fn do_add_self_to_firewall_allowlist(inbound: bool) -> anyhow::Result<()> {
rule.SetApplicationName(&app_path)?;
rule.SetAction(NET_FW_ACTION_ALLOW)?;
if inbound {
- rule.SetDirection(NET_FW_RULE_DIR_IN)?; // 允许入站连接
+ rule.SetDirection(NET_FW_RULE_DIR_IN)?; // Allow inbound connections
} else {
- rule.SetDirection(NET_FW_RULE_DIR_OUT)?; // 允许出站连接
+ rule.SetDirection(NET_FW_RULE_DIR_OUT)?; // Allow outbound connections
}
rule.SetEnabled(windows::Win32::Foundation::VARIANT_TRUE)?;
- rule.SetProfiles(NET_FW_PROFILE2_PRIVATE.0 | NET_FW_PROFILE2_PUBLIC.0)?;
+ rule.SetProfiles(
+ NET_FW_PROFILE2_PRIVATE.0 | NET_FW_PROFILE2_PUBLIC.0 | NET_FW_PROFILE2_DOMAIN.0,
+ )?;
rule.SetGrouping(&BSTR::from("EasyTier"))?;
- // 获取规则集合并添加新规则
+ // Get rule collection and add new rule
let rules = policy.Rules()?;
- rules.Remove(&name)?; // 先删除同名规则
+ rules.Remove(&name)?; // Remove existing rule with same name first
rules.Add(&rule)?;
}
@@ -225,6 +228,266 @@ pub fn add_self_to_firewall_allowlist() -> anyhow::Result<()> {
Ok(())
}
+/// Add firewall rules for specified network interface to allow all traffic
+pub fn add_interface_to_firewall_allowlist(interface_name: &str) -> anyhow::Result<()> {
+ let _com = ComInitializer::new()?;
+
+ // Create firewall policy instance
+ let policy: INetFwPolicy2 = unsafe {
+ CoCreateInstance(
+ &windows::Win32::NetworkManagement::WindowsFirewall::NetFwPolicy2,
+ None,
+ CLSCTX_ALL,
+ )
+ }?;
+
+ tracing::info!(
+ "Adding comprehensive firewall rules for interface: {}",
+ interface_name
+ );
+
+ // Create rules for each protocol type
+ add_protocol_firewall_rules(&policy, interface_name, "TCP", 6)?; // TCP protocol number 6
+ tracing::debug!("Added TCP firewall rules for interface: {}", interface_name);
+
+ add_protocol_firewall_rules(&policy, interface_name, "UDP", 17)?; // UDP protocol number 17
+ tracing::debug!("Added UDP firewall rules for interface: {}", interface_name);
+
+ add_protocol_firewall_rules(&policy, interface_name, "ICMP", 1)?; // ICMP protocol number 1
+ tracing::debug!(
+ "Added ICMP firewall rules for interface: {}",
+ interface_name
+ );
+
+ // Add fallback rules for all protocols
+ add_all_protocols_firewall_rules(&policy, interface_name)?;
+ tracing::debug!(
+ "Added fallback all-protocols rules for interface: {}",
+ interface_name
+ );
+
+ tracing::info!(
+ "Successfully created all firewall rules for interface: {}",
+ interface_name
+ );
+
+ Ok(())
+}
+
+/// Add firewall rules for a specific protocol
+fn add_protocol_firewall_rules(
+ policy: &INetFwPolicy2,
+ interface_name: &str,
+ protocol_name: &str,
+ protocol_number: i32,
+) -> anyhow::Result<()> {
+ // Create rules for both inbound and outbound traffic
+ for (is_inbound, direction_name) in [(true, "Inbound"), (false, "Outbound")] {
+ // Create firewall rule instance
+ let rule: INetFwRule = unsafe {
+ CoCreateInstance(
+ &windows::Win32::NetworkManagement::WindowsFirewall::NetFwRule,
+ None,
+ CLSCTX_ALL,
+ )
+ }?;
+
+ let rule_name = format!(
+ "EasyTier {} - {} Protocol ({})",
+ interface_name, protocol_name, direction_name
+ );
+ let description = format!(
+ "Allow {} traffic on EasyTier interface {}",
+ protocol_name, interface_name
+ );
+
+ let name_bstr = BSTR::from(&rule_name);
+ let desc_bstr = BSTR::from(&description);
+
+ unsafe {
+ rule.SetName(&name_bstr)?;
+ rule.SetDescription(&desc_bstr)?;
+ rule.SetProtocol(protocol_number)?;
+ rule.SetAction(NET_FW_ACTION_ALLOW)?;
+
+ if is_inbound {
+ rule.SetDirection(NET_FW_RULE_DIR_IN)?;
+ } else {
+ rule.SetDirection(NET_FW_RULE_DIR_OUT)?;
+ }
+
+ rule.SetEnabled(windows::Win32::Foundation::VARIANT_TRUE)?;
+ rule.SetProfiles(
+ NET_FW_PROFILE2_PRIVATE.0 | NET_FW_PROFILE2_PUBLIC.0 | NET_FW_PROFILE2_DOMAIN.0,
+ )?;
+ rule.SetGrouping(&BSTR::from("EasyTier"))?;
+
+ // Get rule collection and add new rule
+ let rules = policy.Rules()?;
+ rules.Remove(&name_bstr)?; // Remove existing rule with same name first
+ rules.Add(&rule)?;
+ }
+ }
+
+ Ok(())
+}
+
+/// Add fallback rules for all protocols
+fn add_all_protocols_firewall_rules(
+ policy: &INetFwPolicy2,
+ interface_name: &str,
+) -> anyhow::Result<()> {
+ // Create rules for both inbound and outbound traffic
+ for (is_inbound, direction_name) in [(true, "Inbound"), (false, "Outbound")] {
+ // Create firewall rule instance
+ let rule: INetFwRule = unsafe {
+ CoCreateInstance(
+ &windows::Win32::NetworkManagement::WindowsFirewall::NetFwRule,
+ None,
+ CLSCTX_ALL,
+ )
+ }?;
+
+ let rule_name = format!(
+ "EasyTier {} - All Protocols ({})",
+ interface_name, direction_name
+ );
+ let description = format!(
+ "Allow all protocol traffic on EasyTier interface {}",
+ interface_name
+ );
+
+ let name_bstr = BSTR::from(&rule_name);
+ let desc_bstr = BSTR::from(&description);
+
+ unsafe {
+ rule.SetName(&name_bstr)?;
+ rule.SetDescription(&desc_bstr)?;
+ // Don't set protocol - allows all protocols by default
+ rule.SetAction(NET_FW_ACTION_ALLOW)?;
+
+ if is_inbound {
+ rule.SetDirection(NET_FW_RULE_DIR_IN)?;
+ } else {
+ rule.SetDirection(NET_FW_RULE_DIR_OUT)?;
+ }
+
+ rule.SetEnabled(windows::Win32::Foundation::VARIANT_TRUE)?;
+ rule.SetProfiles(
+ NET_FW_PROFILE2_PRIVATE.0 | NET_FW_PROFILE2_PUBLIC.0 | NET_FW_PROFILE2_DOMAIN.0,
+ )?;
+ rule.SetGrouping(&BSTR::from("EasyTier"))?;
+
+ // Get rule collection and add new rule
+ let rules = policy.Rules()?;
+ rules.Remove(&name_bstr)?; // Remove existing rule with same name first
+ rules.Add(&rule)?;
+ }
+ }
+
+ Ok(())
+}
+
+/// Remove firewall rules for specified interface
+pub fn remove_interface_firewall_rules(interface_name: &str) -> anyhow::Result<()> {
+ let _com = ComInitializer::new()?;
+
+ let policy: INetFwPolicy2 = unsafe {
+ CoCreateInstance(
+ &windows::Win32::NetworkManagement::WindowsFirewall::NetFwPolicy2,
+ None,
+ CLSCTX_ALL,
+ )
+ }?;
+
+ let rules = unsafe { policy.Rules()? };
+
+ // Remove protocol-specific rules
+ for protocol_name in ["TCP", "UDP", "ICMP"] {
+ for direction in ["Inbound", "Outbound"] {
+ let rule_name = format!(
+ "EasyTier {} - {} Protocol ({})",
+ interface_name, protocol_name, direction
+ );
+ let name_bstr = BSTR::from(&rule_name);
+ unsafe {
+ let _ = rules.Remove(&name_bstr); // Ignore errors, rule might not exist
+ }
+ }
+ }
+
+ // Remove fallback protocol rules
+ for direction in ["Inbound", "Outbound"] {
+ let rule_name = format!(
+ "EasyTier {} - All Protocols ({})",
+ interface_name, direction
+ );
+ let name_bstr = BSTR::from(&rule_name);
+ unsafe {
+ let _ = rules.Remove(&name_bstr); // Ignore errors, rule might not exist
+ }
+ }
+
+ Ok(())
+}
+
+/// List EasyTier firewall rules for specified interface (for debugging)
+#[allow(dead_code)]
+pub fn list_interface_firewall_rules(interface_name: &str) -> anyhow::Result> {
+ let _com = ComInitializer::new()?;
+
+ let policy: INetFwPolicy2 = unsafe {
+ CoCreateInstance(
+ &windows::Win32::NetworkManagement::WindowsFirewall::NetFwPolicy2,
+ None,
+ CLSCTX_ALL,
+ )
+ }?;
+
+ let rules = unsafe { policy.Rules()? };
+ let mut found_rules = Vec::new();
+
+ // Check protocol-specific rules
+ for protocol_name in ["TCP", "UDP", "ICMP"] {
+ for direction in ["Inbound", "Outbound"] {
+ let rule_name = format!(
+ "EasyTier {} - {} Protocol ({})",
+ interface_name, protocol_name, direction
+ );
+ if check_rule_exists(&rules, &rule_name)? {
+ found_rules.push(rule_name);
+ }
+ }
+ }
+
+ // Check fallback protocol rules
+ for direction in ["Inbound", "Outbound"] {
+ let rule_name = format!(
+ "EasyTier {} - All Protocols ({})",
+ interface_name, direction
+ );
+ if check_rule_exists(&rules, &rule_name)? {
+ found_rules.push(rule_name);
+ }
+ }
+
+ Ok(found_rules)
+}
+
+/// Check if a firewall rule with specified name exists
+fn check_rule_exists(
+ rules: &windows::Win32::NetworkManagement::WindowsFirewall::INetFwRules,
+ rule_name: &str,
+) -> anyhow::Result {
+ let name_bstr = BSTR::from(rule_name);
+ unsafe {
+ match rules.Item(&name_bstr) {
+ Ok(_) => Ok(true),
+ Err(_) => Ok(false),
+ }
+ }
+}
+
#[cfg(test)]
mod tests {
use super::*;
@@ -234,4 +497,71 @@ mod tests {
let res = add_self_to_firewall_allowlist();
assert!(res.is_ok());
}
+
+ #[test]
+ #[ignore] // Requires administrator privileges, ignored by default
+ fn test_interface_firewall_rules() {
+ let test_interface = "test_interface";
+
+ // Add firewall rules
+ let add_result = add_interface_to_firewall_allowlist(test_interface);
+ assert!(
+ add_result.is_ok(),
+ "Failed to add interface firewall rules: {:?}",
+ add_result
+ );
+
+ println!(
+ "✓ Added comprehensive firewall rules for interface: {}",
+ test_interface
+ );
+
+ // Verify rules were created
+ let rules = list_interface_firewall_rules(test_interface).unwrap();
+ println!("Created {} firewall rules:", rules.len());
+ for rule in &rules {
+ println!(" - {}", rule);
+ }
+
+ // Verify required protocol rules are all created
+ let expected_protocols = ["TCP", "UDP", "ICMP"];
+ let expected_directions = ["Inbound", "Outbound"];
+
+ for protocol in &expected_protocols {
+ for direction in &expected_directions {
+ let rule_name = format!(
+ "EasyTier {} - {} Protocol ({})",
+ test_interface, protocol, direction
+ );
+ assert!(
+ rules.contains(&rule_name),
+ "Missing required rule: {}",
+ rule_name
+ );
+ }
+ }
+
+ println!("✓ All required protocol rules (TCP/UDP/ICMP) are present");
+
+ // Remove firewall rules
+ let remove_result = remove_interface_firewall_rules(test_interface);
+ assert!(
+ remove_result.is_ok(),
+ "Failed to remove interface firewall rules: {:?}",
+ remove_result
+ );
+
+ // Verify rules were removed
+ let remaining_rules = list_interface_firewall_rules(test_interface).unwrap();
+ assert!(
+ remaining_rules.is_empty(),
+ "Some rules were not removed: {:?}",
+ remaining_rules
+ );
+
+ println!(
+ "✓ Successfully removed all firewall rules for interface: {}",
+ test_interface
+ );
+ }
}
diff --git a/easytier/src/common/acl_processor.rs b/easytier/src/common/acl_processor.rs
new file mode 100644
index 000000000..6f979e3c0
--- /dev/null
+++ b/easytier/src/common/acl_processor.rs
@@ -0,0 +1,1487 @@
+use std::{
+ collections::HashMap,
+ net::{IpAddr, SocketAddr},
+ str::FromStr as _,
+ sync::Arc,
+ time::{Duration, SystemTime, UNIX_EPOCH},
+};
+
+use crate::common::{config::ConfigLoader, global_ctx::ArcGlobalCtx, token_bucket::TokenBucket};
+use crate::proto::acl::*;
+use anyhow::Context as _;
+use dashmap::DashMap;
+use tokio::task::JoinSet;
+
+// Performance-optimized key for rate limiting to avoid string allocations
+#[derive(Debug, Clone, Hash, PartialEq, Eq)]
+pub struct RateLimitKey {
+ pub chain_type: ChainType,
+ pub rule_priority: u32,
+}
+
+impl RateLimitKey {
+ pub fn new(chain_type: ChainType, rule_priority: u32) -> Self {
+ Self {
+ chain_type,
+ rule_priority,
+ }
+ }
+}
+
+// Performance-optimized rule identifier to avoid string allocations
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum RuleId {
+ Priority(u32),
+ Stateful(u32),
+ Default,
+}
+
+impl RuleId {
+ /// Convert to string only when actually needed (lazy evaluation)
+ pub fn to_string_cached(&self) -> String {
+ match self {
+ RuleId::Priority(p) => p.to_string(),
+ RuleId::Stateful(p) => format!("stateful-{}", p),
+ RuleId::Default => "default".to_string(),
+ }
+ }
+
+ /// Get string representation for logging (optimized for hot path)
+ pub fn as_str(&self) -> String {
+ self.to_string_cached()
+ }
+}
+
+// Fast lookup structures for performance optimization
+#[derive(Debug, Clone)]
+pub struct FastLookupRule {
+ pub priority: u32,
+ pub protocol: Protocol,
+ pub src_ip_ranges: Vec,
+ pub dst_ip_ranges: Vec,
+ pub src_port_ranges: Vec<(u16, u16)>,
+ pub dst_port_ranges: Vec<(u16, u16)>,
+ pub action: Action,
+ pub enabled: bool,
+ pub stateful: bool,
+ pub rate_limit: u32,
+ pub burst_limit: u32,
+ pub rule_stats: Arc,
+}
+
+// Cache key combining packet info and chain type
+#[derive(Debug, Clone, Hash, PartialEq, Eq)]
+pub struct AclCacheKey {
+ pub chain_type: ChainType,
+ pub protocol: Protocol,
+ pub src_ip: IpAddr,
+ pub dst_ip: IpAddr,
+ pub src_port: u16,
+ pub dst_port: u16,
+}
+
+impl AclCacheKey {
+ pub fn from_packet_info(packet_info: &PacketInfo, chain_type: ChainType) -> Self {
+ Self {
+ chain_type,
+ protocol: packet_info.protocol,
+ src_ip: packet_info.src_ip,
+ dst_ip: packet_info.dst_ip,
+ src_port: packet_info.src_port.unwrap_or(0),
+ dst_port: packet_info.dst_port.unwrap_or(0),
+ }
+ }
+}
+
+// Cache entry with timestamp for LRU cleanup
+#[derive(Debug, Clone)]
+pub struct AclCacheEntry {
+ pub action: Action,
+ pub matched_rule: RuleId,
+ pub last_access: u64,
+ // New fields to track rule characteristics for proper cache behavior
+ pub conn_track_key: Option,
+ pub rate_limit_keys: Vec,
+ pub chain_type: ChainType,
+ pub acl_result: Option,
+ pub rule_stats_vec: Vec>,
+}
+
+// Packet info extracted for ACL processing
+#[derive(Debug, Clone, Hash, PartialEq, Eq)]
+pub struct PacketInfo {
+ pub src_ip: IpAddr,
+ pub dst_ip: IpAddr,
+ pub src_port: Option,
+ pub dst_port: Option,
+ pub protocol: Protocol,
+ pub packet_size: usize,
+}
+
+// ACL processing result
+#[derive(Debug, Clone)]
+pub struct AclResult {
+ pub action: Action,
+ pub matched_rule: Option,
+ pub should_log: bool,
+ pub log_context: Option,
+}
+
+impl AclResult {
+ /// Get matched rule as string (lazy evaluation)
+ pub fn matched_rule_string(&self) -> Option {
+ self.matched_rule.as_ref().map(|r| r.to_string_cached())
+ }
+
+ /// Get matched rule as string reference for logging (compatibility method)
+ pub fn matched_rule_str(&self) -> Option {
+ self.matched_rule.as_ref().map(|r| r.as_str())
+ }
+}
+
+// Context for lazy log message construction
+#[derive(Debug, Clone)]
+pub enum AclLogContext {
+ StatefulMatch {
+ src_ip: IpAddr,
+ dst_ip: IpAddr,
+ },
+ RuleMatch {
+ src_ip: IpAddr,
+ dst_ip: IpAddr,
+ action: Action,
+ },
+ DefaultDrop,
+ DefaultAllow,
+ UnsupportedChainType,
+ RateLimitDrop,
+}
+
+impl AclLogContext {
+ pub fn to_message(&self) -> String {
+ match self {
+ AclLogContext::StatefulMatch { src_ip, dst_ip } => {
+ format!("Stateful match: {} -> {}", src_ip, dst_ip)
+ }
+ AclLogContext::RuleMatch {
+ src_ip,
+ dst_ip,
+ action,
+ } => {
+ format!("Rule match: {} -> {} action: {:?}", src_ip, dst_ip, action)
+ }
+ AclLogContext::DefaultDrop => "No matching rule, default drop".to_string(),
+ AclLogContext::DefaultAllow => "No matching rule, default allow".to_string(),
+ AclLogContext::UnsupportedChainType => "Unsupported chain type".to_string(),
+ AclLogContext::RateLimitDrop => "Rate limit drop".to_string(),
+ }
+ }
+}
+
+pub type SharedState = (
+ Arc>,
+ Arc>>,
+ Arc>,
+);
+
+// High-performance ACL processor - No more internal locks!
+pub struct AclProcessor {
+ // Immutable rule vectors - no locks needed since they're never modified after creation
+ inbound_rules: Vec,
+ outbound_rules: Vec,
+ forward_rules: Vec,
+
+ default_inbound_action: Action,
+ default_outbound_action: Action,
+ default_forward_action: Action,
+
+ default_rule_stats: Arc,
+
+ // Connection tracking table - shared across different processor instances if needed
+ conn_track: Arc>,
+
+ // Rate limiting buckets per rule using TokenBucket with optimized keys
+ rate_limiters: Arc>>,
+
+ // Rule lookup cache with LRU cleanup
+ rule_cache: Arc>,
+ cache_max_size: usize,
+ cache_cleanup_interval: Duration,
+
+ // Statistics
+ stats: Arc>,
+
+ tasks: JoinSet<()>,
+}
+
+impl AclProcessor {
+ /// Create a new ACL processor with pre-built immutable rules
+ /// This is the main constructor that should be used
+ pub fn new(acl_config: Acl) -> Self {
+ Self::new_with_shared_state(acl_config, None, None, None)
+ }
+
+ /// Create a new ACL processor while preserving connection tracking and rate limiting state
+ /// This is useful for hot reloading where you want to preserve established connections
+ pub fn new_with_shared_state(
+ acl_config: Acl,
+ conn_track: Option>>,
+ rate_limiters: Option>>>,
+ stats: Option>>,
+ ) -> Self {
+ let (inbound_rules, outbound_rules, forward_rules) = Self::build_rules(&acl_config);
+ let (default_inbound_action, default_outbound_action, default_forward_action) =
+ Self::build_default_actions(&acl_config);
+ let tasks = JoinSet::new();
+
+ let mut processor = Self {
+ inbound_rules,
+ outbound_rules,
+ forward_rules,
+
+ default_inbound_action,
+ default_outbound_action,
+ default_forward_action,
+
+ default_rule_stats: Arc::new(RuleStats {
+ rule: None,
+ stat: Some(StatItem {
+ packet_count: 0,
+ byte_count: 0,
+ }),
+ }),
+ conn_track: conn_track.unwrap_or_else(|| Arc::new(DashMap::new())),
+ rate_limiters: rate_limiters.unwrap_or_else(|| Arc::new(DashMap::new())),
+ rule_cache: Arc::new(DashMap::new()), // Always start with fresh cache
+ cache_max_size: 10000, // Limit cache to 10k entries
+ cache_cleanup_interval: Duration::from_secs(20), // Cleanup every 5 minutes
+ stats: stats.unwrap_or_else(|| Arc::new(DashMap::new())),
+ tasks,
+ };
+
+ processor.start_cache_cleanup_task();
+ processor
+ }
+
+ fn build_default_actions(acl_config: &Acl) -> (Action, Action, Action) {
+ let default_inbound_action = acl_config
+ .acl_v1
+ .as_ref()
+ .and_then(|v1| {
+ v1.chains
+ .iter()
+ .find(|c| c.chain_type == ChainType::Inbound as i32)
+ })
+ .map(|c| c.default_action())
+ .unwrap_or(Action::Allow);
+
+ let default_outbound_action = acl_config
+ .acl_v1
+ .as_ref()
+ .and_then(|v1| {
+ v1.chains
+ .iter()
+ .find(|c| c.chain_type == ChainType::Outbound as i32)
+ })
+ .map(|c| c.default_action())
+ .unwrap_or(Action::Allow);
+
+ let default_forward_action = acl_config
+ .acl_v1
+ .as_ref()
+ .and_then(|v1| {
+ v1.chains
+ .iter()
+ .find(|c| c.chain_type == ChainType::Forward as i32)
+ })
+ .map(|c| c.default_action())
+ .unwrap_or(Action::Allow);
+
+ (
+ default_inbound_action,
+ default_outbound_action,
+ default_forward_action,
+ )
+ }
+
+ /// Build all rule vectors from configuration
+ fn build_rules(
+ acl_config: &Acl,
+ ) -> (
+ Vec,
+ Vec,
+ Vec,
+ ) {
+ let mut inbound_rules = Vec::new();
+ let mut outbound_rules = Vec::new();
+ let mut forward_rules = Vec::new();
+
+ // Build new rule vectors
+ if let Some(ref acl_v1) = acl_config.acl_v1 {
+ for chain in &acl_v1.chains {
+ if !chain.enabled {
+ continue;
+ }
+
+ let mut rules = chain
+ .rules
+ .iter()
+ .filter(|rule| rule.enabled)
+ .map(Self::convert_to_fast_lookup_rule)
+ .collect::>();
+
+ // Sort by priority (higher priority first)
+ rules.sort_by(|a, b| b.priority.cmp(&a.priority));
+
+ match chain.chain_type() {
+ ChainType::Inbound => inbound_rules.extend(rules),
+ ChainType::Outbound => outbound_rules.extend(rules),
+ ChainType::Forward => forward_rules.extend(rules),
+ _ => {}
+ }
+ }
+ }
+
+ tracing::info!(
+ "ACL rules built: {} inbound, {} outbound, {} forward",
+ inbound_rules.len(),
+ outbound_rules.len(),
+ forward_rules.len(),
+ );
+
+ (inbound_rules, outbound_rules, forward_rules)
+ }
+
+ /// Start periodic cache cleanup task
+ fn start_cache_cleanup_task(&mut self) {
+ let rule_cache = self.rule_cache.clone();
+ let cache_max_size = self.cache_max_size;
+ let cleanup_interval = self.cache_cleanup_interval;
+
+ self.tasks.spawn(async move {
+ let mut interval = tokio::time::interval(cleanup_interval);
+ loop {
+ interval.tick().await;
+ Self::cleanup_cache(&rule_cache, cache_max_size);
+ }
+ });
+
+ let conn_track = self.conn_track.clone();
+ self.tasks.spawn(async move {
+ let mut interval = tokio::time::interval(cleanup_interval);
+ loop {
+ interval.tick().await;
+ Self::cleanup_expired_connections(conn_track.clone(), 60);
+ }
+ });
+ }
+
+ /// Clean up cache using LRU strategy
+ fn cleanup_cache(cache: &DashMap, max_size: usize) {
+ let current_size = cache.len();
+ if current_size <= max_size {
+ return;
+ }
+
+ // Remove oldest entries (LRU cleanup)
+ let mut entries: Vec<(AclCacheKey, u64)> = cache
+ .iter()
+ .map(|entry| (entry.key().clone(), entry.value().last_access))
+ .collect();
+
+ // Sort by last_access (oldest first)
+ entries.sort_by_key(|(_, last_access)| *last_access);
+
+ // Remove oldest 20% of entries
+ let to_remove = current_size - max_size + (max_size / 5);
+ for (key, _) in entries.into_iter().take(to_remove) {
+ cache.remove(&key);
+ }
+
+ tracing::debug!(
+ "Cache cleanup completed: removed {} entries, current size: {}",
+ to_remove,
+ cache.len()
+ );
+ }
+
+ pub fn process_packet_with_cache_entry(
+ &self,
+ packet_info: &PacketInfo,
+ cache_entry: &AclCacheEntry,
+ ) -> AclResult {
+ for rate_limit_key in cache_entry.rate_limit_keys.iter() {
+ // bucket should already be created, so rate and burst are not important
+ if !self.check_rate_limit(rate_limit_key, 1, 1, false) {
+ return AclResult {
+ action: Action::Drop,
+ matched_rule: Some(cache_entry.matched_rule.clone()),
+ should_log: false,
+ log_context: Some(AclLogContext::RateLimitDrop),
+ };
+ }
+ }
+
+ if let Some(conn_track_key) = cache_entry.conn_track_key.as_ref() {
+ self.check_connection_state(conn_track_key, packet_info);
+ }
+
+ self.inc_cache_entry_stats(cache_entry, packet_info);
+
+ cache_entry.acl_result.clone().unwrap()
+ }
+
+ fn inc_cache_entry_stats(&self, cache_entry: &AclCacheEntry, packet_info: &PacketInfo) {
+ for rule_stats in cache_entry.rule_stats_vec.iter() {
+ // Use unsafe code to mutate the contents behind the Arc
+ let stat_ptr = rule_stats.stat.as_ref().unwrap() as *const StatItem as *mut StatItem;
+ unsafe {
+ (*stat_ptr).packet_count += 1;
+ (*stat_ptr).byte_count += packet_info.packet_size as u64;
+ }
+ }
+ }
+
+ pub fn get_rules_stats(&self) -> Vec {
+ let mut stats: Vec = Vec::new();
+ for rule in self.inbound_rules.iter() {
+ stats.push((*rule.rule_stats).clone());
+ }
+ for rule in self.outbound_rules.iter() {
+ stats.push((*rule.rule_stats).clone());
+ }
+ for rule in self.forward_rules.iter() {
+ stats.push((*rule.rule_stats).clone());
+ }
+ stats
+ }
+
+ /// Process a packet through ACL rules - Now lock-free!
+ pub fn process_packet(&self, packet_info: &PacketInfo, chain_type: ChainType) -> AclResult {
+ // Check cache first for performance
+ let cache_key = AclCacheKey::from_packet_info(packet_info, chain_type);
+
+ // If cache hit and can skip checks, return cached result
+ if let Some(mut cached) = self.rule_cache.get_mut(&cache_key) {
+ // Update last access time for LRU
+ cached.last_access = SystemTime::now()
+ .duration_since(UNIX_EPOCH)
+ .unwrap()
+ .as_secs();
+
+ self.increment_stat(AclStatKey::CacheHits);
+ return self.process_packet_with_cache_entry(packet_info, &cached);
+ }
+
+ // Direct access to rules - no locks needed!
+ let rules = match chain_type {
+ ChainType::Inbound => &self.inbound_rules,
+ ChainType::Outbound => &self.outbound_rules,
+ ChainType::Forward => &self.forward_rules,
+ _ => {
+ return AclResult {
+ action: Action::Drop,
+ matched_rule: Some(RuleId::Default),
+ should_log: false,
+ log_context: Some(AclLogContext::UnsupportedChainType),
+ }
+ }
+ };
+
+ let mut cache_entry = AclCacheEntry {
+ action: Action::Allow,
+ matched_rule: RuleId::Default,
+ last_access: SystemTime::now()
+ .duration_since(UNIX_EPOCH)
+ .unwrap()
+ .as_secs(),
+ conn_track_key: None,
+ rate_limit_keys: vec![],
+ chain_type,
+ acl_result: None,
+ rule_stats_vec: vec![],
+ };
+
+ // Process rules in priority order
+ for rule in rules.iter() {
+ if !rule.enabled || !self.rule_matches(rule, packet_info) {
+ continue;
+ }
+
+ // Check rate limiting if configured
+ if rule.rate_limit > 0 {
+ let rule_key = RateLimitKey::new(chain_type, rule.priority);
+ cache_entry.rate_limit_keys.push(rule_key.clone());
+ cache_entry.rule_stats_vec.push(rule.rule_stats.clone());
+ if !self.check_rate_limit(&rule_key, rule.rate_limit, rule.burst_limit, true) {
+ // rate limited, drop packet
+ return AclResult {
+ action: Action::Drop,
+ matched_rule: Some(RuleId::Priority(rule.priority)),
+ should_log: false,
+ log_context: Some(AclLogContext::RateLimitDrop),
+ };
+ }
+ }
+
+ // Handle stateful connections if configured
+ if rule.stateful && rule.action == Action::Allow {
+ let conn_track_key = self.conn_track_key(packet_info);
+ self.check_connection_state(&conn_track_key, packet_info);
+ cache_entry.rule_stats_vec.push(rule.rule_stats.clone());
+ cache_entry.matched_rule = RuleId::Stateful(rule.priority);
+ cache_entry.conn_track_key = Some(conn_track_key);
+ cache_entry.acl_result = Some(AclResult {
+ action: Action::Allow,
+ matched_rule: Some(RuleId::Stateful(rule.priority)),
+ should_log: false,
+ log_context: Some(AclLogContext::StatefulMatch {
+ src_ip: packet_info.src_ip,
+ dst_ip: packet_info.dst_ip,
+ }),
+ });
+ } else {
+ // Rule matched, return action
+ cache_entry.rule_stats_vec.push(rule.rule_stats.clone());
+ cache_entry.matched_rule = RuleId::Priority(rule.priority);
+ cache_entry.acl_result = Some(AclResult {
+ action: rule.action,
+ matched_rule: Some(RuleId::Priority(rule.priority)),
+ should_log: false,
+ log_context: Some(AclLogContext::RuleMatch {
+ src_ip: packet_info.src_ip,
+ dst_ip: packet_info.dst_ip,
+ action: rule.action,
+ }),
+ });
+ }
+
+ // Cache the result with rule info
+ self.increment_stat(AclStatKey::RuleMatches);
+ self.inc_cache_entry_stats(&cache_entry, packet_info);
+ self.cache_result(&cache_key, cache_entry.clone());
+ return cache_entry.acl_result.clone().unwrap();
+ }
+
+ let default_action = match chain_type {
+ ChainType::Inbound => self.default_inbound_action,
+ ChainType::Outbound => self.default_outbound_action,
+ ChainType::Forward => self.default_forward_action,
+ _ => Action::Allow,
+ };
+
+ // No rule matched, return default drop
+ if default_action == Action::Drop {
+ self.increment_stat(AclStatKey::DefaultDrops);
+ } else {
+ self.increment_stat(AclStatKey::DefaultAllows);
+ }
+
+ let log_context = if default_action == Action::Drop {
+ AclLogContext::DefaultDrop
+ } else {
+ AclLogContext::DefaultAllow
+ };
+
+ cache_entry
+ .rule_stats_vec
+ .push(self.default_rule_stats.clone());
+ cache_entry.matched_rule = RuleId::Default;
+ cache_entry.acl_result = Some(AclResult {
+ action: default_action,
+ matched_rule: Some(RuleId::Default),
+ should_log: false,
+ log_context: Some(log_context),
+ });
+
+ // Cache the default result (no rule info)
+ self.inc_cache_entry_stats(&cache_entry, packet_info);
+ self.cache_result(&cache_key, cache_entry.clone());
+ cache_entry.acl_result.clone().unwrap()
+ }
+
+ /// Get shared state for preserving across hot reloads
+ pub fn get_shared_state(&self) -> SharedState {
+ (
+ self.conn_track.clone(),
+ self.rate_limiters.clone(),
+ self.stats.clone(),
+ )
+ }
+
+ /// Cache an ACL result
+ fn cache_result(&self, cache_key: &AclCacheKey, cache_entry: AclCacheEntry) {
+ self.rule_cache.insert(cache_key.clone(), cache_entry);
+
+ // Trigger cleanup if cache is getting too large
+ if self.rule_cache.len() > self.cache_max_size * 2 {
+ let cache = self.rule_cache.clone();
+ let max_size = self.cache_max_size;
+ Self::cleanup_cache(&cache, max_size);
+ }
+ }
+
+ /// Check if a rule matches the packet
+ fn rule_matches(&self, rule: &FastLookupRule, packet_info: &PacketInfo) -> bool {
+ // Protocol check
+ if rule.protocol != Protocol::Any && rule.protocol as i32 != packet_info.protocol as i32 {
+ return false;
+ }
+
+ // Source IP check
+ if !rule.src_ip_ranges.is_empty() {
+ let matches = rule
+ .src_ip_ranges
+ .iter()
+ .any(|cidr| match (cidr, packet_info.src_ip) {
+ (cidr::IpCidr::V4(v4_cidr), IpAddr::V4(v4_addr)) => v4_cidr.contains(&v4_addr),
+ (cidr::IpCidr::V6(v6_cidr), IpAddr::V6(v6_addr)) => v6_cidr.contains(&v6_addr),
+ _ => false,
+ });
+ if !matches {
+ return false;
+ }
+ }
+
+ // Destination IP check
+ if !rule.dst_ip_ranges.is_empty() {
+ let matches = rule
+ .dst_ip_ranges
+ .iter()
+ .any(|cidr| match (cidr, packet_info.dst_ip) {
+ (cidr::IpCidr::V4(v4_cidr), IpAddr::V4(v4_addr)) => v4_cidr.contains(&v4_addr),
+ (cidr::IpCidr::V6(v6_cidr), IpAddr::V6(v6_addr)) => v6_cidr.contains(&v6_addr),
+ _ => false,
+ });
+ if !matches {
+ return false;
+ }
+ }
+
+ // Source port check
+ if let Some(src_port) = packet_info.src_port {
+ if !rule.src_port_ranges.is_empty() {
+ let matches = rule
+ .src_port_ranges
+ .iter()
+ .any(|(start, end)| src_port >= *start && src_port <= *end);
+ if !matches {
+ return false;
+ }
+ }
+ }
+
+ // Destination port check
+ if let Some(dst_port) = packet_info.dst_port {
+ if !rule.dst_port_ranges.is_empty() {
+ let matches = rule
+ .dst_port_ranges
+ .iter()
+ .any(|(start, end)| dst_port >= *start && dst_port <= *end);
+ if !matches {
+ return false;
+ }
+ }
+ }
+
+ true
+ }
+
+ fn conn_track_key(&self, packet_info: &PacketInfo) -> String {
+ format!(
+ "{}:{}->{}:{}",
+ packet_info.src_ip,
+ packet_info.src_port.unwrap_or(0),
+ packet_info.dst_ip,
+ packet_info.dst_port.unwrap_or(0)
+ )
+ }
+
+ /// Check connection state for stateful rules
+ fn check_connection_state(&self, conn_track_key: &str, packet_info: &PacketInfo) {
+ self.conn_track
+ .entry(conn_track_key.to_string())
+ .and_modify(|x| {
+ x.last_seen = SystemTime::now()
+ .duration_since(UNIX_EPOCH)
+ .unwrap()
+ .as_secs();
+ x.packet_count += 1;
+ x.byte_count += packet_info.packet_size as u64;
+ x.state = ConnState::Established as i32;
+ })
+ .or_insert_with(|| ConnTrackEntry {
+ src_addr: Some(
+ SocketAddr::new(packet_info.src_ip, packet_info.src_port.unwrap_or(0)).into(),
+ ),
+ dst_addr: Some(
+ SocketAddr::new(packet_info.dst_ip, packet_info.dst_port.unwrap_or(0)).into(),
+ ),
+ protocol: packet_info.protocol as i32,
+ state: ConnState::New as i32,
+ created_at: SystemTime::now()
+ .duration_since(UNIX_EPOCH)
+ .unwrap()
+ .as_secs(),
+ last_seen: SystemTime::now()
+ .duration_since(UNIX_EPOCH)
+ .unwrap()
+ .as_secs(),
+ packet_count: 1,
+ byte_count: packet_info.packet_size as u64,
+ });
+ }
+
+ /// Check rate limiting for a rule
+ fn check_rate_limit(
+ &self,
+ rule_key: &RateLimitKey,
+ rate: u32,
+ burst: u32,
+ allow_create: bool,
+ ) -> bool {
+ if rate == 0 {
+ return true; // No rate limiting
+ }
+
+ let bucket = self
+ .rate_limiters
+ .entry(rule_key.clone())
+ .or_insert_with(|| {
+ if !allow_create {
+ panic!("Rate limit bucket not found");
+ }
+ TokenBucket::new(burst as u64, rate as u64, Duration::from_millis(10))
+ })
+ .clone();
+
+ // Try to consume 1 token (1 packet)
+ bucket.try_consume(1)
+ }
+
+ /// Convert proto Rule to FastLookupRule
+ fn convert_to_fast_lookup_rule(rule: &Rule) -> FastLookupRule {
+ let src_ip_ranges = rule
+ .source_ips
+ .iter()
+ .filter_map(|x| Self::convert_ip_inet_to_cidr(x.as_str()))
+ .collect();
+
+ let dst_ip_ranges = rule
+ .destination_ips
+ .iter()
+ .filter_map(|x| Self::convert_ip_inet_to_cidr(x.as_str()))
+ .collect();
+
+ let src_port_ranges = rule
+ .source_ports
+ .iter()
+ .filter_map(|port_range| {
+ if let Some((start, end)) = parse_port_range(port_range) {
+ Some((start, end))
+ } else {
+ None
+ }
+ })
+ .collect();
+
+ let dst_port_ranges = rule
+ .ports
+ .iter()
+ .filter_map(|port_range| {
+ if let Some((start, end)) = parse_port_range(port_range) {
+ Some((start, end))
+ } else {
+ None
+ }
+ })
+ .collect();
+
+ FastLookupRule {
+ priority: rule.priority,
+ protocol: rule.protocol(),
+ src_ip_ranges,
+ dst_ip_ranges,
+ src_port_ranges,
+ dst_port_ranges,
+ action: rule.action(),
+ enabled: rule.enabled,
+ stateful: rule.stateful,
+ rate_limit: rule.rate_limit,
+ burst_limit: rule.burst_limit,
+ rule_stats: Arc::new(RuleStats {
+ rule: Some(rule.clone()),
+ stat: Some(StatItem {
+ packet_count: 0,
+ byte_count: 0,
+ }),
+ }),
+ }
+ }
+
+ /// Convert IpInet to CIDR for fast lookup
+ fn convert_ip_inet_to_cidr(input: &str) -> Option {
+ cidr::IpCidr::from_str(input).ok()
+ }
+
+ /// Increment statistics counter
+ pub fn increment_stat(&self, key: AclStatKey) {
+ self.stats
+ .entry(key)
+ .and_modify(|counter| *counter += 1)
+ .or_insert(1);
+ }
+
+ /// Get statistics
+ pub fn get_stats(&self) -> HashMap {
+ let mut stats = self
+ .stats
+ .iter()
+ .map(|entry| (entry.key().as_str(), *entry.value()))
+ .collect::>();
+
+ // Add cache statistics using enum keys
+ stats.insert(AclStatKey::CacheSize.as_str(), self.rule_cache.len() as u64);
+ stats.insert(
+ AclStatKey::CacheMaxSize.as_str(),
+ self.cache_max_size as u64,
+ );
+
+ stats
+ }
+
+ /// Clean up expired connection tracking entries
+ pub fn cleanup_expired_connections(
+ conn_track: Arc>,
+ timeout_secs: u64,
+ ) {
+ let current_time = SystemTime::now()
+ .duration_since(UNIX_EPOCH)
+ .unwrap()
+ .as_secs();
+ let keys_to_remove: Vec = conn_track
+ .iter()
+ .filter_map(|entry| {
+ if current_time - entry.last_seen > timeout_secs {
+ Some(entry.key().clone())
+ } else {
+ None
+ }
+ })
+ .collect();
+
+ for key in keys_to_remove {
+ conn_track.remove(&key);
+ }
+ }
+
+ /// Get cache hit rate
+ pub fn get_cache_hit_rate(&self) -> f64 {
+ let cache_hits = self
+ .stats
+ .get(&AclStatKey::CacheHits)
+ .map(|v| *v.value())
+ .unwrap_or(0);
+ let total_requests = cache_hits
+ + self
+ .stats
+ .get(&AclStatKey::RuleMatches)
+ .map(|v| *v.value())
+ .unwrap_or(0);
+
+ if total_requests == 0 {
+ 0.0
+ } else {
+ cache_hits as f64 / total_requests as f64
+ }
+ }
+}
+
+// 新增辅助函数
+fn parse_port_start(port_strs: &[String]) -> Option {
+ port_strs
+ .iter()
+ .filter_map(|s| parse_port_range(s).map(|(start, _)| start))
+ .min()
+}
+fn parse_port_end(port_strs: &[String]) -> Option {
+ port_strs
+ .iter()
+ .filter_map(|s| parse_port_range(s).map(|(_, end)| end))
+ .max()
+}
+fn parse_port_range(s: &str) -> Option<(u16, u16)> {
+ if let Some((start, end)) = s.split_once('-') {
+ let start = start.trim().parse().ok()?;
+ let end = end.trim().parse().ok()?;
+ Some((start, end))
+ } else {
+ let port = s.trim().parse().ok()?;
+ Some((port, port))
+ }
+}
+
+// Statistics key enum for better performance
+#[derive(Debug, Clone, Hash, PartialEq, Eq)]
+pub enum AclStatKey {
+ // Cache statistics
+ CacheHits,
+ CacheSize,
+ CacheMaxSize,
+ RuleMatches,
+ DefaultAllows,
+ DefaultDrops,
+
+ // Global packet statistics
+ PacketsTotal,
+ PacketsAllowed,
+ PacketsDropped,
+ PacketsNoop,
+
+ // Per-chain statistics
+ InboundPacketsTotal,
+ InboundPacketsAllowed,
+ InboundPacketsDropped,
+ InboundPacketsNoop,
+
+ OutboundPacketsTotal,
+ OutboundPacketsAllowed,
+ OutboundPacketsDropped,
+ OutboundPacketsNoop,
+
+ ForwardPacketsTotal,
+ ForwardPacketsAllowed,
+ ForwardPacketsDropped,
+ ForwardPacketsNoop,
+
+ UnknownPacketsTotal,
+ UnknownPacketsAllowed,
+ UnknownPacketsDropped,
+ UnknownPacketsNoop,
+}
+
+impl AclStatKey {
+ pub fn as_str(&self) -> String {
+ format!("{:?}", self)
+ }
+
+ pub fn from_chain_and_action(chain_type: ChainType, stat_type: AclStatType) -> Self {
+ match (chain_type, stat_type) {
+ (ChainType::Inbound, AclStatType::Total) => AclStatKey::InboundPacketsTotal,
+ (ChainType::Inbound, AclStatType::Allowed) => AclStatKey::InboundPacketsAllowed,
+ (ChainType::Inbound, AclStatType::Dropped) => AclStatKey::InboundPacketsDropped,
+ (ChainType::Inbound, AclStatType::Noop) => AclStatKey::InboundPacketsNoop,
+
+ (ChainType::Outbound, AclStatType::Total) => AclStatKey::OutboundPacketsTotal,
+ (ChainType::Outbound, AclStatType::Allowed) => AclStatKey::OutboundPacketsAllowed,
+ (ChainType::Outbound, AclStatType::Dropped) => AclStatKey::OutboundPacketsDropped,
+ (ChainType::Outbound, AclStatType::Noop) => AclStatKey::OutboundPacketsNoop,
+
+ (ChainType::Forward, AclStatType::Total) => AclStatKey::ForwardPacketsTotal,
+ (ChainType::Forward, AclStatType::Allowed) => AclStatKey::ForwardPacketsAllowed,
+ (ChainType::Forward, AclStatType::Dropped) => AclStatKey::ForwardPacketsDropped,
+ (ChainType::Forward, AclStatType::Noop) => AclStatKey::ForwardPacketsNoop,
+
+ (_, AclStatType::Total) => AclStatKey::UnknownPacketsTotal,
+ (_, AclStatType::Allowed) => AclStatKey::UnknownPacketsAllowed,
+ (_, AclStatType::Dropped) => AclStatKey::UnknownPacketsDropped,
+ (_, AclStatType::Noop) => AclStatKey::UnknownPacketsNoop,
+ }
+ }
+}
+
+pub struct AclRuleBuilder {
+ pub acl: Option,
+ pub tcp_whitelist: Vec,
+ pub udp_whitelist: Vec,
+ pub whitelist_priority: Option,
+}
+
+impl AclRuleBuilder {
+ fn parse_port_list(port_list: &[String]) -> anyhow::Result> {
+ let mut ports = Vec::new();
+
+ for port_spec in port_list {
+ if port_spec.contains('-') {
+ // Handle port range like "8000-9000"
+ let parts: Vec<&str> = port_spec.split('-').collect();
+ if parts.len() != 2 {
+ return Err(anyhow::anyhow!("Invalid port range format: {}", port_spec));
+ }
+
+ let start: u16 = parts[0]
+ .parse()
+ .with_context(|| format!("Invalid start port in range: {}", port_spec))?;
+ let end: u16 = parts[1]
+ .parse()
+ .with_context(|| format!("Invalid end port in range: {}", port_spec))?;
+
+ if start > end {
+ return Err(anyhow::anyhow!(
+ "Start port must be <= end port in range: {}",
+ port_spec
+ ));
+ }
+
+ // acl can handle port range
+ ports.push(port_spec.clone());
+ } else {
+ // Handle single port
+ let port: u16 = port_spec
+ .parse()
+ .with_context(|| format!("Invalid port number: {}", port_spec))?;
+ ports.push(port.to_string());
+ }
+ }
+
+ Ok(ports)
+ }
+
+ fn generate_acl_from_whitelists(&mut self) -> anyhow::Result<()> {
+ if self.tcp_whitelist.is_empty() && self.udp_whitelist.is_empty() {
+ return Ok(());
+ }
+
+ // Create inbound chain for whitelist rules
+ let mut inbound_chain = Chain {
+ name: "inbound_whitelist".to_string(),
+ chain_type: ChainType::Inbound as i32,
+ description: "Auto-generated inbound whitelist from CLI".to_string(),
+ enabled: true,
+ rules: vec![],
+ default_action: Action::Drop as i32, // Default deny
+ };
+
+ let mut rule_priority = self.whitelist_priority.unwrap_or(1000u32);
+
+ // Add TCP whitelist rules
+ if !self.tcp_whitelist.is_empty() {
+ let tcp_ports = Self::parse_port_list(&self.tcp_whitelist)?;
+ let tcp_rule = Rule {
+ name: "tcp_whitelist".to_string(),
+ description: "Auto-generated TCP whitelist rule".to_string(),
+ priority: rule_priority,
+ enabled: true,
+ protocol: Protocol::Tcp as i32,
+ ports: tcp_ports,
+ source_ips: vec![],
+ destination_ips: vec![],
+ source_ports: vec![],
+ action: Action::Allow as i32,
+ rate_limit: 0,
+ burst_limit: 0,
+ stateful: true,
+ };
+ inbound_chain.rules.push(tcp_rule);
+ rule_priority -= 1;
+ }
+
+ // Add UDP whitelist rules
+ if !self.udp_whitelist.is_empty() {
+ let udp_ports = Self::parse_port_list(&self.udp_whitelist)?;
+ let udp_rule = Rule {
+ name: "udp_whitelist".to_string(),
+ description: "Auto-generated UDP whitelist rule".to_string(),
+ priority: rule_priority,
+ enabled: true,
+ protocol: Protocol::Udp as i32,
+ ports: udp_ports,
+ source_ips: vec![],
+ destination_ips: vec![],
+ source_ports: vec![],
+ action: Action::Allow as i32,
+ rate_limit: 0,
+ burst_limit: 0,
+ stateful: false,
+ };
+ inbound_chain.rules.push(udp_rule);
+ }
+
+ if self.acl.is_none() {
+ self.acl = Some(Acl::default());
+ }
+
+ let acl = self.acl.as_mut().unwrap();
+
+ if let Some(ref mut acl_v1) = acl.acl_v1 {
+ acl_v1.chains.push(inbound_chain);
+ } else {
+ acl.acl_v1 = Some(AclV1 {
+ chains: vec![inbound_chain],
+ });
+ }
+
+ Ok(())
+ }
+
+ fn do_build(mut self) -> anyhow::Result> {
+ self.generate_acl_from_whitelists()?;
+ Ok(self.acl.clone())
+ }
+
+ pub fn build(global_ctx: &ArcGlobalCtx) -> anyhow::Result> {
+ let builder = AclRuleBuilder {
+ acl: global_ctx.config.get_acl(),
+ tcp_whitelist: global_ctx.config.get_tcp_whitelist(),
+ udp_whitelist: global_ctx.config.get_udp_whitelist(),
+ whitelist_priority: None,
+ };
+ builder.do_build()
+ }
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum AclStatType {
+ Total,
+ Allowed,
+ Dropped,
+ Noop,
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use std::hash::{Hash, Hasher};
+ use std::net::{IpAddr, Ipv4Addr};
+
+ fn create_test_acl_config() -> Acl {
+ let mut acl_config = Acl::default();
+
+ let mut acl_v1 = AclV1::default();
+
+ // Create inbound chain
+ let mut chain = Chain {
+ name: "test_inbound".to_string(),
+ chain_type: ChainType::Inbound as i32,
+ enabled: true,
+ ..Default::default()
+ };
+
+ // Allow all rule
+ let rule = Rule {
+ name: "allow_all".to_string(),
+ priority: 100,
+ enabled: true,
+ action: Action::Allow as i32,
+ protocol: Protocol::Any as i32,
+ ..Default::default()
+ };
+
+ chain.rules.push(rule);
+ acl_v1.chains.push(chain);
+ acl_config.acl_v1 = Some(acl_v1);
+
+ acl_config
+ }
+
+ fn create_test_packet_info() -> PacketInfo {
+ PacketInfo {
+ src_ip: IpAddr::V4(Ipv4Addr::new(192, 168, 1, 100)),
+ dst_ip: IpAddr::V4(Ipv4Addr::new(10, 0, 0, 1)),
+ src_port: Some(12345),
+ dst_port: Some(80),
+ protocol: Protocol::Tcp,
+ packet_size: 1024,
+ }
+ }
+
+ #[test]
+ fn test_acl_cache_key_creation() {
+ let packet_info = create_test_packet_info();
+ let cache_key = AclCacheKey::from_packet_info(&packet_info, ChainType::Inbound);
+
+ assert_eq!(cache_key.chain_type, ChainType::Inbound);
+ assert_eq!(cache_key.protocol, Protocol::Tcp);
+ assert_eq!(
+ cache_key.src_ip,
+ IpAddr::V4(Ipv4Addr::new(192, 168, 1, 100))
+ );
+ assert_eq!(cache_key.dst_ip, IpAddr::V4(Ipv4Addr::new(10, 0, 0, 1)));
+ assert_eq!(cache_key.src_port, 12345);
+ assert_eq!(cache_key.dst_port, 80);
+ }
+
+ #[test]
+ fn test_acl_cache_key_equality() {
+ let packet_info1 = create_test_packet_info();
+ let packet_info2 = create_test_packet_info();
+
+ let key1 = AclCacheKey::from_packet_info(&packet_info1, ChainType::Inbound);
+ let key2 = AclCacheKey::from_packet_info(&packet_info2, ChainType::Inbound);
+
+ assert_eq!(key1, key2);
+
+ // Test hash consistency
+ use std::collections::hash_map::DefaultHasher;
+ let mut hasher1 = DefaultHasher::new();
+ let mut hasher2 = DefaultHasher::new();
+ key1.hash(&mut hasher1);
+ key2.hash(&mut hasher2);
+ assert_eq!(hasher1.finish(), hasher2.finish());
+ }
+
+ #[tokio::test]
+ async fn test_acl_processor_basic_functionality() {
+ let acl_config = create_test_acl_config();
+ let processor = AclProcessor::new(acl_config);
+ let packet_info = create_test_packet_info();
+
+ let result = processor.process_packet(&packet_info, ChainType::Inbound);
+
+ assert_eq!(result.action, Action::Allow);
+ assert!(result.matched_rule.is_some());
+ }
+
+ #[tokio::test]
+ async fn test_acl_cache_hit() {
+ let acl_config = create_test_acl_config();
+ let processor = AclProcessor::new(acl_config);
+ let packet_info = create_test_packet_info();
+
+ // First request - should be a cache miss
+ let result1 = processor.process_packet(&packet_info, ChainType::Inbound);
+
+ // Second request - should be a cache hit
+ let result2 = processor.process_packet(&packet_info, ChainType::Inbound);
+
+ assert_eq!(result1.action, result2.action);
+ assert_eq!(result1.matched_rule, result2.matched_rule);
+
+ // Check cache statistics
+ let stats = processor.get_stats();
+ assert_eq!(stats.get(&AclStatKey::CacheHits.as_str()).unwrap_or(&0), &1);
+ assert!(processor.get_cache_hit_rate() > 0.0);
+ }
+
+ #[tokio::test]
+ async fn test_lock_free_hot_reload_demo() {
+ println!("\n=== ACL 优化演示：无锁热加载 ===");
+
+ // 创建初始配置
+ let initial_config = create_test_acl_config();
+ let processor = AclProcessor::new(initial_config);
+ let packet_info = create_test_packet_info();
+
+ // 处理一些数据包
+ println!("1. 处理初始数据包...");
+ let result1 = processor.process_packet(&packet_info, ChainType::Inbound);
+ assert_eq!(result1.action, Action::Allow);
+ println!(" ✓ 数据包被允许通过");
+
+ // 获取共享状态
+ let (conn_track, rate_limiters, stats) = processor.get_shared_state();
+ println!("2. 保存连接跟踪和统计状态...");
+ println!(" ✓ 连接数: {}", conn_track.len());
+ println!(" ✓ 限流器数量: {}", rate_limiters.len());
+ println!(" ✓ 统计计数器数量: {}", stats.len());
+
+ // 创建新配置（模拟热加载）
+ let mut new_config = create_test_acl_config();
+ if let Some(ref mut acl_v1) = new_config.acl_v1 {
+ let drop_rule = Rule {
+ name: "drop_all".to_string(),
+ priority: 200,
+ enabled: true,
+ action: Action::Drop as i32,
+ protocol: Protocol::Any as i32,
+ ..Default::default()
+ };
+ acl_v1.chains[0].rules.push(drop_rule);
+ }
+
+ // 创建新的处理器实例（热加载）
+ println!("3. 执行热加载（创建新的处理器实例）...");
+ let new_processor = AclProcessor::new_with_shared_state(
+ new_config,
+ Some(conn_track.clone()),
+ Some(rate_limiters.clone()),
+ Some(stats.clone()),
+ );
+
+ // 验证新处理器的行为
+ let result2 = new_processor.process_packet(&packet_info, ChainType::Inbound);
+ assert_eq!(result2.action, Action::Drop); // 新规则应该拒绝
+ println!(" ✓ 新规则生效：数据包被拒绝");
+
+ // 验证状态被保留
+ let (new_conn_track, new_rate_limiters, new_stats) = new_processor.get_shared_state();
+ assert!(Arc::ptr_eq(&conn_track, &new_conn_track));
+ assert!(Arc::ptr_eq(&rate_limiters, &new_rate_limiters));
+ assert!(Arc::ptr_eq(&stats, &new_stats));
+ println!(" ✓ 连接状态和统计信息被完整保留");
+
+ println!("\n=== 性能优化效果 ===");
+ println!("✓ 无锁访问：处理器内部不再有任何锁");
+ println!("✓ 零拷贝：规则访问直接引用，无需克隆Arc");
+ println!("✓ 热加载：创建新实例替换，保留所有状态");
+ println!("✓ 内存效率：消除了多层Arc包装的开销");
+ }
+
+ #[tokio::test]
+ async fn test_performance_and_security_balance() {
+ // Create ACL config with different rule types
+ let mut acl_config = Acl::default();
+
+ let mut acl_v1 = AclV1::default();
+ let mut chain = Chain {
+ name: "performance_test".to_string(),
+ chain_type: ChainType::Inbound as i32,
+ enabled: true,
+ ..Default::default()
+ };
+
+ // 1. High-priority simple rule for UDP (can be cached efficiently)
+ let simple_rule = Rule {
+ name: "simple_udp".to_string(),
+ priority: 300,
+ enabled: true,
+ action: Action::Allow as i32,
+ protocol: Protocol::Udp as i32,
+ ..Default::default()
+ };
+ // No stateful or rate limit - can benefit from full cache optimization
+ chain.rules.push(simple_rule);
+
+ // 2. Medium-priority stateful + rate-limited rule for TCP (security critical)
+ let security_rule = Rule {
+ name: "security_tcp".to_string(),
+ priority: 200,
+ enabled: true,
+ action: Action::Allow as i32,
+ protocol: Protocol::Tcp as i32,
+ stateful: true,
+ rate_limit: 100,
+ burst_limit: 200,
+ ..Default::default()
+ };
+ chain.rules.push(security_rule);
+
+ // 3. Low-priority default allow rule for Any
+ let default_rule = Rule {
+ name: "default_allow".to_string(),
+ priority: 100,
+ enabled: true,
+ action: Action::Allow as i32,
+ protocol: Protocol::Any as i32,
+ ..Default::default()
+ };
+ chain.rules.push(default_rule);
+
+ acl_v1.chains.push(chain);
+ acl_config.acl_v1 = Some(acl_v1);
+
+ let processor = AclProcessor::new(acl_config);
+
+ // Test simple UDP packet (should hit high-priority simple rule and be cached)
+ let udp_packet = PacketInfo {
+ src_ip: IpAddr::V4(Ipv4Addr::new(192, 168, 1, 100)),
+ dst_ip: IpAddr::V4(Ipv4Addr::new(10, 0, 0, 1)),
+ src_port: Some(12345),
+ dst_port: Some(53), // DNS
+ protocol: Protocol::Udp, // UDP
+ packet_size: 512,
+ };
+
+ // Test TCP packet (should hit stateful+rate-limited rule)
+ let tcp_packet = PacketInfo {
+ src_ip: IpAddr::V4(Ipv4Addr::new(192, 168, 1, 100)),
+ dst_ip: IpAddr::V4(Ipv4Addr::new(10, 0, 0, 1)),
+ src_port: Some(12345),
+ dst_port: Some(80), // HTTP
+ protocol: Protocol::Tcp, // TCP
+ packet_size: 1024,
+ };
+
+ // Process UDP packets multiple times
+ println!("\n=== Performance Test Results ===");
+ for i in 1..=5 {
+ let result = processor.process_packet(&udp_packet, ChainType::Inbound);
+ assert_eq!(result.action, Action::Allow);
+ // UDP packets should match the highest priority rule that applies
+ // Since all rules allow "Any" protocol, UDP will match the highest priority one
+ println!(
+ "UDP packet {}: Allowed by rule (priority {:?})",
+ i, result.matched_rule
+ );
+ }
+
+ // Process TCP packets multiple times (stateful + rate limited)
+ for i in 1..=3 {
+ let result = processor.process_packet(&tcp_packet, ChainType::Inbound);
+ println!(
+ "TCP packet {}: {:?} by rule (priority {:?})",
+ i, result.action, result.matched_rule
+ );
+ }
+
+ let stats = processor.get_stats();
+ println!("\nStatistics:");
+ println!(
+ " Cache hits: {}",
+ stats.get(&AclStatKey::CacheHits.as_str()).unwrap_or(&0)
+ );
+ println!(
+ " Rule matches: {}",
+ stats.get(&AclStatKey::RuleMatches.as_str()).unwrap_or(&0)
+ );
+ println!(
+ " Cache hit rate: {:.1}%",
+ processor.get_cache_hit_rate() * 100.0
+ );
+
+ println!("\n✓ Stateful + rate-limited rules: Always processed for security");
+ println!("✓ Simple rules: Cached for performance");
+ println!(
+ "✓ Cache hit rate: {:.1}%",
+ processor.get_cache_hit_rate() * 100.0
+ );
+ }
+
+ #[test]
+ fn test_rate_limit_drop_log_context() {
+ // Test that RateLimitDrop log context is properly created
+ let context = AclLogContext::RateLimitDrop;
+ let message = context.to_message();
+ assert_eq!(message, "Rate limit drop");
+ }
+
+ #[tokio::test]
+ async fn test_rate_limit_drop_behavior() {
+ let mut acl_config = create_test_acl_config();
+
+ // Create a very restrictive rate-limited rule
+ if let Some(ref mut acl_v1) = acl_config.acl_v1 {
+ let rule = Rule {
+ name: "strict_rate_limit".to_string(),
+ priority: 200,
+ enabled: true,
+ action: Action::Allow as i32,
+ protocol: Protocol::Any as i32,
+ rate_limit: 1, // Allow only 1 packet per second
+ burst_limit: 1, // Burst of 1 packet
+ ..Default::default()
+ };
+ acl_v1.chains[0].rules.push(rule);
+ }
+
+ let processor = AclProcessor::new(acl_config);
+ let packet_info = create_test_packet_info();
+
+ // First request should be allowed
+ let result1 = processor.process_packet(&packet_info, ChainType::Inbound);
+ assert_eq!(result1.action, Action::Allow);
+ assert_eq!(result1.matched_rule, Some(RuleId::Priority(200)));
+
+ // Second request should be rate limited and dropped immediately
+ let result2 = processor.process_packet(&packet_info, ChainType::Inbound);
+ assert_eq!(result2.action, Action::Drop);
+ assert_eq!(result2.matched_rule, Some(RuleId::Priority(200)));
+ assert!(!result2.should_log);
+
+ // Verify the specific log context
+ assert!(matches!(
+ result2.log_context,
+ Some(AclLogContext::RateLimitDrop)
+ ));
+ }
+}
diff --git a/easytier/src/common/compressor.rs b/easytier/src/common/compressor.rs
index 7366378a9..6e8d0143a 100644
--- a/easytier/src/common/compressor.rs
+++ b/easytier/src/common/compressor.rs
@@ -21,6 +21,12 @@ pub trait Compressor {
pub struct DefaultCompressor {}
+impl Default for DefaultCompressor {
+ fn default() -> Self {
+ Self::new()
+ }
+}
+
impl DefaultCompressor {
pub fn new() -> Self {
DefaultCompressor {}
@@ -195,11 +201,11 @@ pub mod tests {
packet,
packet.payload_len()
);
- assert_eq!(packet.peer_manager_header().unwrap().is_compressed(), true);
+ assert!(packet.peer_manager_header().unwrap().is_compressed());
compressor.decompress(&mut packet).await.unwrap();
assert_eq!(packet.payload(), text);
- assert_eq!(packet.peer_manager_header().unwrap().is_compressed(), false);
+ assert!(!packet.peer_manager_header().unwrap().is_compressed());
}
#[tokio::test]
@@ -215,10 +221,10 @@ pub mod tests {
.compress(&mut packet, CompressorAlgo::ZstdDefault)
.await
.unwrap();
- assert_eq!(packet.peer_manager_header().unwrap().is_compressed(), false);
+ assert!(!packet.peer_manager_header().unwrap().is_compressed());
compressor.decompress(&mut packet).await.unwrap();
assert_eq!(packet.payload(), text);
- assert_eq!(packet.peer_manager_header().unwrap().is_compressed(), false);
+ assert!(!packet.peer_manager_header().unwrap().is_compressed());
}
}
diff --git a/easytier/src/common/config.rs b/easytier/src/common/config.rs
index 1c1e8bf12..07f78945d 100644
--- a/easytier/src/common/config.rs
+++ b/easytier/src/common/config.rs
@@ -1,5 +1,6 @@
use std::{
- net::{Ipv4Addr, SocketAddr},
+ hash::Hasher,
+ net::{IpAddr, SocketAddr},
path::PathBuf,
sync::{Arc, Mutex},
u64,
@@ -10,7 +11,10 @@ use cidr::IpCidr;
use serde::{Deserialize, Serialize};
use crate::{
- proto::common::{CompressionAlgoPb, PortForwardConfigPb, SocketType},
+ proto::{
+ acl::Acl,
+ common::{CompressionAlgoPb, PortForwardConfigPb, SocketType},
+ },
tunnel::generate_digest_from_str,
};
@@ -37,15 +41,87 @@ pub fn gen_default_flags() -> Flags {
bind_device: true,
enable_kcp_proxy: false,
disable_kcp_input: false,
- disable_relay_kcp: true,
+ disable_relay_kcp: false,
+ enable_relay_foreign_network_kcp: false,
accept_dns: false,
private_mode: false,
enable_quic_proxy: false,
disable_quic_input: false,
foreign_relay_bps_limit: u64::MAX,
+ multi_thread_count: 2,
+ encryption_algorithm: "aes-gcm".to_string(),
}
}
+pub enum EncryptionAlgorithm {
+ AesGcm,
+ Aes256Gcm,
+ Xor,
+ #[cfg(feature = "wireguard")]
+ ChaCha20,
+
+ #[cfg(feature = "openssl-crypto")]
+ OpensslAesGcm,
+ #[cfg(feature = "openssl-crypto")]
+ OpensslChacha20,
+ #[cfg(feature = "openssl-crypto")]
+ OpensslAes256Gcm,
+}
+
+impl std::fmt::Display for EncryptionAlgorithm {
+ fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+ match self {
+ Self::AesGcm => write!(f, "aes-gcm"),
+ Self::Aes256Gcm => write!(f, "aes-256-gcm"),
+ Self::Xor => write!(f, "xor"),
+ #[cfg(feature = "wireguard")]
+ Self::ChaCha20 => write!(f, "chacha20"),
+ #[cfg(feature = "openssl-crypto")]
+ Self::OpensslAesGcm => write!(f, "openssl-aes-gcm"),
+ #[cfg(feature = "openssl-crypto")]
+ Self::OpensslChacha20 => write!(f, "openssl-chacha20"),
+ #[cfg(feature = "openssl-crypto")]
+ Self::OpensslAes256Gcm => write!(f, "openssl-aes-256-gcm"),
+ }
+ }
+}
+
+impl TryFrom<&str> for EncryptionAlgorithm {
+ type Error = anyhow::Error;
+
+ fn try_from(value: &str) -> Result {
+ match value {
+ "aes-gcm" => Ok(Self::AesGcm),
+ "aes-256-gcm" => Ok(Self::Aes256Gcm),
+ "xor" => Ok(Self::Xor),
+ #[cfg(feature = "wireguard")]
+ "chacha20" => Ok(Self::ChaCha20),
+ #[cfg(feature = "openssl-crypto")]
+ "openssl-aes-gcm" => Ok(Self::OpensslAesGcm),
+ #[cfg(feature = "openssl-crypto")]
+ "openssl-chacha20" => Ok(Self::OpensslChacha20),
+ #[cfg(feature = "openssl-crypto")]
+ "openssl-aes-256-gcm" => Ok(Self::OpensslAes256Gcm),
+ _ => Err(anyhow::anyhow!("invalid encryption algorithm")),
+ }
+ }
+}
+
+pub fn get_avaliable_encrypt_methods() -> Vec<&'static str> {
+ let mut r = vec!["aes-gcm", "aes-256-gcm", "xor"];
+ if cfg!(feature = "wireguard") {
+ r.push("chacha20");
+ }
+ if cfg!(feature = "openssl-crypto") {
+ r.extend(vec![
+ "openssl-aes-gcm",
+ "openssl-chacha20",
+ "openssl-aes-256-gcm",
+ ]);
+ }
+ r
+}
+
#[auto_impl::auto_impl(Box, &)]
pub trait ConfigLoader: Send + Sync {
fn get_id(&self) -> uuid::Uuid;
@@ -63,10 +139,17 @@ pub trait ConfigLoader: Send + Sync {
fn get_ipv4(&self) -> Option;
fn set_ipv4(&self, addr: Option);
+ fn get_ipv6(&self) -> Option;
+ fn set_ipv6(&self, addr: Option);
+
fn get_dhcp(&self) -> bool;
fn set_dhcp(&self, dhcp: bool);
- fn add_proxy_cidr(&self, cidr: cidr::Ipv4Cidr, mapped_cidr: Option);
+ fn add_proxy_cidr(
+ &self,
+ cidr: cidr::Ipv4Cidr,
+ mapped_cidr: Option,
+ ) -> Result<(), anyhow::Error>;
fn remove_proxy_cidr(&self, cidr: cidr::Ipv4Cidr);
fn get_proxy_cidrs(&self) -> Vec;
@@ -96,8 +179,8 @@ pub trait ConfigLoader: Send + Sync {
fn get_flags(&self) -> Flags;
fn set_flags(&self, flags: Flags);
- fn get_exit_nodes(&self) -> Vec;
- fn set_exit_nodes(&self, nodes: Vec);
+ fn get_exit_nodes(&self) -> Vec;
+ fn set_exit_nodes(&self, nodes: Vec);
fn get_routes(&self) -> Option>;
fn set_routes(&self, routes: Option>);
@@ -108,6 +191,15 @@ pub trait ConfigLoader: Send + Sync {
fn get_port_forwards(&self) -> Vec;
fn set_port_forwards(&self, forwards: Vec);
+ fn get_acl(&self) -> Option;
+ fn set_acl(&self, acl: Option);
+
+ fn get_tcp_whitelist(&self) -> Vec;
+ fn set_tcp_whitelist(&self, whitelist: Vec);
+
+ fn get_udp_whitelist(&self) -> Vec;
+ fn set_udp_whitelist(&self, whitelist: Vec);
+
fn dump(&self) -> String;
}
@@ -119,7 +211,7 @@ pub trait LoggingConfigLoader {
pub type NetworkSecretDigest = [u8; 32];
-#[derive(Debug, Clone, Deserialize, Serialize, Default, Eq, Hash)]
+#[derive(Debug, Clone, Deserialize, Serialize)]
pub struct NetworkIdentity {
pub network_name: String,
pub network_secret: Option,
@@ -127,27 +219,53 @@ pub struct NetworkIdentity {
pub network_secret_digest: Option,
}
-impl PartialEq for NetworkIdentity {
- fn eq(&self, other: &Self) -> bool {
- if self.network_name != other.network_name {
- return false;
- }
+#[derive(Eq, PartialEq, Hash)]
+struct NetworkIdentityWithOnlyDigest {
+ network_name: String,
+ network_secret_digest: Option,
+}
- if self.network_secret.is_some()
- && other.network_secret.is_some()
- && self.network_secret != other.network_secret
- {
- return false;
+impl From for NetworkIdentityWithOnlyDigest {
+ fn from(identity: NetworkIdentity) -> Self {
+ if identity.network_secret_digest.is_some() {
+ Self {
+ network_name: identity.network_name,
+ network_secret_digest: identity.network_secret_digest,
+ }
+ } else if identity.network_secret.is_some() {
+ let mut network_secret_digest = [0u8; 32];
+ generate_digest_from_str(
+ &identity.network_name,
+ identity.network_secret.as_ref().unwrap(),
+ &mut network_secret_digest,
+ );
+ Self {
+ network_name: identity.network_name,
+ network_secret_digest: Some(network_secret_digest),
+ }
+ } else {
+ Self {
+ network_name: identity.network_name,
+ network_secret_digest: None,
+ }
}
+ }
+}
- if self.network_secret_digest.is_some()
- && other.network_secret_digest.is_some()
- && self.network_secret_digest != other.network_secret_digest
- {
- return false;
- }
+impl PartialEq for NetworkIdentity {
+ fn eq(&self, other: &Self) -> bool {
+ let self_with_digest = NetworkIdentityWithOnlyDigest::from(self.clone());
+ let other_with_digest = NetworkIdentityWithOnlyDigest::from(other.clone());
+ self_with_digest == other_with_digest
+ }
+}
+
+impl Eq for NetworkIdentity {}
- return true;
+impl std::hash::Hash for NetworkIdentity {
+ fn hash(&self, state: &mut H) {
+ let self_with_digest = NetworkIdentityWithOnlyDigest::from(self.clone());
+ self_with_digest.hash(state);
}
}
@@ -162,8 +280,10 @@ impl NetworkIdentity {
network_secret_digest: Some(network_secret_digest),
}
}
+}
- pub fn default() -> Self {
+impl Default for NetworkIdentity {
+ fn default() -> Self {
Self::new("default".to_string(), "".to_string())
}
}
@@ -216,7 +336,7 @@ pub struct VpnPortalConfig {
pub wireguard_listen: SocketAddr,
}
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq)]
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq, Hash)]
pub struct PortForwardConfig {
pub bind_addr: SocketAddr,
pub dst_addr: SocketAddr,
@@ -237,12 +357,12 @@ impl From for PortForwardConfig {
}
}
-impl Into for PortForwardConfig {
- fn into(self) -> PortForwardConfigPb {
+impl From for PortForwardConfigPb {
+ fn from(val: PortForwardConfig) -> Self {
PortForwardConfigPb {
- bind_addr: Some(self.bind_addr.into()),
- dst_addr: Some(self.dst_addr.into()),
- socket_type: match self.proto.to_lowercase().as_str() {
+ bind_addr: Some(val.bind_addr.into()),
+ dst_addr: Some(val.dst_addr.into()),
+ socket_type: match val.proto.to_lowercase().as_str() {
"tcp" => SocketType::Tcp as i32,
"udp" => SocketType::Udp as i32,
_ => SocketType::Tcp as i32,
@@ -258,11 +378,12 @@ struct Config {
instance_name: Option,
instance_id: Option,
ipv4: Option,
+ ipv6: Option,
dhcp: Option,
network_identity: Option,
listeners: Option>,
mapped_listeners: Option>,
- exit_nodes: Option>,
+ exit_nodes: Option>,
peer: Option>,
proxy_network: Option>,
@@ -282,6 +403,11 @@ struct Config {
#[serde(skip)]
flags_struct: Option,
+
+ acl: Option,
+
+ tcp_whitelist: Option>,
+ udp_whitelist: Option>,
}
#[derive(Debug, Clone)]
@@ -396,8 +522,7 @@ impl ConfigLoader for TomlConfigLoader {
locked_config
.ipv4
.as_ref()
- .map(|s| s.parse().ok())
- .flatten()
+ .and_then(|s| s.parse().ok())
.map(|c: cidr::Ipv4Inet| {
if c.network_length() == 32 {
cidr::Ipv4Inet::new(c.address(), 24).unwrap()
@@ -408,11 +533,16 @@ impl ConfigLoader for TomlConfigLoader {
}
fn set_ipv4(&self, addr: Option) {
- self.config.lock().unwrap().ipv4 = if let Some(addr) = addr {
- Some(addr.to_string())
- } else {
- None
- };
+ self.config.lock().unwrap().ipv4 = addr.map(|addr| addr.to_string());
+ }
+
+ fn get_ipv6(&self) -> Option {
+ let locked_config = self.config.lock().unwrap();
+ locked_config.ipv6.as_ref().and_then(|s| s.parse().ok())
+ }
+
+ fn set_ipv6(&self, addr: Option) {
+ self.config.lock().unwrap().ipv6 = addr.map(|addr| addr.to_string());
}
fn get_dhcp(&self) -> bool {
@@ -423,17 +553,23 @@ impl ConfigLoader for TomlConfigLoader {
self.config.lock().unwrap().dhcp = Some(dhcp);
}
- fn add_proxy_cidr(&self, cidr: cidr::Ipv4Cidr, mapped_cidr: Option) {
+ fn add_proxy_cidr(
+ &self,
+ cidr: cidr::Ipv4Cidr,
+ mapped_cidr: Option,
+ ) -> Result<(), anyhow::Error> {
let mut locked_config = self.config.lock().unwrap();
if locked_config.proxy_network.is_none() {
locked_config.proxy_network = Some(vec![]);
}
if let Some(mapped_cidr) = mapped_cidr.as_ref() {
- assert_eq!(
- cidr.network_length(),
- mapped_cidr.network_length(),
- "Mapped CIDR must have the same network length as the original CIDR",
- );
+ if cidr.network_length() != mapped_cidr.network_length() {
+ return Err(anyhow::anyhow!(
+ "Mapped CIDR must have the same network length as the original CIDR: {} != {}",
+ cidr.network_length(),
+ mapped_cidr.network_length()
+ ));
+ }
}
// insert if no duplicate
if !locked_config
@@ -453,6 +589,7 @@ impl ConfigLoader for TomlConfigLoader {
allow: None,
});
}
+ Ok(())
}
fn remove_proxy_cidr(&self, cidr: cidr::Ipv4Cidr) {
@@ -479,7 +616,7 @@ impl ConfigLoader for TomlConfigLoader {
locked_config.instance_id = Some(id);
id
} else {
- locked_config.instance_id.as_ref().unwrap().clone()
+ *locked_config.instance_id.as_ref().unwrap()
}
}
@@ -493,7 +630,7 @@ impl ConfigLoader for TomlConfigLoader {
.unwrap()
.network_identity
.clone()
- .unwrap_or_else(NetworkIdentity::default)
+ .unwrap_or_default()
}
fn set_network_identity(&self, identity: NetworkIdentity) {
@@ -574,7 +711,7 @@ impl ConfigLoader for TomlConfigLoader {
self.config.lock().unwrap().flags_struct = Some(flags);
}
- fn get_exit_nodes(&self) -> Vec {
+ fn get_exit_nodes(&self) -> Vec {
self.config
.lock()
.unwrap()
@@ -583,7 +720,7 @@ impl ConfigLoader for TomlConfigLoader {
.unwrap_or_default()
}
- fn set_exit_nodes(&self, nodes: Vec) {
+ fn set_exit_nodes(&self, nodes: Vec) {
self.config.lock().unwrap().exit_nodes = Some(nodes);
}
@@ -616,6 +753,40 @@ impl ConfigLoader for TomlConfigLoader {
self.config.lock().unwrap().port_forward = Some(forwards);
}
+ fn get_acl(&self) -> Option {
+ self.config.lock().unwrap().acl.clone()
+ }
+
+ fn set_acl(&self, acl: Option) {
+ self.config.lock().unwrap().acl = acl;
+ }
+
+ fn get_tcp_whitelist(&self) -> Vec {
+ self.config
+ .lock()
+ .unwrap()
+ .tcp_whitelist
+ .clone()
+ .unwrap_or_default()
+ }
+
+ fn set_tcp_whitelist(&self, whitelist: Vec) {
+ self.config.lock().unwrap().tcp_whitelist = Some(whitelist);
+ }
+
+ fn get_udp_whitelist(&self) -> Vec {
+ self.config
+ .lock()
+ .unwrap()
+ .udp_whitelist
+ .clone()
+ .unwrap_or_default()
+ }
+
+ fn set_udp_whitelist(&self, whitelist: Vec) {
+ self.config.lock().unwrap().udp_whitelist = Some(whitelist);
+ }
+
fn dump(&self) -> String {
let default_flags_json = serde_json::to_string(&gen_default_flags()).unwrap();
let default_flags_hashmap =
diff --git a/easytier/src/common/constants.rs b/easytier/src/common/constants.rs
index fffe2c6e9..3544b1390 100644
--- a/easytier/src/common/constants.rs
+++ b/easytier/src/common/constants.rs
@@ -8,14 +8,14 @@ macro_rules! define_global_var {
#[macro_export]
macro_rules! use_global_var {
($name:ident) => {
- crate::common::constants::$name.lock().unwrap().to_owned()
+ $crate::common::constants::$name.lock().unwrap().to_owned()
};
}
#[macro_export]
macro_rules! set_global_var {
($name:ident, $val:expr) => {
- *crate::common::constants::$name.lock().unwrap() = $val
+ *$crate::common::constants::$name.lock().unwrap() = $val
};
}
@@ -27,6 +27,8 @@ define_global_var!(MACHINE_UID, Option, None);
define_global_var!(MAX_DIRECT_CONNS_PER_PEER_IN_FOREIGN_NETWORK, u32, 3);
+define_global_var!(DIRECT_CONNECT_TO_PUBLIC_SERVER, bool, true);
+
pub const UDP_HOLE_PUNCH_CONNECTOR_SERVICE_ID: u32 = 2;
pub const WIN_SERVICE_WORK_DIR_REG_KEY: &str = "SOFTWARE\\EasyTier\\Service\\WorkDir";
diff --git a/easytier/src/common/defer.rs b/easytier/src/common/defer.rs
index 1132c9b75..c243d1ce8 100644
--- a/easytier/src/common/defer.rs
+++ b/easytier/src/common/defer.rs
@@ -12,7 +12,9 @@ impl Defer {
impl Drop for Defer {
fn drop(&mut self) {
- self.func.take().map(|f| f());
+ if let Some(f) = self.func.take() {
+ f()
+ }
}
}
diff --git a/easytier/src/common/dns.rs b/easytier/src/common/dns.rs
index 5ff4f081f..9e638323a 100644
--- a/easytier/src/common/dns.rs
+++ b/easytier/src/common/dns.rs
@@ -48,19 +48,15 @@ pub static RESOLVER: Lazy>>>
pub async fn resolve_txt_record(domain_name: &str) -> Result {
let r = RESOLVER.clone();
- let response = r.txt_lookup(domain_name).await.with_context(|| {
- format!(
- "txt_lookup failed, domain_name: {}",
- domain_name.to_string()
- )
- })?;
+ let response = r
+ .txt_lookup(domain_name)
+ .await
+ .with_context(|| format!("txt_lookup failed, domain_name: {}", domain_name))?;
- let txt_record = response.iter().next().with_context(|| {
- format!(
- "no txt record found, domain_name: {}",
- domain_name.to_string()
- )
- })?;
+ let txt_record = response
+ .iter()
+ .next()
+ .with_context(|| format!("no txt record found, domain_name: {}", domain_name))?;
let txt_data = String::from_utf8_lossy(&txt_record.txt_data()[0]);
tracing::info!(?txt_data, ?domain_name, "get txt record");
@@ -127,7 +123,7 @@ mod tests {
#[tokio::test]
async fn test_socket_addrs() {
- let url = url::Url::parse("tcp://public.easytier.cn:80").unwrap();
+ let url = url::Url::parse("tcp://github-ci-test.easytier.cn:80").unwrap();
let addrs = socket_addrs(&url, || Some(80)).await.unwrap();
assert_eq!(2, addrs.len(), "addrs: {:?}", addrs);
println!("addrs: {:?}", addrs);
diff --git a/easytier/src/common/global_ctx.rs b/easytier/src/common/global_ctx.rs
index 59df861c6..2c5e2cb25 100644
--- a/easytier/src/common/global_ctx.rs
+++ b/easytier/src/common/global_ctx.rs
@@ -5,7 +5,9 @@ use std::{
};
use crate::common::config::ProxyNetworkConfig;
+use crate::common::stats_manager::StatsManager;
use crate::common::token_bucket::TokenBucketManager;
+use crate::peers::acl_filter::AclFilter;
use crate::proto::cli::PeerConnInfo;
use crate::proto::common::{PeerFeatureFlag, PortForwardConfigPb};
use crossbeam::atomic::AtomicCell;
@@ -61,6 +63,7 @@ pub struct GlobalCtx {
event_bus: EventBus,
cached_ipv4: AtomicCell>,
+ cached_ipv6: AtomicCell>,
cached_proxy_cidrs: AtomicCell>>,
ip_collector: Mutex>>,
@@ -80,6 +83,10 @@ pub struct GlobalCtx {
quic_proxy_port: AtomicCell>,
token_bucket_manager: TokenBucketManager,
+
+ stats_manager: Arc,
+
+ acl_filter: Arc,
}
impl std::fmt::Debug for GlobalCtx {
@@ -97,7 +104,7 @@ impl std::fmt::Debug for GlobalCtx {
pub type ArcGlobalCtx = std::sync::Arc;
impl GlobalCtx {
- pub fn new(config_fs: impl ConfigLoader + 'static + Send + Sync) -> Self {
+ pub fn new(config_fs: impl ConfigLoader + 'static) -> Self {
let id = config_fs.get_id();
let network = config_fs.get_network_identity();
let net_ns = NetNS::new(config_fs.get_netns());
@@ -107,13 +114,15 @@ impl GlobalCtx {
let stun_info_collection = Arc::new(StunInfoCollector::new_with_default_servers());
- let enable_exit_node = config_fs.get_flags().enable_exit_node;
+ let enable_exit_node = config_fs.get_flags().enable_exit_node || cfg!(target_env = "ohos");
let proxy_forward_by_system = config_fs.get_flags().proxy_forward_by_system;
let no_tun = config_fs.get_flags().no_tun;
- let mut feature_flags = PeerFeatureFlag::default();
- feature_flags.kcp_input = !config_fs.get_flags().disable_kcp_input;
- feature_flags.no_relay_kcp = config_fs.get_flags().disable_relay_kcp;
+ let feature_flags = PeerFeatureFlag {
+ kcp_input: !config_fs.get_flags().disable_kcp_input,
+ no_relay_kcp: config_fs.get_flags().disable_relay_kcp,
+ ..Default::default()
+ };
GlobalCtx {
inst_name: config_fs.get_inst_name(),
@@ -124,6 +133,7 @@ impl GlobalCtx {
event_bus,
cached_ipv4: AtomicCell::new(None),
+ cached_ipv6: AtomicCell::new(None),
cached_proxy_cidrs: AtomicCell::new(None),
ip_collector: Mutex::new(Some(Arc::new(IPCollector::new(
@@ -145,6 +155,10 @@ impl GlobalCtx {
quic_proxy_port: AtomicCell::new(None),
token_bucket_manager: TokenBucketManager::new(),
+
+ stats_manager: Arc::new(StatsManager::new()),
+
+ acl_filter: Arc::new(AclFilter::new()),
}
}
@@ -173,7 +187,7 @@ impl GlobalCtx {
{
Ok(())
} else {
- Err(anyhow::anyhow!("network {} not in whitelist", network_name).into())
+ Err(anyhow::anyhow!("network {} not in whitelist", network_name))
}
}
@@ -182,8 +196,8 @@ impl GlobalCtx {
return Some(ret);
}
let addr = self.config.get_ipv4();
- self.cached_ipv4.store(addr.clone());
- return addr;
+ self.cached_ipv4.store(addr);
+ addr
}
pub fn set_ipv4(&self, addr: Option) {
@@ -191,6 +205,20 @@ impl GlobalCtx {
self.cached_ipv4.store(None);
}
+ pub fn get_ipv6(&self) -> Option {
+ if let Some(ret) = self.cached_ipv6.load() {
+ return Some(ret);
+ }
+ let addr = self.config.get_ipv6();
+ self.cached_ipv6.store(addr);
+ addr
+ }
+
+ pub fn set_ipv6(&self, addr: Option) {
+ self.config.set_ipv6(addr);
+ self.cached_ipv6.store(None);
+ }
+
pub fn get_id(&self) -> uuid::Uuid {
self.config.get_id()
}
@@ -270,6 +298,29 @@ impl GlobalCtx {
key
}
+ pub fn get_256_key(&self) -> [u8; 32] {
+ let mut key = [0u8; 32];
+ let secret = self
+ .config
+ .get_network_identity()
+ .network_secret
+ .unwrap_or_default();
+ // fill key according to network secret
+ let mut hasher = DefaultHasher::new();
+ hasher.write(secret.as_bytes());
+ hasher.write(b"easytier-256bit-key"); // 添加固定盐值以区分128位和256位密钥
+
+ // 生成32字节密钥
+ for i in 0..4 {
+ let chunk_start = i * 8;
+ let chunk_end = chunk_start + 8;
+ hasher.write(&key[0..chunk_start]);
+ hasher.write(&[i as u8]); // 添加索引以确保每个8字节块都不同
+ key[chunk_start..chunk_end].copy_from_slice(&hasher.finish().to_be_bytes());
+ }
+ key
+ }
+
pub fn enable_exit_node(&self) -> bool {
self.enable_exit_node
}
@@ -301,6 +352,14 @@ impl GlobalCtx {
pub fn token_bucket_manager(&self) -> &TokenBucketManager {
&self.token_bucket_manager
}
+
+ pub fn stats_manager(&self) -> &Arc {
+ &self.stats_manager
+ }
+
+ pub fn get_acl_filter(&self) -> &Arc {
+ &self.acl_filter
+ }
}
#[cfg(test)]
@@ -319,18 +378,18 @@ pub mod tests {
let mut subscriber = global_ctx.subscribe();
let peer_id = new_peer_id();
- global_ctx.issue_event(GlobalCtxEvent::PeerAdded(peer_id.clone()));
- global_ctx.issue_event(GlobalCtxEvent::PeerRemoved(peer_id.clone()));
+ global_ctx.issue_event(GlobalCtxEvent::PeerAdded(peer_id));
+ global_ctx.issue_event(GlobalCtxEvent::PeerRemoved(peer_id));
global_ctx.issue_event(GlobalCtxEvent::PeerConnAdded(PeerConnInfo::default()));
global_ctx.issue_event(GlobalCtxEvent::PeerConnRemoved(PeerConnInfo::default()));
assert_eq!(
subscriber.recv().await.unwrap(),
- GlobalCtxEvent::PeerAdded(peer_id.clone())
+ GlobalCtxEvent::PeerAdded(peer_id)
);
assert_eq!(
subscriber.recv().await.unwrap(),
- GlobalCtxEvent::PeerRemoved(peer_id.clone())
+ GlobalCtxEvent::PeerRemoved(peer_id)
);
assert_eq!(
subscriber.recv().await.unwrap(),
@@ -347,7 +406,7 @@ pub mod tests {
) -> ArcGlobalCtx {
let config_fs = TomlConfigLoader::default();
config_fs.set_inst_name(format!("test_{}", config_fs.get_id()));
- config_fs.set_network_identity(network_identy.unwrap_or(NetworkIdentity::default()));
+ config_fs.set_network_identity(network_identy.unwrap_or_default());
let ctx = Arc::new(GlobalCtx::new(config_fs));
ctx.replace_stun_info_collector(Box::new(MockStunInfoCollector {
diff --git a/easytier/src/common/ifcfg/darwin.rs b/easytier/src/common/ifcfg/darwin.rs
index 2cf13bea6..3c751534a 100644
--- a/easytier/src/common/ifcfg/darwin.rs
+++ b/easytier/src/common/ifcfg/darwin.rs
@@ -1,8 +1,8 @@
use std::net::Ipv4Addr;
-use async_trait::async_trait;
-
use super::{cidr_to_subnet_mask, run_shell_cmd, Error, IfConfiguerTrait};
+use async_trait::async_trait;
+use cidr::{Ipv4Inet, Ipv6Inet};
pub struct MacIfConfiger {}
#[async_trait]
@@ -66,12 +66,17 @@ impl IfConfiguerTrait for MacIfConfiger {
.await
}
- async fn remove_ip(&self, name: &str, ip: Option) -> Result<(), Error> {
+ async fn remove_ip(&self, name: &str, ip: Option) -> Result<(), Error> {
if ip.is_none() {
run_shell_cmd(format!("ifconfig {} inet delete", name).as_str()).await
} else {
run_shell_cmd(
- format!("ifconfig {} inet {} delete", name, ip.unwrap().to_string()).as_str(),
+ format!(
+ "ifconfig {} inet {} delete",
+ name,
+ ip.unwrap().address().to_string()
+ )
+ .as_str(),
)
.await
}
@@ -80,4 +85,60 @@ impl IfConfiguerTrait for MacIfConfiger {
async fn set_mtu(&self, name: &str, mtu: u32) -> Result<(), Error> {
run_shell_cmd(format!("ifconfig {} mtu {}", name, mtu).as_str()).await
}
+
+ async fn add_ipv6_ip(
+ &self,
+ name: &str,
+ address: std::net::Ipv6Addr,
+ cidr_prefix: u8,
+ ) -> Result<(), Error> {
+ run_shell_cmd(format!("ifconfig {} inet6 {}/{} add", name, address, cidr_prefix).as_str())
+ .await
+ }
+
+ async fn remove_ipv6(&self, name: &str, ip: Option) -> Result<(), Error> {
+ if let Some(ip) = ip {
+ run_shell_cmd(format!("ifconfig {} inet6 {} delete", name, ip.address()).as_str()).await
+ } else {
+ // Remove all IPv6 addresses is more complex on macOS, just succeed
+ Ok(())
+ }
+ }
+
+ async fn add_ipv6_route(
+ &self,
+ name: &str,
+ address: std::net::Ipv6Addr,
+ cidr_prefix: u8,
+ cost: Option,
+ ) -> Result<(), Error> {
+ let cmd = if let Some(cost) = cost {
+ format!(
+ "route -n add -inet6 {}/{} -interface {} -hopcount {}",
+ address, cidr_prefix, name, cost
+ )
+ } else {
+ format!(
+ "route -n add -inet6 {}/{} -interface {}",
+ address, cidr_prefix, name
+ )
+ };
+ run_shell_cmd(cmd.as_str()).await
+ }
+
+ async fn remove_ipv6_route(
+ &self,
+ name: &str,
+ address: std::net::Ipv6Addr,
+ cidr_prefix: u8,
+ ) -> Result<(), Error> {
+ run_shell_cmd(
+ format!(
+ "route -n delete -inet6 {}/{} -interface {}",
+ address, cidr_prefix, name
+ )
+ .as_str(),
+ )
+ .await
+ }
}
diff --git a/easytier/src/common/ifcfg/mod.rs b/easytier/src/common/ifcfg/mod.rs
index e779cacd8..f5bd223a8 100644
--- a/easytier/src/common/ifcfg/mod.rs
+++ b/easytier/src/common/ifcfg/mod.rs
@@ -1,15 +1,18 @@
#[cfg(any(target_os = "macos", target_os = "freebsd"))]
mod darwin;
-#[cfg(any(target_os = "linux"))]
+#[cfg(target_os = "linux")]
mod netlink;
#[cfg(target_os = "windows")]
+mod win;
+#[cfg(target_os = "windows")]
mod windows;
mod route;
-use std::net::Ipv4Addr;
+use std::net::{Ipv4Addr, Ipv6Addr};
use async_trait::async_trait;
+use cidr::{Ipv4Inet, Ipv6Inet};
use tokio::process::Command;
use super::error::Error;
@@ -41,10 +44,38 @@ pub trait IfConfiguerTrait: Send + Sync {
) -> Result<(), Error> {
Ok(())
}
+ async fn add_ipv6_route(
+ &self,
+ _name: &str,
+ _address: Ipv6Addr,
+ _cidr_prefix: u8,
+ _cost: Option,
+ ) -> Result<(), Error> {
+ Ok(())
+ }
+ async fn remove_ipv6_route(
+ &self,
+ _name: &str,
+ _address: Ipv6Addr,
+ _cidr_prefix: u8,
+ ) -> Result<(), Error> {
+ Ok(())
+ }
+ async fn add_ipv6_ip(
+ &self,
+ _name: &str,
+ _address: Ipv6Addr,
+ _cidr_prefix: u8,
+ ) -> Result<(), Error> {
+ Ok(())
+ }
async fn set_link_status(&self, _name: &str, _up: bool) -> Result<(), Error> {
Ok(())
}
- async fn remove_ip(&self, _name: &str, _ip: Option) -> Result<(), Error> {
+ async fn remove_ip(&self, _name: &str, _ip: Option) -> Result<(), Error> {
+ Ok(())
+ }
+ async fn remove_ipv6(&self, _name: &str, _ip: Option) -> Result<(), Error> {
Ok(())
}
async fn wait_interface_show(&self, _name: &str) -> Result<(), Error> {
@@ -110,7 +141,7 @@ pub struct DummyIfConfiger {}
#[async_trait]
impl IfConfiguerTrait for DummyIfConfiger {}
-#[cfg(any(target_os = "linux"))]
+#[cfg(target_os = "linux")]
pub type IfConfiger = netlink::NetlinkIfConfiger;
#[cfg(any(target_os = "macos", target_os = "freebsd"))]
diff --git a/easytier/src/common/ifcfg/netlink.rs b/easytier/src/common/ifcfg/netlink.rs
index 80ecbd209..f51b83e13 100644
--- a/easytier/src/common/ifcfg/netlink.rs
+++ b/easytier/src/common/ifcfg/netlink.rs
@@ -8,7 +8,7 @@ use std::{
use anyhow::Context;
use async_trait::async_trait;
-use cidr::IpInet;
+use cidr::{IpInet, Ipv4Inet, Ipv6Inet};
use netlink_packet_core::{
NetlinkDeserializable, NetlinkHeader, NetlinkMessage, NetlinkPayload, NetlinkSerializable,
NLM_F_ACK, NLM_F_CREATE, NLM_F_DUMP, NLM_F_EXCL, NLM_F_REQUEST,
@@ -85,14 +85,14 @@ fn send_netlink_req_and_wait_one_resp {
if e.code == NonZero::new(0) {
- return Ok(());
+ Ok(())
} else {
- return Err(e.to_io().into());
+ Err(e.to_io().into())
}
}
p => {
tracing::error!("Unexpected netlink response: {:?}", p);
- return Err(anyhow::anyhow!("Unexpected netlink response").into());
+ Err(anyhow::anyhow!("Unexpected netlink response").into())
}
}
}
@@ -194,6 +194,32 @@ impl NetlinkIfConfiger {
)
}
+ fn get_prefix_len_ipv6(name: &str, ip: Ipv6Addr) -> Result {
+ let addrs = Self::list_addresses(name)?;
+ for addr in addrs {
+ if addr.address() == IpAddr::V6(ip) {
+ return Ok(addr.network_length());
+ }
+ }
+ Err(Error::NotFound)
+ }
+
+ fn remove_one_ipv6(name: &str, ip: Ipv6Addr, prefix_len: u8) -> Result<(), Error> {
+ let mut message = AddressMessage::default();
+ message.header.prefix_len = prefix_len;
+ message.header.index = NetlinkIfConfiger::get_interface_index(name)?;
+ message.header.family = AddressFamily::Inet6;
+
+ message
+ .attributes
+ .push(AddressAttribute::Address(std::net::IpAddr::V6(ip)));
+
+ send_netlink_req_and_wait_one_resp::(
+ RouteNetlinkMessage::DelAddress(message),
+ true,
+ )
+ }
+
pub(crate) fn mtu_op>(
name: &str,
op: T,
@@ -237,8 +263,8 @@ impl NetlinkIfConfiger {
let (address, netmask) = match (address.family(), netmask.family()) {
(Some(Inet), Some(Inet)) => (
- IpAddr::V4(address.as_sockaddr_in().unwrap().ip().into()),
- IpAddr::V4(netmask.as_sockaddr_in().unwrap().ip().into()),
+ IpAddr::V4(address.as_sockaddr_in().unwrap().ip()),
+ IpAddr::V4(netmask.as_sockaddr_in().unwrap().ip()),
),
(Some(Inet6), Some(Inet6)) => (
IpAddr::V6(address.as_sockaddr_in6().unwrap().ip()),
@@ -307,7 +333,7 @@ impl NetlinkIfConfiger {
let mut resp = Vec::::new();
loop {
- if resp.len() == 0 {
+ if resp.is_empty() {
let (new_resp, _) = s.recv_from_full()?;
resp = new_resp;
}
@@ -447,7 +473,7 @@ impl IfConfiguerTrait for NetlinkIfConfiger {
Ok(())
}
- async fn remove_ip(&self, name: &str, ip: Option) -> Result<(), Error> {
+ async fn remove_ip(&self, name: &str, ip: Option) -> Result<(), Error> {
if ip.is_none() {
let addrs = Self::list_addresses(name)?;
for addr in addrs {
@@ -457,8 +483,8 @@ impl IfConfiguerTrait for NetlinkIfConfiger {
}
} else {
let ip = ip.unwrap();
- let prefix_len = Self::get_prefix_len(name, ip)?;
- Self::remove_one_ip(name, ip, prefix_len)?;
+ let prefix_len = Self::get_prefix_len(name, ip.address())?;
+ Self::remove_one_ip(name, ip.address(), prefix_len)?;
}
Ok(())
@@ -469,6 +495,106 @@ impl IfConfiguerTrait for NetlinkIfConfiger {
Ok(())
}
+
+ async fn add_ipv6_ip(
+ &self,
+ name: &str,
+ address: std::net::Ipv6Addr,
+ cidr_prefix: u8,
+ ) -> Result<(), Error> {
+ let mut message = AddressMessage::default();
+
+ message.header.prefix_len = cidr_prefix;
+ message.header.index = NetlinkIfConfiger::get_interface_index(name)?;
+ message.header.family = AddressFamily::Inet6;
+
+ message
+ .attributes
+ .push(AddressAttribute::Address(std::net::IpAddr::V6(address)));
+
+ // For IPv6, we don't need IFA_LOCAL or IFA_BROADCAST
+ send_netlink_req_and_wait_one_resp::(
+ RouteNetlinkMessage::NewAddress(message),
+ false,
+ )
+ }
+
+ async fn remove_ipv6(&self, name: &str, ip: Option) -> Result<(), Error> {
+ if ip.is_none() {
+ let addrs = Self::list_addresses(name)?;
+ for addr in addrs {
+ if let IpAddr::V6(ipv6) = addr.address() {
+ let prefix_len = addr.network_length();
+ Self::remove_one_ipv6(name, ipv6, prefix_len)?;
+ }
+ }
+ } else {
+ let ipv6 = ip.unwrap();
+ let prefix_len = Self::get_prefix_len_ipv6(name, ipv6.address())?;
+ Self::remove_one_ipv6(name, ipv6.address(), prefix_len)?;
+ }
+
+ Ok(())
+ }
+
+ async fn add_ipv6_route(
+ &self,
+ name: &str,
+ address: std::net::Ipv6Addr,
+ cidr_prefix: u8,
+ cost: Option,
+ ) -> Result<(), Error> {
+ let mut message = RouteMessage::default();
+
+ message.header.address_family = AddressFamily::Inet6;
+ message.header.destination_prefix_length = cidr_prefix;
+ message.header.table = RouteHeader::RT_TABLE_MAIN;
+ message.header.protocol = RouteProtocol::Static;
+ message.header.scope = RouteScope::Universe;
+ message.header.kind = RouteType::Unicast;
+
+ // Add metric (cost) if specified
+ if let Some(cost) = cost {
+ message
+ .attributes
+ .push(RouteAttribute::Priority(cost as u32));
+ }
+
+ message
+ .attributes
+ .push(RouteAttribute::Oif(NetlinkIfConfiger::get_interface_index(
+ name,
+ )?));
+
+ message
+ .attributes
+ .push(RouteAttribute::Destination(RouteAddress::Inet6(address)));
+
+ send_netlink_req_and_wait_one_resp(RouteNetlinkMessage::NewRoute(message), false)
+ }
+
+ async fn remove_ipv6_route(
+ &self,
+ name: &str,
+ address: std::net::Ipv6Addr,
+ cidr_prefix: u8,
+ ) -> Result<(), Error> {
+ let routes = Self::list_routes()?;
+ let ifidx = NetlinkIfConfiger::get_interface_index(name)?;
+
+ for msg in routes {
+ let other_route: Route = msg.clone().into();
+ if other_route.destination == std::net::IpAddr::V6(address)
+ && other_route.prefix == cidr_prefix
+ && other_route.ifindex == Some(ifidx)
+ {
+ send_netlink_req_and_wait_one_resp(RouteNetlinkMessage::DelRoute(msg), true)?;
+ return Ok(());
+ }
+ }
+
+ Ok(())
+ }
}
#[cfg(test)]
diff --git a/easytier/src/common/ifcfg/win/luid.rs b/easytier/src/common/ifcfg/win/luid.rs
new file mode 100644
index 000000000..29af75c9d
--- /dev/null
+++ b/easytier/src/common/ifcfg/win/luid.rs
@@ -0,0 +1,745 @@
+//
+// Port supporting code from wireguard-windows, as used by 3rd-party/wireguard-go, to Rust
+// This file implements functionality similar to: wireguard-windows/tunnel/winipcfg/luid.go
+//
+// ATTENTION: NOT included are DNS() and SetDNS() - functions to query and set DNS servers for a network interface.
+//
+
+use super::netsh;
+use super::types::*;
+use cidr::Ipv4Inet;
+use cidr::Ipv6Inet;
+use std::net::{Ipv4Addr, Ipv6Addr};
+use std::ptr;
+use winapi::shared::{
+ guiddef::GUID, ifdef::NET_LUID, netioapi::*, nldef::*, winerror::*, ws2def::*, ws2ipdef::*,
+};
+
+pub struct InterfaceLuid {
+ luid: NET_LUID,
+}
+
+impl InterfaceLuid {
+ pub fn new(luid_value: u64) -> Self {
+ InterfaceLuid {
+ luid: winapi::shared::ifdef::NET_LUID_LH { Value: luid_value },
+ }
+ }
+
+ pub fn luid(&self) -> NET_LUID {
+ self.luid
+ }
+
+ /// get_ip_interface method retrieves IP information for the specified interface on the local computer.
+ pub fn get_ip_interface(
+ &self,
+ family: ADDRESS_FAMILY,
+ ) -> Result {
+ let mut row = MIB_IPINTERFACE_ROW::default();
+ unsafe { InitializeIpInterfaceEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+ row.Family = family;
+
+ let result = unsafe { GetIpInterfaceEntry(&mut row) };
+ if NO_ERROR == result {
+ Ok(row)
+ } else {
+ Err(result)
+ }
+ }
+
+ /// https://learn.microsoft.com/en-us/windows/win32/api/netioapi/nf-netioapi-setipinterfaceentry
+ /// If only InterfaceIndex was specified, SetIpInterfaceEntry() will modify ipif with a correct InterfaceLuid
+ pub fn set_ip_interface(&self, ipif: *mut MIB_IPINTERFACE_ROW) -> Result<(), NETIO_STATUS> {
+ let result = unsafe { SetIpInterfaceEntry(ipif) };
+ if NO_ERROR == result {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// get_interface method retrieves information for the specified adapter on the local computer.
+ /// https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-getifentry2
+ pub fn get_interface(&self) -> Result {
+ let mut row = MIB_IF_ROW2 {
+ InterfaceLuid: self.luid,
+ ..MIB_IF_ROW2::default()
+ };
+
+ let result = unsafe { GetIfEntry2(&mut row) };
+ if NO_ERROR == result {
+ Ok(row)
+ } else {
+ Err(result)
+ }
+ }
+
+ /// GUID method converts a locally unique identifier (LUID) for a network interface to a globally unique identifier (GUID) for the interface.
+ /// https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-convertinterfaceluidtoguid
+ pub fn get_guid(&self) -> Result {
+ let mut interface_guid = GUID::default();
+
+ let result = unsafe { ConvertInterfaceLuidToGuid(&self.luid, &mut interface_guid) };
+
+ if NO_ERROR == result {
+ Ok(interface_guid)
+ } else {
+ Err(result)
+ }
+ }
+
+ /// luid_from_guid function converts a globally unique identifier (GUID) for a network interface to the locally unique identifier (LUID) for the interface.
+ /// https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-convertinterfaceguidtoluid
+ pub fn luid_from_guid(interface_guid: &GUID) -> Result {
+ let mut interface_luid = NET_LUID::default();
+
+ let result = unsafe { ConvertInterfaceGuidToLuid(interface_guid, &mut interface_luid) };
+
+ if NO_ERROR == result {
+ Ok(Self {
+ luid: interface_luid,
+ })
+ } else {
+ Err(result)
+ }
+ }
+
+ /// luid_from_index function converts a local index for a network interface to the locally unique identifier (LUID) for the interface.
+ /// https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-convertinterfaceindextoluid
+ pub fn luid_from_index(interface_index: u32) -> Result {
+ let mut interface_luid = NET_LUID::default();
+
+ let result = unsafe { ConvertInterfaceIndexToLuid(interface_index, &mut interface_luid) };
+
+ if NO_ERROR == result {
+ Ok(Self {
+ luid: interface_luid,
+ })
+ } else {
+ Err(result)
+ }
+ }
+
+ /// get_from_ipv4_address method returns MibUnicastIPAddressRow struct that matches to provided 'ip' argument. Corresponds to GetUnicastIpAddressEntry
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-getunicastipaddressentry)
+ pub fn get_from_ipv4_address(
+ &self,
+ ip: &Ipv4Addr,
+ ) -> Result {
+ let mut row = MIB_UNICASTIPADDRESS_ROW::default();
+ unsafe { InitializeUnicastIpAddressEntry(&mut row) };
+
+ unsafe { *row.Address.Ipv4_mut() = convert_ipv4addr_to_sockaddr(ip) };
+
+ let result = unsafe { GetUnicastIpAddressEntry(&mut row) };
+
+ if NO_ERROR == result {
+ Ok(row)
+ } else {
+ Err(result)
+ }
+ }
+
+ /// get_from_ipv6_address method returns MibUnicastIPAddressRow struct that matches to provided 'ip' argument. Corresponds to GetUnicastIpAddressEntry
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-getunicastipaddressentry)
+ pub fn get_from_ipv6_address(
+ &self,
+ ip: &Ipv6Addr,
+ ) -> Result {
+ let mut row = MIB_UNICASTIPADDRESS_ROW::default();
+ unsafe { InitializeUnicastIpAddressEntry(&mut row) };
+
+ unsafe { *row.Address.Ipv6_mut() = convert_ipv6addr_to_sockaddr(ip) };
+
+ let result = unsafe { GetUnicastIpAddressEntry(&mut row) };
+
+ if NO_ERROR == result {
+ Ok(row)
+ } else {
+ Err(result)
+ }
+ }
+
+ /// add_ipv4_address method adds new unicast IP address to the interface. Corresponds to CreateUnicastIpAddressEntry function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-createunicastipaddressentry).
+ pub fn add_ipv4_address(&self, address: &Ipv4Inet) -> Result<(), NETIO_STATUS> {
+ let mut row = MIB_UNICASTIPADDRESS_ROW::default();
+ unsafe { InitializeUnicastIpAddressEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+ row.DadState = IpDadStatePreferred;
+ row.ValidLifetime = 0xffffffff;
+ row.PreferredLifetime = 0xffffffff;
+
+ unsafe { *row.Address.Ipv4_mut() = convert_ipv4addr_to_sockaddr(&address.address()) };
+ row.OnLinkPrefixLength = address.network_length();
+
+ let result = unsafe { CreateUnicastIpAddressEntry(&row) };
+
+ if NO_ERROR == result {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// add_ipv6_address method adds new unicast IP address to the interface. Corresponds to CreateUnicastIpAddressEntry function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-createunicastipaddressentry).
+ pub fn add_ipv6_address(&self, address: &Ipv6Inet) -> Result<(), NETIO_STATUS> {
+ let mut row = MIB_UNICASTIPADDRESS_ROW::default();
+ unsafe { InitializeUnicastIpAddressEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+ row.DadState = IpDadStatePreferred;
+ row.ValidLifetime = 0xffffffff;
+ row.PreferredLifetime = 0xffffffff;
+
+ unsafe { *row.Address.Ipv6_mut() = convert_ipv6addr_to_sockaddr(&address.address()) };
+ row.OnLinkPrefixLength = address.network_length();
+
+ let result = unsafe { CreateUnicastIpAddressEntry(&row) };
+
+ if NO_ERROR == result {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// add_ipv4_addresses method adds multiple new unicast IP addresses to the interface. Corresponds to CreateUnicastIpAddressEntry function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-createunicastipaddressentry).
+ pub fn add_ipv4_addresses(
+ &self,
+ addresses: impl IntoIterator- ,
+ ) -> Result<(), NETIO_STATUS> {
+ for ip in addresses.into_iter().enumerate() {
+ self.add_ipv4_address(&ip.1)?;
+ }
+ Ok(())
+ }
+
+ /// add_ipv6_addresses method adds multiple new unicast IP addresses to the interface. Corresponds to CreateUnicastIpAddressEntry function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-createunicastipaddressentry).
+ pub fn add_ipv6_addresses(
+ &self,
+ addresses: impl IntoIterator
- ,
+ ) -> Result<(), NETIO_STATUS> {
+ for ip in addresses.into_iter().enumerate() {
+ self.add_ipv6_address(&ip.1)?;
+ }
+ Ok(())
+ }
+
+ /// set_ipv4_addresses method sets new unicast IP addresses to the interface.
+ pub fn set_ipv4_addresses(
+ &self,
+ addresses: impl IntoIterator
- ,
+ ) -> Result<(), NETIO_STATUS> {
+ self.flush_ipv4_addresses()?;
+ self.add_ipv4_addresses(addresses)?;
+ Ok(())
+ }
+
+ /// set_ipv6_addresses method sets new unicast IP addresses to the interface.
+ pub fn set_ipv6_addresses(
+ &self,
+ addresses: impl IntoIterator
- ,
+ ) -> Result<(), NETIO_STATUS> {
+ self.flush_ipv6_addresses()?;
+ self.add_ipv6_addresses(addresses)?;
+ Ok(())
+ }
+
+ /// delete_ipv4_address method deletes interface's unicast IP address. Corresponds to DeleteUnicastIpAddressEntry function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-deleteunicastipaddressentry).
+ pub fn delete_ipv4_address(&self, address: &Ipv4Inet) -> Result<(), NETIO_STATUS> {
+ let mut row = MIB_UNICASTIPADDRESS_ROW::default();
+ unsafe { InitializeUnicastIpAddressEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+ row.DadState = IpDadStatePreferred;
+ row.ValidLifetime = 0xffffffff;
+ row.PreferredLifetime = 0xffffffff;
+
+ unsafe { *row.Address.Ipv4_mut() = convert_ipv4addr_to_sockaddr(&address.address()) };
+ row.OnLinkPrefixLength = address.network_length();
+
+ let result = unsafe { DeleteUnicastIpAddressEntry(&row) };
+
+ if NO_ERROR == result {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// delete_ipv4_address method deletes interface's unicast IP address. Corresponds to DeleteUnicastIpAddressEntry function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-deleteunicastipaddressentry).
+ pub fn delete_ipv4_address2(
+ &self,
+ address: *const SOCKADDR_IN,
+ prefix_len: u8,
+ ) -> Result<(), NETIO_STATUS> {
+ let mut row = MIB_UNICASTIPADDRESS_ROW::default();
+ unsafe { InitializeUnicastIpAddressEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+ row.DadState = IpDadStatePreferred;
+ row.ValidLifetime = 0xffffffff;
+ row.PreferredLifetime = 0xffffffff;
+
+ assert!(!address.is_null());
+ unsafe { *row.Address.Ipv4_mut() = *address };
+ row.OnLinkPrefixLength = prefix_len;
+
+ let result = unsafe { DeleteUnicastIpAddressEntry(&row) };
+
+ if NO_ERROR == result {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// delete_ipv6_address method deletes interface's unicast IP address. Corresponds to DeleteUnicastIpAddressEntry function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-deleteunicastipaddressentry).
+ pub fn delete_ipv6_address(&self, address: &Ipv6Inet) -> Result<(), NETIO_STATUS> {
+ let mut row = MIB_UNICASTIPADDRESS_ROW::default();
+ unsafe { InitializeUnicastIpAddressEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+ row.DadState = IpDadStatePreferred;
+ row.ValidLifetime = 0xffffffff;
+ row.PreferredLifetime = 0xffffffff;
+
+ unsafe { *row.Address.Ipv6_mut() = convert_ipv6addr_to_sockaddr(&address.address()) };
+ row.OnLinkPrefixLength = address.network_length();
+
+ let result = unsafe { DeleteUnicastIpAddressEntry(&row) };
+
+ if NO_ERROR == result {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// delete_ipv6_address method deletes interface's unicast IP address. Corresponds to DeleteUnicastIpAddressEntry function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-deleteunicastipaddressentry).
+ pub fn delete_ipv6_address2(
+ &self,
+ address: *const SOCKADDR_IN6,
+ prefix_len: u8,
+ ) -> Result<(), NETIO_STATUS> {
+ let mut row = MIB_UNICASTIPADDRESS_ROW::default();
+ unsafe { InitializeUnicastIpAddressEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+ row.DadState = IpDadStatePreferred;
+ row.ValidLifetime = 0xffffffff;
+ row.PreferredLifetime = 0xffffffff;
+
+ assert!(!address.is_null());
+ unsafe { *row.Address.Ipv6_mut() = *address };
+ row.OnLinkPrefixLength = prefix_len;
+
+ let result = unsafe { DeleteUnicastIpAddressEntry(&row) };
+
+ if NO_ERROR == result {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// flush_ip_addresses method deletes all interface's unicast IP addresses.
+ pub fn flush_ip_addresses(&self, address_family: ADDRESS_FAMILY) -> Result<(), NETIO_STATUS> {
+ let mut p_table: PMIB_UNICASTIPADDRESS_TABLE = ptr::null_mut();
+ let result = unsafe { GetUnicastIpAddressTable(address_family, &mut p_table) };
+ if NO_ERROR != result {
+ return Err(result);
+ }
+
+ assert!(!p_table.is_null());
+ let num_entries = unsafe { *p_table }.NumEntries;
+ let x_table = unsafe { *p_table }.Table.as_ptr();
+ for i in 0..num_entries {
+ let current_entry = unsafe { x_table.add(i as _) };
+ if unsafe { (*current_entry).InterfaceLuid.Value } == self.luid.Value {
+ unsafe { DeleteUnicastIpAddressEntry(current_entry) };
+ }
+ }
+
+ unsafe { FreeMibTable(p_table as _) };
+
+ Ok(())
+ }
+
+ /// flush_ipv4_addresses method deletes all interface's unicast IP addresses.
+ pub fn flush_ipv4_addresses(&self) -> Result<(), NETIO_STATUS> {
+ self.flush_ip_addresses(AF_INET as _)
+ }
+
+ /// flush_ipv6_addresses method deletes all interface's unicast IP addresses.
+ pub fn flush_ipv6_addresses(&self) -> Result<(), NETIO_STATUS> {
+ self.flush_ip_addresses(AF_INET6 as _)
+ }
+
+ /// route_ipv4 method returns route determined with the input arguments. Corresponds to GetIpForwardEntry2 function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-getipforwardentry2).
+ /// NOTE: If the corresponding route isn't found, the method will return error.
+ pub fn route_ipv4(
+ &self,
+ destination: &Ipv4Inet,
+ next_hop: &Ipv4Addr,
+ ) -> Result
{
+ let mut row = MIB_IPFORWARD_ROW2::default();
+ unsafe { InitializeIpForwardEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+ row.ValidLifetime = 0xffffffff;
+ row.PreferredLifetime = 0xffffffff;
+
+ unsafe {
+ *row.DestinationPrefix.Prefix.Ipv4_mut() =
+ convert_ipv4addr_to_sockaddr(&destination.address())
+ };
+ row.DestinationPrefix.PrefixLength = destination.network_length();
+
+ unsafe { *row.NextHop.Ipv4_mut() = convert_ipv4addr_to_sockaddr(next_hop) };
+
+ let result = unsafe { GetIpForwardEntry2(&mut row) };
+
+ if NO_ERROR == result {
+ Ok(row)
+ } else {
+ Err(result)
+ }
+ }
+
+ /// route_ipv6 method returns route determined with the input arguments. Corresponds to GetIpForwardEntry2 function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-getipforwardentry2).
+ /// NOTE: If the corresponding route isn't found, the method will return error.
+ pub fn route_ipv6(
+ &self,
+ destination: &Ipv6Inet,
+ next_hop: &Ipv6Addr,
+ ) -> Result {
+ let mut row = MIB_IPFORWARD_ROW2::default();
+ unsafe { InitializeIpForwardEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+ row.ValidLifetime = 0xffffffff;
+ row.PreferredLifetime = 0xffffffff;
+
+ unsafe {
+ *row.DestinationPrefix.Prefix.Ipv6_mut() =
+ convert_ipv6addr_to_sockaddr(&destination.address())
+ };
+ row.DestinationPrefix.PrefixLength = destination.network_length();
+
+ unsafe { *row.NextHop.Ipv6_mut() = convert_ipv6addr_to_sockaddr(next_hop) };
+
+ let result = unsafe { GetIpForwardEntry2(&mut row) };
+
+ if NO_ERROR == result {
+ Ok(row)
+ } else {
+ Err(result)
+ }
+ }
+
+ /// add_route_ipv4 method adds a route to the interface. Corresponds to CreateIpForwardEntry2 function, with added splitDefault feature.
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-createipforwardentry2)
+ pub fn add_route_ipv4(
+ &self,
+ destination: &Ipv4Inet,
+ next_hop: &Ipv4Addr,
+ metric: u32,
+ ) -> Result<(), NETIO_STATUS> {
+ let mut row = MIB_IPFORWARD_ROW2::default();
+ unsafe { InitializeIpForwardEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+ row.ValidLifetime = 0xffffffff;
+ row.PreferredLifetime = 0xffffffff;
+
+ unsafe {
+ *row.DestinationPrefix.Prefix.Ipv4_mut() =
+ convert_ipv4addr_to_sockaddr(&destination.address())
+ };
+ row.DestinationPrefix.PrefixLength = destination.network_length();
+
+ unsafe { *row.NextHop.Ipv4_mut() = convert_ipv4addr_to_sockaddr(next_hop) };
+
+ row.Metric = metric;
+
+ let result = unsafe { CreateIpForwardEntry2(&row) };
+
+ if NO_ERROR == result {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// add_route_ipv6 method adds a route to the interface. Corresponds to CreateIpForwardEntry2 function, with added splitDefault feature.
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-createipforwardentry2)
+ pub fn add_route_ipv6(
+ &self,
+ destination: &Ipv6Inet,
+ next_hop: &Ipv6Addr,
+ metric: u32,
+ ) -> Result<(), NETIO_STATUS> {
+ let mut row = MIB_IPFORWARD_ROW2::default();
+ unsafe { InitializeIpForwardEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+ row.ValidLifetime = 0xffffffff;
+ row.PreferredLifetime = 0xffffffff;
+
+ unsafe {
+ *row.DestinationPrefix.Prefix.Ipv6_mut() =
+ convert_ipv6addr_to_sockaddr(&destination.address())
+ };
+ row.DestinationPrefix.PrefixLength = destination.network_length();
+
+ unsafe { *row.NextHop.Ipv6_mut() = convert_ipv6addr_to_sockaddr(next_hop) };
+
+ row.Metric = metric;
+
+ let result = unsafe { CreateIpForwardEntry2(&row) };
+
+ if NO_ERROR == result {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// add_routes_ipv4 method adds multiple routes to the interface
+ pub fn add_routes_ipv4(
+ &self,
+ routes_data: impl IntoIterator- ,
+ ) -> Result<(), NETIO_STATUS> {
+ for rd in routes_data.into_iter().enumerate() {
+ self.add_route_ipv4(&rd.1.destination, &rd.1.next_hop, rd.1.metric)?;
+ }
+ Ok(())
+ }
+
+ /// add_routes_ipv6 method adds multiple routes to the interface
+ pub fn add_routes_ipv6(
+ &self,
+ routes_data: impl IntoIterator
- ,
+ ) -> Result<(), NETIO_STATUS> {
+ for rd in routes_data.into_iter().enumerate() {
+ self.add_route_ipv6(&rd.1.destination, &rd.1.next_hop, rd.1.metric)?;
+ }
+ Ok(())
+ }
+
+ /// set_routes_ipv4 method sets (flush than add) multiple routes to the interface.
+ pub fn set_routes_ipv4(
+ &self,
+ routes_data: impl IntoIterator
- ,
+ ) -> Result<(), NETIO_STATUS> {
+ self.flush_routes_ipv4()?;
+ self.add_routes_ipv4(routes_data)?;
+ Ok(())
+ }
+
+ /// set_routes_ipv6 method sets (flush than add) multiple routes to the interface.
+ pub fn set_routes_ipv6(
+ &self,
+ routes_data: impl IntoIterator
- ,
+ ) -> Result<(), NETIO_STATUS> {
+ self.flush_routes_ipv6()?;
+ self.add_routes_ipv6(routes_data)?;
+ Ok(())
+ }
+
+ /// delete_route_ipv4 method deletes a route that matches the criteria. Corresponds to DeleteIpForwardEntry2 function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-deleteipforwardentry2).
+ pub fn delete_route_ipv4(
+ &self,
+ destination: &Ipv4Inet,
+ next_hop: &Ipv4Addr,
+ ) -> Result<(), NETIO_STATUS> {
+ let mut row = MIB_IPFORWARD_ROW2::default();
+ unsafe { InitializeIpForwardEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+
+ unsafe {
+ *row.DestinationPrefix.Prefix.Ipv4_mut() =
+ convert_ipv4addr_to_sockaddr(&destination.address())
+ };
+ row.DestinationPrefix.PrefixLength = destination.network_length();
+
+ unsafe { *row.NextHop.Ipv4_mut() = convert_ipv4addr_to_sockaddr(next_hop) };
+
+ let result = unsafe { GetIpForwardEntry2(&mut row) };
+ if NO_ERROR != result {
+ return Err(result);
+ }
+
+ let result = unsafe { DeleteIpForwardEntry2(&row) };
+ if NO_ERROR == result {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// delete_route_ipv6 method deletes a route that matches the criteria. Corresponds to DeleteIpForwardEntry2 function
+ /// (https://docs.microsoft.com/en-us/windows/desktop/api/netioapi/nf-netioapi-deleteipforwardentry2).
+ pub fn delete_route_ipv6(
+ &self,
+ destination: &Ipv6Inet,
+ next_hop: &Ipv6Addr,
+ ) -> Result<(), NETIO_STATUS> {
+ let mut row = MIB_IPFORWARD_ROW2::default();
+ unsafe { InitializeIpForwardEntry(&mut row) };
+
+ row.InterfaceLuid = self.luid;
+
+ unsafe {
+ *row.DestinationPrefix.Prefix.Ipv6_mut() =
+ convert_ipv6addr_to_sockaddr(&destination.address())
+ };
+ row.DestinationPrefix.PrefixLength = destination.network_length();
+
+ unsafe { *row.NextHop.Ipv6_mut() = convert_ipv6addr_to_sockaddr(next_hop) };
+
+ let result = unsafe { GetIpForwardEntry2(&mut row) };
+ if NO_ERROR != result {
+ return Err(result);
+ }
+
+ let result = unsafe { DeleteIpForwardEntry2(&row) };
+
+ if NO_ERROR == result {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// flush_routes method deletes all interface's routes.
+ /// It continues on failures, and returns the last error afterwards.
+ pub fn flush_routes(&self, address_family: ADDRESS_FAMILY) -> Result<(), NETIO_STATUS> {
+ let mut last_error: NETIO_STATUS = NO_ERROR;
+
+ let mut p_table: PMIB_IPFORWARD_TABLE2 = ptr::null_mut();
+ let result = unsafe { GetIpForwardTable2(address_family, &mut p_table) };
+ if NO_ERROR != result {
+ return Err(result);
+ }
+
+ assert!(!p_table.is_null());
+ let num_entries = unsafe { *p_table }.NumEntries;
+ let x_table = unsafe { *p_table }.Table.as_ptr();
+ for i in 0..num_entries {
+ let current_entry = unsafe { x_table.add(i as _) };
+ if unsafe { (*current_entry).InterfaceLuid.Value } == self.luid.Value {
+ let result = unsafe { DeleteIpForwardEntry2(current_entry) };
+ if NO_ERROR != result {
+ last_error = result;
+ }
+ }
+ }
+
+ unsafe { FreeMibTable(p_table as _) };
+
+ if NO_ERROR == last_error {
+ Ok(())
+ } else {
+ Err(result)
+ }
+ }
+
+ /// flush_routes_ipv4 method deletes all interface's routes.
+ /// It continues on failures, and returns the last error afterwards.
+ pub fn flush_routes_ipv4(&self) -> Result<(), NETIO_STATUS> {
+ self.flush_routes(AF_INET as _)
+ }
+
+ /// flush_routes_ipv6 method deletes all interface's routes.
+ /// It continues on failures, and returns the last error afterwards.
+ pub fn flush_routes_ipv6(&self) -> Result<(), NETIO_STATUS> {
+ self.flush_routes(AF_INET6 as _)
+ }
+
+ /// flush_dns method clears all DNS servers associated with the adapter.
+ fn flush_dns(&self, family: ADDRESS_FAMILY) -> Result<(), String> {
+ let ip_itf = match self.get_ip_interface(family) {
+ Ok(ip_itf) => ip_itf,
+ Err(_) => {
+ return Err(String::from("Failed to obtain interface"));
+ }
+ };
+
+ netsh::flush_dns(family, ip_itf.InterfaceIndex)
+ }
+
+ /// flush_dns_ipv4 method clears all DNS servers associated with the adapter.
+ pub fn flush_dns_ipv4(&self) -> Result<(), String> {
+ self.flush_dns(AF_INET as _)
+ }
+
+ /// flush_dns_ipv6 method clears all DNS servers associated with the adapter.
+ pub fn flush_dns_ipv6(&self) -> Result<(), String> {
+ self.flush_dns(AF_INET6 as _)
+ }
+
+ /// Sets MTU on the interface
+ /// TODO: Set IP and other things in here too, so the code is more organized
+ pub fn set_iface_config(&self, mtu: u32) -> Result<(), NETIO_STATUS> {
+ // SAFETY: Both NET_LUID_LH unions should be the same. We're just copying out
+ // the u64 value and re-wrapping it, since wintun doesn't refer to the windows
+ // crate's version of NET_LUID_LH.
+ self.try_set_mtu(AF_INET as ADDRESS_FAMILY, mtu)?;
+ self.try_set_mtu(AF_INET6 as ADDRESS_FAMILY, mtu)?;
+ Ok(())
+ }
+
+ fn try_set_mtu(&self, family: ADDRESS_FAMILY, mut mtu: u32) -> Result<(), NETIO_STATUS> {
+ let mut row = MIB_IPINTERFACE_ROW {
+ Family: family,
+ InterfaceLuid: self.luid,
+ ..Default::default()
+ };
+
+ // SAFETY: TODO
+ let error = unsafe { GetIpInterfaceEntry(&mut row) };
+ if error != NO_ERROR {
+ if family == (AF_INET6 as ADDRESS_FAMILY) && error == ERROR_NOT_FOUND {
+ tracing::debug!(?family, "Couldn't set MTU, maybe IPv6 is disabled.");
+ } else {
+ tracing::warn!(?family, "Couldn't set MTU: {}", error);
+ }
+ return Err(error);
+ }
+
+ if family == (AF_INET6 as ADDRESS_FAMILY) {
+ // ipv6 mtu must be at least 1280
+ mtu = 1280.max(mtu);
+ }
+
+ // https://stackoverflow.com/questions/54857292/setipinterfaceentry-returns-error-invalid-parameter
+ row.SitePrefixLength = 0;
+
+ row.NlMtu = mtu;
+
+ // SAFETY: TODO
+ let ret = unsafe { SetIpInterfaceEntry(&mut row) };
+ if NO_ERROR == ret {
+ Ok(())
+ } else {
+ Err(ret)
+ }
+ }
+}
diff --git a/easytier/src/common/ifcfg/win/mod.rs b/easytier/src/common/ifcfg/win/mod.rs
new file mode 100644
index 000000000..5c850f465
--- /dev/null
+++ b/easytier/src/common/ifcfg/win/mod.rs
@@ -0,0 +1,3 @@
+pub mod luid;
+pub mod netsh;
+pub mod types;
diff --git a/easytier/src/common/ifcfg/win/netsh.rs b/easytier/src/common/ifcfg/win/netsh.rs
new file mode 100644
index 000000000..267d404f6
--- /dev/null
+++ b/easytier/src/common/ifcfg/win/netsh.rs
@@ -0,0 +1,118 @@
+//
+// Port supporting code for wireguard-nt from wireguard-windows v0.5.3 to Rust
+// This file replicates the functionality of wireguard-windows/tunnel/winipcfg/netsh.go
+//
+
+use std::{
+ net::{Ipv4Addr, Ipv6Addr},
+ process::{Command, Stdio},
+};
+use winapi::shared::ws2def::{ADDRESS_FAMILY, AF_INET, AF_INET6};
+
+pub fn flush_dns(family: ADDRESS_FAMILY, if_index: u32) -> Result<(), String> {
+ let proto_name = match family as i32 {
+ AF_INET => "ipv4",
+ AF_INET6 => "ipv6",
+ _ => {
+ return Err(String::from("Invalid address family"));
+ }
+ };
+
+ //let netsh_params = format!("interface {proto} set dnsservers name={itf} source=static address=none validate=no register=both", proto=proto_name, itf=ip_itf.InterfaceIndex);
+ let ret_netsh = Command::new("netsh.exe")
+ .arg("interface")
+ .arg(proto_name)
+ .arg("set")
+ .arg("dnsservers")
+ .arg(format!("name={}", if_index))
+ .arg("source=static")
+ .arg("address=none")
+ .arg("validate=no")
+ .arg("register=both")
+ .stdin(Stdio::piped())
+ .stdout(Stdio::piped())
+ .output();
+ match ret_netsh {
+ Ok(output) => {
+ // netsh.exe returns error messages only and is silent upon success. BUT then it will return \r\n, so we need to look at the lines.
+ if let Ok(stdout_str) = String::from_utf8(output.stdout) {
+ if stdout_str.is_empty() || stdout_str == "\r\n" {
+ Ok(())
+ } else {
+ // TODO: ignore "There are no Domain Name Servers (DNS) configured on this computer."
+ // Is this string localized?
+ Err(stdout_str)
+ }
+ } else {
+ Err(String::from("Could not parse netsh output"))
+ }
+ }
+ Err(_) => Err(String::from("Failed to execute command")),
+ }
+}
+
+// Please execute flush_dns() first, as written in the original source code.
+fn add_dns(family: ADDRESS_FAMILY, if_index: u32, dnses: &[String]) -> Result<(), String> {
+ let proto_name = match family as i32 {
+ AF_INET => "ipv4",
+ AF_INET6 => "ipv6",
+ _ => {
+ return Err(String::from("Invalid address family"));
+ }
+ };
+
+ // "interface ipv4 add dnsservers name=%d address=%s validate=no"
+ let ret_netsh = Command::new("netsh.exe")
+ .arg("interface")
+ .arg(proto_name)
+ .arg("add")
+ .arg("dnsservers")
+ .arg(format!("name={}", if_index))
+ .arg(format!(
+ "address={}",
+ dnses
+ .iter()
+ .map(|x| x.to_string())
+ .collect::
>()
+ .join(",")
+ ))
+ .arg("validate=no")
+ .stdin(Stdio::piped())
+ .stdout(Stdio::piped())
+ .output();
+ match ret_netsh {
+ Ok(output) => {
+ // netsh.exe returns error messages only and is silent upon success. BUT then it will return \r\n, so we need to look at the lines.
+ if let Ok(stdout_str) = String::from_utf8(output.stdout) {
+ if stdout_str.is_empty() || stdout_str == "\r\n" {
+ Ok(())
+ } else {
+ // TODO: ignore "There are no Domain Name Servers (DNS) configured on this computer."
+ // Is this string localized?
+ Err(stdout_str)
+ }
+ } else {
+ Err(String::from("Could not parse netsh output"))
+ }
+ }
+ Err(_) => Err(String::from("Failed to execute command")),
+ }
+}
+
+pub fn add_dns_ipv4(if_index: u32, dnses: &[Ipv4Addr]) -> Result<(), String> {
+ flush_dns(AF_INET as _, if_index)?;
+ if dnses.is_empty() {
+ return Ok(());
+ }
+ let dnses_str: Vec = dnses.iter().map(|addr| addr.to_string()).collect();
+ add_dns(AF_INET as _, if_index, &dnses_str)
+}
+
+pub fn add_dns_ipv6(if_index: u32, dnses: &[Ipv6Addr]) -> Result<(), String> {
+ flush_dns(AF_INET6 as _, if_index)?;
+ if dnses.is_empty() {
+ return Ok(());
+ }
+ let dnses_str: Vec = dnses.iter().map(|addr| addr.to_string()).collect();
+ add_dns(AF_INET6 as _, if_index, &dnses_str)
+}
diff --git a/easytier/src/common/ifcfg/win/types.rs b/easytier/src/common/ifcfg/win/types.rs
new file mode 100644
index 000000000..ee030c408
--- /dev/null
+++ b/easytier/src/common/ifcfg/win/types.rs
@@ -0,0 +1,103 @@
+//
+// Port supporting code for wireguard-nt from wireguard-windows v0.5.3 to Rust
+// This file replicates parts of wireguard-windows/tunnel/winipcfg/types.go
+//
+
+use cidr::{Ipv4Inet, Ipv6Inet};
+use std::ffi::OsString;
+use std::net::{Ipv4Addr, Ipv6Addr};
+use std::os::windows::prelude::*;
+use winapi::shared::ws2def::*;
+use winapi::shared::ws2ipdef::*;
+
+#[derive(Hash, Eq, PartialEq, Debug)]
+pub struct RouteDataIpv4 {
+ pub destination: Ipv4Inet,
+ pub next_hop: Ipv4Addr,
+ pub metric: u32,
+}
+
+#[derive(Hash, Eq, PartialEq, Debug)]
+pub struct RouteDataIpv6 {
+ pub destination: Ipv6Inet,
+ pub next_hop: Ipv6Addr,
+ pub metric: u32,
+}
+
+/// This function converts std::net::Ipv4Addr to winapi::shared::inaddr::in_addr
+#[inline]
+pub fn convert_ipv4addr_to_inaddr(ip: &Ipv4Addr) -> winapi::shared::inaddr::in_addr {
+ let mut winaddr = winapi::shared::inaddr::in_addr::default();
+
+ let s_un_b = unsafe { winaddr.S_un.S_un_b_mut() };
+ s_un_b.s_b1 = ip.octets()[0];
+ s_un_b.s_b2 = ip.octets()[1];
+ s_un_b.s_b3 = ip.octets()[2];
+ s_un_b.s_b4 = ip.octets()[3];
+
+ winaddr
+}
+
+/// This function converts std::net::Ipv6Addr to winapi::shared::in6addr::in6_addr
+#[inline]
+pub fn convert_ipv6addr_to_inaddr(ip: &Ipv6Addr) -> winapi::shared::in6addr::in6_addr {
+ let mut winaddr = winapi::shared::in6addr::in6_addr::default();
+ let octets = ip.octets();
+ for i in 0..octets.len() {
+ unsafe { winaddr.u.Byte_mut()[i] = octets[i] };
+ }
+
+ winaddr
+}
+
+/// This function converts std::net::Ipv4Addr to winapi::shared::ws2def::SOCKADDR_IN
+pub fn convert_ipv4addr_to_sockaddr(ip: &Ipv4Addr) -> SOCKADDR_IN {
+ SOCKADDR_IN {
+ sin_family: AF_INET as ADDRESS_FAMILY,
+ sin_addr: convert_ipv4addr_to_inaddr(ip),
+ ..Default::default()
+ }
+}
+
+/// This function converts ipnet::Ipv6Addr to winapi::shared::ws2ipdef::SOCKADDR_IN6
+pub fn convert_ipv6addr_to_sockaddr(ip: &Ipv6Addr) -> SOCKADDR_IN6 {
+ SOCKADDR_IN6 {
+ sin6_family: AF_INET6 as ADDRESS_FAMILY,
+ sin6_addr: convert_ipv6addr_to_inaddr(ip),
+ ..Default::default()
+ }
+}
+
+/// This function converts winapi::shared::ws2def::SOCKADDR_IN to std::net::Ipv4Addr
+pub fn convert_sockaddr_to_ipv4addr(sockaddr: &SOCKADDR_IN) -> Ipv4Addr {
+ unsafe {
+ Ipv4Addr::new(
+ sockaddr.sin_addr.S_un.S_un_b().s_b1,
+ sockaddr.sin_addr.S_un.S_un_b().s_b2,
+ sockaddr.sin_addr.S_un.S_un_b().s_b3,
+ sockaddr.sin_addr.S_un.S_un_b().s_b4,
+ )
+ }
+}
+
+/// This function converts a null-terminated Windows Unicode PWCHAR/LPWSTR to an OsString
+pub fn u16_ptr_to_osstring(ptr: *const u16) -> OsString {
+ assert!(!ptr.is_null());
+ let len = (0..)
+ .take_while(|&i| unsafe { *ptr.offset(i) } != 0)
+ .count();
+ let slice = unsafe { std::slice::from_raw_parts(ptr, len) };
+
+ OsString::from_wide(slice)
+}
+
+/// This function converts a null-terminated Windows PWCHAR/LPWSTR to a String
+pub fn u16_ptr_to_string(ptr: *const u16) -> String {
+ assert!(!ptr.is_null());
+ let len = (0..)
+ .take_while(|&i| unsafe { *ptr.offset(i) } != 0)
+ .count();
+ let slice = unsafe { std::slice::from_raw_parts(ptr, len) };
+
+ String::from_utf16_lossy(slice)
+}
diff --git a/easytier/src/common/ifcfg/windows.rs b/easytier/src/common/ifcfg/windows.rs
index 5699104f5..3d5d27d4c 100644
--- a/easytier/src/common/ifcfg/windows.rs
+++ b/easytier/src/common/ifcfg/windows.rs
@@ -1,61 +1,185 @@
-use std::{io, net::Ipv4Addr};
+use crate::common::ifcfg::win::types::{RouteDataIpv4, RouteDataIpv6};
+use super::win::luid::InterfaceLuid;
use async_trait::async_trait;
+use cidr::{Ipv4Inet, Ipv6Inet};
+use std::{
+ io,
+ net::{Ipv4Addr, Ipv6Addr},
+ ptr::null_mut,
+};
+use windows_sys::Win32::{
+ Foundation::NO_ERROR,
+ NetworkManagement::IpHelper::{GetIfEntry, SetIfEntry, MIB_IFROW},
+ System::Diagnostics::Debug::{
+ FormatMessageW, FORMAT_MESSAGE_FROM_SYSTEM, FORMAT_MESSAGE_IGNORE_INSERTS,
+ },
+};
use winreg::{
enums::{HKEY_LOCAL_MACHINE, KEY_READ, KEY_WRITE},
RegKey,
};
-use super::{cidr_to_subnet_mask, run_shell_cmd, Error, IfConfiguerTrait};
-
+use super::{Error, IfConfiguerTrait};
pub struct WindowsIfConfiger {}
+fn format_win_error(error: u32) -> String {
+ // use FormatMessageW to get the error message
+ let mut buffer = vec![0; 1024];
+ let size = buffer.len() as u32;
+ let flags = FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS;
+
+ unsafe {
+ FormatMessageW(
+ flags,
+ null_mut(),
+ error,
+ 0,
+ buffer.as_mut_ptr() as *mut u16,
+ size,
+ null_mut(),
+ );
+ }
+ let str_end = buffer.iter().position(|&b| b == 0).unwrap_or(buffer.len());
+ format!(
+ "{} (code: {})",
+ String::from_utf16_lossy(&buffer[..str_end])
+ .trim()
+ .to_string(),
+ error
+ )
+}
+
impl WindowsIfConfiger {
pub fn get_interface_index(name: &str) -> Option {
crate::arch::windows::find_interface_index(name).ok()
}
- async fn list_ipv4(name: &str) -> Result, Error> {
- use anyhow::Context;
- use network_interface::NetworkInterfaceConfig;
- use std::net::IpAddr;
- let ret = network_interface::NetworkInterface::show().with_context(|| "show interface")?;
- let addrs = ret
- .iter()
- .filter_map(|x| {
- if x.name != name {
- return None;
- }
- Some(x.addr.clone())
- })
- .flat_map(|x| x)
- .map(|x| x.ip())
- .filter_map(|x| {
- if let IpAddr::V4(ipv4) = x {
- Some(ipv4)
+ #[tracing::instrument(err, ret)]
+ async fn add_ip_address(name: &str, addr: Ipv4Inet) -> Result<(), Error> {
+ let if_index = Self::get_interface_index(name).ok_or(Error::NotFound)?;
+ let luid = InterfaceLuid::luid_from_index(if_index).map_err(|e| {
+ anyhow::anyhow!("Failed to get interface luid: {}", format_win_error(e))
+ })?;
+ luid.add_ipv4_address(&addr)
+ .map_err(|e| anyhow::anyhow!("Failed to add IPv4 address: {}", format_win_error(e)))?;
+ Ok(())
+ }
+
+ #[tracing::instrument(err, ret)]
+ async fn remove_ip_address(name: &str, addr: Option) -> Result<(), Error> {
+ let Some(if_index) = Self::get_interface_index(name) else {
+ return Err(Error::NotFound);
+ };
+ let luid = InterfaceLuid::luid_from_index(if_index).map_err(|e| {
+ anyhow::anyhow!("Failed to get interface luid: {}", format_win_error(e))
+ })?;
+ if let Some(addr) = addr {
+ luid.delete_ipv4_address(&addr).map_err(|e| {
+ anyhow::anyhow!("Failed to delete IPv4 address: {}", format_win_error(e))
+ })?;
+ } else {
+ luid.flush_ipv4_addresses().map_err(|e| {
+ anyhow::anyhow!("Failed to flush IPv4 addresses: {}", format_win_error(e))
+ })?;
+ }
+ Ok(())
+ }
+
+ #[tracing::instrument(err, ret)]
+ async fn set_interface_status(name: &str, up: bool) -> Result<(), Error> {
+ let Some(if_index) = Self::get_interface_index(name) else {
+ return Err(Error::NotFound);
+ };
+
+ unsafe {
+ let mut if_row = MIB_IFROW {
+ wszName: [0; 256],
+ dwIndex: if_index,
+ dwType: 0,
+ dwMtu: 0,
+ dwSpeed: 0,
+ dwPhysAddrLen: 0,
+ bPhysAddr: [0; 8],
+ dwAdminStatus: if up { 1 } else { 2 }, // 1 = up, 2 = down
+ dwOperStatus: 0,
+ dwLastChange: 0,
+ dwInOctets: 0,
+ dwInUcastPkts: 0,
+ dwInNUcastPkts: 0,
+ dwInDiscards: 0,
+ dwInErrors: 0,
+ dwInUnknownProtos: 0,
+ dwOutOctets: 0,
+ dwOutUcastPkts: 0,
+ dwOutNUcastPkts: 0,
+ dwOutDiscards: 0,
+ dwOutErrors: 0,
+ dwOutQLen: 0,
+ dwDescrLen: 0,
+ bDescr: [0; 256],
+ };
+
+ if GetIfEntry(&mut if_row) == NO_ERROR {
+ if SetIfEntry(&if_row) == NO_ERROR {
+ Ok(())
} else {
- None
+ Err(anyhow::anyhow!("Failed to set interface status").into())
}
- })
- .collect::>();
+ } else {
+ Err(anyhow::anyhow!("Failed to get interface entry").into())
+ }
+ }
+ }
- Ok(addrs)
+ #[tracing::instrument(err, ret)]
+ async fn set_interface_mtu(name: &str, mtu: u32) -> Result<(), Error> {
+ let Some(if_index) = Self::get_interface_index(name) else {
+ return Err(Error::NotFound);
+ };
+ let luid = InterfaceLuid::luid_from_index(if_index).map_err(|e| {
+ anyhow::anyhow!("Failed to get interface luid: {}", format_win_error(e))
+ })?;
+ luid.set_iface_config(mtu).map_err(|e| {
+ anyhow::anyhow!("Failed to set interface config: {}", format_win_error(e))
+ })?;
+ Ok(())
}
- async fn remove_one_ipv4(name: &str, ip: Ipv4Addr) -> Result<(), Error> {
- run_shell_cmd(
- format!(
- "netsh interface ipv4 delete address {} address={}",
- name,
- ip.to_string()
- )
- .as_str(),
- )
- .await
+ #[tracing::instrument(err, ret)]
+ async fn add_ipv6_address(name: &str, addr: Ipv6Inet) -> Result<(), Error> {
+ let Some(if_index) = Self::get_interface_index(name) else {
+ return Err(Error::NotFound);
+ };
+ let luid = InterfaceLuid::luid_from_index(if_index).map_err(|e| {
+ anyhow::anyhow!("Failed to get interface luid: {}", format_win_error(e))
+ })?;
+ luid.add_ipv6_address(&addr)
+ .map_err(|e| anyhow::anyhow!("Failed to add IPv6 address: {}", format_win_error(e)))?;
+ Ok(())
+ }
+
+ #[tracing::instrument(err, ret)]
+ async fn remove_ipv6_address(name: &str, addr: Option) -> Result<(), Error> {
+ let Some(if_index) = Self::get_interface_index(name) else {
+ return Err(Error::NotFound);
+ };
+ let luid = InterfaceLuid::luid_from_index(if_index).map_err(|e| {
+ anyhow::anyhow!("Failed to get interface luid: {}", format_win_error(e))
+ })?;
+ if let Some(addr) = addr {
+ luid.delete_ipv6_address(&addr).map_err(|e| {
+ anyhow::anyhow!("Failed to delete IPv6 address: {}", format_win_error(e))
+ })?;
+ } else {
+ luid.flush_ipv6_addresses().map_err(|e| {
+ anyhow::anyhow!("Failed to flush IPv6 addresses: {}", format_win_error(e))
+ })?;
+ }
+ Ok(())
}
}
-#[cfg(target_os = "windows")]
#[async_trait]
impl IfConfiguerTrait for WindowsIfConfiger {
async fn add_ipv4_route(
@@ -65,20 +189,20 @@ impl IfConfiguerTrait for WindowsIfConfiger {
cidr_prefix: u8,
cost: Option,
) -> Result<(), Error> {
- let Some(idx) = Self::get_interface_index(name) else {
+ let Some(if_index) = Self::get_interface_index(name) else {
return Err(Error::NotFound);
};
- run_shell_cmd(
- format!(
- "route ADD {} MASK {} 10.1.1.1 IF {} METRIC {}",
- address,
- cidr_to_subnet_mask(cidr_prefix),
- idx,
- cost.unwrap_or(9000)
- )
- .as_str(),
- )
- .await
+ let luid = InterfaceLuid::luid_from_index(if_index).map_err(|e| {
+ anyhow::anyhow!("Failed to get interface luid: {}", format_win_error(e))
+ })?;
+
+ luid.add_routes_ipv4([RouteDataIpv4 {
+ destination: Ipv4Inet::new(address, cidr_prefix).unwrap(),
+ next_hop: Ipv4Addr::UNSPECIFIED,
+ metric: cost.unwrap_or(9000) as u32,
+ }])
+ .map_err(|e| anyhow::anyhow!("Failed to add route: {}", format_win_error(e)))?;
+ Ok(())
}
async fn remove_ipv4_route(
@@ -87,19 +211,18 @@ impl IfConfiguerTrait for WindowsIfConfiger {
address: Ipv4Addr,
cidr_prefix: u8,
) -> Result<(), Error> {
- let Some(idx) = Self::get_interface_index(name) else {
+ let Some(if_index) = Self::get_interface_index(name) else {
return Err(Error::NotFound);
};
- run_shell_cmd(
- format!(
- "route DELETE {} MASK {} IF {}",
- address,
- cidr_to_subnet_mask(cidr_prefix),
- idx
- )
- .as_str(),
+ let luid = InterfaceLuid::luid_from_index(if_index).map_err(|e| {
+ anyhow::anyhow!("Failed to get interface luid: {}", format_win_error(e))
+ })?;
+ luid.delete_route_ipv4(
+ &Ipv4Inet::new(address, cidr_prefix).unwrap(),
+ &Ipv4Addr::UNSPECIFIED,
)
- .await
+ .map_err(|e| anyhow::anyhow!("Failed to delete route: {}", format_win_error(e)))?;
+ Ok(())
}
async fn add_ipv4_ip(
@@ -108,39 +231,15 @@ impl IfConfiguerTrait for WindowsIfConfiger {
address: Ipv4Addr,
cidr_prefix: u8,
) -> Result<(), Error> {
- run_shell_cmd(
- format!(
- "netsh interface ipv4 add address {} address={} mask={}",
- name,
- address,
- cidr_to_subnet_mask(cidr_prefix)
- )
- .as_str(),
- )
- .await
+ Self::add_ip_address(name, Ipv4Inet::new(address, cidr_prefix).unwrap()).await
}
async fn set_link_status(&self, name: &str, up: bool) -> Result<(), Error> {
- run_shell_cmd(
- format!(
- "netsh interface set interface {} {}",
- name,
- if up { "enable" } else { "disable" }
- )
- .as_str(),
- )
- .await
+ Self::set_interface_status(name, up).await
}
- async fn remove_ip(&self, name: &str, ip: Option) -> Result<(), Error> {
- if ip.is_none() {
- for ip in Self::list_ipv4(name).await?.iter() {
- Self::remove_one_ipv4(name, *ip).await?;
- }
- Ok(())
- } else {
- Self::remove_one_ipv4(name, ip.unwrap()).await
- }
+ async fn remove_ip(&self, name: &str, ip: Option) -> Result<(), Error> {
+ Self::remove_ip_address(name, ip).await
}
async fn wait_interface_show(&self, name: &str) -> Result<(), Error> {
@@ -160,14 +259,66 @@ impl IfConfiguerTrait for WindowsIfConfiger {
}
async fn set_mtu(&self, name: &str, mtu: u32) -> Result<(), Error> {
- let _ = run_shell_cmd(
- format!("netsh interface ipv6 set subinterface {} mtu={}", name, mtu).as_str(),
- )
- .await;
- run_shell_cmd(
- format!("netsh interface ipv4 set subinterface {} mtu={}", name, mtu).as_str(),
+ Self::set_interface_mtu(name, mtu).await
+ }
+
+ async fn add_ipv6_ip(
+ &self,
+ name: &str,
+ address: Ipv6Addr,
+ cidr_prefix: u8,
+ ) -> Result<(), Error> {
+ Self::add_ipv6_address(name, Ipv6Inet::new(address, cidr_prefix).unwrap()).await
+ }
+
+ async fn remove_ipv6(&self, name: &str, ip: Option) -> Result<(), Error> {
+ Self::remove_ipv6_address(name, ip).await
+ }
+
+ async fn add_ipv6_route(
+ &self,
+ name: &str,
+ address: Ipv6Addr,
+ cidr_prefix: u8,
+ cost: Option,
+ ) -> Result<(), Error> {
+ let Some(if_index) = Self::get_interface_index(name) else {
+ return Err(Error::NotFound);
+ };
+
+ let luid = InterfaceLuid::luid_from_index(if_index).map_err(|e| {
+ anyhow::anyhow!("Failed to get interface luid: {}", format_win_error(e))
+ })?;
+
+ luid.add_routes_ipv6([RouteDataIpv6 {
+ destination: Ipv6Inet::new(address, cidr_prefix).unwrap(),
+ next_hop: Ipv6Addr::UNSPECIFIED,
+ metric: cost.unwrap_or(9000) as u32,
+ }])
+ .map_err(|e| anyhow::anyhow!("Failed to add route: {}", format_win_error(e)))?;
+ Ok(())
+ }
+
+ async fn remove_ipv6_route(
+ &self,
+ name: &str,
+ address: Ipv6Addr,
+ cidr_prefix: u8,
+ ) -> Result<(), Error> {
+ let Some(if_index) = Self::get_interface_index(name) else {
+ return Err(Error::NotFound);
+ };
+
+ let luid = InterfaceLuid::luid_from_index(if_index).map_err(|e| {
+ anyhow::anyhow!("Failed to get interface luid: {}", format_win_error(e))
+ })?;
+
+ luid.delete_route_ipv6(
+ &Ipv6Inet::new(address, cidr_prefix).unwrap(),
+ &Ipv6Addr::UNSPECIFIED,
)
- .await
+ .map_err(|e| anyhow::anyhow!("Failed to delete route: {}", format_win_error(e)))?;
+ Ok(())
}
}
diff --git a/easytier/src/common/mod.rs b/easytier/src/common/mod.rs
index 308f60d00..7d2572c73 100644
--- a/easytier/src/common/mod.rs
+++ b/easytier/src/common/mod.rs
@@ -10,6 +10,7 @@ use tracing::Instrument;
use crate::{set_global_var, use_global_var};
+pub mod acl_processor;
pub mod compressor;
pub mod config;
pub mod constants;
@@ -21,6 +22,7 @@ pub mod ifcfg;
pub mod netns;
pub mod network;
pub mod scoped_task;
+pub mod stats_manager;
pub mod stun;
pub mod stun_codec_ext;
pub mod token_bucket;
@@ -138,8 +140,8 @@ pub fn get_machine_id() -> uuid::Uuid {
)))]
let gen_mid = None;
- if gen_mid.is_some() {
- return gen_mid.unwrap();
+ if let Some(mid) = gen_mid {
+ return mid;
}
let gen_mid = uuid::Uuid::new_v4();
diff --git a/easytier/src/common/netns.rs b/easytier/src/common/netns.rs
index 4f6ba3e11..27f5289fd 100644
--- a/easytier/src/common/netns.rs
+++ b/easytier/src/common/netns.rs
@@ -34,13 +34,12 @@ impl NetNSGuard {
return;
}
- let ns_path: String;
let name = name.unwrap();
- if name == ROOT_NETNS_NAME {
- ns_path = "/proc/1/ns/net".to_string();
+ let ns_path: String = if name == ROOT_NETNS_NAME {
+ "/proc/1/ns/net".to_string()
} else {
- ns_path = format!("/var/run/netns/{}", name);
- }
+ format!("/var/run/netns/{}", name)
+ };
let ns = std::fs::File::open(ns_path).unwrap();
tracing::info!(
diff --git a/easytier/src/common/network.rs b/easytier/src/common/network.rs
index 8396a3039..73dd97c66 100644
--- a/easytier/src/common/network.rs
+++ b/easytier/src/common/network.rs
@@ -16,14 +16,14 @@ struct InterfaceFilter {
iface: NetworkInterface,
}
-#[cfg(target_os = "android")]
+#[cfg(any(target_os = "android", target_env = "ohos"))]
impl InterfaceFilter {
async fn filter_iface(&self) -> bool {
true
}
}
-#[cfg(target_os = "linux")]
+#[cfg(all(target_os = "linux", not(target_env = "ohos")))]
impl InterfaceFilter {
async fn is_tun_tap_device(&self) -> bool {
let path = format!("/sys/class/net/{}/tun_flags", self.iface.name);
@@ -211,7 +211,7 @@ impl IPCollector {
cached_ip_list.read().await.public_ipv6
);
- let sleep_sec = if !cached_ip_list.read().await.public_ipv4.is_none() {
+ let sleep_sec = if cached_ip_list.read().await.public_ipv4.is_some() {
CACHED_IP_LIST_TIMEOUT_SEC
} else {
3
@@ -252,14 +252,11 @@ impl IPCollector {
for iface in ifaces {
for ip in iface.ips {
let ip: std::net::IpAddr = ip.ip();
- match ip {
- std::net::IpAddr::V4(v4) => {
- if ip.is_loopback() || ip.is_multicast() {
- continue;
- }
- ret.interface_ipv4s.push(v4.into());
+ if let std::net::IpAddr::V4(v4) = ip {
+ if ip.is_loopback() || ip.is_multicast() {
+ continue;
}
- _ => {}
+ ret.interface_ipv4s.push(v4.into());
}
}
}
@@ -269,14 +266,11 @@ impl IPCollector {
for iface in ifaces {
for ip in iface.ips {
let ip: std::net::IpAddr = ip.ip();
- match ip {
- std::net::IpAddr::V6(v6) => {
- if v6.is_multicast() || v6.is_loopback() || v6.is_unicast_link_local() {
- continue;
- }
- ret.interface_ipv6s.push(v6.into());
+ if let std::net::IpAddr::V6(v6) = ip {
+ if v6.is_multicast() || v6.is_loopback() || v6.is_unicast_link_local() {
+ continue;
}
- _ => {}
+ ret.interface_ipv6s.push(v6.into());
}
}
}
diff --git a/easytier/src/common/stats_manager.rs b/easytier/src/common/stats_manager.rs
new file mode 100644
index 000000000..432901324
--- /dev/null
+++ b/easytier/src/common/stats_manager.rs
@@ -0,0 +1,886 @@
+use dashmap::DashMap;
+use serde::{Deserialize, Serialize};
+use std::cell::UnsafeCell;
+use std::fmt;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+use tokio::time::interval;
+
+use crate::common::scoped_task::ScopedTask;
+
+/// Predefined metric names for type safety
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum MetricName {
+ /// RPC calls sent to peers
+ PeerRpcClientTx,
+ /// RPC calls received from peers
+ PeerRpcClientRx,
+ /// RPC calls sent to peers
+ PeerRpcServerTx,
+ /// RPC calls received from peers
+ PeerRpcServerRx,
+ /// RPC call duration in milliseconds
+ PeerRpcDuration,
+ /// RPC errors
+ PeerRpcErrors,
+
+ /// Traffic bytes sent
+ TrafficBytesTx,
+ /// Traffic bytes received
+ TrafficBytesRx,
+ /// Traffic bytes forwarded
+ TrafficBytesForwarded,
+ /// Traffic bytes sent to self
+ TrafficBytesSelfTx,
+ /// Traffic bytes received from self
+ TrafficBytesSelfRx,
+ /// Traffic bytes forwarded for foreign network, rx to local
+ TrafficBytesForeignForwardRx,
+ /// Traffic bytes forwarded for foreign network, tx from local
+ TrafficBytesForeignForwardTx,
+ /// Traffic bytes forwarded for foreign network, forward
+ TrafficBytesForeignForwardForwarded,
+
+ /// Traffic packets sent
+ TrafficPacketsTx,
+ /// Traffic packets received
+ TrafficPacketsRx,
+ /// Traffic packets forwarded
+ TrafficPacketsForwarded,
+ /// Traffic packets sent to self
+ TrafficPacketsSelfTx,
+ /// Traffic packets received from self
+ TrafficPacketsSelfRx,
+ /// Traffic packets forwarded for foreign network, rx to local
+ TrafficPacketsForeignForwardRx,
+ /// Traffic packets forwarded for foreign network, tx from local
+ TrafficPacketsForeignForwardTx,
+ /// Traffic packets forwarded for foreign network, forward
+ TrafficPacketsForeignForwardForwarded,
+
+ /// Compression bytes before compression
+ CompressionBytesRxBefore,
+ /// Compression bytes after compression
+ CompressionBytesRxAfter,
+ /// Compression bytes before compression
+ CompressionBytesTxBefore,
+ /// Compression bytes after compression
+ CompressionBytesTxAfter,
+}
+
+impl fmt::Display for MetricName {
+ fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+ match self {
+ MetricName::PeerRpcClientTx => write!(f, "peer_rpc_client_tx"),
+ MetricName::PeerRpcClientRx => write!(f, "peer_rpc_client_rx"),
+ MetricName::PeerRpcServerTx => write!(f, "peer_rpc_server_tx"),
+ MetricName::PeerRpcServerRx => write!(f, "peer_rpc_server_rx"),
+ MetricName::PeerRpcDuration => write!(f, "peer_rpc_duration_ms"),
+ MetricName::PeerRpcErrors => write!(f, "peer_rpc_errors"),
+
+ MetricName::TrafficBytesTx => write!(f, "traffic_bytes_tx"),
+ MetricName::TrafficBytesRx => write!(f, "traffic_bytes_rx"),
+ MetricName::TrafficBytesForwarded => write!(f, "traffic_bytes_forwarded"),
+ MetricName::TrafficBytesSelfTx => write!(f, "traffic_bytes_self_tx"),
+ MetricName::TrafficBytesSelfRx => write!(f, "traffic_bytes_self_rx"),
+ MetricName::TrafficBytesForeignForwardRx => {
+ write!(f, "traffic_bytes_foreign_forward_rx")
+ }
+ MetricName::TrafficBytesForeignForwardTx => {
+ write!(f, "traffic_bytes_foreign_forward_tx")
+ }
+ MetricName::TrafficBytesForeignForwardForwarded => {
+ write!(f, "traffic_bytes_foreign_forward_forwarded")
+ }
+
+ MetricName::TrafficPacketsTx => write!(f, "traffic_packets_tx"),
+ MetricName::TrafficPacketsRx => write!(f, "traffic_packets_rx"),
+ MetricName::TrafficPacketsForwarded => write!(f, "traffic_packets_forwarded"),
+ MetricName::TrafficPacketsSelfTx => write!(f, "traffic_packets_self_tx"),
+ MetricName::TrafficPacketsSelfRx => write!(f, "traffic_packets_self_rx"),
+ MetricName::TrafficPacketsForeignForwardRx => {
+ write!(f, "traffic_packets_foreign_forward_rx")
+ }
+ MetricName::TrafficPacketsForeignForwardTx => {
+ write!(f, "traffic_packets_foreign_forward_tx")
+ }
+ MetricName::TrafficPacketsForeignForwardForwarded => {
+ write!(f, "traffic_packets_foreign_forward_forwarded")
+ }
+
+ MetricName::CompressionBytesRxBefore => write!(f, "compression_bytes_rx_before"),
+ MetricName::CompressionBytesRxAfter => write!(f, "compression_bytes_rx_after"),
+ MetricName::CompressionBytesTxBefore => write!(f, "compression_bytes_tx_before"),
+ MetricName::CompressionBytesTxAfter => write!(f, "compression_bytes_tx_after"),
+ }
+ }
+}
+
+/// Predefined label types for type safety
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum LabelType {
+ /// Network Name
+ NetworkName(String),
+ /// Source peer ID
+ SrcPeerId(u32),
+ /// Destination peer ID
+ DstPeerId(u32),
+ /// Service name
+ ServiceName(String),
+ /// Method name
+ MethodName(String),
+ /// Protocol type
+ Protocol(String),
+ /// Direction (tx/rx)
+ Direction(String),
+ /// Compression algorithm
+ CompressionAlgo(String),
+ /// Error type
+ ErrorType(String),
+ /// Status
+ Status(String),
+}
+
+impl fmt::Display for LabelType {
+ fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+ match self {
+ LabelType::NetworkName(name) => write!(f, "network_name={}", name),
+ LabelType::SrcPeerId(id) => write!(f, "src_peer_id={}", id),
+ LabelType::DstPeerId(id) => write!(f, "dst_peer_id={}", id),
+ LabelType::ServiceName(name) => write!(f, "service_name={}", name),
+ LabelType::MethodName(name) => write!(f, "method_name={}", name),
+ LabelType::Protocol(proto) => write!(f, "protocol={}", proto),
+ LabelType::Direction(dir) => write!(f, "direction={}", dir),
+ LabelType::CompressionAlgo(algo) => write!(f, "compression_algo={}", algo),
+ LabelType::ErrorType(err) => write!(f, "error_type={}", err),
+ LabelType::Status(status) => write!(f, "status={}", status),
+ }
+ }
+}
+
+impl LabelType {
+ pub fn key(&self) -> &'static str {
+ match self {
+ LabelType::NetworkName(_) => "network_name",
+ LabelType::SrcPeerId(_) => "src_peer_id",
+ LabelType::DstPeerId(_) => "dst_peer_id",
+ LabelType::ServiceName(_) => "service_name",
+ LabelType::MethodName(_) => "method_name",
+ LabelType::Protocol(_) => "protocol",
+ LabelType::Direction(_) => "direction",
+ LabelType::CompressionAlgo(_) => "compression_algo",
+ LabelType::ErrorType(_) => "error_type",
+ LabelType::Status(_) => "status",
+ }
+ }
+
+ pub fn value(&self) -> String {
+ match self {
+ LabelType::NetworkName(name) => name.clone(),
+ LabelType::SrcPeerId(id) => id.to_string(),
+ LabelType::DstPeerId(id) => id.to_string(),
+ LabelType::ServiceName(name) => name.clone(),
+ LabelType::MethodName(name) => name.clone(),
+ LabelType::Protocol(proto) => proto.clone(),
+ LabelType::Direction(dir) => dir.clone(),
+ LabelType::CompressionAlgo(algo) => algo.clone(),
+ LabelType::ErrorType(err) => err.clone(),
+ LabelType::Status(status) => status.clone(),
+ }
+ }
+}
+
+/// Label represents a key-value pair for metric identification
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct Label {
+ pub key: String,
+ pub value: String,
+}
+
+impl Label {
+ pub fn new(key: impl Into, value: impl Into) -> Self {
+ Self {
+ key: key.into(),
+ value: value.into(),
+ }
+ }
+
+ pub fn from_label_type(label_type: &LabelType) -> Self {
+ Self {
+ key: label_type.key().to_string(),
+ value: label_type.value(),
+ }
+ }
+}
+
+/// LabelSet represents a collection of labels for a metric
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct LabelSet {
+ labels: Vec,
+}
+
+impl LabelSet {
+ pub fn new() -> Self {
+ Self { labels: Vec::new() }
+ }
+
+ pub fn with_label(mut self, key: impl Into, value: impl Into) -> Self {
+ self.labels.push(Label::new(key, value));
+ self.labels.sort_by(|a, b| a.key.cmp(&b.key)); // Keep labels sorted for consistent hashing
+ self
+ }
+
+ /// Add a typed label to the set
+ pub fn with_label_type(mut self, label_type: LabelType) -> Self {
+ self.labels.push(Label::from_label_type(&label_type));
+ self.labels.sort_by(|a, b| a.key.cmp(&b.key)); // Keep labels sorted for consistent hashing
+ self
+ }
+
+ /// Create a LabelSet from multiple LabelTypes
+ pub fn from_label_types(label_types: &[LabelType]) -> Self {
+ let mut labels = Vec::new();
+ for label_type in label_types {
+ labels.push(Label::from_label_type(label_type));
+ }
+ labels.sort_by(|a, b| a.key.cmp(&b.key)); // Keep labels sorted for consistent hashing
+ Self { labels }
+ }
+
+ pub fn labels(&self) -> &[Label] {
+ &self.labels
+ }
+
+ /// Generate a string key for this label set
+ pub fn to_key(&self) -> String {
+ if self.labels.is_empty() {
+ return String::new();
+ }
+
+ let mut parts = Vec::with_capacity(self.labels.len());
+ for label in &self.labels {
+ parts.push(format!("{}={}", label.key, label.value));
+ }
+ parts.join(",")
+ }
+}
+
+impl Default for LabelSet {
+ fn default() -> Self {
+ Self::new()
+ }
+}
+
+/// UnsafeCounter provides a high-performance counter using UnsafeCell
+#[derive(Debug)]
+pub struct UnsafeCounter {
+ value: UnsafeCell,
+}
+
+impl Default for UnsafeCounter {
+ fn default() -> Self {
+ Self::new()
+ }
+}
+
+impl UnsafeCounter {
+ pub fn new() -> Self {
+ Self {
+ value: UnsafeCell::new(0),
+ }
+ }
+
+ pub fn new_with_value(initial: u64) -> Self {
+ Self {
+ value: UnsafeCell::new(initial),
+ }
+ }
+
+ /// Increment the counter by the given amount
+ /// # Safety
+ /// This method is unsafe because it uses UnsafeCell. The caller must ensure
+ /// that no other thread is accessing this counter simultaneously.
+ pub unsafe fn add(&self, delta: u64) {
+ let ptr = self.value.get();
+ *ptr = (*ptr).saturating_add(delta);
+ }
+
+ /// Increment the counter by 1
+ /// # Safety
+ /// This method is unsafe because it uses UnsafeCell. The caller must ensure
+ /// that no other thread is accessing this counter simultaneously.
+ pub unsafe fn inc(&self) {
+ self.add(1);
+ }
+
+ /// Get the current value of the counter
+ /// # Safety
+ /// This method is unsafe because it uses UnsafeCell. The caller must ensure
+ /// that no other thread is modifying this counter simultaneously.
+ pub unsafe fn get(&self) -> u64 {
+ let ptr = self.value.get();
+ *ptr
+ }
+
+ /// Reset the counter to zero
+ /// # Safety
+ /// This method is unsafe because it uses UnsafeCell. The caller must ensure
+ /// that no other thread is accessing this counter simultaneously.
+ pub unsafe fn reset(&self) {
+ let ptr = self.value.get();
+ *ptr = 0;
+ }
+
+ /// Set the counter to a specific value
+ /// # Safety
+ /// This method is unsafe because it uses UnsafeCell. The caller must ensure
+ /// that no other thread is accessing this counter simultaneously.
+ pub unsafe fn set(&self, value: u64) {
+ let ptr = self.value.get();
+ *ptr = value;
+ }
+}
+
+// UnsafeCounter is Send + Sync because the safety is guaranteed by the caller
+unsafe impl Send for UnsafeCounter {}
+unsafe impl Sync for UnsafeCounter {}
+
+/// MetricData contains both the counter and last update timestamp
+/// Uses UnsafeCell for lock-free access
+#[derive(Debug)]
+struct MetricData {
+ counter: UnsafeCounter,
+ last_updated: UnsafeCell,
+}
+
+impl MetricData {
+ fn new() -> Self {
+ Self {
+ counter: UnsafeCounter::new(),
+ last_updated: UnsafeCell::new(Instant::now()),
+ }
+ }
+
+ fn new_with_value(initial: u64) -> Self {
+ Self {
+ counter: UnsafeCounter::new_with_value(initial),
+ last_updated: UnsafeCell::new(Instant::now()),
+ }
+ }
+
+ /// Update the last_updated timestamp
+ /// # Safety
+ /// This method is unsafe because it uses UnsafeCell. The caller must ensure
+ /// that no other thread is accessing this timestamp simultaneously.
+ unsafe fn touch(&self) {
+ let ptr = self.last_updated.get();
+ *ptr = Instant::now();
+ }
+
+ /// Get the last updated timestamp
+ /// # Safety
+ /// This method is unsafe because it uses UnsafeCell. The caller must ensure
+ /// that no other thread is modifying this timestamp simultaneously.
+ unsafe fn get_last_updated(&self) -> Instant {
+ let ptr = self.last_updated.get();
+ *ptr
+ }
+}
+
+// MetricData is Send + Sync because the safety is guaranteed by the caller
+unsafe impl Send for MetricData {}
+unsafe impl Sync for MetricData {}
+
+/// MetricKey uniquely identifies a metric with its name and labels
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+struct MetricKey {
+ name: MetricName,
+ labels: LabelSet,
+}
+
+impl MetricKey {
+ fn new(name: MetricName, labels: LabelSet) -> Self {
+ Self { name, labels }
+ }
+}
+
+impl fmt::Display for MetricKey {
+ fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+ let label_str = self.labels.to_key();
+ if label_str.is_empty() {
+ f.write_str(self.name.to_string().as_str())
+ } else {
+ f.write_str(format!("{}[{}]", self.name, label_str).as_str())
+ }
+ }
+}
+
+/// CounterHandle provides a safe interface to a MetricData
+/// It ensures thread-local access patterns for performance
+#[derive(Clone)]
+pub struct CounterHandle {
+ metric_data: Arc,
+ _key: MetricKey, // Keep key for debugging purposes
+}
+
+impl CounterHandle {
+ fn new(metric_data: Arc, key: MetricKey) -> Self {
+ Self {
+ metric_data,
+ _key: key,
+ }
+ }
+
+ /// Increment the counter by the given amount
+ pub fn add(&self, delta: u64) {
+ unsafe {
+ self.metric_data.counter.add(delta);
+ self.metric_data.touch();
+ }
+ }
+
+ /// Increment the counter by 1
+ pub fn inc(&self) {
+ unsafe {
+ self.metric_data.counter.inc();
+ self.metric_data.touch();
+ }
+ }
+
+ /// Get the current value of the counter
+ pub fn get(&self) -> u64 {
+ unsafe { self.metric_data.counter.get() }
+ }
+
+ /// Reset the counter to zero
+ pub fn reset(&self) {
+ unsafe {
+ self.metric_data.counter.reset();
+ self.metric_data.touch();
+ }
+ }
+
+ /// Set the counter to a specific value
+ pub fn set(&self, value: u64) {
+ unsafe {
+ self.metric_data.counter.set(value);
+ self.metric_data.touch();
+ }
+ }
+}
+
+/// MetricSnapshot represents a point-in-time view of a metric
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct MetricSnapshot {
+ pub name: MetricName,
+ pub labels: LabelSet,
+ pub value: u64,
+}
+
+impl MetricSnapshot {
+ pub fn name_str(&self) -> String {
+ self.name.to_string()
+ }
+}
+
+/// StatsManager manages global statistics with high performance counters
+pub struct StatsManager {
+ counters: Arc>>,
+ cleanup_task: ScopedTask<()>,
+}
+
+impl StatsManager {
+ /// Create a new StatsManager
+ pub fn new() -> Self {
+ let counters = Arc::new(DashMap::new());
+
+ // Start cleanup task only if we're in a tokio runtime
+ let counters_clone = Arc::downgrade(&counters.clone());
+ let cleanup_task = tokio::spawn(async move {
+ let mut interval = interval(Duration::from_secs(60)); // Check every minute
+ loop {
+ interval.tick().await;
+
+ let cutoff_time = Instant::now() - Duration::from_secs(180); // 3 minutes
+
+ let Some(counters) = counters_clone.upgrade() else {
+ break;
+ };
+
+ // Remove entries that haven't been updated for 3 minutes
+ counters.retain(|_, metric_data: &mut Arc| unsafe {
+ metric_data.get_last_updated() > cutoff_time
+ });
+ }
+ });
+
+ Self {
+ counters,
+ cleanup_task: cleanup_task.into(),
+ }
+ }
+
+ /// Get or create a counter with the given name and labels
+ pub fn get_counter(&self, name: MetricName, labels: LabelSet) -> CounterHandle {
+ let key = MetricKey::new(name, labels);
+
+ let metric_data = self
+ .counters
+ .entry(key.clone())
+ .or_insert_with(|| Arc::new(MetricData::new()))
+ .clone();
+
+ CounterHandle::new(metric_data, key)
+ }
+
+ /// Get a counter with no labels
+ pub fn get_simple_counter(&self, name: MetricName) -> CounterHandle {
+ self.get_counter(name, LabelSet::new())
+ }
+
+ /// Get all metric snapshots
+ pub fn get_all_metrics(&self) -> Vec {
+ let mut metrics = Vec::new();
+
+ for entry in self.counters.iter() {
+ let key = entry.key();
+ let metric_data = entry.value();
+
+ let value = unsafe { metric_data.counter.get() };
+
+ metrics.push(MetricSnapshot {
+ name: key.name,
+ labels: key.labels.clone(),
+ value,
+ });
+ }
+
+ // Sort by metric name and then by labels for consistent output
+ metrics.sort_by(|a, b| {
+ a.name
+ .to_string()
+ .cmp(&b.name.to_string())
+ .then_with(|| a.labels.to_key().cmp(&b.labels.to_key()))
+ });
+
+ metrics
+ }
+
+ /// Get metrics filtered by name prefix
+ pub fn get_metrics_by_prefix(&self, prefix: &str) -> Vec {
+ self.get_all_metrics()
+ .into_iter()
+ .filter(|m| m.name.to_string().starts_with(prefix))
+ .collect()
+ }
+
+ /// Get a specific metric by name and labels
+ pub fn get_metric(&self, name: MetricName, labels: &LabelSet) -> Option 
-
+
+
+
+
-
+
+
+
-
+
+
+