Create tun_common subdir

Cargo.lock

@@ -6657,6 +6657,17 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "nym-ip-packet-requests"
+version = "0.1.0"
+dependencies = [
+ "bincode",
+ "bytes",
+ "nym-service-providers-common",
+ "nym-sphinx",
+ "serde",
+]
+
 [[package]]
 name = "nym-ip-packet-router"
 version = "0.1.0"
@@ -6670,11 +6681,13 @@ dependencies = [
  "nym-client-core",
  "nym-config",
  "nym-exit-policy",
+ "nym-ip-packet-requests",
  "nym-network-requester",
  "nym-sdk",
  "nym-service-providers-common",
  "nym-sphinx",
  "nym-task",
+ "nym-tun",
  "nym-wireguard",
  "nym-wireguard-types",
  "reqwest",
@@ -7465,6 +7478,19 @@ dependencies = [
  "wasm-utils",
 ]
 
+[[package]]
+name = "nym-tun"
+version = "0.1.0"
+dependencies = [
+ "boringtun",
+ "etherparse",
+ "log",
+ "nym-wireguard-types",
+ "thiserror",
+ "tokio",
+ "tokio-tun",
+]
+
 [[package]]
 name = "nym-types"
 version = "1.0.0"
@@ -7584,6 +7610,7 @@ version = "0.1.0"
 dependencies = [
  "async-recursion",
  "base64 0.21.4",
+ "bincode",
  "boringtun",
  "bytes",
  "dashmap",
@@ -7592,7 +7619,9 @@ dependencies = [
  "ip_network",
  "ip_network_table",
  "log",
+ "nym-sphinx",
  "nym-task",
+ "nym-tun",
  "nym-wireguard-types",
  "rand 0.8.5",
  "serde",
@@ -7608,14 +7637,19 @@ version = "0.1.0"
 dependencies = [
  "base64 0.21.4",
  "boringtun",
+ "bytes",
  "dashmap",
  "hmac 0.12.1",
+ "ip_network",
+ "ip_network_table",
+ "log",
  "nym-crypto",
  "rand 0.7.3",
  "serde",
  "serde_json",
  "sha2 0.10.8",
  "thiserror",
+ "tokio",
  "utoipa",
  "x25519-dalek 2.0.0",
 ]

Cargo.toml

@@ -49,6 +49,7 @@ members = [
     "common/exit-policy",
     "common/http-api-client",
     "common/inclusion-probability",
+    "common/ip-packet-requests",
     "common/ledger",
     "common/mixnode-common",
     "common/network-defaults",
@@ -74,6 +75,7 @@ members = [
     "common/store-cipher",
     "common/task",
     "common/topology",
+    "common/tun",
     "common/types",
     "common/wasm/client-core",
     "common/wasm/storage",

common/ip-packet-requests/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "nym-ip-packet-requests"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+bincode = "1.3.3"
+bytes = "1.5.0"
+nym-service-providers-common = { path = "../../service-providers/common" }
+nym-sphinx = { path = "../nymsphinx" }
+serde = { workspace = true, features = ["derive"] }

common/ip-packet-requests/src/lib.rs

@@ -0,0 +1,33 @@
+use nym_service_providers_common::interface;
+
+pub type IpPacketRouterRequest = interface::Request<TaggedIpPacket>;
+pub type IpPacketRouterResponse = interface::Response<IpPacket>;
+
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct TaggedIpPacket {
+    pub packet: bytes::Bytes,
+    pub return_address: nym_sphinx::addressing::clients::Recipient,
+    pub return_mix_hops: Option<u8>,
+    pub return_mix_delays: Option<f64>,
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct IpPacket {
+    pub packet: bytes::Bytes,
+}
+
+impl TaggedIpPacket {
+    pub fn from_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+}
+
+fn make_bincode_serializer() -> impl bincode::Options {
+    use bincode::Options;
+    bincode::DefaultOptions::new()
+        .with_big_endian()
+        .with_varint_encoding()
+}

common/tun/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "nym-tun"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+thiserror.workspace = true
+tokio = { workspace = true, features = ["rt-multi-thread", "net", "io-util", "time", "sync", "macros"] }
+etherparse = "0.13.0"
+log.workspace = true
+# TODO: remove
+boringtun = { workspace = true }
+nym-wireguard-types = { path = "../wireguard-types", optional = true }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+tokio-tun = "0.9.0"
+
+[features]
+wireguard = ["nym-wireguard-types"]

common/tun/src/lib.rs

@@ -0,0 +1,7 @@
+#[cfg(target_os = "linux")]
+mod linux;
+
+pub mod tun_task_channel;
+
+#[cfg(target_os = "linux")]
+pub use linux::tun_device;

common/tun/src/linux/tun_device.rs

@@ -1,7 +1,6 @@
 use std::{
     collections::HashMap,
     net::{IpAddr, Ipv4Addr},
-    sync::Arc,
     time::Duration,
 };
 
@@ -11,16 +10,18 @@ use tokio::{
     time::timeout,
 };
 
-use crate::{
-    active_peers::PeerEventSenderError,
-    event::Event,
-    tun_task_channel::{
-        tun_task_channel, tun_task_response_channel, TunTaskPayload, TunTaskResponseRx,
-        TunTaskResponseSendError, TunTaskResponseTx, TunTaskRx, TunTaskTx,
-    },
-    udp_listener::PeersByIp,
+use crate::tun_task_channel::{
+    tun_task_channel, tun_task_response_channel, TunTaskPayload, TunTaskResponseRx,
+    TunTaskResponseSendError, TunTaskResponseTx, TunTaskRx, TunTaskTx,
 };
 
+#[cfg(feature = "wireguard")]
+use nym_wireguard_types::tun_common::{
+    active_peers::{PeerEventSenderError, PeersByIp},
+    event::Event,
+};
+
+#[cfg(feature = "wireguard")]
 const MUTEX_LOCK_TIMEOUT_MS: u64 = 200;
 const TUN_WRITE_TIMEOUT_MS: u64 = 1000;
 
@@ -32,6 +33,7 @@ pub enum TunDeviceError {
     #[error("error writing to tun device: {source}")]
     TunWriteError { source: std::io::Error },
 
+    #[cfg(feature = "wireguard")]
     #[error("failed forwarding packet to peer: {source}")]
     ForwardToPeerFailed {
         #[from]
@@ -94,6 +96,7 @@ pub struct TunDevice {
 
 pub enum RoutingMode {
     // The routing table, as how wireguard does it
+    #[cfg(feature = "wireguard")]
     AllowedIps(AllowedIpsInner),
 
     // This is an alternative to the routing table, where we just match outgoing source IP with
@@ -108,15 +111,18 @@ impl RoutingMode {
         })
     }
 
-    pub fn new_allowed_ips(peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>) -> Self {
+    #[cfg(feature = "wireguard")]
+    pub fn new_allowed_ips(peers_by_ip: std::sync::Arc<tokio::sync::Mutex<PeersByIp>>) -> Self {
         RoutingMode::AllowedIps(AllowedIpsInner { peers_by_ip })
     }
 }
 
+#[cfg(feature = "wireguard")]
 pub struct AllowedIpsInner {
-    peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>,
+    peers_by_ip: std::sync::Arc<tokio::sync::Mutex<PeersByIp>>,
 }
 
+#[cfg(feature = "wireguard")]
 impl AllowedIpsInner {
     async fn lock(&self) -> Result<tokio::sync::MutexGuard<PeersByIp>, TunDeviceError> {
         timeout(
@@ -180,6 +186,7 @@ impl TunDevice {
         );
 
         // TODO: expire old entries
+        #[allow(irrefutable_let_patterns)]
         if let RoutingMode::Nat(nat_table) = &mut self.routing_mode {
             nat_table.nat_table.insert(src_addr, tag);
         }
@@ -207,6 +214,7 @@ impl TunDevice {
 
         match self.routing_mode {
             // This is how wireguard does it, by consulting the AllowedIPs table.
+            #[cfg(feature = "wireguard")]
             RoutingMode::AllowedIps(ref peers_by_ip) => {
                 let peers = peers_by_ip.lock().await?;
                 if let Some(peer_tx) = peers.longest_match(dst_addr).map(|(_, tx)| tx) {

common/wireguard-types/Cargo.toml

@@ -12,9 +12,14 @@ license.workspace = true
 
 [dependencies]
 base64 = { workspace = true }
+bytes = "1.5.0"
 dashmap = { workspace = true }
+ip_network = "0.4.1"
+ip_network_table = "0.2.0"
+log = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }
+tokio = { workspace = true, features = ["sync", "time"] }
 
 nym-crypto = { path = "../crypto", features = ["asymmetric"] }
 
@@ -45,4 +50,4 @@ nym-crypto = { path = "../crypto", features = ["rand"]}
 default = ["verify"]
 openapi = ["utoipa", "serde_json"]
 # this is moved to a separate feature as we really need clients to import it (especially, *cough*, wasm)
-verify = ["hmac", "sha2"]
+verify = ["hmac", "sha2"]

common/wireguard-types/src/lib.rs

@@ -4,6 +4,7 @@
 pub mod error;
 pub mod public_key;
 pub mod registration;
+pub mod tun_common;
 
 pub use error::Error;
 pub use public_key::PeerPublicKey;

common/wireguard-types/src/tun_common/active_peers.rs

@@ -5,24 +5,24 @@ use dashmap::{
     mapref::one::{Ref, RefMut},
     DashMap,
 };
-use tokio::{
-    sync::mpsc::{self},
-    time::{error::Elapsed, timeout},
-};
+use tokio::sync::mpsc::{self};
 
-use crate::event::Event;
+use crate::tun_common::{event::Event, network_table::NetworkTable};
+
+// Registered peers
+pub type PeersByIp = NetworkTable<PeerEventSender>;
 
 // Channels that are used to communicate with the various tunnels
 #[derive(Clone)]
 pub struct PeerEventSender(mpsc::Sender<Event>);
-pub(crate) struct PeerEventReceiver(mpsc::Receiver<Event>);
+pub struct PeerEventReceiver(mpsc::Receiver<Event>);
 
 #[derive(thiserror::Error, Debug)]
 pub enum PeerEventSenderError {
-    #[error("timeout")]
-    Timeout {
+    #[error("send failed: timeout: {source}")]
+    SendTimeoutError {
         #[from]
-        source: Elapsed,
+        source: mpsc::error::SendTimeoutError<Event>,
     },
 
     #[error("send failed: {source}")]
@@ -33,20 +33,21 @@ pub enum PeerEventSenderError {
 }
 
 impl PeerEventSender {
-    pub(crate) async fn send(&self, event: Event) -> Result<(), PeerEventSenderError> {
-        timeout(Duration::from_millis(1000), self.0.send(event))
-            .await?
-            .map_err(|err| err.into())
+    pub async fn send(&self, event: Event) -> Result<(), PeerEventSenderError> {
+        Ok(self
+            .0
+            .send_timeout(event, Duration::from_millis(1000))
+            .await?)
     }
 }
 
 impl PeerEventReceiver {
-    pub(crate) async fn recv(&mut self) -> Option<Event> {
+    pub async fn recv(&mut self) -> Option<Event> {
         self.0.recv().await
     }
 }
 
-pub(crate) fn peer_event_channel() -> (PeerEventSender, PeerEventReceiver) {
+pub fn peer_event_channel() -> (PeerEventSender, PeerEventReceiver) {
     let (tx, rx) = mpsc::channel(16);
     (PeerEventSender(tx), PeerEventReceiver(rx))
 }
@@ -55,20 +56,20 @@ pub(crate) type PeersByKey = DashMap<x25519::PublicKey, PeerEventSender>;
 pub(crate) type PeersByAddr = DashMap<SocketAddr, PeerEventSender>;
 
 #[derive(Default)]
-pub(crate) struct ActivePeers {
+pub struct ActivePeers {
     active_peers: PeersByKey,
     active_peers_by_addr: PeersByAddr,
 }
 
 impl ActivePeers {
-    pub(crate) fn remove(&self, public_key: &x25519::PublicKey) {
+    pub fn remove(&self, public_key: &x25519::PublicKey) {
         log::info!("Removing peer: {public_key:?}");
         self.active_peers.remove(public_key);
         log::warn!("TODO: remove from peers_by_ip?");
         log::warn!("TODO: remove from peers_by_addr");
     }
 
-    pub(crate) fn insert(
+    pub fn insert(
         &self,
         public_key: x25519::PublicKey,
         addr: SocketAddr,
@@ -78,17 +79,14 @@ impl ActivePeers {
         self.active_peers_by_addr.insert(addr, peer_tx);
     }
 
-    pub(crate) fn get_by_key_mut(
+    pub fn get_by_key_mut(
         &self,
         public_key: &x25519::PublicKey,
     ) -> Option<RefMut<'_, x25519::PublicKey, PeerEventSender>> {
         self.active_peers.get_mut(public_key)
     }
 
-    pub(crate) fn get_by_addr(
-        &self,
-        addr: &SocketAddr,
-    ) -> Option<Ref<'_, SocketAddr, PeerEventSender>> {
+    pub fn get_by_addr(&self, addr: &SocketAddr) -> Option<Ref<'_, SocketAddr, PeerEventSender>> {
         self.active_peers_by_addr.get(addr)
     }
 }

common/wireguard-types/src/tun_common/mod.rs

@@ -0,0 +1,3 @@
+pub mod active_peers;
+pub mod event;
+pub mod network_table;

common/wireguard-types/src/tun_common/network_table.rs

@@ -9,7 +9,7 @@ pub struct NetworkTable<T> {
 }
 
 impl<T> NetworkTable<T> {
-    pub(crate) fn new() -> Self {
+    pub fn new() -> Self {
         Self {
             ips: IpNetworkTable::new(),
         }

common/wireguard/Cargo.toml

@@ -13,6 +13,7 @@ license.workspace = true
 [dependencies]
 async-recursion = "1.0.4"
 base64 = "0.21.3"
+bincode = "1.3.3"
 # The latest version on crates.io at the time of writing this (6.0.0) has a
 # version mismatch with x25519-dalek/curve25519-dalek that is resolved in the
 # latest commit. So pick that for now.
@@ -27,6 +28,8 @@ ip_network_table = "0.2.0"
 log.workspace = true
 nym-task = { path = "../task" }
 nym-wireguard-types = { path = "../wireguard-types" }
+nym-sphinx = { path = "../nymsphinx" }
+nym-tun = { path = "../tun" , features = ["wireguard"] }
 rand.workspace = true
 serde = { workspace = true, features = ["derive"] }
 tap.workspace = true

common/wireguard/src/lib.rs

@@ -3,15 +3,15 @@
 // #![warn(clippy::expect_used)]
 // #![warn(clippy::unwrap_used)]
 
-mod active_peers;
+// mod active_peers;
 mod error;
-mod event;
-mod network_table;
+// mod event;
+// mod network_table;
 mod packet_relayer;
-mod platform;
+// mod platform;
 mod registered_peers;
 pub mod setup;
-pub mod tun_task_channel;
+// pub mod tun_task_channel;
 mod udp_listener;
 mod wg_tunnel;
 
@@ -20,7 +20,9 @@ use std::sync::Arc;
 
 // Currently the module related to setting up the virtual network device is platform specific.
 #[cfg(target_os = "linux")]
-pub use platform::linux::tun_device;
+use nym_tun::tun_device;
+
+use nym_tun::tun_task_channel;
 
 /// Start wireguard UDP listener and TUN device
 ///
@@ -36,7 +38,9 @@ pub async fn start_wireguard(
 
     // We can optionally index peers by their IP like standard wireguard. If we don't then we do
     // plain NAT where we match incoming destination IP with outgoing source IP.
-    let peers_by_ip = Arc::new(tokio::sync::Mutex::new(network_table::NetworkTable::new()));
+
+    use nym_wireguard_types::tun_common::network_table::NetworkTable;
+    let peers_by_ip = Arc::new(tokio::sync::Mutex::new(NetworkTable::new()));
 
     // Alternative 1:
     let routing_mode = tun_device::RoutingMode::new_allowed_ips(peers_by_ip.clone());

common/wireguard/src/packet_relayer.rs

@@ -3,11 +3,9 @@ use std::{collections::HashMap, sync::Arc};
 use tap::TapFallible;
 use tokio::sync::mpsc::{self};
 
-use crate::{
-    active_peers::PeerEventSender,
-    event::Event,
-    tun_task_channel::{TunTaskResponseRx, TunTaskTx},
-};
+use crate::tun_task_channel::{TunTaskResponseRx, TunTaskTx};
+
+use nym_wireguard_types::tun_common::{active_peers::PeerEventSender, event::Event};
 
 #[derive(Clone)]
 pub struct PacketRelaySender(pub(crate) mpsc::Sender<(u64, Vec<u8>)>);

common/wireguard/src/udp_listener.rs

@@ -7,15 +7,19 @@ use boringtun::{
 use futures::StreamExt;
 use log::error;
 use nym_task::TaskClient;
-use nym_wireguard_types::{registration::GatewayClientRegistry, PeerPublicKey, WG_PORT};
+use nym_wireguard_types::{
+    registration::GatewayClientRegistry,
+    tun_common::{
+        active_peers::{ActivePeers, PeersByIp},
+        event::Event,
+    },
+    PeerPublicKey, WG_PORT,
+};
 use tap::TapFallible;
 use tokio::{net::UdpSocket, sync::Mutex};
 
 use crate::{
-    active_peers::{ActivePeers, PeerEventSender},
     error::WgError,
-    event::Event,
-    network_table::NetworkTable,
     packet_relayer::PacketRelaySender,
     registered_peers::{RegisteredPeer, RegisteredPeers},
     setup::{self, WG_ADDRESS},
@@ -24,9 +28,6 @@ use crate::{
 
 const MAX_PACKET: usize = 65535;
 
-// Registered peers
-pub(crate) type PeersByIp = NetworkTable<PeerEventSender>;
-
 async fn add_test_peer(registered_peers: &mut RegisteredPeers) {
     let peer_static_public = PeerPublicKey::new(setup::peer_static_public_key());
     let peer_index = 0;

common/wireguard/src/wg_tunnel.rs

@@ -7,18 +7,16 @@ use boringtun::{
 };
 use bytes::Bytes;
 use log::{debug, error, info, warn};
+use nym_wireguard_types::tun_common::{
+    active_peers::{peer_event_channel, PeerEventReceiver, PeerEventSender},
+    event::Event,
+    network_table::NetworkTable,
+};
 use rand::RngCore;
 use tap::TapFallible;
 use tokio::{net::UdpSocket, sync::broadcast, time::timeout};
 
-use crate::{
-    active_peers::{peer_event_channel, PeerEventReceiver, PeerEventSender},
-    error::WgError,
-    event::Event,
-    network_table::NetworkTable,
-    packet_relayer::PacketRelaySender,
-    registered_peers::PeerIdx,
-};
+use crate::{error::WgError, packet_relayer::PacketRelaySender, registered_peers::PeerIdx};
 
 const HANDSHAKE_MAX_RATE: u64 = 10;
 

service-providers/ip-packet-router/Cargo.toml

@@ -18,11 +18,13 @@ nym-bin-common = { path = "../../common/bin-common" }
 nym-client-core = { path = "../../common/client-core" }
 nym-config = { path = "../../common/config" }
 nym-exit-policy = { path = "../../common/exit-policy" }
+nym-ip-packet-requests = { path = "../../common/ip-packet-requests" }
 nym-network-requester = { path = "../network-requester" }
 nym-sdk = { path = "../../sdk/rust/nym-sdk" }
 nym-service-providers-common = { path = "../common" }
 nym-sphinx = { path = "../../common/nymsphinx" }
 nym-task = { path = "../../common/task" }
+nym-tun = { path = "../../common/tun" }
 nym-wireguard = { path = "../../common/wireguard" }
 nym-wireguard-types = { path = "../../common/wireguard-types" }
 reqwest.workspace = true

service-providers/ip-packet-router/src/lib.rs

@@ -139,13 +139,13 @@ impl IpPacketRouterBuilder {
         let self_address = *mixnet_client.nym_address();
 
         // Create the TUN device that we interact with the rest of the world with
-        let config = nym_wireguard::tun_device::TunDeviceConfig {
+        let config = nym_tun::tun_device::TunDeviceConfig {
             base_name: TUN_BASE_NAME.to_string(),
             ip: TUN_DEVICE_ADDRESS.parse().unwrap(),
             netmask: TUN_DEVICE_NETMASK.parse().unwrap(),
         };
-        let (tun, tun_task_tx, tun_task_response_rx) = nym_wireguard::tun_device::TunDevice::new(
-            nym_wireguard::tun_device::RoutingMode::new_nat(),
+        let (tun, tun_task_tx, tun_task_response_rx) = nym_tun::tun_device::TunDevice::new(
+            nym_tun::tun_device::RoutingMode::new_nat(),
             config,
         );
         tun.start();
@@ -183,8 +183,8 @@ impl IpPacketRouterBuilder {
 struct IpPacketRouter {
     _config: Config,
     request_filter: request_filter::RequestFilter,
-    tun_task_tx: nym_wireguard::tun_task_channel::TunTaskTx,
-    tun_task_response_rx: nym_wireguard::tun_task_channel::TunTaskResponseRx,
+    tun_task_tx: nym_tun::tun_task_channel::TunTaskTx,
+    tun_task_response_rx: nym_tun::tun_task_channel::TunTaskResponseRx,
     mixnet_client: nym_sdk::mixnet::MixnetClient,
     task_handle: TaskHandle,
 }
@@ -253,7 +253,7 @@ impl IpPacketRouter {
             reconstructed.sender_tag
         );
 
-        let tagged_packet = TaggedPacket::from_message(&reconstructed)
+        let tagged_packet = nym_ip_packet_requests::TaggedIpPacket::from_message(&reconstructed)
             .map_err(|err| IpPacketRouterError::FailedToDeserializeTaggedPacket { source: err })?;
 
         // We don't forward packets that we are not able to parse. BUT, there might be a good
@@ -295,27 +295,6 @@ impl IpPacketRouter {
     }
 }
 
-#[derive(serde::Serialize, serde::Deserialize)]
-pub struct TaggedPacket {
-    packet: bytes::Bytes,
-    return_address: Recipient,
-    return_mix_hops: Option<u8>,
-}
-
-impl TaggedPacket {
-    fn from_message(message: &ReconstructedMessage) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-}
-
-fn make_bincode_serializer() -> impl bincode::Options {
-    use bincode::Options;
-    bincode::DefaultOptions::new()
-        .with_big_endian()
-        .with_varint_encoding()
-}
-
 struct ParsedPacket<'a> {
     packet_type: &'a str,
     src_addr: IpAddr,