shpark

Original documentation 1 suggests setting up network for CH guest using virtio-net deivces, host TAP and bridge interfaces.

This note is an alternative way of achieving a the Internet connectivity without setting up a bridge--spoiler alert--with iptables. (Similar setup used by smoltcp 2)

Create and configure a TAP interface

shpark

Tcp

tcp_proxy_server

Starts an ordinary TcpListener which is bound to port_forward.source. After accepting a connection, the socket is passed to handle_tcp_proxy_connection function along with virtual_port, port_forward and wg.

handle_tcp_proxy_connection function

shpark

Tun and UDP listener

Tx

A local process attempts to send packet to WireGuard IP address (e.g., 192.168.4.3). The packet is delivered to wg interface (for user-space implementation, this is a TUN interface). Boringtun reads packets from the tun interface, find a matching peer, encapsulate packet and emit packet via the Udp socket. Recall that unlike TCP (connection, STREAM, ...), a UDP socket can be reused to send packets to different destinations (See sendto() and recvfrom() usages).

shpark

How to open/create a TUN interface

fd = open("/dev/net/tun", O_RDWR);

struct ifreq ifr;
ifr.ifr_flags = IFF_TUN; // or IFF_TAP
strncpy(ifr.ifr_name, (char*)name, IFNAMSIZ-1);

int res = ioctl(fd, TUNSETIFF, &ifr);

shpark

Linux socket/sock/sk_buff

struct socket

For higher-level use. Connects b/w struct file and struct sk:

typedef enum {
	SS_FREE = 0,			/* not allocated		*/
	SS_UNCONNECTED,			/* unconnected to any socket	*/
	SS_CONNECTING,			/* in process of connecting	*/

shpark

use std::{fs, str::FromStr};

#[derive(Debug, PartialEq, Eq, Copy, Clone)]
struct Range {
    start: i64,
    end: i64,
}

impl PartialOrd for Range {
    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {