mirror/Easytier
1
0
Fork 0
mirror of https://github.com/EasyTier/EasyTier.git synced 2026-09-03 01:25:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(core): separate portable core from native runtime (#2451)

Browse Source 
Create easytier-core as the portable owner of configuration,
connectivity, tunnels, peer and routing state, gateways, management,
the data plane, and instance lifecycle. Keep operating-system
integration, native protocol engines, process startup, and presentation
in easytier behind explicit Host capability adapters.

Create easytier-proto to own schemas, generated RPC types, descriptors,
and feature-scoped protocol slices. Remove runtime protobuf reflection
from core while preserving unknown route-peer fields across forwarding.

Normalize instance construction through CoreInstance, CoreHostAdapters,
CoreProcessRuntime, and InstanceManager. Make the runtime config store
the only authoritative mutable configuration after startup.

Move the portable TCP/UDP data plane into core and extract a generic
OperationBroker for completion, cancellation, disposal, and capacity
accounting. Expose the session-based FFI v2 completion API and keep the
WASI guest ABI, wire schemas, and adapters with core.

Migrate CLI, GUI, web, FFI, Android JNI, OHOS, uptime, and mobile
consumers to the shared manager and core state. Add explicit user/web
config ownership and revision-aware web reconciliation.

Preserve configuration, wire, and management behavior while fixing
regressions discovered by the full platform and integration matrix:

- inherit advertised relay capabilities in foreign networks;
- refresh OSPF peer state immediately after runtime config changes;
- restore CLI GlobalCtx event output without forcing GUI logging;
- retain legacy encryption names and standalone RPC tunnel metadata;
- restore ICMP host composition and fragmented UDP handling;
- use portable 64-bit atomics on 32-bit MIPS targets; and
- retain discarded operations until late cancellation completes.

Validate the refactor across 45 GitHub checks, including Linux, macOS,
Windows, FreeBSD, web, GUI, Android, OHOS, feature profiles, and
three-node and subnet-proxy integration tests.

BREAKING CHANGE: internal Rust module paths are not preserved. Legacy
native data-plane APIs are replaced by the session-based FFI v2 API.
The dedicated Android data-plane wrapper is removed.
This commit is contained in:
KKRainbow
2026-07-26 15:41:55 +08:00
committed by GitHub
parent 346f32d3d0
commit 021f523431
523 changed files with 102785 additions and 67067 deletions
Download Patch File Download Diff File Expand all files Collapse all files
easytier/src/vpn_portal/mod.rs
-48
View File
@@ -1,50 +1,2 @@
// with vpn portal, user can use other vpn client to connect to easytier servers
// without installing easytier.
// these vpn client include:
// 1. wireguard
// 2. openvpn (TODO)
// 3. shadowsocks (TODO)
use std::sync::Arc;
use crate::{common::global_ctx::ArcGlobalCtx, peers::peer_manager::PeerManager};
#[cfg(feature = "wireguard")]
pub mod wireguard;
#[async_trait::async_trait]
pub trait VpnPortal: Send + Sync {
async fn start(
&mut self,
global_ctx: ArcGlobalCtx,
peer_mgr: Arc<PeerManager>,
) -> anyhow::Result<()>;
async fn dump_client_config(&self, peer_mgr: Arc<PeerManager>) -> String;
fn name(&self) -> String;
async fn list_clients(&self) -> Vec<String>;
}
pub struct NullVpnPortal;
#[async_trait::async_trait]
impl VpnPortal for NullVpnPortal {
async fn start(
&mut self,
_global_ctx: ArcGlobalCtx,
_peer_mgr: Arc<PeerManager>,
) -> anyhow::Result<()> {
Ok(())
}
async fn dump_client_config(&self, _peer_mgr: Arc<PeerManager>) -> String {
"".to_string()
}
fn name(&self) -> String {
"null".to_string()
}
async fn list_clients(&self) -> Vec<String> {
vec![]
}
}
easytier/src/vpn_portal/wireguard.rs
+69 -319
View File
@@ -1,339 +1,92 @@
use std::{
net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV6},
net::{Ipv6Addr, SocketAddr, SocketAddrV6},
sync::Arc,
};
use anyhow::Context;
use base64::{Engine, prelude::BASE64_STANDARD};
use cidr::Ipv4Inet;
use dashmap::DashMap;
use futures::StreamExt;
use pnet::packet::ipv4::Ipv4Packet;
use tokio::task::JoinSet;
use tracing::Level;
use crate::{
common::{
config::NetworkIdentity,
global_ctx::{ArcGlobalCtx, GlobalCtxEvent},
join_joinset_background, shrink_dashmap,
},
peers::{PeerPacketFilter, peer_manager::PeerManager},
tunnel::{
Tunnel, TunnelListener,
mpsc::{MpscTunnel, MpscTunnelSender},
packet_def::{PacketType, ZCPacket, ZCPacketType},
wireguard::{WgConfig, WgTunnelListener},
},
use easytier_core::{
gateway::vpn_portal::{VpnPortalClientConfigPlan, VpnPortalHost, VpnPortalListener},
socket::SocketListener,
};
use super::VpnPortal;
type WgPeerIpTable = Arc<DashMap<Ipv4Addr, Arc<ClientEntry>>>;
use crate::{
common::{config::NetworkIdentity, global_ctx::ArcGlobalCtx},
tunnel::wireguard::{WgConfig, WgTunnelListener},
};
pub(crate) fn get_wg_config_for_portal(nid: &NetworkIdentity) -> WgConfig {
let key_seed = format!(
"{}{}",
nid.network_name,
nid.network_secret.as_ref().unwrap_or(&"".to_string())
nid.network_secret.as_ref().unwrap_or(&String::new())
);
WgConfig::new_for_portal(&key_seed, &key_seed)
}
struct ClientEntry {
endpoint_addr: Option<url::Url>,
sink: MpscTunnelSender,
fn listener_endpoint(listener_url: &url::Url) -> &str {
&listener_url[url::Position::BeforeHost..url::Position::AfterPort]
}
struct WireGuardImpl {
pub struct WireGuardPortalHost {
global_ctx: ArcGlobalCtx,
peer_mgr: Arc<PeerManager>,
wg_config: WgConfig,
listener_addr: SocketAddr,
wg_peer_ip_table: WgPeerIpTable,
tasks: Arc<std::sync::Mutex<JoinSet<()>>>,
listener_addr: Option<SocketAddr>,
}
impl WireGuardImpl {
fn new(global_ctx: ArcGlobalCtx, peer_mgr: Arc<PeerManager>) -> Self {
let nid = global_ctx.get_network_identity();
let wg_config = get_wg_config_for_portal(&nid);
let vpn_cfg = global_ctx.config.get_vpn_portal_config().unwrap();
let listener_addr = vpn_cfg.wireguard_listen;
Self {
impl WireGuardPortalHost {
pub fn new(global_ctx: ArcGlobalCtx, listener_addr: Option<SocketAddr>) -> Arc<Self> {
Arc::new(Self {
wg_config: get_wg_config_for_portal(&global_ctx.get_network_identity()),
global_ctx,
peer_mgr,
wg_config,
listener_addr,
wg_peer_ip_table: Arc::new(DashMap::new()),
tasks: Arc::new(std::sync::Mutex::new(JoinSet::new())),
}
})
}
async fn handle_incoming_conn(
t: Box<dyn Tunnel>,
peer_mgr: Arc<PeerManager>,
wg_peer_ip_table: WgPeerIpTable,
) {
let info = t.info().unwrap_or_default();
let mut mpsc_tunnel = MpscTunnel::new(t, None);
let mut stream = mpsc_tunnel.get_stream();
let mut ip_registered = false;
let remote_addr = info.remote_addr.clone();
let endpoint_addr = remote_addr.clone().map(Into::into);
peer_mgr
.get_global_ctx()
.issue_event(GlobalCtxEvent::VpnPortalClientConnected(
info.local_addr.clone().unwrap_or_default().to_string(),
info.remote_addr.clone().unwrap_or_default().to_string(),
));
let mut map_key = None;
loop {
let msg = match stream.next().await {
Some(Ok(msg)) => msg,
Some(Err(err)) => {
tracing::error!(?err, "Failed to receive from wg client");
break;
}
None => {
tracing::info!("Wireguard client disconnected");
break;
}
};
assert_eq!(msg.packet_type(), ZCPacketType::WG);
let inner = msg.inner();
let Some(i) = Ipv4Packet::new(&inner) else {
tracing::error!(?inner, "Failed to parse ipv4 packet");
continue;
};
if !ip_registered {
let client_entry = Arc::new(ClientEntry {
endpoint_addr: endpoint_addr.clone(),
sink: mpsc_tunnel.get_sink(),
});
map_key = Some(i.get_source());
// Be careful here: we may overwrite an existing entry if the client IP is reused,
// which is common when clients are behind NAT.
wg_peer_ip_table.insert(i.get_source(), client_entry.clone());
ip_registered = true;
}
tracing::trace!(?i, "Received from wg client");
let dst = i.get_destination();
let _ = peer_mgr
.send_msg_by_ip(
ZCPacket::new_with_payload(inner.as_ref()),
IpAddr::V4(dst),
false,
)
.await;
}
if let Some(map_key) = map_key {
// Remove the client from the wg_peer_ip_table only when its endpoint address is unchanged,
// or we may break clients behind NAT.
match wg_peer_ip_table
.remove_if(&map_key, |_, entry| entry.endpoint_addr == endpoint_addr)
{
Some(_) => tracing::info!(?map_key, "Removed wg client from table"),
None => tracing::info!(
?map_key,
"The wg client changed its endpoint address, not removing from table"
),
}
shrink_dashmap(&wg_peer_ip_table, None);
}
peer_mgr
.get_global_ctx()
.issue_event(GlobalCtxEvent::VpnPortalClientDisconnected(
info.local_addr.unwrap_or_default().to_string(),
info.remote_addr.unwrap_or_default().to_string(),
));
}
async fn start_pipeline_processor(&self) {
struct PeerPacketFilterForVpnPortal {
wg_peer_ip_table: WgPeerIpTable,
}
#[async_trait::async_trait]
impl PeerPacketFilter for PeerPacketFilterForVpnPortal {
async fn try_process_packet_from_peer(&self, packet: ZCPacket) -> Option<ZCPacket> {
let hdr = packet.peer_manager_header().unwrap();
if hdr.packet_type != PacketType::Data as u8 {
return Some(packet);
};
let payload_bytes = packet.payload();
let ipv4 = Ipv4Packet::new(payload_bytes)?;
if ipv4.get_version() != 4 {
return Some(packet);
}
let Some(entry) = self
.wg_peer_ip_table
.get(&ipv4.get_destination())
.map(|f| f.clone())
else {
return Some(packet);
};
tracing::trace!(?ipv4, "Packet filter for vpn portal");
let payload_offset = packet.packet_type().get_packet_offsets().payload_offset;
let packet = ZCPacket::new_from_buf(
packet.inner().split_off(payload_offset),
ZCPacketType::WG,
);
match entry.sink.try_send(packet) {
Ok(_) => {
tracing::trace!("Sent packet to wg client");
}
Err(e) => {
tracing::debug!(?e, "Failed to send packet to wg client");
}
}
None
}
}
self.peer_mgr
.add_packet_process_pipeline(Box::new(PeerPacketFilterForVpnPortal {
wg_peer_ip_table: self.wg_peer_ip_table.clone(),
}))
.await;
}
async fn start_listener(&self, listener_addr: &SocketAddr) -> anyhow::Result<()> {
async fn start_listener(&self, listener_addr: SocketAddr) -> anyhow::Result<VpnPortalListener> {
let mut listener_url = url::Url::parse("wg://0.0.0.0:0").unwrap();
listener_url.set_port(Some(listener_addr.port())).unwrap();
listener_url.set_ip_host(listener_addr.ip()).unwrap();
let mut l = WgTunnelListener::new(listener_url.clone(), self.wg_config.clone());
tracing::info!("Wireguard VPN Portal Starting");
let mut listener = WgTunnelListener::new(listener_url, self.wg_config.clone());
{
let _g = self.global_ctx.net_ns.guard();
l.listen()
let _guard = self.global_ctx.net_ns.guard();
listener
.listen()
.await
.with_context(|| "Failed to start wireguard listener for vpn portal")?;
.context("failed to start WireGuard VPN portal listener")?;
}
let tasks = Arc::downgrade(&self.tasks.clone());
let peer_mgr = self.peer_mgr.clone();
let wg_peer_ip_table = self.wg_peer_ip_table.clone();
self.tasks.lock().unwrap().spawn(async move {
while let Ok(t) = l.accept().await {
let Some(tasks) = tasks.upgrade() else {
break;
};
tasks.lock().unwrap().spawn(Self::handle_incoming_conn(
t,
peer_mgr.clone(),
wg_peer_ip_table.clone(),
));
}
});
self.global_ctx
.issue_event(GlobalCtxEvent::VpnPortalStarted(listener_url.to_string()));
Ok(())
Ok(Box::new(listener))
}
}
#[tracing::instrument(skip(self), err(level = Level::WARN))]
async fn start(&self) -> anyhow::Result<()> {
tracing::info!("Wireguard VPN Portal Starting");
self.start_listener(&self.listener_addr).await?;
// if binding to v4 unspecified, also start a listener on v6 unspecified
if let SocketAddr::V4(v4) = &self.listener_addr
#[async_trait::async_trait]
impl VpnPortalHost for WireGuardPortalHost {
async fn start_listeners(&self) -> anyhow::Result<Vec<VpnPortalListener>> {
let listener_addr = self.listener_addr.context("VPN portal config is not set")?;
let mut listeners = vec![self.start_listener(listener_addr).await?];
if let SocketAddr::V4(v4) = listener_addr
&& v4.ip().is_unspecified()
{
let _ = self
.start_listener(&SocketAddr::V6(SocketAddrV6::new(
&& let Ok(listener) = self
.start_listener(SocketAddr::V6(SocketAddrV6::new(
Ipv6Addr::UNSPECIFIED,
v4.port(),
0,
0,
)))
.await;
};
join_joinset_background(self.tasks.clone(), "wireguard".to_string());
self.start_pipeline_processor().await;
Ok(())
}
}
#[derive(Default)]
pub struct WireGuard {
inner: Option<WireGuardImpl>,
}
#[async_trait::async_trait]
impl VpnPortal for WireGuard {
async fn start(
&mut self,
global_ctx: ArcGlobalCtx,
peer_mgr: Arc<PeerManager>,
) -> anyhow::Result<()> {
assert!(self.inner.is_none());
let vpn_cfg = global_ctx.config.get_vpn_portal_config();
if vpn_cfg.is_none() {
anyhow::bail!("vpn cfg is not set for wireguard vpn portal");
}
let inner = WireGuardImpl::new(global_ctx, peer_mgr);
inner.start().await?;
self.inner = Some(inner);
Ok(())
}
async fn dump_client_config(&self, peer_mgr: Arc<PeerManager>) -> String {
if self.inner.is_none() {
return "ERROR: Wireguard VPN Portal Not Started".to_string();
}
let global_ctx = self.inner.as_ref().unwrap().global_ctx.clone();
if global_ctx.config.get_vpn_portal_config().is_none() {
return "ERROR: VPN Portal Config Not Set".to_string();
}
let routes = peer_mgr.list_routes().await;
let mut allow_ips = routes
.iter()
.flat_map(|x| x.proxy_cidrs.iter().map(String::to_string))
.collect::<Vec<_>>();
if let Some(ipv4) = routes
.iter()
.filter_map(|x| x.ipv4_addr)
.chain(global_ctx.get_ipv4().into_iter().map(Into::into))
.next()
.await
{
let inet = Ipv4Inet::from(ipv4);
allow_ips.push(inet.network().to_string());
listeners.push(listener);
}
Ok(listeners)
}
let vpn_cfg = global_ctx.config.get_vpn_portal_config().unwrap();
let client_cidr = vpn_cfg.client_cidr;
fn name(&self) -> String {
"wireguard".to_owned()
}
allow_ips.push(client_cidr.to_string());
let allow_ips = allow_ips.into_iter().collect::<Vec<_>>().join(",");
let cfg = self.inner.as_ref().unwrap().wg_config.clone();
let cfg_str = format!(
fn render_client_config(&self, plan: &VpnPortalClientConfigPlan) -> String {
let listener_addr = listener_endpoint(&plan.listener_url);
format!(
r#"
[Interface]
PrivateKey = {peer_secret_key}
@@ -341,39 +94,36 @@ Address = {address} # should assign an ip from this cidr manually
[Peer]
PublicKey = {my_public_key}
AllowedIPs = {allow_ips}
Endpoint = {listenr_addr} # should be the public ip(or domain) of the vpn server
AllowedIPs = {allowed_ips}
Endpoint = {listener_addr} # should be the public ip(or domain) of the vpn server
PersistentKeepalive = 25
"#,
peer_secret_key = BASE64_STANDARD.encode(cfg.peer_secret_key()),
my_public_key = BASE64_STANDARD.encode(cfg.my_public_key()),
listenr_addr = self.inner.as_ref().unwrap().listener_addr,
allow_ips = allow_ips,
address = client_cidr.first_address().to_string() + "/32",
);
cfg_str
peer_secret_key = BASE64_STANDARD.encode(self.wg_config.peer_secret_key()),
my_public_key = BASE64_STANDARD.encode(self.wg_config.my_public_key()),
listener_addr = listener_addr,
allowed_ips = plan.allowed_ips.join(","),
address = plan.client_cidr.first_address().to_string() + "/32",
)
}
fn name(&self) -> String {
"wireguard".to_string()
fn not_started_client_config(&self) -> String {
"ERROR: Wireguard VPN Portal Not Started".to_owned()
}
}
async fn list_clients(&self) -> Vec<String> {
self.inner
.as_ref()
.map(|w| {
w.wg_peer_ip_table
.iter()
.map(|x| {
x.value()
.endpoint_addr
.as_ref()
.map(|x| x.to_string())
.unwrap_or_default()
})
.collect()
})
.unwrap_or_default()
#[cfg(test)]
mod tests {
use super::listener_endpoint;
#[test]
fn listener_endpoint_uses_the_active_listener_url() {
assert_eq!(
listener_endpoint(&"wg://192.0.2.10:51820".parse().unwrap()),
"192.0.2.10:51820"
);
assert_eq!(
listener_endpoint(&"wg://[2001:db8::10]:51820".parse().unwrap()),
"[2001:db8::10]:51820"
);
}
}