mirror/Easytier
1
0
Fork 0
mirror of https://github.com/EasyTier/EasyTier.git synced 2026-08-31 16:29:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: support android shared tun fd groups

Browse Source 
Android previously treated setTunFd as a single-instance update, and the
VpnService plugin could only expose one IPv4 address. That made shared
TUN members disable each other or leave only one address configured.

Group enabled Android TUN instances by shared dev_name, send the fd to
every compatible member, and only disable incompatible TUN users. Build
the Android VPN request from the whole running shared group and pass
every IPv4 address to VpnService.

The shared mobile dispatcher now owns current fd device state on a
process-level runtime. New setTunFd calls replace that state even when
the raw fd number is reused, and mobile TUN read/write/create failures
rebuild with backoff while preserving member registrations.

Protect shared member cleanup with per-registration ownership tokens, so
old async cleanup cannot unregister a recreated member or remove its
source claims. Mobile source addresses are registered in the dispatcher
without applying OS ifcfg changes, so Android-originated packets return
through the owning instance.

When one shared member stops while another remains, notify the frontend
to recalculate the VpnService config instead of leaving stale addresses
and routes. Serialize Android VpnService config recalculation so stale
async events cannot overwrite newer shared-group state.

If one shared member is not ready, rebuild from the healthy members and
retry the missing member later. If no healthy member remains, stop the
Android VPN service instead of keeping stale routes active.
This commit is contained in:
sijie.sun
2026-06-14 14:04:02 +08:00
parent 3d0d2bed9e
commit a7ab60e0e4
11 changed files with 1013 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
easytier/src/instance/shared_virtual_nic.rs
+195 -9
View File
@@ -25,6 +25,7 @@ mod dispatcher;
use dispatcher::{SharedVirtualNicDispatcher, SharedVirtualNicMemberTunnelTable};
pub type SharedVirtualNicMemberId = uuid::Uuid;
pub(super) type SharedVirtualNicMemberRegistrationId = uuid::Uuid;
#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
pub struct SharedIpv4Route {
@@ -256,6 +257,7 @@ pub struct SharedVirtualNic {
ifcfg: SharedIfConfig,
valid: Arc<AtomicBool>,
member_tunnel_table: SharedVirtualNicMemberTunnelTable,
member_registrations: BTreeMap<SharedVirtualNicMemberId, SharedVirtualNicMemberRegistrationId>,
dispatcher: Option<SharedVirtualNicDispatcher>,
}
@@ -266,6 +268,7 @@ impl SharedVirtualNic {
ifcfg: SharedIfConfig::default(),
valid: Arc::new(AtomicBool::new(true)),
member_tunnel_table: SharedVirtualNicMemberTunnelTable::default(),
member_registrations: BTreeMap::new(),
dispatcher: None,
}
}
@@ -302,6 +305,71 @@ impl SharedVirtualNic {
self.nic.lock().await.link_up().await
}
async fn attach_member_registration(
&mut self,
member_id: SharedVirtualNicMemberId,
registration_id: SharedVirtualNicMemberRegistrationId,
) -> Result<(), Error> {
self.ensure_valid()?;
match self.member_registrations.insert(member_id, registration_id) {
Some(old_registration_id) if old_registration_id != registration_id => {
self.remove_member_claims(member_id).await?;
}
_ => {}
}
Ok(())
}
fn is_current_member_registration(
&self,
member_id: SharedVirtualNicMemberId,
registration_id: SharedVirtualNicMemberRegistrationId,
) -> bool {
self.member_registrations
.get(&member_id)
.is_some_and(|current| *current == registration_id)
}
async fn apply_member_claims_for_registration(
&mut self,
member_id: SharedVirtualNicMemberId,
registration_id: SharedVirtualNicMemberRegistrationId,
claims: SharedIfConfigClaims,
) -> Result<(), Error> {
if !self.is_current_member_registration(member_id, registration_id) {
return Ok(());
}
self.apply_member_claims(member_id, claims).await
}
#[cfg(mobile)]
async fn apply_member_claims_for_mobile_registration(
&mut self,
member_id: SharedVirtualNicMemberId,
registration_id: SharedVirtualNicMemberRegistrationId,
claims: SharedIfConfigClaims,
) -> Result<(), Error> {
if !self.is_current_member_registration(member_id, registration_id) {
return Ok(());
}
self.apply_member_claims_for_mobile(member_id, claims).await
}
async fn remove_member_registration_claims(
&mut self,
member_id: SharedVirtualNicMemberId,
registration_id: SharedVirtualNicMemberRegistrationId,
) -> Result<(), Error> {
if !self.is_current_member_registration(member_id, registration_id) {
return Ok(());
}
self.member_registrations.remove(&member_id);
self.remove_member_claims(member_id).await
}
async fn apply_member_claims(
&mut self,
member_id: SharedVirtualNicMemberId,
@@ -330,6 +398,25 @@ impl SharedVirtualNic {
Ok(())
}
#[cfg(mobile)]
async fn apply_member_claims_for_mobile(
&mut self,
member_id: SharedVirtualNicMemberId,
claims: SharedIfConfigClaims,
) -> Result<(), Error> {
self.ensure_valid()?;
let mut next_ifcfg = self.ifcfg.clone();
let next_claims = claims.clone();
next_ifcfg.apply_member_claims(member_id, claims);
self.sync_dispatcher_sources_for_member(member_id, &next_claims)
.await?;
self.ifcfg = next_ifcfg;
Ok(())
}
async fn remove_member_claims(
&mut self,
member_id: SharedVirtualNicMemberId,
@@ -340,7 +427,10 @@ impl SharedVirtualNic {
let Some(delta) = next_ifcfg.remove_member(member_id) else {
return Ok(());
};
#[cfg(not(mobile))]
self.apply_ifcfg_delta(&delta).await?;
#[cfg(mobile)]
drop(delta);
self.remove_dispatcher_sources_for_member(member_id).await?;
self.ifcfg = next_ifcfg;
@@ -430,13 +520,16 @@ impl SharedVirtualNic {
) -> Result<(), Error> {
self.ensure_valid()?;
if self.dispatcher.is_some() {
if let Some(dispatcher) = &self.dispatcher {
dispatcher.update_mobile_tun_fd(tun_fd);
self.nic.lock().await.set_mobile_tun_fd_name(tun_fd);
return Ok(());
}
let tunnel = self.nic.lock().await.create_dev_for_mobile(tun_fd).await?;
let dispatcher = SharedVirtualNicDispatcher::start(
tunnel,
self.nic.lock().await.set_mobile_tun_fd_name(tun_fd);
let dispatcher = SharedVirtualNicDispatcher::start_for_mobile(
self.nic.clone(),
tun_fd,
self.member_tunnel_table.clone(),
self.valid.clone(),
);
@@ -523,6 +616,7 @@ fn ignore_removed_ifcfg_not_found(result: Result<(), Error>) -> Result<(), Error
struct SharedVirtualNicMemberRegistration {
member_id: SharedVirtualNicMemberId,
registration_id: SharedVirtualNicMemberRegistrationId,
shared_nic: Arc<Mutex<SharedVirtualNic>>,
member_tunnel_table: SharedVirtualNicMemberTunnelTable,
}
@@ -533,16 +627,22 @@ impl SharedVirtualNicMemberRegistration {
tunnel: Box<dyn Tunnel>,
close_notifier: Arc<Notify>,
) -> Result<(), Error> {
self.member_tunnel_table
.register(self.member_id, tunnel, close_notifier)
self.member_tunnel_table.register(
self.member_id,
self.registration_id,
tunnel,
close_notifier,
)
}
}
impl Drop for SharedVirtualNicMemberRegistration {
fn drop(&mut self) {
self.member_tunnel_table.unregister(self.member_id);
self.member_tunnel_table
.unregister(self.member_id, self.registration_id);
let shared_nic = self.shared_nic.clone();
let member_id = self.member_id;
let registration_id = self.registration_id;
let Ok(handle) = tokio::runtime::Handle::try_current() else {
tracing::warn!(
@@ -554,7 +654,10 @@ impl Drop for SharedVirtualNicMemberRegistration {
handle.spawn(async move {
let mut shared_nic = shared_nic.lock().await;
if let Err(err) = shared_nic.remove_member_claims(member_id).await {
if let Err(err) = shared_nic
.remove_member_registration_claims(member_id, registration_id)
.await
{
tracing::warn!(
?member_id,
?err,
@@ -580,12 +683,14 @@ impl SharedVirtualNicMember {
close_notifier: Arc<Notify>,
member_tunnel_table: SharedVirtualNicMemberTunnelTable,
) -> Self {
let registration_id = uuid::Uuid::new_v4();
Self {
member_id,
shared_nic: shared_nic.clone(),
close_notifier,
registration: Arc::new(SharedVirtualNicMemberRegistration {
member_id,
registration_id,
shared_nic: shared_nic.clone(),
member_tunnel_table,
}),
@@ -608,6 +713,9 @@ impl SharedVirtualNicMember {
let (member_tunnel, shared_tunnel) = create_ring_tunnel_pair();
{
let mut shared_nic = self.shared_nic.lock().await;
shared_nic
.attach_member_registration(self.member_id, self.registration.registration_id)
.await?;
shared_nic.ensure_dispatcher().await?;
}
self.registration
@@ -623,6 +731,9 @@ impl SharedVirtualNicMember {
let (member_tunnel, shared_tunnel) = create_ring_tunnel_pair();
{
let mut shared_nic = self.shared_nic.lock().await;
shared_nic
.attach_member_registration(self.member_id, self.registration.registration_id)
.await?;
shared_nic.ensure_dispatcher_for_mobile(tun_fd).await?;
}
self.registration
@@ -667,6 +778,24 @@ impl SharedVirtualNicMember {
.await
}
#[cfg(mobile)]
pub async fn add_mobile_source_ip(&self, ip: Ipv4Addr, cidr: i32) -> Result<(), Error> {
let ip = ipv4_inet(ip, cidr)?;
self.update_claims_for_mobile(|claims| {
claims.ipv4_addresses.insert(ip);
})
.await
}
#[cfg(mobile)]
pub async fn add_mobile_source_ipv6(&self, ip: Ipv6Addr, cidr: i32) -> Result<(), Error> {
let ip = ipv6_inet(ip, cidr)?;
self.update_claims_for_mobile(|claims| {
claims.ipv6_addresses.insert(ip);
})
.await
}
pub async fn remove_ipv6(&self, ip: Option<Ipv6Inet>) -> Result<(), Error> {
self.update_claims(|claims| match ip {
Some(ip) => {
@@ -740,7 +869,30 @@ impl SharedVirtualNicMember {
let mut shared_nic = self.shared_nic.lock().await;
let mut claims = shared_nic.ifcfg.claims_of(self.member_id);
update(&mut claims);
shared_nic.apply_member_claims(self.member_id, claims).await
shared_nic
.apply_member_claims_for_registration(
self.member_id,
self.registration.registration_id,
claims,
)
.await
}
#[cfg(mobile)]
async fn update_claims_for_mobile<F>(&self, update: F) -> Result<(), Error>
where
F: FnOnce(&mut SharedIfConfigClaims) + Send,
{
let mut shared_nic = self.shared_nic.lock().await;
let mut claims = shared_nic.ifcfg.claims_of(self.member_id);
update(&mut claims);
shared_nic
.apply_member_claims_for_mobile_registration(
self.member_id,
self.registration.registration_id,
claims,
)
.await
}
}
@@ -1081,6 +1233,40 @@ mod tests {
drop(shared_nic.nic());
}
#[tokio::test]
async fn stale_member_registration_cleanup_keeps_current_claims() {
let mut shared_nic = SharedVirtualNic::new(virtual_nic_config());
let member = member_id(1);
let old_registration = uuid::Uuid::from_u128(10);
let current_registration = uuid::Uuid::from_u128(11);
let ip = Ipv4Inet::from_str("10.50.0.2/24").unwrap();
shared_nic
.member_registrations
.insert(member, current_registration);
shared_nic.ifcfg_mut().apply_member_claims(
member,
SharedIfConfigClaims {
ipv4_addresses: BTreeSet::from([ip]),
..Default::default()
},
);
shared_nic
.remove_member_registration_claims(member, old_registration)
.await
.unwrap();
assert_eq!(
shared_nic.ifcfg().owners_of_ipv4_address(&ip),
BTreeSet::from([member])
);
assert_eq!(
shared_nic.member_registrations.get(&member),
Some(&current_registration)
);
}
#[test]
fn registry_reuses_shared_virtual_nic_for_same_dev_name() {
let mut registry = SharedVirtualNicRegistry::new();
easytier/src/instance/shared_virtual_nic/dispatcher.rs
+441 -17
View File
@@ -5,19 +5,28 @@ use std::{
Arc, Mutex as StdMutex,
atomic::{AtomicBool, Ordering},
},
time::Duration,
};
use cidr::{Ipv4Inet, Ipv6Inet};
use futures::{SinkExt, StreamExt};
#[cfg(mobile)]
use std::sync::OnceLock;
#[cfg(mobile)]
use tokio::runtime::{Builder, Runtime};
#[cfg(mobile)]
use tokio::sync::{Mutex, watch};
use tokio::sync::{Notify, mpsc, oneshot};
use tokio_util::task::AbortOnDropHandle;
#[cfg(mobile)]
use crate::instance::virtual_nic::VirtualNic;
use crate::{
common::error::Error,
tunnel::{Tunnel, ZCPacketSink, ZCPacketStream, packet_def::ZCPacket},
};
use super::SharedVirtualNicMemberId;
use super::{SharedVirtualNicMemberId, SharedVirtualNicMemberRegistrationId};
const MEMBER_TUNNEL_BUFFER_SIZE: usize = 1024;
const FLOW_OWNER_LIMIT: usize = 4096;
@@ -27,6 +36,24 @@ const TCP_HEADER_MIN_LEN: usize = 20;
const UDP_HEADER_LEN: usize = 8;
const TCP_PROTOCOL: u8 = 6;
const UDP_PROTOCOL: u8 = 17;
const DISPATCHER_SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(1);
#[cfg(mobile)]
const MOBILE_REBUILD_INITIAL_DELAY: Duration = Duration::from_millis(100);
#[cfg(mobile)]
const MOBILE_REBUILD_MAX_DELAY: Duration = Duration::from_secs(5);
#[cfg(mobile)]
fn mobile_dispatcher_runtime() -> &'static Runtime {
static RUNTIME: OnceLock<Runtime> = OnceLock::new();
RUNTIME.get_or_init(|| {
Builder::new_multi_thread()
.worker_threads(1)
.thread_name("easytier-shared-tun")
.enable_all()
.build()
.expect("failed to build shared virtual nic mobile dispatcher runtime")
})
}
struct SharedVirtualNicMemberPacket {
member_id: SharedVirtualNicMemberId,
@@ -40,12 +67,17 @@ enum SharedVirtualNicControl {
},
Unregister {
member_id: SharedVirtualNicMemberId,
registration_id: SharedVirtualNicMemberRegistrationId,
},
UpdateSources {
member_id: SharedVirtualNicMemberId,
sources: BTreeSet<SharedVirtualNicFlowAddr>,
ack: oneshot::Sender<()>,
},
Shutdown {
invalidate: bool,
ack: oneshot::Sender<()>,
},
}
#[derive(Clone, Default)]
@@ -60,6 +92,7 @@ struct SharedVirtualNicMemberTunnelTableState {
}
struct SharedVirtualNicMemberTunnelEntry {
registration_id: SharedVirtualNicMemberRegistrationId,
sender: mpsc::Sender<ZCPacket>,
close_notifier: Arc<Notify>,
_tasks: Vec<AbortOnDropHandle<()>>,
@@ -76,7 +109,7 @@ impl SharedVirtualNicMemberTunnelTable {
state.control_sender = Some(control_sender);
}
fn detach_dispatcher(&self) {
pub(super) fn detach_dispatcher(&self) {
let mut state = self.state.lock().unwrap();
state.to_tun_sender.take();
state.control_sender.take();
@@ -85,6 +118,7 @@ impl SharedVirtualNicMemberTunnelTable {
pub(super) fn register(
&self,
member_id: SharedVirtualNicMemberId,
registration_id: SharedVirtualNicMemberRegistrationId,
tunnel: Box<dyn Tunnel>,
close_notifier: Arc<Notify>,
) -> Result<(), Error> {
@@ -121,7 +155,10 @@ impl SharedVirtualNicMemberTunnelTable {
}
}
let _ = reader_control_sender.send(SharedVirtualNicControl::Unregister { member_id });
let _ = reader_control_sender.send(SharedVirtualNicControl::Unregister {
member_id,
registration_id,
});
reader_close_notifier.notify_one();
}));
@@ -131,8 +168,10 @@ impl SharedVirtualNicMemberTunnelTable {
while let Some(packet) = to_member_receiver.recv().await {
if let Err(err) = member_sink.send(packet).await {
tracing::error!(?member_id, ?err, "shared member tunnel write failed");
let _ = writer_control_sender
.send(SharedVirtualNicControl::Unregister { member_id });
let _ = writer_control_sender.send(SharedVirtualNicControl::Unregister {
member_id,
registration_id,
});
writer_close_notifier.notify_one();
break;
}
@@ -140,6 +179,7 @@ impl SharedVirtualNicMemberTunnelTable {
}));
let entry = SharedVirtualNicMemberTunnelEntry {
registration_id,
sender: to_member_sender,
close_notifier,
_tasks: vec![reader_task, writer_task],
@@ -152,11 +192,18 @@ impl SharedVirtualNicMemberTunnelTable {
Ok(())
}
pub(super) fn unregister(&self, member_id: SharedVirtualNicMemberId) {
pub(super) fn unregister(
&self,
member_id: SharedVirtualNicMemberId,
registration_id: SharedVirtualNicMemberRegistrationId,
) {
let Some(control_sender) = self.control_sender() else {
return;
};
let _ = control_sender.send(SharedVirtualNicControl::Unregister { member_id });
let _ = control_sender.send(SharedVirtualNicControl::Unregister {
member_id,
registration_id,
});
}
fn dispatcher_channels(
@@ -309,6 +356,8 @@ impl SharedVirtualNicFlowTable {
pub(super) struct SharedVirtualNicDispatcher {
_task: AbortOnDropHandle<()>,
control_sender: mpsc::UnboundedSender<SharedVirtualNicControl>,
#[cfg(mobile)]
mobile_tun_fd_sender: Option<watch::Sender<std::os::fd::RawFd>>,
}
impl SharedVirtualNicDispatcher {
@@ -335,6 +384,51 @@ impl SharedVirtualNicDispatcher {
Self {
_task: AbortOnDropHandle::new(tokio::spawn(task.run())),
control_sender,
#[cfg(mobile)]
mobile_tun_fd_sender: None,
}
}
#[cfg(mobile)]
pub(super) fn start_for_mobile(
nic: Arc<Mutex<VirtualNic>>,
tun_fd: std::os::fd::RawFd,
member_tunnel_table: SharedVirtualNicMemberTunnelTable,
valid: Arc<AtomicBool>,
) -> Self {
let (to_tun_sender, to_tun_receiver) = mpsc::channel(MEMBER_TUNNEL_BUFFER_SIZE);
let (control_sender, control_receiver) = mpsc::unbounded_channel();
let (mobile_tun_fd_sender, mobile_tun_fd_receiver) = watch::channel(tun_fd);
let task_member_tunnel_table = member_tunnel_table.clone();
member_tunnel_table.attach_dispatcher(to_tun_sender, control_sender.clone());
let task = mobile_dispatcher_runtime().spawn(async move {
let task = SharedVirtualNicMobileDispatcherTask {
nic,
tun_stream: None,
tun_sink: None,
tun_fd: mobile_tun_fd_receiver,
to_tun_receiver,
control_receiver,
member_tunnel_table: task_member_tunnel_table,
valid,
state: SharedVirtualNicDispatcherState::default(),
};
task.run().await;
});
Self {
_task: AbortOnDropHandle::new(task),
control_sender,
mobile_tun_fd_sender: Some(mobile_tun_fd_sender),
}
}
#[cfg(mobile)]
pub(super) fn update_mobile_tun_fd(&self, tun_fd: std::os::fd::RawFd) {
if let Some(sender) = &self.mobile_tun_fd_sender {
sender.send_replace(tun_fd);
}
}
@@ -371,6 +465,27 @@ impl SharedVirtualNicDispatcher {
rx.await
.map_err(|_| anyhow::anyhow!("shared virtual nic dispatcher is not running").into())
}
pub(super) async fn shutdown_without_invalidation(self) {
let (ack, rx) = oneshot::channel();
if self
.control_sender
.send(SharedVirtualNicControl::Shutdown {
invalidate: false,
ack,
})
.is_err()
{
return;
}
if tokio::time::timeout(DISPATCHER_SHUTDOWN_TIMEOUT, rx)
.await
.is_err()
{
tracing::warn!("timed out shutting down shared virtual nic dispatcher");
}
}
}
struct SharedVirtualNicDispatcherTask {
@@ -391,7 +506,14 @@ impl SharedVirtualNicDispatcherTask {
let Some(control) = control else {
break;
};
self.state.handle_control(control);
match control {
SharedVirtualNicControl::Shutdown { invalidate, ack } => {
self.cleanup(invalidate);
let _ = ack.send(());
return;
}
other => self.state.handle_control(other),
}
}
member_packet = self.to_tun_receiver.recv() => {
let Some(member_packet) = member_packet else {
@@ -417,7 +539,13 @@ impl SharedVirtualNicDispatcherTask {
}
}
self.valid.store(false, Ordering::Release);
self.cleanup(true);
}
fn cleanup(&mut self, invalidate: bool) {
if invalidate {
self.valid.store(false, Ordering::Release);
}
self.member_tunnel_table.detach_dispatcher();
self.state.close_all();
}
@@ -436,6 +564,207 @@ impl SharedVirtualNicDispatcherTask {
}
}
#[cfg(mobile)]
struct SharedVirtualNicMobileDispatcherTask {
nic: Arc<Mutex<VirtualNic>>,
tun_stream: Option<Pin<Box<dyn ZCPacketStream>>>,
tun_sink: Option<Pin<Box<dyn ZCPacketSink>>>,
tun_fd: watch::Receiver<std::os::fd::RawFd>,
to_tun_receiver: mpsc::Receiver<SharedVirtualNicMemberPacket>,
control_receiver: mpsc::UnboundedReceiver<SharedVirtualNicControl>,
member_tunnel_table: SharedVirtualNicMemberTunnelTable,
valid: Arc<AtomicBool>,
state: SharedVirtualNicDispatcherState,
}
#[cfg(mobile)]
impl SharedVirtualNicMobileDispatcherTask {
async fn run(mut self) {
let mut rebuild_delay = MOBILE_REBUILD_INITIAL_DELAY;
let mut wait_before_rebuild = false;
let mut rebuild_deadline = None;
loop {
if self.tun_stream.is_none() {
if !wait_before_rebuild {
if !self.rebuild_tun().await {
wait_before_rebuild = true;
rebuild_deadline = None;
}
continue;
}
let deadline = *rebuild_deadline
.get_or_insert_with(|| tokio::time::Instant::now() + rebuild_delay);
tokio::select! {
control = self.control_receiver.recv() => {
if !self.handle_control(control) {
return;
}
}
member_packet = self.to_tun_receiver.recv() => {
let Some(member_packet) = member_packet else {
self.cleanup(true);
return;
};
tracing::trace!(
member_id = ?member_packet.member_id,
"shared virtual nic dropped member packet while rebuilding mobile tun"
);
}
changed = self.tun_fd.changed() => {
if changed.is_err() {
self.cleanup(true);
return;
}
rebuild_delay = MOBILE_REBUILD_INITIAL_DELAY;
wait_before_rebuild = false;
rebuild_deadline = None;
}
_ = tokio::time::sleep_until(deadline) => {
rebuild_delay = next_mobile_rebuild_delay(rebuild_delay);
wait_before_rebuild = false;
rebuild_deadline = None;
}
}
continue;
}
tokio::select! {
control = self.control_receiver.recv() => {
if !self.handle_control(control) {
return;
}
}
member_packet = self.to_tun_receiver.recv() => {
let Some(member_packet) = member_packet else {
self.cleanup(true);
return;
};
if self.forward_member_packet_to_tun(member_packet).await {
wait_before_rebuild = true;
rebuild_deadline = None;
} else {
rebuild_delay = MOBILE_REBUILD_INITIAL_DELAY;
}
}
packet = self.tun_stream.as_mut().expect("mobile tun stream should exist").next() => {
let Some(packet) = packet else {
tracing::error!("shared virtual nic mobile tun stream closed");
self.drop_tun();
wait_before_rebuild = true;
rebuild_deadline = None;
continue;
};
let packet = match packet {
Ok(packet) => packet,
Err(err) => {
tracing::error!(?err, "shared virtual nic read from mobile tun failed");
self.drop_tun();
wait_before_rebuild = true;
rebuild_deadline = None;
continue;
}
};
rebuild_delay = MOBILE_REBUILD_INITIAL_DELAY;
self.state.forward_tun_packet_to_member(packet).await;
}
changed = self.tun_fd.changed() => {
if changed.is_err() {
self.cleanup(true);
return;
}
self.drop_tun();
rebuild_delay = MOBILE_REBUILD_INITIAL_DELAY;
wait_before_rebuild = false;
rebuild_deadline = None;
}
}
}
}
async fn rebuild_tun(&mut self) -> bool {
let tun_fd = *self.tun_fd.borrow_and_update();
match self.nic.lock().await.create_dev_for_mobile(tun_fd).await {
Ok(tunnel) => {
let (tun_stream, tun_sink) = tunnel.split();
self.tun_stream = Some(tun_stream);
self.tun_sink = Some(tun_sink);
tracing::info!(fd = tun_fd, "rebuilt shared virtual nic mobile tun");
true
}
Err(err) => {
tracing::error!(
fd = tun_fd,
?err,
"failed to rebuild shared virtual nic mobile tun"
);
false
}
}
}
async fn forward_member_packet_to_tun(
&mut self,
member_packet: SharedVirtualNicMemberPacket,
) -> bool {
self.state
.remember_reverse_owner(member_packet.member_id, &member_packet.packet);
let Some(tun_sink) = self.tun_sink.as_mut() else {
tracing::trace!(
member_id = ?member_packet.member_id,
"shared virtual nic dropped member packet without mobile tun"
);
return false;
};
if let Err(err) = tun_sink.send(member_packet.packet).await {
tracing::error!(?err, "shared virtual nic write to mobile tun failed");
self.drop_tun();
return true;
}
false
}
fn handle_control(&mut self, control: Option<SharedVirtualNicControl>) -> bool {
let Some(control) = control else {
self.cleanup(true);
return false;
};
match control {
SharedVirtualNicControl::Shutdown { invalidate, ack } => {
self.cleanup(invalidate);
let _ = ack.send(());
false
}
other => {
self.state.handle_control(other);
true
}
}
}
fn drop_tun(&mut self) {
self.tun_stream.take();
self.tun_sink.take();
}
fn cleanup(&mut self, invalidate: bool) {
self.drop_tun();
if invalidate {
self.valid.store(false, Ordering::Release);
}
self.member_tunnel_table.detach_dispatcher();
self.state.close_all();
}
}
#[cfg(mobile)]
fn next_mobile_rebuild_delay(delay: Duration) -> Duration {
delay.saturating_mul(2).min(MOBILE_REBUILD_MAX_DELAY)
}
#[derive(Default)]
struct SharedVirtualNicDispatcherState {
members: BTreeMap<SharedVirtualNicMemberId, SharedVirtualNicMemberTunnelEntry>,
@@ -449,8 +778,11 @@ impl SharedVirtualNicDispatcherState {
SharedVirtualNicControl::Register { member_id, entry } => {
self.register(member_id, entry);
}
SharedVirtualNicControl::Unregister { member_id } => {
self.unregister(member_id);
SharedVirtualNicControl::Unregister {
member_id,
registration_id,
} => {
self.unregister(member_id, registration_id);
}
SharedVirtualNicControl::UpdateSources {
member_id,
@@ -460,6 +792,9 @@ impl SharedVirtualNicDispatcherState {
self.source_table.update_member_sources(member_id, sources);
let _ = ack.send(());
}
SharedVirtualNicControl::Shutdown { .. } => {
unreachable!("dispatcher shutdown is handled by the dispatcher task")
}
}
}
@@ -472,7 +807,20 @@ impl SharedVirtualNicDispatcherState {
drop(old_entry);
}
fn unregister(&mut self, member_id: SharedVirtualNicMemberId) {
fn unregister(
&mut self,
member_id: SharedVirtualNicMemberId,
registration_id: SharedVirtualNicMemberRegistrationId,
) {
if self
.members
.get(&member_id)
.map(|entry| entry.registration_id)
!= Some(registration_id)
{
return;
}
let entry = self.members.remove(&member_id);
drop(entry);
self.flow_table.remove_owner(member_id);
@@ -530,10 +878,10 @@ impl SharedVirtualNicDispatcherState {
member_id: SharedVirtualNicMemberId,
packet: ZCPacket,
) -> Result<(), ZCPacket> {
let Some(sender) = self
let Some((registration_id, sender)) = self
.members
.get(&member_id)
.map(|entry| entry.sender.clone())
.map(|entry| (entry.registration_id, entry.sender.clone()))
else {
return Err(packet);
};
@@ -541,7 +889,7 @@ impl SharedVirtualNicDispatcherState {
match sender.send(packet).await {
Ok(()) => Ok(()),
Err(err) => {
self.unregister(member_id);
self.unregister(member_id, registration_id);
Err(err.0)
}
}
@@ -690,7 +1038,15 @@ mod tests {
}
fn member_entry(sender: mpsc::Sender<ZCPacket>) -> SharedVirtualNicMemberTunnelEntry {
member_entry_with_registration(sender, uuid::Uuid::from_u128(1))
}
fn member_entry_with_registration(
sender: mpsc::Sender<ZCPacket>,
registration_id: SharedVirtualNicMemberRegistrationId,
) -> SharedVirtualNicMemberTunnelEntry {
SharedVirtualNicMemberTunnelEntry {
registration_id,
sender,
close_notifier: Arc::new(Notify::new()),
_tasks: Vec::new(),
@@ -772,7 +1128,7 @@ mod tests {
owner,
BTreeSet::from([SharedVirtualNicFlowAddr::V6(source.octets())]),
);
state.unregister(owner);
state.unregister(owner, uuid::Uuid::from_u128(1));
state
.forward_tun_packet_to_member(ipv6_packet(source, dst))
.await;
@@ -780,6 +1136,28 @@ mod tests {
assert!(fallback_receiver.try_recv().is_err());
}
#[tokio::test]
async fn dispatcher_ignores_stale_member_unregister() {
let member_id = uuid::Uuid::from_u128(1);
let stale_registration = uuid::Uuid::from_u128(10);
let current_registration = uuid::Uuid::from_u128(11);
let src = "2001:db8::1".parse::<Ipv6Addr>().unwrap();
let dst = "2001:db8:ffff::1".parse::<Ipv6Addr>().unwrap();
let (sender, mut receiver) = mpsc::channel(1);
let mut state = SharedVirtualNicDispatcherState::default();
state.register(
member_id,
member_entry_with_registration(sender, current_registration),
);
state.unregister(member_id, stale_registration);
state
.forward_tun_packet_to_member(ipv6_packet(src, dst))
.await;
assert!(receiver.try_recv().is_ok());
}
#[tokio::test]
async fn dispatcher_invalidates_shared_nic_when_tun_read_fails() {
let member_id = uuid::Uuid::from_u128(1);
@@ -800,7 +1178,12 @@ mod tests {
let (_member_tunnel, shared_tunnel) = create_ring_tunnel_pair();
member_tunnel_table
.register(member_id, shared_tunnel, close_notifier.clone())
.register(
member_id,
uuid::Uuid::from_u128(1),
shared_tunnel,
close_notifier.clone(),
)
.unwrap();
dispatcher
.update_sources(member_id, &BTreeSet::new(), &BTreeSet::new())
@@ -815,4 +1198,45 @@ mod tests {
assert!(!valid.load(Ordering::Acquire));
assert!(member_tunnel_table.dispatcher_channels().is_none());
}
#[tokio::test]
async fn dispatcher_shutdown_for_replacement_keeps_shared_nic_valid() {
let member_id = uuid::Uuid::from_u128(1);
let (_tun_tx, tun_rx) = mpsc::unbounded_channel();
let tun_stream = tokio_stream::wrappers::UnboundedReceiverStream::new(tun_rx);
let tun_sink = futures::sink::unfold((), |(), _packet: ZCPacket| async {
Ok::<(), TunnelError>(())
});
let tunnel = TunnelWrapper::new(tun_stream, tun_sink, None);
let member_tunnel_table = SharedVirtualNicMemberTunnelTable::default();
let valid = Arc::new(AtomicBool::new(true));
let dispatcher = SharedVirtualNicDispatcher::start(
Box::new(tunnel),
member_tunnel_table.clone(),
valid.clone(),
);
let close_notifier = Arc::new(Notify::new());
let (_member_tunnel, shared_tunnel) = create_ring_tunnel_pair();
member_tunnel_table
.register(
member_id,
uuid::Uuid::from_u128(1),
shared_tunnel,
close_notifier.clone(),
)
.unwrap();
dispatcher
.update_sources(member_id, &BTreeSet::new(), &BTreeSet::new())
.await
.unwrap();
dispatcher.shutdown_without_invalidation().await;
tokio::time::timeout(Duration::from_secs(1), close_notifier.notified())
.await
.unwrap();
assert!(valid.load(Ordering::Acquire));
assert!(member_tunnel_table.dispatcher_channels().is_none());
}
}
easytier/src/instance/virtual_nic.rs
+38 -5
View File
@@ -599,6 +599,11 @@ impl VirtualNic {
Ok(tun::create(&config)?)
}
#[cfg(mobile)]
pub fn set_mobile_tun_fd_name(&mut self, tun_fd: std::os::fd::RawFd) {
self.ifname = Some(format!("tunfd_{}", tun_fd));
}
#[cfg(mobile)]
pub async fn create_dev_for_mobile(
&mut self,
@@ -634,7 +639,7 @@ impl VirtualNic {
None,
);
self.ifname = Some(format!("tunfd_{}", tun_fd));
self.set_mobile_tun_fd_name(tun_fd);
Ok(Box::new(ft))
}
@@ -986,6 +991,22 @@ impl NicBackend {
Self::Shared(member) => member.add_ipv6(ip, cidr).await,
}
}
#[cfg(mobile)]
pub async fn add_mobile_source_ip(&self, ip: Ipv4Addr, cidr: i32) -> Result<(), Error> {
match self {
Self::Dedicated(_) => Ok(()),
Self::Shared(member) => member.add_mobile_source_ip(ip, cidr).await,
}
}
#[cfg(mobile)]
pub async fn add_mobile_source_ipv6(&self, ip: Ipv6Addr, cidr: i32) -> Result<(), Error> {
match self {
Self::Dedicated(_) => Ok(()),
Self::Shared(member) => member.add_mobile_source_ipv6(ip, cidr).await,
}
}
}
pub struct NicCtx {
@@ -1673,16 +1694,14 @@ impl NicCtx {
#[cfg(mobile)]
pub async fn run_for_mobile(&mut self, tun_fd: std::os::fd::RawFd) -> Result<(), Error> {
let tunnel = match self.backend.create_dev_for_mobile(tun_fd).await {
let (tunnel, ifname) = match self.backend.create_dev_for_mobile(tun_fd).await {
Ok(ret) => {
let ifname = self
.backend
.ifname()
.await
.ok_or_else(|| anyhow::anyhow!("tun device has no interface name"))?;
self.global_ctx
.issue_event(GlobalCtxEvent::TunDeviceReady(ifname));
ret
(ret, ifname)
}
Err(err) => {
self.global_ctx
@@ -1691,6 +1710,20 @@ impl NicCtx {
}
};
if let Some(ipv4_addr) = self.global_ctx.get_ipv4() {
self.backend
.add_mobile_source_ip(ipv4_addr.address(), ipv4_addr.network_length() as i32)
.await?;
}
if let Some(ipv6_addr) = self.global_ctx.get_ipv6() {
self.backend
.add_mobile_source_ipv6(ipv6_addr.address(), ipv6_addr.network_length() as i32)
.await?;
}
self.global_ctx
.issue_event(GlobalCtxEvent::TunDeviceReady(ifname));
let (stream, sink) = tunnel.split();
self.do_forward_nic_to_peers_task(stream)?;