add private mode (#897)

---------

Co-authored-by: Sijie.Sun <sunsijie@buaa.edu.cn>

easytier/src/common/config.rs

@@ -37,6 +37,7 @@ pub fn gen_default_flags() -> Flags {
         disable_kcp_input: false,
         disable_relay_kcp: true,
         accept_dns: false,
+        private_mode: false,
     }
 }
 

easytier/src/easytier-core.rs

@@ -452,6 +452,13 @@ struct Cli {
         help = t!("core_clap.accept_dns").to_string(),
     )]
     accept_dns: Option<bool>,
+
+    #[arg(
+        long,
+        env = "ET_PRIVATE_MODE",
+        help = t!("core_clap.private_mode").to_string(),
+    )]
+    private_mode: Option<bool>,
 }
 
 rust_i18n::i18n!("locales", fallback = "en");
@@ -770,6 +777,7 @@ impl TryFrom<&Cli> for TomlConfigLoader {
         f.enable_kcp_proxy = cli.enable_kcp_proxy.unwrap_or(f.enable_kcp_proxy);
         f.disable_kcp_input = cli.disable_kcp_input.unwrap_or(f.disable_kcp_input);
         f.accept_dns = cli.accept_dns.unwrap_or(f.accept_dns);
+        f.private_mode = cli.private_mode.unwrap_or(f.private_mode);
         cfg.set_flags(f);
 
         if !cli.exit_nodes.is_empty() {

easytier/src/launcher.rs

@@ -676,6 +676,10 @@ impl NetworkConfig {
             flags.mtu = mtu as u32;
         }
 
+        if let Some(enable_private_mode) = self.enable_private_mode {
+            flags.private_mode = enable_private_mode;
+        }
+
         cfg.set_flags(flags);
         Ok(cfg)
     }

easytier/src/peers/peer_manager.rs

@@ -422,6 +422,13 @@ impl PeerManager {
         tracing::info!("add tunnel as server start");
         let mut peer = PeerConn::new(self.my_peer_id, self.global_ctx.clone(), tunnel);
         peer.do_handshake_as_server().await?;
+        if self.global_ctx.config.get_flags().private_mode
+            && peer.get_network_identity().network_name != self.global_ctx.get_network_identity().network_name
+        {
+            return Err(Error::SecretKeyError(
+                "private mode is turned on, network identity not match".to_string(),
+            ));
+        }
         if peer.get_network_identity().network_name
             == self.global_ctx.get_network_identity().network_name
         {

easytier/src/proto/common.proto

@@ -33,6 +33,8 @@ message FlagsInConfig {
 
   // enable magic dns or not
   bool accept_dns = 22;
+  // enable private mode
+  bool private_mode = 23;
 }
 
 message RpcDescriptor {

easytier/src/proto/web.proto

@@ -65,6 +65,7 @@ message NetworkConfig {
     repeated string mapped_listeners = 41;
 
     optional bool enable_magic_dns = 42;
+    optional bool enable_private_mode = 43;
 }
 
 message MyNodeInfo {