Files
Easytier/easytier-proto/proto/api_manage.proto
T
KKRainbow 62e4fd15e9 feat(vpn): multi-client WireGuard portal with attached peers (#2502)
* feat(peer): support protocol-agnostic attached peers

Add locally attached peers backed by independent, peer-level portable
managers and authenticated in-process ring connections. Carry trusted
connection provenance through packet admission so attached relay
privileges cannot be forged through packet headers.

Let every peer manager own ACL loading, sanitized policy updates, route
refresh, and runtime cleanup. In Secure Mode, grant attached identities
ephemeral credentials instead of sharing administrator and group secrets.

* feat(vpn): add reusable attached-peer portal runtime

Add a protocol-neutral portal runtime that converts authenticated client
sessions into attached EasyTier peers. Own per-client generations,
status, packet forwarding, address translation, and peer cleanup without
knowing the transport protocol.

Add transactional IPv4 source and destination rewriting with correct
IPv4, TCP, UDP, ICMP, and quoted-packet checksum updates. Keep the old
production portal path temporarily active until the WireGuard adapter is
migrated in the next change.

* feat(wireguard): attach named clients through peer portal

Replace the monolithic WireGuard portal with a native adapter that owns
key derivation, UDP demultiplexing, reauthentication, roaming, and
bounded per-client packet queues. Hand authenticated sessions to the
generic portal runtime for peer lifecycle and IPv4 translation.

Move portal configuration into the core instance model, require a
dedicated server key, and preserve existing listener, CLI, and runtime
configuration behavior. Reject runtime address conflicts before
publishing shared configuration.

* feat(vpn): expose per-client portal status

Project configured clients and their runtime state through the portal
RPC, including generated client configuration, listener, peer identity,
endpoint, tunnel address, ACL groups, and errors. Keep private client
configuration out of the broad instance-info response and expose the
explicit RPC through the CLI and Tauri bridge.

* feat(vpn): add portal configuration to web clients

Expose WireGuard portal listener, key, client, ACL group, and runtime
status fields in the shared frontend library, Web dashboard, and Tauri
client. Preserve UUID and uint64 values across protobuf JSON
boundaries, keep dynamic client editor rows stable, and document the
portal workflow.

* test(vpn): cover multi-client and roaming WireGuard portals

Add two three-node integration tests for the WireGuard VPN portal.

The multi-client test connects two kernel WireGuard clients from
separate network namespaces, verifies per-client connectivity to mesh
nodes, and exercises cross-client traffic that runs the IPv4 source
and destination translation in both directions. A TCP echo exchange
through the portal additionally covers the TCP pseudo-header checksum
rewrite path that ICMP-only ping tests miss, and portal status
snapshots must report both clients online with distinct peer ids and
correctly learned tunnel addresses.

The roaming test swaps the client namespace address (delete the old
address, then add the new one) so the kernel WireGuard source cache is
invalidated and the client keeps sending under the same session from
the new source, exactly like a real network change. The portal must
update the client endpoint on the same peer id via the data path
(same generation, no re-handshake, no detach/reconnect) while
connectivity to mesh nodes is preserved.

Supporting changes: run_wireguard_client now takes an interface name,
and the shared namespace topology gains net_f (10.1.2.5) on the portal
bridge for the second client.
2026-08-21 10:59:05 +08:00

230 lines
6.6 KiB
Protocol Buffer

syntax = "proto3";
import "common.proto";
import "peer_rpc.proto";
import "api_instance.proto";
import "acl.proto";
package api.manage;
enum NetworkingMethod {
PublicServer = 0;
Manual = 1;
Standalone = 2;
}
enum ConfigSource {
ConfigSourceUnspecified = 0;
ConfigSourceUser = 1;
ConfigSourceWeb = 2;
}
message NetworkConfig {
optional string instance_id = 1;
optional bool dhcp = 2;
optional string virtual_ipv4 = 3;
optional int32 network_length = 4;
optional string hostname = 5;
optional string network_name = 6;
optional string network_secret = 7;
optional NetworkingMethod networking_method = 8;
optional string public_server_url = 9;
repeated string peer_urls = 10;
repeated string proxy_cidrs = 11;
optional bool enable_vpn_portal = 12 [deprecated = true];
optional int32 vpn_portal_listen_port = 13 [deprecated = true];
optional string vpn_portal_client_network_addr = 14 [deprecated = true];
optional int32 vpn_portal_client_network_len = 15 [deprecated = true];
optional bool advanced_settings = 16;
repeated string listener_urls = 17;
// optional int32 rpc_port = 18;
optional bool latency_first = 19;
optional string dev_name = 20;
optional bool use_smoltcp = 21;
optional bool disable_ipv6 = 47;
optional bool enable_kcp_proxy = 22;
optional bool disable_kcp_input = 23;
optional bool disable_p2p = 24;
optional bool bind_device = 25;
optional bool no_tun = 26;
optional bool enable_exit_node = 27;
optional bool relay_all_peer_rpc = 28;
optional bool multi_thread = 29;
optional bool enable_relay_network_whitelist = 30;
repeated string relay_network_whitelist = 31;
optional bool enable_manual_routes = 32;
repeated string routes = 33;
repeated string exit_nodes = 34;
optional bool proxy_forward_by_system = 35;
optional bool disable_encryption = 36;
optional bool enable_socks5 = 37;
optional int32 socks5_port = 38;
optional bool disable_udp_hole_punching = 39;
optional int32 mtu = 40;
repeated string mapped_listeners = 41;
optional bool enable_magic_dns = 42;
optional bool enable_private_mode = 43;
// repeated string rpc_portal_whitelists = 44;
optional bool enable_quic_proxy = 45;
optional bool disable_quic_input = 46;
optional int32 quic_listen_port = 50 [deprecated = true];
repeated PortForwardConfig port_forwards = 48;
optional bool disable_sym_hole_punching = 49;
optional bool p2p_only = 51;
optional common.CompressionAlgoPb data_compress_algo = 52;
optional string encryption_algorithm = 53;
optional bool disable_tcp_hole_punching = 54;
common.SecureModeConfig secure_mode = 55;
optional acl.Acl acl = 56;
optional string credential_file = 57;
optional bool lazy_p2p = 58;
optional bool need_p2p = 59;
optional uint64 instance_recv_bps_limit = 60;
optional bool disable_upnp = 61;
optional bool ipv6_public_addr_provider = 62;
optional bool ipv6_public_addr_auto = 63;
optional string ipv6_public_addr_prefix = 64;
optional bool disable_relay_data = 65;
optional bool enable_udp_broadcast_relay = 66;
optional uint32 socket_mark = 67;
repeated NetworkPeerConfig peers = 68;
optional VpnPortalConfig vpn_portal_config = 69;
}
message VpnPortalClientConfig {
string name = 1;
string virtual_ip = 2;
repeated string groups = 3;
}
message VpnPortalConfig {
string wireguard_listen = 1;
optional string wireguard_private_key = 2;
repeated VpnPortalClientConfig clients = 3;
}
message NetworkPeerConfig {
string uri = 1;
optional string peer_public_key = 2;
}
message PortForwardConfig {
string bind_ip = 1;
uint32 bind_port = 2;
string dst_ip = 3;
uint32 dst_port = 4;
string proto = 5;
}
message MyNodeInfo {
common.Ipv4Inet virtual_ipv4 = 1;
string hostname = 2;
string version = 3;
peer_rpc.GetIpListResponse ips = 4;
common.StunInfo stun_info = 5;
repeated common.Url listeners = 6;
optional string vpn_portal_cfg = 7 [deprecated = true];
uint32 peer_id = 8;
}
message NetworkInstanceRunningInfo {
string dev_name = 1;
MyNodeInfo my_node_info = 2;
repeated string events = 3;
repeated api.instance.Route routes = 4;
repeated api.instance.PeerInfo peers = 5;
repeated api.instance.PeerRoutePair peer_route_pairs = 6;
bool running = 7;
optional string error_msg = 8;
peer_rpc.RouteForeignNetworkSummary foreign_network_summary = 9;
}
message NetworkInstanceRunningInfoMap {
map<string, NetworkInstanceRunningInfo> map = 1;
}
message NetworkMeta {
common.UUID inst_id = 1;
string network_name = 2;
uint32 config_permission = 3;
string instance_name = 4;
ConfigSource source = 5;
}
message ValidateConfigRequest { NetworkConfig config = 1; }
message ValidateConfigResponse { string toml_config = 1; }
message RunNetworkInstanceRequest {
common.UUID inst_id = 1;
NetworkConfig config = 2;
bool overwrite = 3;
ConfigSource source = 4;
}
message RunNetworkInstanceResponse { common.UUID inst_id = 1; }
message RetainNetworkInstanceRequest { repeated common.UUID inst_ids = 1; }
message RetainNetworkInstanceResponse {
repeated common.UUID remain_inst_ids = 1;
}
message CollectNetworkInfoRequest { repeated common.UUID inst_ids = 1; }
message CollectNetworkInfoResponse { NetworkInstanceRunningInfoMap info = 1; }
message ListNetworkInstanceRequest {}
message ListNetworkInstanceResponse { repeated common.UUID inst_ids = 1; }
message DeleteNetworkInstanceRequest { repeated common.UUID inst_ids = 1; }
message DeleteNetworkInstanceResponse {
repeated common.UUID remain_inst_ids = 1;
}
message GetNetworkInstanceConfigRequest { common.UUID inst_id = 1; }
message GetNetworkInstanceConfigResponse {
NetworkConfig config = 1;
ConfigSource source = 2;
}
message ListNetworkInstanceMetaRequest { repeated common.UUID inst_ids = 1; }
message ListNetworkInstanceMetaResponse { repeated NetworkMeta metas = 1; }
service WebClientService {
rpc ValidateConfig(ValidateConfigRequest) returns (ValidateConfigResponse) {}
rpc RunNetworkInstance(RunNetworkInstanceRequest)
returns (RunNetworkInstanceResponse) {}
rpc RetainNetworkInstance(RetainNetworkInstanceRequest)
returns (RetainNetworkInstanceResponse) {}
rpc CollectNetworkInfo(CollectNetworkInfoRequest)
returns (CollectNetworkInfoResponse) {}
rpc ListNetworkInstance(ListNetworkInstanceRequest)
returns (ListNetworkInstanceResponse) {}
rpc DeleteNetworkInstance(DeleteNetworkInstanceRequest)
returns (DeleteNetworkInstanceResponse) {}
rpc GetNetworkInstanceConfig(GetNetworkInstanceConfigRequest)
returns (GetNetworkInstanceConfigResponse) {}
rpc ListNetworkInstanceMeta(ListNetworkInstanceMetaRequest)
returns (ListNetworkInstanceMetaResponse) {}
}