Vpn

Cargo.toml

@@ -59,6 +59,7 @@ tokio = { version = "1" }
 tokio-stream = { version = "0.1", features = ["sync"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+serde_yaml = "0.9"
 nix = { version = "0.29", features = ["net"] }
 clap = { version = "4", features = ["derive"] }
 tracing = "0.1"

changelog.d/2387.added.md

@@ -0,0 +1 @@
+Add initial and very basic implementation of vpn

mirrord/agent/Cargo.toml

@@ -28,6 +28,7 @@ tokio = { workspace = true, features = [
     "process",
     "signal",
 ] }
+procfs = "0.16.0"
 serde.workspace = true
 serde_json.workspace = true
 pnet = "0.35"
@@ -69,6 +70,7 @@ tokio-rustls = "0.26"
 x509-parser = "0.16"
 rustls.workspace = true
 envy = "0.4"
+socket2.workspace = true
 
 [target.'cfg(target_os = "linux")'.dependencies]
 iptables = { git = "https://github.com/metalbear-co/rust-iptables.git", rev = "e66c7332e361df3c61a194f08eefe3f40763d624" }

mirrord/agent/src/entrypoint.rs

@@ -46,6 +46,7 @@ use crate::{
         StealerCommand, TcpConnectionStealer, TcpStealerApi,
     },
     util::{run_thread_in_namespace, ClientId},
+    vpn::VpnApi,
     watched_task::{TaskStatus, WatchedTask},
     *,
 };
@@ -200,6 +201,7 @@ struct ClientConnectionHandler {
     tcp_outgoing_api: TcpOutgoingApi,
     udp_outgoing_api: UdpOutgoingApi,
     dns_api: DnsApi,
+    vpn_api: VpnApi,
     state: State,
     /// Whether the client has sent us [`ClientMessage::ReadyForLogs`].
     ready_for_logs: bool,
@@ -224,6 +226,7 @@ impl ClientConnectionHandler {
 
         let tcp_outgoing_api = TcpOutgoingApi::new(pid);
         let udp_outgoing_api = UdpOutgoingApi::new(pid);
+        let vpn_api = VpnApi::new(pid);
 
         let client_handler = Self {
             id,
@@ -234,6 +237,7 @@ impl ClientConnectionHandler {
             tcp_outgoing_api,
             udp_outgoing_api,
             dns_api,
+            vpn_api,
             state,
             ready_for_logs: false,
         };
@@ -372,6 +376,10 @@ impl ClientConnectionHandler {
                     Ok(message) => self.respond(DaemonMessage::GetAddrInfoResponse(message)).await?,
                     Err(e) => break e,
                 },
+                message = self.vpn_api.daemon_message() => match message{
+                    Ok(message) => self.respond(DaemonMessage::Vpn(message)).await?,
+                    Err(e) => break e,
+                },
                 _ = cancellation_token.cancelled() => return Ok(()),
             }
         };
@@ -473,6 +481,9 @@ impl ClientConnectionHandler {
             ClientMessage::ReadyForLogs => {
                 self.ready_for_logs = true;
             }
+            ClientMessage::Vpn(message) => {
+                self.vpn_api.layer_message(message).await?;
+            }
         }
 
         Ok(true)

mirrord/agent/src/error.rs

@@ -79,6 +79,10 @@ pub(crate) enum AgentError {
 
     #[error("Timeout on accepting first client connection")]
     FirstConnectionTimeout,
+
+    /// Temporary error for vpn feature
+    #[error("Generic error in vpn: {0}")]
+    VpnError(String),
 }
 
 impl From<mpsc::error::SendError<StealerCommand>> for AgentError {

mirrord/agent/src/main.rs

@@ -37,6 +37,8 @@ mod steal;
 #[cfg(target_os = "linux")]
 mod util;
 #[cfg(target_os = "linux")]
+mod vpn;
+#[cfg(target_os = "linux")]
 mod watched_task;
 
 #[cfg(target_os = "linux")]