Support UDP/TCP port fowarding to a host without setting up a tun

cmd/nebula/main.go

@@ -4,10 +4,14 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"os/signal"
+	"syscall"
 
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/config"
+	"github.com/slackhq/nebula/port_forwarder"
+	"github.com/slackhq/nebula/service"
 	"github.com/slackhq/nebula/util"
 )
 
@@ -52,16 +56,58 @@ func main() {
 		os.Exit(1)
 	}
 
-	ctrl, err := nebula.Main(c, *configTest, Build, l, nil)
-	if err != nil {
-		util.LogWithContextIfNeeded("Failed to start", err, l)
-		os.Exit(1)
+	fwd_list := port_forwarder.NewPortForwardingList()
+	disabled_tun := c.GetBool("tun.disabled", false)
+	activate_service_anyway := c.GetBool("port_forwarding.enable_without_rules", false)
+	if disabled_tun {
+		port_forwarder.ParseConfig(l, c, fwd_list)
 	}
 
-	if !*configTest {
-		ctrl.Start()
-		notifyReady(l)
-		ctrl.ShutdownBlock()
+	if !*configTest && disabled_tun && (activate_service_anyway || !fwd_list.IsEmpty()) {
+		l.Infof("Configuring user-tun instead of disabled-tun as port forwarding is configured")
+
+		service, err := service.New(c, l)
+		if err != nil {
+			util.LogWithContextIfNeeded("Failed to create service", err, l)
+			os.Exit(1)
+		}
+
+		// initialize port forwarding:
+		pf_service, err := port_forwarder.ConstructFromInitialFwdList(service, l, &fwd_list)
+		if err != nil {
+			util.LogWithContextIfNeeded("Failed to start", err, l)
+			os.Exit(1)
+		}
+
+		c.RegisterReloadCallback(func(c *config.C) {
+			pf_service.ReloadConfigAndApplyChanges(c)
+		})
+
+		pf_service.Activate()
+
+		// wait for termination request
+		signalChannel := make(chan os.Signal, 1)
+		signal.Notify(signalChannel, syscall.SIGINT, syscall.SIGTERM)
+		fmt.Println("Running, press ctrl+c to shutdown...")
+		<-signalChannel
+
+		// shutdown:
+		service.CloseAndWait()
+
+	} else {
+
+		l.Info("Configuring for disabled or kernel tun. no port forwarding provided")
+		ctrl, err := nebula.Main(c, *configTest, Build, l, nil)
+		if err != nil {
+			util.LogWithContextIfNeeded("Failed to start", err, l)
+			os.Exit(1)
+		}
+
+		if !*configTest {
+			ctrl.Start()
+			notifyReady(l)
+			ctrl.ShutdownBlock()
+		}
 	}
 
 	os.Exit(0)

connection_manager.go

@@ -26,6 +26,11 @@ const (
 	sendTestPacket trafficDecision = 6
 )
 
+// The data written into this variable is never used.
+// Its there to avoid a fresh dynamic memory allocation of 1 byte
+// for each time its used.
+var BYTE_SLICE_ONE []byte = []byte{1}
+
 type connectionManager struct {
 	in     map[uint32]struct{}
 	inLock *sync.RWMutex
@@ -463,12 +468,12 @@ func (n *connectionManager) sendPunch(hostinfo *HostInfo) {
 	if n.punchy.GetTargetEverything() {
 		hostinfo.remotes.ForEach(n.hostMap.GetPreferredRanges(), func(addr netip.AddrPort, preferred bool) {
 			n.metricsTxPunchy.Inc(1)
-			n.intf.outside.WriteTo([]byte{1}, addr)
+			n.intf.outside.WriteTo(BYTE_SLICE_ONE, addr)
 		})
 
 	} else if hostinfo.remote.IsValid() {
 		n.metricsTxPunchy.Inc(1)
-		n.intf.outside.WriteTo([]byte{1}, hostinfo.remote)
+		n.intf.outside.WriteTo(BYTE_SLICE_ONE, hostinfo.remote)
 	}
 }
 

e2e/forwarding/.gitignore

@@ -0,0 +1,3 @@
+*.out
+*.crt
+*.key

e2e/forwarding/README.md

@@ -0,0 +1,27 @@
+# Userspace port forwarding
+A simple speedtest for userspace port forwarding that can run without root access.
+
+## A side
+Nebula running at port 10000, forwarding inbound TCP connections on port 5201 to 127.0.0.1:15001.
+
+## B side
+Nebula running at port 10001, forwarding outbound TCP connections from 127.0.0.1:15002 to port 5201 of the A side.
+
+## Speedtest
+
+   ┌──────────────────────┐:10001     :10002┌──────────────────────┐
+   │    Nebula A side     ├─────────────────┤    Nebula B side     │
+   │                      │                 │                      │
+   │    192.168.100.1     │    TCP 5201     │    192.168.100.2     │
+   │          ┌───────────┼─────────────────┼──────────┐           │
+   │          │           ├─────────────────┤          │           │
+   └──────────▼───────────┘                 └──────────▲───────────┘
+              │                                        │ 127.0.0.1:15002
+              │                                        │
+   ┌──────────▼───────────┐                 ┌──────────┴───────────┐
+   │                      │                 │                      │
+   │                      │                 │                      │
+   │  iperf3 -s -p 15001  │                 │  iperf3 -c -p 15001  │
+   │                      │                 │                      │
+   │                      │                 │                      │
+   └──────────────────────┘                 └──────────────────────┘

e2e/forwarding/a_config.yml

@@ -0,0 +1,35 @@
+pki:
+  ca: ca.crt
+  cert: a.crt
+  key: a.key
+
+static_host_map:
+  "192.168.100.2": ["127.0.0.1:10002"]
+
+logging:
+  level: info
+
+listen:
+  host: 127.0.0.1
+  port: 10001
+
+port_forwarding:
+  enable_without_rules: true
+  inbound:
+    - listen_port: 5201
+      dial_address: "127.0.0.1:15001"
+      protocols: [tcp, udp]
+
+tun:
+  disabled: true
+  mtu: 1300
+
+firewall:
+  outbound:
+    - port: any
+      proto: udp
+      host: any
+  inbound:
+    - port: 5201
+      proto: any
+      host: any

e2e/forwarding/b_config.yml

@@ -0,0 +1,34 @@
+pki:
+  ca: ca.crt
+  cert: b.crt
+  key: b.key
+
+static_host_map:
+  "192.168.100.1": ["127.0.0.1:10001"]
+
+logging:
+  level: info
+
+listen:
+  host: 127.0.0.1
+  port: 10002
+
+port_forwarding:
+  enable_without_rules: true
+  outbound:
+    - listen_address: "127.0.0.1:15002"
+      dial_address: "192.168.100.1:5201"
+      protocols: [tcp, udp]
+
+tun:
+  disabled: true
+  mtu: 1300
+
+firewall:
+  outbound:
+    - port: any
+      proto: udp
+      host: any
+    - port: 5201
+      proto: any
+      host: any

e2e/forwarding/generate_certificates.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+../../nebula-cert ca -name "E2E test CA"
+../../nebula-cert sign -name "A" -ip "192.168.100.1/24" -out-crt a.crt -out-key a.key
+../../nebula-cert sign -name "B" -ip "192.168.100.2/24" -out-crt b.crt -out-key b.key

e2e/forwarding/speedtest.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+cd "$(dirname "$0")"
+
+if ! test -f ca.key; then
+  echo "Generating new test certificates"
+  ./generate_certificates.sh
+fi
+
+../../nebula -config "$(pwd)/a_config.yml" &>a.out &
+A_PID=$!
+../../nebula -config "$(pwd)/b_config.yml" &>b.out &
+B_PID=$!
+
+iperf3 -s -p 15001 &
+IPERF_SERVER_PID=$!
+
+sleep 1
+iperf3 -c 127.0.0.1 -p 15002 -P 10 "$@"
+
+# Cleanup
+kill $IPERF_SERVER_PID $A_PID $B_PID
+
+# wait for shutdown logs are written to files
+sleep 1
+
+echo "##########################################"
+echo "A side logs:"
+echo "##########################################"
+cat a.out
+
+echo "##########################################"
+echo "B side logs:"
+echo "##########################################"
+cat b.out
+rm a.out b.out

e2e/forwarding/speedtest_udp.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+cd "$(dirname "$0")"
+
+./speedtest.sh --udp --bidir --bitrate=100MiB "$@"

examples/config.yml

@@ -206,7 +206,11 @@ relay:
 
 # Configure the private interface. Note: addr is baked into the nebula certificate
 tun:
-  # When tun is disabled, a lighthouse can be started without a local tun interface (and therefore without root)
+  # When tun is disabled, a feature limited Nebula can be started without root privileges.
+  # In this limited mode, Nebula can
+  # - run a lighthouse node
+  # - offer access from and to the nebula network via port forwarding
+  # - respond to ping requests
   disabled: false
   # Name of the device. If not set, a default will be chosen by the OS.
   # For macOS: if set, must be in the form `utun[0-9]+`.
@@ -368,3 +372,26 @@ firewall:
       proto: tcp
       group: remote_client
       local_cidr: 192.168.100.1/24
+
+# By using port port forwarding (port tunnels) its possible to establish connections
+# from/into the nebula-network without using a tun/tap device and thus without requiring root access
+# on the host. Port forwarding is only supported when setting "tun.disabled" is set to true.
+# In this case, if a user-tun instead of a real one is instantiated to allow the port forwarding.
+# IMPORTANT: For incoming tunnels, don't forget to also open the firewall for the relevant ports.
+port_forwarding:
+  # Forces activation of the user tun, even when there is no rule specified.
+  # This can be useful, when rules are planned to be added later by reload.
+  # Reload config can't consider a change on tun-type.
+  enable_without_rules: false
+  outbound:
+  # format of listen- and dial-address: <host/ip>:<port>
+  #- listen_address: 127.0.0.1:3399
+  #  dial_address: 192.168.100.92:4499
+     # format of protocols lists (yml-list): [tcp], [udp], [tcp, udp]
+  #  protocols: [tcp, udp]
+  inbound:
+  # format of dial_address: <host/ip>:<port>
+  #- listen_port: 5599
+  #  dial_address: 127.0.0.1:5599
+     # format of protocols lists (yml-list): [tcp], [udp], [tcp, udp]
+  #  protocols: [tcp, udp]

examples/go_service/main.go

@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"log"
 	"net"
+	"os"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/service"
 )
@@ -59,7 +61,9 @@ pki:
 	if err := cfg.LoadString(configStr); err != nil {
 		return err
 	}
-	svc, err := service.New(&cfg)
+	l := logrus.New()
+	l.Out = os.Stdout
+	svc, err := service.New(&cfg, l)
 	if err != nil {
 		return err
 	}

interface.go

@@ -301,7 +301,7 @@ func (f *Interface) listenIn(reader io.ReadWriteCloser, i int) {
 	for {
 		n, err := reader.Read(packet)
 		if err != nil {
-			if errors.Is(err, os.ErrClosed) && f.closed.Load() {
+			if (errors.Is(err, os.ErrClosed) && f.closed.Load()) || errors.Is(err, io.EOF) {
 				return
 			}