mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-03-22 00:41:55 +00:00
58fe527b0e
From the perspective of any application, Firezone is a layer-3 network and will thus use the host's networking stack to form IP packets for whichever application protocol is in use (UDP, TCP, etc). These packets then get encapsulated into UDP packets by Firezone and sent to a Gateway. As a result of this design, the IP header seen by the networking stacks of the Client and the receiving service are not visible to any intermediary along the network path of the Client and Gateway. In case this network path is congested and middleboxes such as routers need to drop packets, they will look at the ECN bits in the IP header (of the UDP packet generated by a Client or Gateway) and flip a bit in case the previous value indicated support for ECN (`0x01` or `0x10`). When received by a network stack that supports ECN, seeing `0x11` means that the network path is congested and that it must reduce its send/receive windows (or otherwise throttle the connection). At present, this doesn't work with Firezone because of the aforementioned encapsulation of IP packets. To support ECN, we need to therefore: - Copy ECN bits from a received IP packet to the datagram that encapsulates it: This ensures that if the Client's network stack support ECN, we mirror that support on the wire. - Copy ECN bits from a received datagram to the IP packet the is sent to the TUN device: This ensures that if the "Congestion Experienced" bit get set along the network path between Client and Gateway, we reflect that accordingly on the IP packet emitted by the TUN device. Resolves: #3758 --------- Signed-off-by: Thomas Eizinger <thomas@eizinger.io> Co-authored-by: Jamil Bou Kheir <jamilbk@users.noreply.github.com>
55 lines
1.8 KiB
Rust
55 lines
1.8 KiB
Rust
use crate::slice_utils::write_to_offset_unchecked;
|
|
use etherparse::Ipv4HeaderSlice;
|
|
|
|
pub struct Ipv4HeaderSliceMut<'a> {
|
|
slice: &'a mut [u8],
|
|
}
|
|
|
|
impl<'a> Ipv4HeaderSliceMut<'a> {
|
|
/// Creates a new [`Ipv4HeaderSliceMut`].
|
|
pub fn from_slice(
|
|
slice: &'a mut [u8],
|
|
) -> Result<Self, etherparse::err::ipv4::HeaderSliceError> {
|
|
Ipv4HeaderSlice::from_slice(slice)?;
|
|
|
|
Ok(Self { slice })
|
|
}
|
|
|
|
/// Creates a new [`Ipv4HeaderSliceMut`] without checking the slice.
|
|
///
|
|
/// # Safety
|
|
///
|
|
/// The caller must guarantee that the slice is at least of length 20.
|
|
pub unsafe fn from_slice_unchecked(slice: &'a mut [u8]) -> Self {
|
|
Self { slice }
|
|
}
|
|
|
|
pub fn set_checksum(&mut self, checksum: u16) {
|
|
// Safety: Slice it at least of length 40 as checked in the ctor.
|
|
unsafe { write_to_offset_unchecked(self.slice, 10, checksum.to_be_bytes()) };
|
|
}
|
|
|
|
pub fn set_source(&mut self, src: [u8; 4]) {
|
|
// Safety: Slice it at least of length 20 as checked in the ctor.
|
|
unsafe { write_to_offset_unchecked(self.slice, 12, src) };
|
|
}
|
|
|
|
pub fn set_destination(&mut self, dst: [u8; 4]) {
|
|
// Safety: Slice it at least of length 20 as checked in the ctor.
|
|
unsafe { write_to_offset_unchecked(self.slice, 16, dst) };
|
|
}
|
|
|
|
pub fn set_total_length(&mut self, len: [u8; 2]) {
|
|
// Safety: Slice it at least of length 20 as checked in the ctor.
|
|
unsafe { write_to_offset_unchecked(self.slice, 2, len) };
|
|
}
|
|
|
|
pub fn set_ecn(&mut self, ecn: u8) {
|
|
let current = self.slice[1];
|
|
let new = current & 0b1111_1100 | ecn;
|
|
|
|
// Safety: Slice it at least of length 20 as checked in the ctor.
|
|
unsafe { write_to_offset_unchecked(self.slice, 1, [new]) };
|
|
}
|
|
}
|