shpark

use std::{fs, str::FromStr};

#[derive(Debug, PartialEq, Eq, Copy, Clone)]
struct Range {
    start: i64,
    end: i64,
}

impl PartialOrd for Range {
    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {

shpark

Linux socket/sock/sk_buff

struct socket

For higher-level use. Connects b/w struct file and struct sk:

typedef enum {
	SS_FREE = 0,			/* not allocated		*/
	SS_UNCONNECTED,			/* unconnected to any socket	*/
	SS_CONNECTING,			/* in process of connecting	*/

shpark

How to open/create a TUN interface

fd = open("/dev/net/tun", O_RDWR);

struct ifreq ifr;
ifr.ifr_flags = IFF_TUN; // or IFF_TAP
strncpy(ifr.ifr_name, (char*)name, IFNAMSIZ-1);

int res = ioctl(fd, TUNSETIFF, &ifr);

shpark

Tun and UDP listener

Tx

A local process attempts to send packet to WireGuard IP address (e.g., 192.168.4.3). The packet is delivered to wg interface (for user-space implementation, this is a TUN interface). Boringtun reads packets from the tun interface, find a matching peer, encapsulate packet and emit packet via the Udp socket. Recall that unlike TCP (connection, STREAM, ...), a UDP socket can be reused to send packets to different destinations (See sendto() and recvfrom() usages).

shpark

Tcp

tcp_proxy_server

Starts an ordinary TcpListener which is bound to port_forward.source. After accepting a connection, the socket is passed to handle_tcp_proxy_connection function along with virtual_port, port_forward and wg.

handle_tcp_proxy_connection function

shpark

Original documentation 1 suggests setting up network for CH guest using virtio-net deivces, host TAP and bridge interfaces.

This note is an alternative way of achieving a the Internet connectivity without setting up a bridge--spoiler alert--with iptables. (Similar setup used by smoltcp 2)

Create and configure a TAP interface

shpark

Linux netns cheat sheet

TL;DR. You first create a network namesmace (netns), and a veth device (you also create a peer). Then you assign one end to another netns. You can talk to another netns via the veth.

TODO: How to use a different device instead of veth for communication across netns?

Create a new netns

shpark

qemu-system-x86_64 -enable-kvm -m 2G -smp 4 --machine q35 -nographic -drive if=pflash,format=raw,file=OVMF_CODE.fd,readonly=on -drive if=pflash,format=raw,file=OVMF_VARS.fd,readonly=on -drive if=none,file=fat:rw:esp,id=esp0,format=raw -device virtio-blk-pci,drive=esp0,num-queues=4
SecCoreStartupWithStack(0xFFFCC000, 0x820000)
Register PPI Notify: DCD0BE23-9586-40F4-B643-06522CED4EDE
Install PPI: 8C8CE578-8A3D-4F1C-9935-896185C32DD3
Install PPI: 5473C07A-3DCB-4DCA-BD6F-1E9689E7349A
The 0th FV start address is 0x00000820000, size is 0x000E0000, handle is 0x820000
Register PPI Notify: 49EDB1C1-BF21-4761-BB12-EB0031AABB39
Register PPI Notify: EA7CA24B-DED5-4DAD-A389-BF827E8F9B38
Install PPI: B9E0ABFE-5979-4914-977F-6DEE78C278A6
Install PPI: DBE23AA9-A345-4B97-85B6-B226F1617389

shpark

On Ubuntu, you can use lsinitramfs or unmkinitramfs tools to play with initrd.

shpark

#!/usr/bin/env bash

KERNEL=$1
DISKIMG=$2

# NOTE: You can omit `virtio_mmio.device=4K@0xd0000000:5`
qemu-system-x86_64 -machine microvm \
                   -drive file=$DISKIMG,format=raw,id=id0 \
                   -device virtio-blk-device,drive=id0 \
                   -m 4G -smp 8 \