README.md

@@ -1,8 +1,41 @@
-# vppn: Virtual Potentially Private Network
+# vppn: Virtual Pretty Private Network
 
-## TO DO
+## Roadmap
 
-* Double buffering in IFReader and ConnReader ?
+* Use probe and relayed-probe packets vs ping/pong.
+* Rename Mediator -> Relay
+* Use default port 456
+* Remove signing key from hub
+* Peer: UDP hole-punching
+* Peer: local peer discovery - part of RoutingProcessor
+* Peer: update hub w/ latest port on startup
+
+## Learnings
+
+* Encryption / decryption is 20x faster than signing/opening.
+* Allowing out-of order packets is massively important for throughput with TCP
+
+## Principles
+
+* Creates an IPv4/24 network with a maximum of 254 peers. (1-254)
+* Simple setup: via setup link from the hub.
+* Each peer has full network state replicated from the hub.
+
+## Routing
+
+* Routing is different for public vs non-public peers
+  * Public: routes are initialized via incoming ping requests
+  * NonPub: routes are initialized via incoming ping responses
+
+A non-public peer needs to maintain connections with every public peer.
+
+* Sending:
+  * Public: send to address
+  * Non-public: send to a mediator
+
+* Pings:
+  * Servers don't need to ping
+  * Clients need to ping all public and local peers to keep connections open
 
 ## Hub Server Configuration
 
@@ -13,6 +46,7 @@ adduser user
 # Enable ssh.
 cp -r ~/.ssh /home/user/
 chown -R user:user /home/user/.ssh
+
 ```
 
 Upload `hub` executable:
@@ -24,14 +58,18 @@ scp hub user@<remote>:~/
 Create systemd file in `/etc/systemd/system/hub.service
 
 ```
+Description=hub
+Requires=network.target
+
 [Service]
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 Type=simple
 User=user
 WorkingDirectory=/home/user/
-ExecStart=/home/user/hub -listen <addr>:https -root-dir=/home/user
+ExecStart=/home/user/hub -listen <addr>:https -secure=true -root-dir=/home/user
 Restart=always
 RestartSec=8
+TimeoutStopSec=24
 
 [Install]
 WantedBy=default.target
@@ -41,7 +79,6 @@ Add and start the hub server:
 
 ```
 systemctl daemon-reload
-systemctl enable hub
 systemctl start hub
 ```
 
@@ -59,24 +96,21 @@ Install the binary somewhere, for example `~/bin/vppn`.
 
 Create systemd file in `/etc/systemd/system/vppn.service`.
 
+
 ```
+Description=vppn
+Requires=network.target
+
 [Service]
 AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
 Type=simple
 User=user
 WorkingDirectory=/home/user/
-ExecStart=/home/user/vppn -name mynetwork -hub-address https://my.hub -api-key 1234567890
+ExecStart=/home/user/vppn -name vppn
 Restart=always
 RestartSec=8
+TimeoutStopSec=24
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=default.target
-```
-
-Add and start the service:
-
-```
-systemctl daemon-reload
-systemctl enable vppn
-systemctl start vppn
 ```

aestests/aes_test.go

@@ -0,0 +1,79 @@
+package aestests
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"log"
+	"testing"
+)
+
+func must(err error) {
+	if err != nil {
+		panic(err)
+	}
+}
+
+func TestAES(t *testing.T) {
+	key := make([]byte, 32)
+	rand.Read(key)
+
+	block, err := aes.NewCipher(key)
+	must(err)
+
+	aesgcm, err := cipher.NewGCM(block)
+	must(err)
+
+	log.Print(aesgcm.NonceSize())
+	log.Print(aesgcm.Overhead())
+}
+
+func BenchmarkSeal(b *testing.B) {
+	key := make([]byte, 32)
+	rand.Read(key)
+
+	block, err := aes.NewCipher(key)
+	must(err)
+
+	cryptor, err := cipher.NewGCM(block)
+	must(err)
+
+	nonce := make([]byte, 12)
+	rand.Read(nonce)
+
+	data := make([]byte, 1400)
+	rand.Read(data)
+
+	out := make([]byte, 1500)
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		out = cryptor.Seal(out[:0], nonce, data, nil)
+	}
+}
+
+func BenchmarkOpen(b *testing.B) {
+	key := make([]byte, 32)
+	rand.Read(key)
+
+	block, err := aes.NewCipher(key)
+	must(err)
+
+	cryptor, err := cipher.NewGCM(block)
+	must(err)
+
+	nonce := make([]byte, 12)
+	rand.Read(nonce)
+
+	data := make([]byte, 1400)
+	rand.Read(data)
+
+	sealed := make([]byte, 1500)
+	sealed = cryptor.Seal(sealed[:0], nonce, data, nil)
+
+	dec := make([]byte, 1500)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		dec, err = cryptor.Open(dec[:0], nonce, sealed, nil)
+	}
+}

cmd/vppn/build.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+go build
+sudo setcap cap_net_admin+iep vppn
+sudo setcap cap_net_bind_service+iep vppn

cmd/vppn/main.go

@@ -2,10 +2,10 @@ package main
 
 import (
 	"log"
-	"vppn/peer"
+	"vppn/node"
 )
 
 func main() {
 	log.SetFlags(0)
-	peer.Main()
+	node.Main()
 }

go.mod

@@ -1,15 +1,17 @@
 module vppn
 
-go 1.24.1
+go 1.23.2
 
 require (
-	git.crumpington.com/lib/go v0.9.0
+	git.crumpington.com/lib/go v0.8.1
-	golang.org/x/crypto v0.36.0
+	git.crumpington.com/lib/webutil v0.0.7
-	golang.org/x/sys v0.31.0
+	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
+	golang.org/x/crypto v0.29.0
 )
 
 require (
 	github.com/mattn/go-sqlite3 v1.14.24 // indirect
-	golang.org/x/net v0.37.0 // indirect
+	golang.org/x/net v0.31.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/sys v0.27.0 // indirect
+	golang.org/x/text v0.20.0 // indirect
 )

go.sum

@@ -1,12 +1,16 @@
-git.crumpington.com/lib/go v0.9.0 h1:QXoMhsycSgEUWNiiPZWl0jgBls+NI9TNR5Z6nNXslCM=
+git.crumpington.com/lib/go v0.8.1 h1:rWjddllSxQ4yReraqDaGZAod4NpRD9LtGx1yV71ytcU=
-git.crumpington.com/lib/go v0.9.0/go.mod h1:i3DXiPDo/pgPMHAxUTpyo1Xj2spcvXwXcBef3aSYlnQ=
+git.crumpington.com/lib/go v0.8.1/go.mod h1:XjQaf2NFlje9BJ1EevZL8NNioPrAe7WwHpKUhcDw2Lk=
+git.crumpington.com/lib/webutil v0.0.7 h1:1RG9CpuXYalT0NPj8fvxjOLV566LqL37APvAdASFzgA=
+git.crumpington.com/lib/webutil v0.0.7/go.mod h1:efIEiuK1uqFIhI/dlsWUHMsC5bXcEbJEjmdluRoFPPQ=
 github.com/mattn/go-sqlite3 v1.14.24 h1:tpSp2G2KyMnnQu99ngJ47EIkWVmliIizyZBfPrBWDRM=
 github.com/mattn/go-sqlite3 v1.14.24/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 h1:TG/diQgUe0pntT/2D9tmUCz4VNwm9MfrtPr0SU2qSX8=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8/go.mod h1:P5HUIBuIWKbyjl083/loAegFkfbFNx5i2qEP4CNbm7E=
-golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
+golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
-golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/net v0.31.0 h1:68CPQngjLL0r2AlUKiSxtQFKvzRVbnzLwMUn5SzcLHo=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/net v0.31.0/go.mod h1:P4fl1q7dY2hnZFxEk4pPSkDHF+QqjitcnDjUQyMM+pM=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
+golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=

hub/api/api.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"crypto/rand"
 	"database/sql"
 	"embed"
 	"errors"
@@ -13,6 +14,7 @@ import (
 	"git.crumpington.com/lib/go/idgen"
 	"git.crumpington.com/lib/go/sqliteutil"
 	"golang.org/x/crypto/bcrypt"
+	"golang.org/x/crypto/nacl/box"
 )
 
 //go:embed migrations
@@ -21,6 +23,7 @@ var migrations embed.FS
 type API struct {
 	db          *sql.DB
 	lock        sync.Mutex
+	peerIntents map[string]PeerCreateArgs
 }
 
 func New(dbPath string) (*API, error) {
@@ -35,6 +38,7 @@ func New(dbPath string) (*API, error) {
 
 	a := &API{
 		db:          sqlDB,
+		peerIntents: map[string]PeerCreateArgs{},
 	}
 
 	return a, a.ensurePassword()
@@ -54,11 +58,17 @@ func (a *API) ensurePassword() error {
 	log.Printf("Setting password: %s", pwd)
 
 	hashed, err := bcrypt.GenerateFromPassword([]byte(pwd), bcrypt.DefaultCost)
+
 	if err != nil {
 		return err
 	}
 
-	conf := &Config{ConfigID: 1, Password: hashed}
+	conf := &Config{
+		ConfigID:   1,
+		VPNNetwork: []byte{10, 1, 1, 0},
+		Password:   hashed,
+	}
+
 	return db.Config_Insert(a.db, conf)
 }
 
@@ -74,6 +84,10 @@ func (a *API) Config_Update(conf *Config) error {
 	return db.Config_Update(a.db, conf)
 }
 
+func (a *API) Config_UpdatePassword(pwdHash []byte) error {
+	return db.Config_UpdatePassword(a.db, pwdHash)
+}
+
 func (a *API) Session_Delete(sessionID string) error {
 	return db.Session_Delete(a.db, sessionID)
 }
@@ -127,42 +141,94 @@ func (a *API) Session_SignIn(s *Session, pwd string) error {
 	return db.Session_SetSignedIn(a.db, s.SessionID)
 }
 
-func (a *API) Network_Create(n *Network) error {
+type PeerCreateArgs struct {
-	n.NetworkID = idgen.NextID(0)
+	Name     string
-	return db.Network_Insert(a.db, n)
+	PublicIP []byte
+	Port     uint16
+	Relay    bool
 }
 
-func (a *API) Network_Delete(n *Network) error {
+// Create the intention to add a peer. The returned code is used to complete
-	return db.Network_Delete(a.db, n.NetworkID)
+// the peer creation. The code is valid for 5 minutes.
-}
+func (a *API) Peer_CreateIntent(args PeerCreateArgs) string {
-
-func (a *API) Network_Get(id int64) (*Network, error) {
-	return db.Network_Get(a.db, id)
-}
-
-func (a *API) Network_List() ([]*Network, error) {
-	const query = db.Network_SelectQuery + ` ORDER BY Name ASC`
-	return db.Network_List(a.db, query)
-}
-
-func (a *API) Peer_CreateNew(p *Peer) error {
-	p.Version = idgen.NextID(0)
-	p.PubKey = []byte{}
-	p.PubSignKey = []byte{}
-	p.APIKey = idgen.NewToken()
-
-	return db.Peer_Insert(a.db, p)
-}
-
-func (a *API) Peer_Init(peer *Peer, args m.PeerInitArgs) error {
 	a.lock.Lock()
 	defer a.lock.Unlock()
 
-	peer.Version = idgen.NextID(0)
+	code := idgen.NewToken()
-	peer.PubKey = args.EncPubKey
+	a.peerIntents[code] = args
-	peer.PubSignKey = args.PubSignKey
 
-	return db.Peer_UpdateFull(a.db, peer)
+	go func() {
+		time.Sleep(5 * time.Minute)
+		a.lock.Lock()
+		defer a.lock.Unlock()
+		delete(a.peerIntents, code)
+	}()
+
+	return code
+}
+
+func (a *API) Peer_Create(creationCode string) (*m.PeerConfig, error) {
+	a.lock.Lock()
+	defer a.lock.Unlock()
+
+	args, ok := a.peerIntents[creationCode]
+	if !ok {
+		return nil, ErrNotAuthorized
+	}
+
+	delete(a.peerIntents, creationCode)
+
+	encPubKey, encPrivKey, err := box.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+
+	// Get peer IP.
+	peerIP := byte(0)
+
+	for i := byte(1); i < 255; i++ {
+		exists, err := db.Peer_Exists(a.db, i)
+		if err != nil {
+			return nil, err
+		}
+		if !exists {
+			peerIP = i
+			break
+		}
+	}
+
+	if peerIP == 0 {
+		return nil, ErrNoIPAvailable
+	}
+
+	peer := &Peer{
+		PeerIP:   peerIP,
+		Version:  idgen.NextID(0),
+		APIKey:   idgen.NewToken(),
+		Name:     args.Name,
+		PublicIP: args.PublicIP,
+		Port:     args.Port,
+		Relay:    args.Relay,
+		PubKey:   encPubKey[:],
+	}
+
+	if err := db.Peer_Insert(a.db, peer); err != nil {
+		return nil, err
+	}
+
+	conf := a.Config_Get()
+
+	return &m.PeerConfig{
+		PeerIP:     peer.PeerIP,
+		HubAddress: conf.HubAddress,
+		APIKey:     peer.APIKey,
+		Network:    conf.VPNNetwork,
+		PublicIP:   peer.PublicIP,
+		Port:       peer.Port,
+		Relay:   peer.Relay,
+		PubKey:     encPubKey[:],
+		PrivKey:    encPrivKey[:],
+	}, nil
 }
 
 func (a *API) Peer_Update(p *Peer) error {
@@ -173,16 +239,16 @@ func (a *API) Peer_Update(p *Peer) error {
 	return db.Peer_Update(a.db, p)
 }
 
-func (a *API) Peer_Delete(networkID int64, peerIP byte) error {
+func (a *API) Peer_Delete(ip byte) error {
-	return db.Peer_Delete(a.db, networkID, peerIP)
+	return db.Peer_Delete(a.db, ip)
 }
 
-func (a *API) Peer_List(networkID int64) ([]*Peer, error) {
+func (a *API) Peer_List() ([]*Peer, error) {
-	return db.Peer_ListAll(a.db, networkID)
+	return db.Peer_ListAll(a.db)
 }
 
-func (a *API) Peer_Get(networkID int64, ip byte) (*Peer, error) {
+func (a *API) Peer_Get(ip byte) (*Peer, error) {
-	return db.Peer_Get(a.db, networkID, ip)
+	return db.Peer_Get(a.db, ip)
 }
 
 func (a *API) Peer_GetByAPIKey(key string) (*Peer, error) {

hub/api/db/generated.go

@@ -17,10 +17,12 @@ type TX interface {
 
 type Config struct {
 	ConfigID   int64
+	HubAddress string
+	VPNNetwork []byte
 	Password   []byte
 }
 
-const Config_SelectQuery = "SELECT ConfigID,Password FROM config"
+const Config_SelectQuery = "SELECT ConfigID,HubAddress,VPNNetwork,Password FROM config"
 
 func Config_Insert(
 	tx TX,
@@ -31,7 +33,7 @@ func Config_Insert(
 		return err
 	}
 
-	_, err = tx.Exec("INSERT INTO config(ConfigID,Password) VALUES(?,?)", row.ConfigID, row.Password)
+	_, err = tx.Exec("INSERT INTO config(ConfigID,HubAddress,VPNNetwork,Password) VALUES(?,?,?,?)", row.ConfigID, row.HubAddress, row.VPNNetwork, row.Password)
 	return err
 }
 
@@ -44,7 +46,7 @@ func Config_Update(
 		return err
 	}
 
-	result, err := tx.Exec("UPDATE config SET Password=? WHERE ConfigID=?", row.Password, row.ConfigID)
+	result, err := tx.Exec("UPDATE config SET HubAddress=?,VPNNetwork=? WHERE ConfigID=?", row.HubAddress, row.VPNNetwork, row.ConfigID)
 	if err != nil {
 		return err
 	}
@@ -72,7 +74,7 @@ func Config_UpdateFull(
 		return err
 	}
 
-	result, err := tx.Exec("UPDATE config SET Password=? WHERE ConfigID=?", row.Password, row.ConfigID)
+	result, err := tx.Exec("UPDATE config SET HubAddress=?,VPNNetwork=?,Password=? WHERE ConfigID=?", row.HubAddress, row.VPNNetwork, row.Password, row.ConfigID)
 	if err != nil {
 		return err
 	}
@@ -122,8 +124,8 @@ func Config_Get(
 	err error,
 ) {
 	row = &Config{}
-	r := tx.QueryRow("SELECT ConfigID,Password FROM config WHERE ConfigID=?", ConfigID)
+	r := tx.QueryRow("SELECT ConfigID,HubAddress,VPNNetwork,Password FROM config WHERE ConfigID=?", ConfigID)
-	err = r.Scan(&row.ConfigID, &row.Password)
+	err = r.Scan(&row.ConfigID, &row.HubAddress, &row.VPNNetwork, &row.Password)
 	return
 }
 
@@ -137,7 +139,7 @@ func Config_GetWhere(
 ) {
 	row = &Config{}
 	r := tx.QueryRow(query, args...)
-	err = r.Scan(&row.ConfigID, &row.Password)
+	err = r.Scan(&row.ConfigID, &row.HubAddress, &row.VPNNetwork, &row.Password)
 	return
 }
 
@@ -157,7 +159,7 @@ func Config_Iterate(
 		defer rows.Close()
 		for rows.Next() {
 			row := &Config{}
-			err := rows.Scan(&row.ConfigID, &row.Password)
+			err := rows.Scan(&row.ConfigID, &row.HubAddress, &row.VPNNetwork, &row.Password)
 			if !yield(row, err) {
 				return
 			}
@@ -300,156 +302,11 @@ func Session_List(
 	return l, nil
 }
 
-// ----------------------------------------------------------------------------
-// Table: networks
-// ----------------------------------------------------------------------------
-
-type Network struct {
-	NetworkID int64
-	Name      string
-	Network   []byte
-}
-
-const Network_SelectQuery = "SELECT NetworkID,Name,Network FROM networks"
-
-func Network_Insert(
-	tx TX,
-	row *Network,
-) (err error) {
-	Network_Sanitize(row)
-	if err = Network_Validate(row); err != nil {
-		return err
-	}
-
-	_, err = tx.Exec("INSERT INTO networks(NetworkID,Name,Network) VALUES(?,?,?)", row.NetworkID, row.Name, row.Network)
-	return err
-}
-
-func Network_UpdateFull(
-	tx TX,
-	row *Network,
-) (err error) {
-	Network_Sanitize(row)
-	if err = Network_Validate(row); err != nil {
-		return err
-	}
-
-	result, err := tx.Exec("UPDATE networks SET Name=?,Network=? WHERE NetworkID=?", row.Name, row.Network, row.NetworkID)
-	if err != nil {
-		return err
-	}
-
-	n, err := result.RowsAffected()
-	if err != nil {
-		panic(err)
-	}
-	switch n {
-	case 0:
-		return sql.ErrNoRows
-	case 1:
-		return nil
-	default:
-		panic("multiple rows updated")
-	}
-}
-
-func Network_Delete(
-	tx TX,
-	NetworkID int64,
-) (err error) {
-	result, err := tx.Exec("DELETE FROM networks WHERE NetworkID=?", NetworkID)
-	if err != nil {
-		return err
-	}
-
-	n, err := result.RowsAffected()
-	if err != nil {
-		panic(err)
-	}
-	switch n {
-	case 0:
-		return sql.ErrNoRows
-	case 1:
-		return nil
-	default:
-		panic("multiple rows deleted")
-	}
-}
-
-func Network_Get(
-	tx TX,
-	NetworkID int64,
-) (
-	row *Network,
-	err error,
-) {
-	row = &Network{}
-	r := tx.QueryRow("SELECT NetworkID,Name,Network FROM networks WHERE NetworkID=?", NetworkID)
-	err = r.Scan(&row.NetworkID, &row.Name, &row.Network)
-	return
-}
-
-func Network_GetWhere(
-	tx TX,
-	query string,
-	args ...any,
-) (
-	row *Network,
-	err error,
-) {
-	row = &Network{}
-	r := tx.QueryRow(query, args...)
-	err = r.Scan(&row.NetworkID, &row.Name, &row.Network)
-	return
-}
-
-func Network_Iterate(
-	tx TX,
-	query string,
-	args ...any,
-) iter.Seq2[*Network, error] {
-	rows, err := tx.Query(query, args...)
-	if err != nil {
-		return func(yield func(*Network, error) bool) {
-			yield(nil, err)
-		}
-	}
-
-	return func(yield func(*Network, error) bool) {
-		defer rows.Close()
-		for rows.Next() {
-			row := &Network{}
-			err := rows.Scan(&row.NetworkID, &row.Name, &row.Network)
-			if !yield(row, err) {
-				return
-			}
-		}
-	}
-}
-
-func Network_List(
-	tx TX,
-	query string,
-	args ...any,
-) (
-	l []*Network,
-	err error,
-) {
-	for row, err := range Network_Iterate(tx, query, args...) {
-		if err != nil {
-			return nil, err
-		}
-		l = append(l, row)
-	}
-	return l, nil
-}
-
 // ----------------------------------------------------------------------------
 // Table: peers
 // ----------------------------------------------------------------------------
 
 type Peer struct {
-	NetworkID  int64
 	PeerIP   byte
 	Version  int64
 	APIKey   string
@@ -458,10 +315,9 @@ type Peer struct {
 	Port     uint16
 	Relay    bool
 	PubKey   []byte
-	PubSignKey []byte
 }
 
-const Peer_SelectQuery = "SELECT NetworkID,PeerIP,Version,APIKey,Name,PublicIP,Port,Relay,PubKey,PubSignKey FROM peers"
+const Peer_SelectQuery = "SELECT PeerIP,Version,APIKey,Name,PublicIP,Port,Relay,PubKey FROM peers"
 
 func Peer_Insert(
 	tx TX,
@@ -472,7 +328,7 @@ func Peer_Insert(
 		return err
 	}
 
-	_, err = tx.Exec("INSERT INTO peers(NetworkID,PeerIP,Version,APIKey,Name,PublicIP,Port,Relay,PubKey,PubSignKey) VALUES(?,?,?,?,?,?,?,?,?,?)", row.NetworkID, row.PeerIP, row.Version, row.APIKey, row.Name, row.PublicIP, row.Port, row.Relay, row.PubKey, row.PubSignKey)
+	_, err = tx.Exec("INSERT INTO peers(PeerIP,Version,APIKey,Name,PublicIP,Port,Relay,PubKey) VALUES(?,?,?,?,?,?,?,?)", row.PeerIP, row.Version, row.APIKey, row.Name, row.PublicIP, row.Port, row.Relay, row.PubKey)
 	return err
 }
 
@@ -485,7 +341,7 @@ func Peer_Update(
 		return err
 	}
 
-	result, err := tx.Exec("UPDATE peers SET Version=?,Name=?,PublicIP=?,Port=?,Relay=? WHERE NetworkID=? AND PeerIP=?", row.Version, row.Name, row.PublicIP, row.Port, row.Relay, row.NetworkID, row.PeerIP)
+	result, err := tx.Exec("UPDATE peers SET Version=?,Name=?,PublicIP=?,Port=?,Relay=? WHERE PeerIP=?", row.Version, row.Name, row.PublicIP, row.Port, row.Relay, row.PeerIP)
 	if err != nil {
 		return err
 	}
@@ -513,7 +369,7 @@ func Peer_UpdateFull(
 		return err
 	}
 
-	result, err := tx.Exec("UPDATE peers SET Version=?,APIKey=?,Name=?,PublicIP=?,Port=?,Relay=?,PubKey=?,PubSignKey=? WHERE NetworkID=? AND PeerIP=?", row.Version, row.APIKey, row.Name, row.PublicIP, row.Port, row.Relay, row.PubKey, row.PubSignKey, row.NetworkID, row.PeerIP)
+	result, err := tx.Exec("UPDATE peers SET Version=?,APIKey=?,Name=?,PublicIP=?,Port=?,Relay=?,PubKey=? WHERE PeerIP=?", row.Version, row.APIKey, row.Name, row.PublicIP, row.Port, row.Relay, row.PubKey, row.PeerIP)
 	if err != nil {
 		return err
 	}
@@ -534,10 +390,9 @@ func Peer_UpdateFull(
 
 func Peer_Delete(
 	tx TX,
-	NetworkID int64,
 	PeerIP byte,
 ) (err error) {
-	result, err := tx.Exec("DELETE FROM peers WHERE NetworkID=? AND PeerIP=?", NetworkID, PeerIP)
+	result, err := tx.Exec("DELETE FROM peers WHERE PeerIP=?", PeerIP)
 	if err != nil {
 		return err
 	}
@@ -558,15 +413,14 @@ func Peer_Delete(
 
 func Peer_Get(
 	tx TX,
-	NetworkID int64,
 	PeerIP byte,
 ) (
 	row *Peer,
 	err error,
 ) {
 	row = &Peer{}
-	r := tx.QueryRow("SELECT NetworkID,PeerIP,Version,APIKey,Name,PublicIP,Port,Relay,PubKey,PubSignKey FROM peers WHERE NetworkID=? AND PeerIP=?", NetworkID, PeerIP)
+	r := tx.QueryRow("SELECT PeerIP,Version,APIKey,Name,PublicIP,Port,Relay,PubKey FROM peers WHERE PeerIP=?", PeerIP)
-	err = r.Scan(&row.NetworkID, &row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP, &row.Port, &row.Relay, &row.PubKey, &row.PubSignKey)
+	err = r.Scan(&row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP, &row.Port, &row.Relay, &row.PubKey)
 	return
 }
 
@@ -580,7 +434,7 @@ func Peer_GetWhere(
 ) {
 	row = &Peer{}
 	r := tx.QueryRow(query, args...)
-	err = r.Scan(&row.NetworkID, &row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP, &row.Port, &row.Relay, &row.PubKey, &row.PubSignKey)
+	err = r.Scan(&row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP, &row.Port, &row.Relay, &row.PubKey)
 	return
 }
 
@@ -600,7 +454,7 @@ func Peer_Iterate(
 		defer rows.Close()
 		for rows.Next() {
 			row := &Peer{}
-			err := rows.Scan(&row.NetworkID, &row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP, &row.Port, &row.Relay, &row.PubKey, &row.PubSignKey)
+			err := rows.Scan(&row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP, &row.Port, &row.Relay, &row.PubKey)
 			if !yield(row, err) {
 				return
 			}

hub/api/db/sanitize-validate.go

@@ -3,21 +3,35 @@ package db
 import (
 	"errors"
 	"net/netip"
+	"net/url"
 	"strings"
 )
 
 var (
 	ErrInvalidIP   = errors.New("invalid IP")
-	ErrNonPrivateIP    = errors.New("non-private IP")
 	ErrInvalidPort = errors.New("invalid port")
-	ErrInvalidNetName  = errors.New("invalid network name")
-	ErrInvalidPeerName = errors.New("invalid peer name")
 )
 
 func Config_Sanitize(c *Config) {
+	if u, err := url.Parse(c.HubAddress); err == nil {
+		c.HubAddress = u.String()
+	}
+
+	if addr, ok := netip.AddrFromSlice(c.VPNNetwork); ok {
+		c.VPNNetwork = addr.AsSlice()
+	}
 }
 
 func Config_Validate(c *Config) error {
+	if _, err := url.Parse(c.HubAddress); err != nil {
+		return err
+	}
+
+	addr, ok := netip.AddrFromSlice(c.VPNNetwork)
+	if !ok || !addr.Is4() || addr.As4()[3] != 0 || addr.As4()[0] == 0 {
+		return ErrInvalidIP
+	}
+
 	return nil
 }
 
@@ -28,42 +42,6 @@ func Session_Validate(s *Session) error {
 	return nil
 }
 
-func Network_Sanitize(n *Network) {
-	n.Name = strings.TrimSpace(n.Name)
-
-	if addr, ok := netip.AddrFromSlice(n.Network); ok {
-		n.Network = addr.AsSlice()
-	}
-}
-
-func Network_Validate(c *Network) error {
-	// 16 bytes is linux limit for network interface names.
-	if len(c.Name) == 0 || len(c.Name) > 16 {
-		return ErrInvalidNetName
-	}
-
-	for _, c := range c.Name {
-		if c >= 'a' && c <= 'z' {
-			continue
-		}
-		if c >= '0' && c <= '9' {
-			continue
-		}
-		return ErrInvalidNetName
-	}
-
-	addr, ok := netip.AddrFromSlice(c.Network)
-	if !ok || !addr.Is4() || addr.As4()[3] != 0 || addr.As4()[0] == 0 {
-		return ErrInvalidIP
-	}
-
-	if !addr.IsPrivate() {
-		return ErrNonPrivateIP
-	}
-
-	return nil
-}
-
 func Peer_Sanitize(p *Peer) {
 	p.Name = strings.TrimSpace(p.Name)
 	if len(p.PublicIP) != 0 {
@@ -87,20 +65,5 @@ func Peer_Validate(p *Peer) error {
 	if p.Port == 0 {
 		return ErrInvalidPort
 	}
-
-	for _, c := range p.Name {
-		if c >= 'a' && c <= 'z' {
-			continue
-		}
-		if c >= '0' && c <= '9' {
-			continue
-		}
-		if c == '.' || c == '-' || c == '_' {
-			continue
-		}
-
-		return ErrInvalidPeerName
-	}
-
 	return nil
 }

hub/api/db/tables.defs

@@ -1,6 +1,8 @@
 TABLE config OF Config (
   ConfigID    int64  PK,
-  Password    []byte
+  HubAddress  string,
+  VPNNetwork  []byte,
+  Password    []byte NoUpdate
 );
 
 TABLE sessions OF Session NoUpdate (
@@ -11,14 +13,7 @@ TABLE sessions OF Session NoUpdate (
   LastSeenAt int64
 );
 
-TABLE networks OF Network (
-  NetworkID int64 PK,
-  Name      string NoUpdate,
-  Network   []byte NoUpdate
-);
-
 TABLE peers OF Peer (
-  NetworkID  int64 PK,
   PeerIP     byte PK,
   Version    int64,
   APIKey     string NoUpdate,
@@ -26,6 +21,5 @@ TABLE peers OF Peer (
   PublicIP   []byte,
   Port       uint16,
   Relay      bool,
-  PubKey     []byte NoUpdate,
+  PubKey     []byte NoUpdate
-  PubSignKey []byte NoUpdate
 );

hub/api/db/written.go

@@ -26,9 +26,16 @@ func Session_DeleteBefore(
 	return err
 }
 
-func Peer_ListAll(tx TX, networkID int64) ([]*Peer, error) {
+func Config_UpdatePassword(
-	const query = Peer_SelectQuery + ` WHERE NetworkID=? ORDER BY PeerIP ASC`
+	tx TX,
-	return Peer_List(tx, query, networkID)
+	pwdHash []byte,
+) (err error) {
+	_, err = tx.Exec("UPDATE config SET Password=? WHERE ConfigID=1", pwdHash)
+	return err
+}
+
+func Peer_ListAll(tx TX) ([]*Peer, error) {
+	return Peer_List(tx, Peer_SelectQuery)
 }
 
 func Peer_GetByAPIKey(tx TX, apiKey string) (*Peer, error) {
@@ -38,8 +45,7 @@ func Peer_GetByAPIKey(tx TX, apiKey string) (*Peer, error) {
 		apiKey)
 }
 
-func Peer_Exists(tx TX, networkID int64, ip byte) (exists bool, err error) {
+func Peer_Exists(tx TX, ip byte) (exists bool, err error) {
-	const query = `SELECT EXISTS(SELECT 1 FROM peers WHERE NetworkID=? AND PeerIP=?)`
+	err = tx.QueryRow(`SELECT EXISTS(SELECT 1 FROM peers WHERE PeerIP=?)`, ip).Scan(&exists)
-	err = tx.QueryRow(query, networkID, ip).Scan(&exists)
 	return
 }

hub/api/migrations/2024-11-30-init.sql

@@ -1,5 +1,7 @@
 CREATE TABLE config (
   ConfigID    INTEGER NOT NULL PRIMARY KEY, -- Always 1.
+  HubAddress  TEXT    NOT NULL, -- https://for.example.com
+  VPNNetwork  BLOB    NOT NULL, -- Network (/24), example 10.51.50.0
   Password    BLOB    NOT NULL  -- bcrypt password for web interface
 ) WITHOUT ROWID;
 
@@ -13,22 +15,13 @@ CREATE TABLE sessions (
 
 CREATE INDEX sessions_last_seen_index ON sessions(LastSeenAt);
 
-CREATE TABLE networks (
-  NetworkID   INTEGER NOT NULL PRIMARY KEY,
-  Name        TEXT    NOT NULL UNIQUE, -- Network/interface name.
-  Network     BLOB    NOT NULL UNIQUE  -- Network (/24), example 10.51.50.0
-) WITHOUT ROWID;
-
 CREATE TABLE peers (
-  NetworkID  INTEGER NOT NULL,
+  PeerIP     INTEGER NOT NULL PRIMARY KEY, -- Final byte.
-  PeerIP     INTEGER NOT NULL,             -- Final byte of IP.
+  Version    INTEGER NOT NULL,
-  Version    INTEGER NOT NULL,             -- Changes when updated.
+  APIKey     TEXT    NOT NULL UNIQUE,
-  APIKey     TEXT    NOT NULL UNIQUE,      -- Peer's secret API key.
   Name       TEXT    NOT NULL UNIQUE,      -- For humans.
   PublicIP   BLOB    NOT NULL,
   Port       INTEGER NOT NULL,
   Relay      INTEGER NOT NULL DEFAULT 0,   -- Boolean if peer will forward packets. Must also have public address.
-  PubKey     BLOB    NOT NULL,
+  PubKey     BLOB    NOT NULL
-  PubSignKey BLOB    NOT NULL,
-  PRIMARY KEY(NetworkID, PeerIP)
 ) WITHOUT ROWID;

hub/api/session.go

@@ -0,0 +1 @@
+package api

hub/api/types.go

@@ -4,5 +4,4 @@ import "vppn/hub/api/db"
 
 type Config = db.Config
 type Session = db.Session
-type Network = db.Network
 type Peer = db.Peer

hub/app.go

@@ -7,7 +7,7 @@ import (
 	"path/filepath"
 	"vppn/hub/api"
 
-	"git.crumpington.com/lib/go/webutil"
+	"git.crumpington.com/lib/webutil"
 )
 
 //go:embed static
@@ -19,14 +19,14 @@ var templateFS embed.FS
 type Config struct {
 	RootDir    string
 	ListenAddr string
-	Insecure   bool
+	Secure     bool
 }
 
 type App struct {
 	api    *api.API
 	mux    *http.ServeMux
 	tmpl   map[string]*template.Template
-	insecure bool
+	secure bool
 }
 
 func NewApp(conf Config) (*App, error) {
@@ -39,7 +39,7 @@ func NewApp(conf Config) (*App, error) {
 		api:    api,
 		mux:    http.NewServeMux(),
 		tmpl:   webutil.ParseTemplateSet(templateFuncs, templateFS),
-		insecure: conf.Insecure,
+		secure: conf.Secure,
 	}
 
 	app.registerRoutes()

hub/cookie.go

@@ -17,9 +17,8 @@ func (a *App) setCookie(w http.ResponseWriter, name, value string) {
 		Name:     name,
 		Value:    value,
 		Path:     "/",
-		Secure:   !a.insecure,
+		Secure:   a.secure,
 		SameSite: http.SameSiteStrictMode,
-		HttpOnly: true,
 		MaxAge:   86400 * 365 * 10,
 	})
 }

hub/form.go

@@ -1,42 +0,0 @@
-package hub
-
-import (
-	"net/url"
-	"vppn/hub/api"
-
-	"git.crumpington.com/lib/go/webutil"
-)
-
-func (app *App) formGetNetwork(form url.Values) (*api.Network, error) {
-	var id int64
-	if err := webutil.NewFormScanner(form).Scan("NetworkID", &id).Error(); err != nil {
-		return nil, err
-	}
-
-	return app.api.Network_Get(id)
-}
-
-func (app *App) formGetNetworkPeers(form url.Values) (*api.Network, []*api.Peer, error) {
-	n, err := app.formGetNetwork(form)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	peers, err := app.api.Peer_List(n.NetworkID)
-	return n, peers, err
-}
-
-func (app *App) formGetPeer(form url.Values) (*api.Network, *api.Peer, error) {
-	net, err := app.formGetNetwork(form)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	var ip byte
-	if err := webutil.NewFormScanner(form).Scan("PeerIP", &ip).Error(); err != nil {
-		return nil, nil, err
-	}
-
-	peer, err := app.api.Peer_Get(net.NetworkID, ip)
-	return net, peer, err
-}

hub/handler.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"vppn/hub/api"
 
-	"git.crumpington.com/lib/go/webutil"
+	"git.crumpington.com/lib/webutil"
 )
 
 type handlerFunc func(s *api.Session, w http.ResponseWriter, r *http.Request) error
@@ -65,26 +65,13 @@ func (app *App) handleSignedIn(pattern string, fn handlerFunc) {
 	})
 }
 
-type peerHandlerFunc func(p *api.Peer, w http.ResponseWriter, r *http.Request) error
+type peerHandlerFunc func(w http.ResponseWriter, r *http.Request) error
 
 func (app *App) handlePeer(pattern string, fn peerHandlerFunc) {
 	wrapped := func(w http.ResponseWriter, r *http.Request) {
-		_, apiKey, ok := r.BasicAuth()
-		if !ok {
-			http.Error(w, "Not authorized", http.StatusUnauthorized)
-			return
-		}
-
-		peer, err := app.api.Peer_GetByAPIKey(apiKey)
-		if err != nil {
-			http.Error(w, "Not authorized", http.StatusUnauthorized)
-			return
-		}
-
 		r.ParseForm()
-		if err := fn(peer, w, r); err != nil {
+		if err := fn(w, r); err != nil {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
-			return
 		}
 	}
 

hub/handlers.go

@@ -1,7 +1,6 @@
 package hub
 
 import (
-	"encoding/json"
 	"errors"
 	"log"
 	"net/http"
@@ -16,7 +15,7 @@ import (
 
 func (a *App) _root(s *api.Session, w http.ResponseWriter, r *http.Request) error {
 	if s.SignedIn {
-		return a.redirect(w, r, "/admin/network/list/")
+		return a.redirect(w, r, "/admin/config/")
 	} else {
 		return a.redirect(w, r, "/sign-in/")
 	}
@@ -54,219 +53,47 @@ func (a *App) _adminSignOutSubmit(s *api.Session, w http.ResponseWriter, r *http
 	return a.redirect(w, r, "/")
 }
 
-func (a *App) _adminNetworkList(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+func (a *App) _adminConfig(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	l, err := a.api.Network_List()
+	return a.render("/admin-config.html", w, struct {
-	if err != nil {
-		return err
-	}
-	return a.render("/admin-network-list.html", w, struct {
 		Session *api.Session
-		Networks []*api.Network
+		Config  *api.Config
-	}{s, l})
+	}{
+		s,
+		a.api.Config_Get(),
+	})
 }
 
-func (a *App) _adminNetworkCreate(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+func (a *App) _adminConfigEdit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	return a.render("/admin-network-create.html", w, struct{ Session *api.Session }{s})
+	return a.render("/admin-config-edit.html", w, struct {
+		Session *api.Session
+		Config  *api.Config
+	}{
+		s,
+		a.api.Config_Get(),
+	})
 }
 
-func (a *App) _adminNetworkCreateSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+func (a *App) _adminConfigEditSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	n := &api.Network{}
+	var (
-	var netStr string
+		conf  = a.api.Config_Get()
+		ipStr string
+	)
 
 	err := webutil.NewFormScanner(r.Form).
-		Scan("Name", &n.Name).
+		Scan("HubAddress", &conf.HubAddress).
-		Scan("Network", &netStr).
+		Scan("VPNNetwork", &ipStr).
 		Error()
 	if err != nil {
 		return err
 	}
 
-	n.Network, err = stringToIP(netStr)
+	if conf.VPNNetwork, err = stringToIP(ipStr); err != nil {
-	if err != nil {
 		return err
 	}
-
+	if err := a.api.Config_Update(conf); err != nil {
-	if err := a.api.Network_Create(n); err != nil {
 		return err
 	}
-
+	return a.redirect(w, r, "/admin/config/")
-	return a.redirect(w, r, "/admin/network/view/?NetworkID=%d", n.NetworkID)
-}
-
-func (a *App) _adminNetworkView(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	n, peers, err := a.formGetNetworkPeers(r.Form)
-	if err != nil {
-		return err
-	}
-
-	return a.render("/network/network-view.html", w, struct {
-		Session *api.Session
-		Network *api.Network
-		Peers   []*api.Peer
-	}{s, n, peers})
-}
-
-func (a *App) _adminNetworkDelete(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	n, peers, err := a.formGetNetworkPeers(r.Form)
-	if err != nil {
-		return err
-	}
-
-	return a.render("/network/network-delete.html", w, struct {
-		Session *api.Session
-		Network *api.Network
-		Peers   []*api.Peer
-	}{s, n, peers})
-}
-
-func (a *App) _adminNetworkDeleteSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	n, err := a.formGetNetwork(r.Form)
-	if err != nil {
-		return err
-	}
-
-	if err = a.api.Network_Delete(n); err != nil {
-		return err
-	}
-	return a.redirect(w, r, "/admin/network/list/")
-}
-
-func (a *App) _adminPeerCreate(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	n, err := a.formGetNetwork(r.Form)
-	if err != nil {
-		return err
-	}
-
-	return a.render("/network/peer-create.html", w, struct {
-		Session *api.Session
-		Network *api.Network
-	}{s, n})
-}
-
-func (a *App) _adminPeerCreateSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	var ipStr string
-
-	p := &api.Peer{}
-	err := webutil.NewFormScanner(r.Form).
-		Scan("NetworkID", &p.NetworkID).
-		Scan("IP", &p.PeerIP).
-		Scan("Name", &p.Name).
-		Scan("PublicIP", &ipStr).
-		Scan("Port", &p.Port).
-		Scan("Relay", &p.Relay).
-		Error()
-	if err != nil {
-		return err
-	}
-
-	if p.PublicIP, err = stringToIP(ipStr); err != nil {
-		return err
-	}
-
-	if err := a.api.Peer_CreateNew(p); err != nil {
-		return err
-	}
-	return a.redirect(w, r, "/admin/peer/view/?NetworkID=%d&PeerIP=%d", p.NetworkID, p.PeerIP)
-}
-
-func (a *App) _adminPeerView(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	net, peer, err := a.formGetPeer(r.Form)
-	if err != nil {
-		return err
-	}
-
-	return a.render("/network/peer-view.html", w, struct {
-		Session *api.Session
-		Network *api.Network
-		Peer    *api.Peer
-	}{s, net, peer})
-}
-
-func (a *App) _adminPeerEdit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	net, peer, err := a.formGetPeer(r.Form)
-	if err != nil {
-		return err
-	}
-
-	return a.render("/network/peer-edit.html", w, struct {
-		Session *api.Session
-		Network *api.Network
-		Peer    *api.Peer
-	}{s, net, peer})
-}
-
-func (a *App) _adminPeerEditSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	_, peer, err := a.formGetPeer(r.Form)
-	if err != nil {
-		return err
-	}
-
-	var ipStr string
-
-	err = webutil.NewFormScanner(r.Form).
-		Scan("Name", &peer.Name).
-		Scan("PublicIP", &ipStr).
-		Scan("Port", &peer.Port).
-		Scan("Relay", &peer.Relay).
-		Error()
-	if err != nil {
-		return err
-	}
-
-	if peer.PublicIP, err = stringToIP(ipStr); err != nil {
-		return err
-	}
-
-	if err = a.api.Peer_Update(peer); err != nil {
-		return err
-	}
-
-	return a.redirect(w, r, "/admin/peer/view/?NetworkID=%d&PeerIP=%d", peer.NetworkID, peer.PeerIP)
-}
-
-func (a *App) _adminPeerDelete(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	n, peer, err := a.formGetPeer(r.Form)
-	if err != nil {
-		return err
-	}
-
-	return a.render("/network/peer-delete.html", w, struct {
-		Session *api.Session
-		Network *api.Network
-		Peer    *api.Peer
-	}{s, n, peer})
-}
-
-func (a *App) _adminPeerDeleteSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	n, peer, err := a.formGetPeer(r.Form)
-	if err != nil {
-		return err
-	}
-	if err := a.api.Peer_Delete(n.NetworkID, peer.PeerIP); err != nil {
-		return err
-	}
-	return a.redirect(w, r, "/admin/network/view/?NetworkID=%d", n.NetworkID)
-}
-
-func (a *App) _adminNetworkHosts(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	n, peers, err := a.formGetNetworkPeers(r.Form)
-	if err != nil {
-		return err
-	}
-
-	b := strings.Builder{}
-
-	for _, peer := range peers {
-		ip := n.Network
-		ip[3] = peer.PeerIP
-		b.WriteString(netip.AddrFrom4([4]byte(ip)).String())
-		b.WriteString(" ")
-		b.WriteString(peer.Name)
-		b.WriteString("\n")
-	}
-
-	w.Write([]byte(b.String()))
-	return nil
 }
 
 func (a *App) _adminPasswordEdit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
@@ -308,61 +135,232 @@ func (a *App) _adminPasswordSubmit(s *api.Session, w http.ResponseWriter, r *htt
 		return err
 	}
 
-	conf.Password = hash
+	if err := a.api.Config_UpdatePassword(hash); err != nil {
-
-	if err := a.api.Config_Update(conf); err != nil {
 		return err
 	}
 
 	return a.redirect(w, r, "/admin/config/")
 }
 
-func (a *App) _peerInit(peer *api.Peer, w http.ResponseWriter, r *http.Request) error {
+func (a *App) _adminPeerList(s *api.Session, w http.ResponseWriter, r *http.Request) error {
-	args := m.PeerInitArgs{}
+	peers, err := a.api.Peer_List()
-	if err := json.NewDecoder(r.Body).Decode(&args); err != nil {
-		return err
-	}
-
-	net, err := a.api.Network_Get(peer.NetworkID)
 	if err != nil {
 		return err
 	}
 
-	if err := a.api.Peer_Init(peer, args); err != nil {
+	return a.render("/admin-peer-list.html", w, struct {
+		Session *api.Session
+		Peers   []*api.Peer
+	}{
+		s,
+		peers,
+	})
+}
+
+func (a *App) _adminHosts(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	conf := a.api.Config_Get()
+
+	peers, err := a.api.Peer_List()
+	if err != nil {
 		return err
 	}
 
-	resp := m.PeerInitResp{
+	b := strings.Builder{}
+
+	for _, peer := range peers {
+		ip := conf.VPNNetwork
+		ip[3] = peer.PeerIP
+		b.WriteString(netip.AddrFrom4([4]byte(ip)).String())
+		b.WriteString(" ")
+		b.WriteString(peer.Name)
+		b.WriteString("\n")
+	}
+
+	w.Write([]byte(b.String()))
+	return nil
+}
+
+func (a *App) _adminPeerCreate(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	return a.render("/admin-peer-create.html", w, struct{ Session *api.Session }{s})
+}
+
+func (a *App) _adminPeerCreateSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	var ipStr string
+
+	args := api.PeerCreateArgs{}
+	err := webutil.NewFormScanner(r.Form).
+		Scan("Name", &args.Name).
+		Scan("PublicIP", &ipStr).
+		Scan("Port", &args.Port).
+		Scan("Relay", &args.Relay).
+		Error()
+	if err != nil {
+		return err
+	}
+
+	if args.PublicIP, err = stringToIP(ipStr); err != nil {
+		return err
+	}
+
+	code := a.api.Peer_CreateIntent(args)
+	return a.redirect(w, r, "/admin/peer/intent-created/?Code=%s", code)
+}
+
+func (a *App) _adminPeerIntentCreated(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	code := r.FormValue("Code")
+	if code == "" {
+		return errors.New("missing Code")
+	}
+
+	return a.render("/admin-peer-intent.html", w, struct {
+		Session    *api.Session
+		HubAddress string
+		Code       string
+	}{s, a.api.Config_Get().HubAddress, code})
+}
+
+func (a *App) _adminPeerView(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	var peerIP byte
+	err := webutil.NewFormScanner(r.Form).Scan("PeerIP", &peerIP).Error()
+	if err != nil {
+		return err
+	}
+
+	peer, err := a.api.Peer_Get(peerIP)
+	if err != nil {
+		return err
+	}
+
+	return a.render("/admin-peer-view.html", w, struct {
+		Session *api.Session
+		Peer    *api.Peer
+	}{s, peer})
+}
+
+func (a *App) _adminPeerEdit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	var peerIP byte
+	err := webutil.NewFormScanner(r.Form).Scan("PeerIP", &peerIP).Error()
+	if err != nil {
+		return err
+	}
+
+	peer, err := a.api.Peer_Get(peerIP)
+	if err != nil {
+		return err
+	}
+
+	return a.render("/admin-peer-edit.html", w, struct {
+		Session *api.Session
+		Peer    *api.Peer
+	}{s, peer})
+}
+
+func (a *App) _adminPeerEditSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	var (
+		peerIP byte
+		ipStr  string
+	)
+
+	err := webutil.NewFormScanner(r.Form).Scan("PeerIP", &peerIP).Error()
+	if err != nil {
+		return err
+	}
+
+	peer, err := a.api.Peer_Get(peerIP)
+	if err != nil {
+		return err
+	}
+	err = webutil.NewFormScanner(r.Form).
+		Scan("Name", &peer.Name).
+		Scan("PublicIP", &ipStr).
+		Scan("Port", &peer.Port).
+		Scan("Relay", &peer.Relay).
+		Error()
+	if err != nil {
+		return err
+	}
+
+	if peer.PublicIP, err = stringToIP(ipStr); err != nil {
+		return err
+	}
+
+	if err = a.api.Peer_Update(peer); err != nil {
+		return err
+	}
+
+	return a.redirect(w, r, "/admin/peer/view/?PeerIP=%d", peer.PeerIP)
+}
+
+func (a *App) _adminPeerDelete(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	var peerIP byte
+	err := webutil.NewFormScanner(r.Form).Scan("PeerIP", &peerIP).Error()
+	if err != nil {
+		return err
+	}
+
+	peer, err := a.api.Peer_Get(peerIP)
+	if err != nil {
+		return err
+	}
+
+	return a.render("/admin-peer-delete.html", w, struct {
+		Session *api.Session
+		Peer    *api.Peer
+	}{s, peer})
+}
+
+func (a *App) _adminPeerDeleteSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
+	var peerIP byte
+	err := webutil.NewFormScanner(r.Form).Scan("PeerIP", &peerIP).Error()
+	if err != nil {
+		return err
+	}
+
+	if err := a.api.Peer_Delete(peerIP); err != nil {
+		return err
+	}
+
+	return a.redirect(w, r, "/admin/peer/list/")
+}
+
+func (a *App) _peerCreate(w http.ResponseWriter, r *http.Request) error {
+	code := r.FormValue("Code")
+	conf, err := a.api.Peer_Create(code)
+	if err != nil {
+		return err
+	}
+
+	return a.sendJSON(w, conf)
+}
+
+func (a *App) _peerFetchState(w http.ResponseWriter, r *http.Request) error {
+	_, apiKey, ok := r.BasicAuth()
+	if !ok {
+		return api.ErrNotAuthorized
+	}
+
+	peer, err := a.api.Peer_GetByAPIKey(apiKey)
+	if err != nil {
+		return err
+	}
+
+	peers, err := a.api.Peer_List()
+	if err != nil {
+		return err
+	}
+
+	conf := a.api.Config_Get()
+
+	state := m.NetworkState{
+		HubAddress: conf.HubAddress,
+		Network:    conf.VPNNetwork,
 		PeerIP:     peer.PeerIP,
-		Network: net.Network,
+		PublicIP:   peer.PublicIP,
+		Port:       peer.Port,
 	}
 
-	resp.NetworkState.Peers, err = a.peersArray(net.NetworkID)
+	for _, p := range peers {
-	if err != nil {
+		state.Peers[p.PeerIP] = &m.Peer{
-		return err
-	}
-
-	return a.sendJSON(w, resp)
-}
-
-func (a *App) _peerFetchState(peer *api.Peer, w http.ResponseWriter, r *http.Request) error {
-
-	peers, err := a.peersArray(peer.NetworkID)
-	if err != nil {
-		return err
-	}
-	return a.sendJSON(w, m.NetworkState{Peers: peers})
-}
-
-func (a *App) peersArray(networkID int64) (peers [256]*m.Peer, err error) {
-	l, err := a.api.Peer_List(networkID)
-	if err != nil {
-		return peers, err
-	}
-
-	for _, p := range l {
-		if len(p.PubKey) != 0 {
-			peers[p.PeerIP] = &m.Peer{
 			PeerIP:   p.PeerIP,
 			Version:  p.Version,
 			Name:     p.Name,
@@ -370,10 +368,8 @@ func (a *App) peersArray(networkID int64) (peers [256]*m.Peer, err error) {
 			Port:     p.Port,
 			Relay:    p.Relay,
 			PubKey:   p.PubKey,
-				PubSignKey: p.PubSignKey,
-			}
 		}
 	}
 
-	return
+	return a.sendJSON(w, state)
 }

hub/main.go

@@ -6,7 +6,7 @@ import (
 	"net/http"
 	"os"
 
-	"git.crumpington.com/lib/go/webutil"
+	"git.crumpington.com/lib/webutil"
 )
 
 func Main() {
@@ -15,7 +15,7 @@ func Main() {
 	conf := Config{}
 	flag.StringVar(&conf.RootDir, "root-dir", "", "[REQUIRED] Root directory.")
 	flag.StringVar(&conf.ListenAddr, "listen", "", "[REQUIRED] Listen address.")
-	flag.BoolVar(&conf.Insecure, "insecure", false, "Don't use secure cookies.")
+	flag.BoolVar(&conf.Secure, "secure", false, "Use secure cookies.")
 
 	flag.Parse()
 

hub/routes.go

@@ -9,28 +9,24 @@ func (a *App) registerRoutes() {
 	a.handleNotSignedIn("GET  /sign-in/", a._signin)
 	a.handleNotSignedIn("POST /sign-in/", a._signinSubmit)
 
+	a.handleSignedIn("GET  /admin/config/", a._adminConfig)
+	a.handleSignedIn("GET  /admin/config/edit/", a._adminConfigEdit)
+	a.handleSignedIn("POST /admin/config/edit/", a._adminConfigEditSubmit)
 	a.handleSignedIn("GET  /admin/sign-out/", a._adminSignOut)
 	a.handleSignedIn("POST /admin/sign-out/", a._adminSignOutSubmit)
-
+	a.handleSignedIn("GET  /admin/password/edit/", a._adminPasswordEdit)
-	a.handleSignedIn("GET  /admin/network/list/", a._adminNetworkList)
+	a.handleSignedIn("POST /admin/password/edit/", a._adminPasswordSubmit)
-	a.handleSignedIn("GET  /admin/network/create/", a._adminNetworkCreate)
+	a.handleSignedIn("GET  /admin/peer/list/", a._adminPeerList)
-	a.handleSignedIn("POST /admin/network/create/", a._adminNetworkCreateSubmit)
+	a.handleSignedIn("GET  /admin/peer/hosts/", a._adminHosts)
-	a.handleSignedIn("GET  /admin/network/delete/", a._adminNetworkDelete)
-	a.handleSignedIn("POST /admin/network/delete/", a._adminNetworkDeleteSubmit)
-
-	a.handleSignedIn("GET  /admin/network/view/", a._adminNetworkView)
-	a.handleSignedIn("GET  /admin/network/hosts/", a._adminNetworkHosts)
 	a.handleSignedIn("GET  /admin/peer/create/", a._adminPeerCreate)
 	a.handleSignedIn("POST /admin/peer/create/", a._adminPeerCreateSubmit)
+	a.handleSignedIn("GET  /admin/peer/intent-created/", a._adminPeerIntentCreated)
 	a.handleSignedIn("GET  /admin/peer/view/", a._adminPeerView)
 	a.handleSignedIn("GET  /admin/peer/edit/", a._adminPeerEdit)
 	a.handleSignedIn("POST /admin/peer/edit/", a._adminPeerEditSubmit)
 	a.handleSignedIn("GET  /admin/peer/delete/", a._adminPeerDelete)
 	a.handleSignedIn("POST /admin/peer/delete/", a._adminPeerDeleteSubmit)
 
-	a.handleSignedIn("GET  /admin/password/edit/", a._adminPasswordEdit)
+	a.handlePeer("GET /peer/create/", a._peerCreate)
-	a.handleSignedIn("POST /admin/password/edit/", a._adminPasswordSubmit)
-
-	a.handlePeer("POST /peer/init/", a._peerInit)
 	a.handlePeer("GET /peer/fetch-state/", a._peerFetchState)
 }

hub/static/custom.css

@@ -1,3 +1,7 @@
+body {
+    max-width: 1920px;
+}
+
 .def-list tr td:first-child {
     text-align:right;
     width:1%;

hub/templates/admin-config-edit.html

@@ -0,0 +1,20 @@
+{{define "body" -}}
+<h2>Config</h2>
+
+<form method="POST">
+  <input type="hidden" name="CSRF" value="{{.Session.CSRF}}">
+  <p>
+    <label>Hub Address</label><br>
+    <input type="url" name="HubAddress" value="{{.Config.HubAddress}}">
+  </p>
+  <p>
+    <label>VPN Network</label><br>
+    <input type="text" name="VPNNetwork" value="{{ipToString .Config.VPNNetwork}}">
+  </p>
+  <p>
+    <button type="submit">Save</button>
+    <a href="/admin/config/">Cancel</a>
+  </p>
+</form>
+
+{{- end}}

hub/templates/admin-config.html

@@ -0,0 +1,19 @@
+{{define "body" -}}
+<h2>Config</h2>
+
+<p>
+  <a href="/admin/config/edit/">Edit</a> /
+  <a href="/admin/password/edit/">Change Password</a>
+</p>
+
+<table class="def-list">
+  <tr>
+    <td>Hub Address</td>
+    <td>{{.Config.HubAddress}}</td>
+  </tr>
+  <tr>
+    <td>VPN Network</td>
+    <td>{{ipToString .Config.VPNNetwork}}</td>
+  </tr>
+</table>
+{{- end}}

hub/templates/admin-network-create.html

@@ -1,19 +0,0 @@
-{{define "body" -}}
-<h2>Create Network</h2>
-
-<form method="POST">
-  <input type="hidden" name="CSRF" value="{{.Session.CSRF}}">
-  <p>
-    <label>Name</label><br>
-    <input type="text" name="Name">
-  </p>
-  <p>
-    <label>Network /24</label><br>
-    <input type="text" name="Network">
-  </p>
-  <p>
-    <button type="submit">Save</button>
-    <a href="/admin/network/list/">Cancel</a>
-  </p>
-</form>
-{{- end}}

hub/templates/admin-network-list.html

@@ -1,38 +0,0 @@
-{{define "body" -}}
-<h2>Networks</h2>
-
-<p>
-  <a href="/admin/network/create/">Create</a>
-</p>
-
-{{if .Networks -}}
-<table>
-  <thead>
-    <tr>
-      <th>Name</th>
-      <th>Network</th>
-    </tr>
-  </thead>
-  <tbody>
-  {{range .Networks -}}
-  <tr>
-    <td>
-      <a href="/admin/network/view/?NetworkID={{.NetworkID}}">
-        {{.Name}}
-      </a>
-    </td>
-    <td>{{ipToString .Network}}</td>
-  </tr>
-  </tbody>
-  {{- end}}
-</table>
-{{- else}}
-<p>No networks.</p>
-{{- end}}
-
-<h3>Settings</h3>
-
-<ul>
-  <li><a href="/admin/password/edit/">Password</a></li>
-</ul>
-{{- end}}

hub/templates/admin-peer-create.html

@@ -1,13 +1,8 @@
 {{define "body" -}}
-<h3>New Peer</h3>
+<h2>New Peer</h2>
 
 <form method="POST">
   <input type="hidden" name="CSRF" value="{{.Session.CSRF}}">
-  <input type="hidden" name="NetworkID" value="{{.Network.NetworkID}}">
-  <p>
-    <label>IP</label><br>
-    <input type="number" name="IP" min="1" max="255" value="0">
-  </p>
   <p>
     <label>Name</label><br>
     <input type="text" name="Name">
@@ -28,7 +23,7 @@
   </p>
   <p>
     <button type="submit">Save</button>
-    <a href="/admin/network/view/?NetworkID={{.Network.NetworkID}}">Cancel</a>
+    <a href="/admin/config/">Cancel</a>
   </p>
 </form>
 

hub/templates/admin-peer-delete.html

@@ -0,0 +1,36 @@
+{{define "body" -}}
+<h2>Delete Peer</h2>
+
+{{with .Peer -}}
+<form method="POST">
+  <input type="hidden" name="CSRF" value="{{$.Session.CSRF}}">
+  <p>
+    <label>Peer IP</label><br>
+    <input type="number" name="PeerIP" value="{{.PeerIP}}" disabled>
+  </p>
+  <p>
+    <label>Name</label><br>
+    <input type="text" value="{{.Name}}" disabled>
+  </p>
+  <p>
+    <label>Public IP</label><br>
+    <input type="text" value="{{ipToString .PublicIP}}" disabled>
+  </p>
+  <p>
+    <label>Port</label><br>
+    <input type="number" value="{{.Port}}" disabled>
+  </p>
+  <p>
+    <label>
+      <input type="checkbox" {{if .Relay}}checked{{end}} disabled>
+      Relay
+    </label>
+  </p>
+  <p>
+    <button type="submit">Delete</button>
+    <a href="/admin/peer/view/?PeerIP={{.PeerIP}}">Cancel</a>
+  </p>
+</form>
+{{- end}}
+
+{{- end}}

hub/templates/admin-peer-edit.html

@@ -6,7 +6,7 @@
   <input type="hidden" name="CSRF" value="{{$.Session.CSRF}}">
   <p>
     <label>Peer IP</label><br>
-    <input type="text" value="{{.PeerIP}}" disabled>
+    <input type="number" name="PeerIP" value="{{.PeerIP}}" disabled>
   </p>
   <p>
     <label>Name</label><br>
@@ -28,8 +28,9 @@
   </p>
   <p>
     <button type="submit">Save</button>
-    <a href="/admin/peer/view/?NetworkID={{$.Network.NetworkID}}&PeerIP={{.PeerIP}}">Cancel</a>
+    <a href="/admin/peer/view/?PeerIP={{.PeerIP}}">Cancel</a>
   </p>
 </form>
 {{- end}}
+
 {{- end}}

hub/templates/admin-peer-intent.html

@@ -0,0 +1,13 @@
+{{define "body" -}}
+<h2>Create Peer</h2>
+
+<p>
+  Configure the peer with the following URL:
+</p>
+<pre>
+  {{.HubAddress}}/peer/create/?Code={{.Code}}
+</pre>
+<p>
+  <a href="/admin/peer/list/">Done</a>
+</p>
+{{- end}}

hub/templates/admin-peer-list.html

@@ -1,20 +1,9 @@
 {{define "body" -}}
-<p>
+<h2>Peers</h2>
-  <a href="/admin/network/delete/?NetworkID={{.Network.NetworkID}}">Delete</a> /
-  <a href="/admin/network/hosts/?NetworkID={{.Network.NetworkID}}">Hosts</a>
-</p>
-
-<table class="def-list">
-  <tr>
-    <td>Network</td>
-    <td>{{ipToString .Network.Network}}/24</td>
-  </tr>
-</table>
-
-<h3>Peers</h3>
 
 <p>
-  <a href="/admin/peer/create/?NetworkID={{.Network.NetworkID}}">Create</a>
+  <a href="/admin/peer/create/">Add Peer</a> /
+  <a href="/admin/peer/hosts/">Hosts</a>
 </p>
 
 {{if .Peers -}}
@@ -32,7 +21,7 @@
   {{range .Peers -}}
   <tr>
     <td>
-      <a href="/admin/peer/view/?NetworkID={{$.Network.NetworkID}}&PeerIP={{.PeerIP}}">
+      <a href="/admin/peer/view/?PeerIP={{.PeerIP}}">
         {{.PeerIP}}
       </a>
     </td>
@@ -47,4 +36,5 @@
 {{- else}}
 <p>No peers.</p>
 {{- end}}
+
 {{- end}}

hub/templates/admin-peer-view.html

@@ -1,25 +1,20 @@
 {{define "body" -}}
-<h3>{{.Peer.Name}}</h3>
+<h2>Peer</h2>
+
 <p>
-  <a href="/admin/peer/edit/?NetworkID={{.Network.NetworkID}}&PeerIP={{.Peer.PeerIP}}">Edit</a> /
+  <a href="/admin/peer/edit/?PeerIP={{.Peer.PeerIP}}">Edit</a> /
-  <a href="/admin/peer/delete/?NetworkID={{.Network.NetworkID}}&PeerIP={{.Peer.PeerIP}}">Delete</a>
+  <a href="/admin/peer/delete/?PeerIP={{.Peer.PeerIP}}">Delete</a>
 </p>
 
 {{with .Peer -}}
 <table class="def-list">
   <tr><td>Peer IP</td><td>{{.PeerIP}}</td></tr>
+  <tr><td>Name</td><td>{{.Name}}</td></tr>
   <tr><td>Public IP</td><td>{{ipToString .PublicIP}}</td></tr>
   <tr><td>Port</td><td>{{.Port}}</td></tr>
   <tr><td>Relay</td><td>{{if .Relay}}T{{else}}F{{end}}</td></tr>
-</td></tr>
+  <tr><td>API Key</td><td>{{.APIKey}}</td></tr>
 </table>
-
-<details>
-  <summary>API Key</summary>
-  <p>{{.APIKey}}</p>
-</details>
-
-
 {{- end}}
 
 {{- end}}

hub/templates/admin-sign-out.html

@@ -5,7 +5,7 @@
   <input type="hidden" name="CSRF" value="{{.Session.CSRF}}">
   <p>
     <button type="submit">Sign Out</button>
-    <a href="/">Cancel</a>
+    <a href="/admin/config/">Cancel</a>
   </p>
 </form>
 {{- end}}

hub/templates/base.html

@@ -10,7 +10,8 @@
     <h1>VPPN</h1>
     <nav>
       {{if .Session.SignedIn -}}
-      <a href="/admin/networks/list/">Home</a> /
+      <a href="/admin/config/">Config</a> /
+      <a href="/admin/peer/list/">Peers</a> /
       <a href="/admin/sign-out/">Sign out</a>
       {{- end}}
     </nav>

hub/templates/network/base.html

@@ -1,25 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <title>VPPN Hub</title>
-  <link rel="stylesheet" href="/static/new.min.css">
-    <link rel="stylesheet" href="/static/custom.css">
-</head>
-<body>
-  <header>
-    <h1>VPPN</h1>
-    <nav>
-      {{if .Session.SignedIn -}}
-      <a href="/admin/networks/list/">Home</a> /
-      <a href="/admin/sign-out/">Sign out</a>
-      {{- end}}
-    </nav>
-  </header>
-  <h2>
-    Network:
-    <a href="/admin/network/view/?NetworkID={{.Network.NetworkID}}">{{.Network.Name}}</a>
-  </h2>
-
-  {{block "body" .}}There's nothing here.{{end}}
-</body>
-</html>

hub/templates/network/network-delete.html

@@ -1,16 +0,0 @@
-{{define "body" -}}
-<h3>Delete</h3>
-
-{{if .Peers -}}
-<p>You must first delete all peers.</p>
-{{- else -}}
-<form method="POST">
-  <input type="hidden" name="CSRF" value="{{.Session.CSRF}}">
-  <input type="hidden" name="NetworkID" value="{{.Network.NetworkID}}">
-  <p>
-    <button type="submit">Delete</button>
-    <a href="/admin/network/view/?NetworkID={{.Network.NetworkID}}">Cancel</a>
-  </p>
-</form>
-{{- end}}
-{{- end}}

hub/templates/network/peer-delete.html

@@ -1,15 +0,0 @@
-{{define "body" -}}
-<h3>Delete {{.Peer.Name}}</h3>
-
-{{with .Peer -}}
-<form method="POST">
-  <input type="hidden" name="CSRF" value="{{$.Session.CSRF}}">
-  <input type="hidden" name="NetworkID" value="{{.NetworkID}}">
-  <input type="hidden" name="NetworkID" value="{{.PeerIP}}">
-  <p>
-    <button type="submit">Delete</button>
-    <a href="/admin/peer/view/?PeerIP={{.PeerIP}}&NetworkID={{.NetworkID}}">Cancel</a>
-  </p>
-</form>
-{{- end}}
-{{- end}}

hub/time.go

@@ -0,0 +1 @@
+package hub

m/models.go

@@ -1,15 +1,16 @@
 // The package `m` contains models shared between the hub and peer programs.
 package m
 
-type PeerInitArgs struct {
+type PeerConfig struct {
-	EncPubKey  []byte
-	PubSignKey []byte
-}
-
-type PeerInitResp struct {
 	PeerIP     byte
+	HubAddress string
 	Network    []byte
-	NetworkState NetworkState
+	APIKey     string
+	PublicIP   []byte
+	Port       uint16
+	Relay      bool
+	PubKey     []byte
+	PrivKey    []byte
 }
 
 type Peer struct {
@@ -20,9 +21,17 @@ type Peer struct {
 	Port     uint16
 	Relay    bool
 	PubKey   []byte
-	PubSignKey []byte
 }
 
 type NetworkState struct {
+	HubAddress string
+
+	// The requester's data:
+	Network  []byte
+	PeerIP   byte
+	PublicIP []byte
+	Port     uint16
+
+	// All peer data.
 	Peers [256]*Peer
 }

node/addrdiscovery.go

@@ -0,0 +1,71 @@
+package node
+
+import (
+	"log"
+	"net/netip"
+	"time"
+)
+
+func addrDiscoveryServer() {
+	var (
+		buf1 = make([]byte, bufferSize)
+		buf2 = make([]byte, bufferSize)
+	)
+
+	for {
+		pkt := <-discoveryPackets
+
+		p, ok := pkt.Payload.(addrDiscoveryPacket)
+		if !ok {
+			continue
+		}
+
+		route := routingTable[pkt.SrcIP].Load()
+		if route == nil || !route.RemoteAddr.IsValid() {
+			continue
+		}
+
+		_sendControlPacket(addrDiscoveryPacket{
+			TraceID: p.TraceID,
+			ToAddr:  pkt.SrcAddr,
+		}, *route, buf1, buf2)
+	}
+}
+
+func addrDiscoveryClient() {
+	var (
+		checkInterval = 8 * time.Second
+		timer         = time.NewTimer(4 * time.Second)
+
+		buf1 = make([]byte, bufferSize)
+		buf2 = make([]byte, bufferSize)
+
+		addrPacket addrDiscoveryPacket
+		lAddr      netip.AddrPort
+	)
+
+	for {
+		select {
+		case pkt := <-discoveryPackets:
+			p, ok := pkt.Payload.(addrDiscoveryPacket)
+			if !ok || p.TraceID != addrPacket.TraceID || !p.ToAddr.IsValid() || p.ToAddr == lAddr {
+				continue
+			}
+
+			log.Printf("Discovered local address: %v", p.ToAddr)
+			lAddr = p.ToAddr
+			localAddr.Store(&p.ToAddr)
+
+		case <-timer.C:
+			timer.Reset(checkInterval)
+
+			route := getRelayRoute()
+			if route == nil {
+				continue
+			}
+
+			addrPacket.TraceID = newTraceID()
+			_sendControlPacket(addrPacket, *route, buf1, buf2)
+		}
+	}
+}

node/bitset.go

@@ -1,4 +1,4 @@
-package peer
+package node
 
 const bitSetSize = 512 // Multiple of 64.
 

node/bitset_test.go

@@ -1,4 +1,4 @@
-package peer
+package node
 
 import (
 	"math/rand"

node/cipher-control.go

@@ -1,4 +1,4 @@
-package peer
+package node
 
 import "golang.org/x/crypto/nacl/box"
 
@@ -12,7 +12,7 @@ func newControlCipher(privKey, pubKey []byte) *controlCipher {
 	return &controlCipher{shared}
 }
 
-func (cc *controlCipher) Encrypt(h Header, data, out []byte) []byte {
+func (cc *controlCipher) Encrypt(h header, data, out []byte) []byte {
 	const s = controlHeaderSize
 	out = out[:s+controlCipherOverhead+len(data)]
 	h.Marshal(out[:s])

node/cipher-control_test.go

@@ -1,4 +1,4 @@
-package peer
+package node
 
 import (
 	"bytes"
@@ -40,7 +40,7 @@ func TestControlCipher(t *testing.T) {
 	}
 
 	for _, plaintext := range testCases {
-		h1 := Header{
+		h1 := header{
 			StreamID: controlStreamID,
 			Counter:  235153,
 			SourceIP: 4,
@@ -51,7 +51,7 @@ func TestControlCipher(t *testing.T) {
 
 		encrypted = c1.Encrypt(h1, plaintext, encrypted)
 
-		h2 := Header{}
+		h2 := header{}
 		h2.Parse(encrypted)
 		if !reflect.DeepEqual(h1, h2) {
 			t.Fatal(h1, h2)
@@ -80,7 +80,7 @@ func TestControlCipher_ShortCiphertext(t *testing.T) {
 
 func BenchmarkControlCipher_Encrypt(b *testing.B) {
 	c1, _ := newControlCipherForTesting()
-	h1 := Header{
+	h1 := header{
 		Counter:  235153,
 		SourceIP: 4,
 		DestIP:   88,
@@ -100,7 +100,7 @@ func BenchmarkControlCipher_Encrypt(b *testing.B) {
 func BenchmarkControlCipher_Decrypt(b *testing.B) {
 	c1, c2 := newControlCipherForTesting()
 
-	h1 := Header{
+	h1 := header{
 		Counter:  235153,
 		SourceIP: 4,
 		DestIP:   88,

node/cipher-data.go

@@ -1,13 +1,12 @@
-package peer
+package node
 
 import (
-	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/rand"
-	"log"
 )
 
+// TODO: Use [32]byte for simplicity everywhere.
 type dataCipher struct {
 	key  [32]byte
 	aead cipher.AEAD
@@ -16,20 +15,21 @@ type dataCipher struct {
 func newDataCipher() *dataCipher {
 	key := [32]byte{}
 	if _, err := rand.Read(key[:]); err != nil {
-		log.Fatalf("Failed to read random data: %v", err)
+		panic(err)
 	}
 	return newDataCipherFromKey(key)
 }
 
+// key must be 32 bytes.
 func newDataCipherFromKey(key [32]byte) *dataCipher {
 	block, err := aes.NewCipher(key[:])
 	if err != nil {
-		log.Fatalf("Failed to create new cipher: %v", err)
+		panic(err)
 	}
 
 	aead, err := cipher.NewGCM(block)
 	if err != nil {
-		log.Fatalf("Failed to create new GCM: %v", err)
+		panic(err)
 	}
 
 	return &dataCipher{key: key, aead: aead}
@@ -39,11 +39,7 @@ func (sc *dataCipher) Key() [32]byte {
 	return sc.key
 }
 
-func (sc *dataCipher) HasKey(k [32]byte) bool {
+func (sc *dataCipher) Encrypt(h header, data, out []byte) []byte {
-	return bytes.Equal(k[:], sc.key[:])
-}
-
-func (sc *dataCipher) Encrypt(h Header, data, out []byte) []byte {
 	const s = dataHeaderSize
 	out = out[:s+dataCipherOverhead+len(data)]
 	h.Marshal(out[:s])

node/cipher-data_test.go

@@ -1,4 +1,4 @@
-package peer
+package node
 
 import (
 	"bytes"
@@ -22,7 +22,7 @@ func TestDataCipher(t *testing.T) {
 	}
 
 	for _, plaintext := range testCases {
-		h1 := Header{
+		h1 := header{
 			StreamID: dataStreamID,
 			Counter:  235153,
 			SourceIP: 4,
@@ -33,7 +33,7 @@ func TestDataCipher(t *testing.T) {
 
 		dc1 := newDataCipher()
 		encrypted = dc1.Encrypt(h1, plaintext, encrypted)
-		h2 := Header{}
+		h2 := header{}
 		h2.Parse(encrypted)
 
 		dc2 := newDataCipherFromKey(dc1.Key())
@@ -67,7 +67,7 @@ func TestDataCipher_ModifyCiphertext(t *testing.T) {
 	}
 
 	for _, plaintext := range testCases {
-		h1 := Header{
+		h1 := header{
 			Counter:  235153,
 			SourceIP: 4,
 			DestIP:   88,
@@ -99,7 +99,7 @@ func TestDataCipher_ShortCiphertext(t *testing.T) {
 }
 
 func BenchmarkDataCipher_Encrypt(b *testing.B) {
-	h1 := Header{
+	h1 := header{
 		Counter:  235153,
 		SourceIP: 4,
 		DestIP:   88,
@@ -118,7 +118,7 @@ func BenchmarkDataCipher_Encrypt(b *testing.B) {
 }
 
 func BenchmarkDataCipher_Decrypt(b *testing.B) {
-	h1 := Header{
+	h1 := header{
 		Counter:  235153,
 		SourceIP: 4,
 		DestIP:   88,

node/cmd/client/build.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+go build
+sudo setcap cap_net_admin+iep ./client
+./client 144.76.78.93

node/cmd/client/main.go

@@ -0,0 +1,15 @@
+package main
+
+import (
+	"log"
+	"os"
+	"vppn/node"
+)
+
+func main() {
+	if len(os.Args) != 2 {
+		log.Fatalf("Usage: %s <addr:port>", os.Args[0])
+	}
+	n := node.NewTmpNodeClient(os.Args[1])
+	n.RunClient()
+}

node/cmd/server/build.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+go build
+ssh kevin "killall server"
+scp server kevin:/home/jdl/tmp/
+ssh root@kevin "sudo setcap cap_net_admin+iep /home/jdl/tmp/server"
+ssh kevin "/home/jdl/tmp/server"

node/cmd/server/main.go

@@ -0,0 +1,8 @@
+package main
+
+import "vppn/node"
+
+func main() {
+	n := node.NewTmpNodeServer()
+	n.RunServer()
+}

node/conn.go

@@ -0,0 +1,49 @@
+package node
+
+import (
+	"io"
+	"log"
+	"net"
+	"net/netip"
+	"runtime/debug"
+	"sync"
+)
+
+// ----------------------------------------------------------------------------
+
+type connWriter struct {
+	lock sync.Mutex
+	conn *net.UDPConn
+}
+
+func newConnWriter(conn *net.UDPConn) *connWriter {
+	return &connWriter{conn: conn}
+}
+
+func (w *connWriter) WriteTo(packet []byte, addr netip.AddrPort) {
+	w.lock.Lock()
+	if _, err := w.conn.WriteToUDPAddrPort(packet, addr); err != nil {
+		debug.PrintStack()
+		log.Fatalf("Failed to write to UDP port: %v", err)
+	}
+	w.lock.Unlock()
+}
+
+// ----------------------------------------------------------------------------
+
+type ifWriter struct {
+	lock  sync.Mutex
+	iface io.ReadWriteCloser
+}
+
+func newIFWriter(iface io.ReadWriteCloser) *ifWriter {
+	return &ifWriter{iface: iface}
+}
+
+func (w *ifWriter) Write(packet []byte) {
+	w.lock.Lock()
+	if _, err := w.iface.Write(packet); err != nil {
+		log.Fatalf("Failed to write to interface: %v", err)
+	}
+	w.lock.Unlock()
+}

node/dupcheck.go

@@ -1,4 +1,4 @@
-package peer
+package node
 
 type dupCheck struct {
 	bitSet
@@ -38,20 +38,20 @@ func (dc *dupCheck) IsDup(counter uint64) bool {
 	delta := counter - dc.tailCounter
 
 	// Full clear.
-	if delta >= bitSetSize-1 {
+	if delta >= bitSetSize {
 		dc.ClearAll()
 		dc.Set(0)
 
 		dc.tail = 1
 		dc.head = 2
 		dc.tailCounter = counter + 1
-		dc.headCounter = dc.tailCounter - bitSetSize + 1
+		dc.headCounter = dc.tailCounter - bitSetSize
 
 		return false
 	}
 
 	// Clear if necessary.
-	for range delta {
+	for i := 0; i < int(delta); i++ {
 		dc.put(false)
 	}
 

node/dupcheck_test.go

@@ -1,4 +1,4 @@
-package peer
+package node
 
 import (
 	"testing"
@@ -19,7 +19,6 @@ func TestDupCheck(t *testing.T) {
 	}
 
 	testCases := []TestCase{
-		{511, true},
 		{0, true},
 		{1, true},
 		{2, true},
@@ -40,13 +39,11 @@ func TestDupCheck(t *testing.T) {
 		{516, false},
 		{517, true},
 		{2512, false},
-		{2512, true},
+		{2000, true},
-		{2001, true},
+		{2001, false},
-		{2002, false},
-		{2002, true},
 		{4000, false},
-		{4000 - 511, true},  // Too old.
+		{4000 - 512, true},  // Too old.
-		{4000 - 510, false}, // Just in the window.
+		{4000 - 511, false}, // Just in the window.
 	}
 
 	for i, tc := range testCases {

node/files.go

@@ -1,4 +1,4 @@
-package peer
+package node
 
 import (
 	"encoding/json"
@@ -8,19 +8,6 @@ import (
 	"vppn/m"
 )
 
-type LocalConfig struct {
-	LocalPeerIP byte
-	Network     []byte
-	PubKey      []byte
-	PrivKey     []byte
-	PubSignKey  []byte
-	PrivSignKey []byte
-}
-
-type startupCount struct {
-	Count uint16
-}
-
 func configDir(netName string) string {
 	d, err := os.UserHomeDir()
 	if err != nil {
@@ -30,15 +17,11 @@ func configDir(netName string) string {
 }
 
 func peerConfigPath(netName string) string {
-	return filepath.Join(configDir(netName), "config.json")
+	return filepath.Join(configDir(netName), "peer-config.json")
 }
 
 func peerStatePath(netName string) string {
-	return filepath.Join(configDir(netName), "state.json")
+	return filepath.Join(configDir(netName), "peer-state.json")
-}
-
-func startupCountPath(netName string) string {
-	return filepath.Join(configDir(netName), "startup_count.json")
 }
 
 func storeJson(x any, outPath string) error {
@@ -73,7 +56,7 @@ func storeJson(x any, outPath string) error {
 	return os.Rename(tmpPath, outPath)
 }
 
-func storePeerConfig(netName string, pc LocalConfig) error {
+func storePeerConfig(netName string, pc m.PeerConfig) error {
 	return storeJson(pc, peerConfigPath(netName))
 }
 
@@ -90,18 +73,10 @@ func loadJson(dataPath string, ptr any) error {
 	return json.Unmarshal(data, ptr)
 }
 
-func loadPeerConfig(netName string) (pc LocalConfig, err error) {
+func loadPeerConfig(netName string) (pc m.PeerConfig, err error) {
 	return pc, loadJson(peerConfigPath(netName), &pc)
 }
 
 func loadNetworkState(netName string) (ps m.NetworkState, err error) {
 	return ps, loadJson(peerStatePath(netName), &ps)
 }
-
-func loadStartupCount(netName string) (c startupCount, err error) {
-	return c, loadJson(startupCountPath(netName), &c)
-}
-
-func storeStartupCount(netName string, c startupCount) error {
-	return storeJson(c, startupCountPath(netName))
-}

node/globalfuncs.go

@@ -0,0 +1,73 @@
+package node
+
+import (
+	"net/netip"
+	"sync/atomic"
+)
+
+func getRelayRoute() *peerRoute {
+	if ip := relayIP.Load(); ip != nil {
+		return routingTable[*ip].Load()
+	}
+	return nil
+}
+
+func getLocalAddr() netip.AddrPort {
+	if a := localAddr.Load(); a != nil {
+		return *a
+	}
+	return netip.AddrPort{}
+}
+
+func _sendControlPacket(pkt interface{ Marshal([]byte) []byte }, route peerRoute, buf1, buf2 []byte) {
+	buf := pkt.Marshal(buf2)
+	h := header{
+		StreamID: controlStreamID,
+		Counter:  atomic.AddUint64(&sendCounters[route.IP], 1),
+		SourceIP: localIP,
+		DestIP:   route.IP,
+	}
+	buf = route.ControlCipher.Encrypt(h, buf, buf1)
+
+	if route.Direct {
+		_conn.WriteTo(buf, route.RemoteAddr)
+		return
+	}
+
+	_relayPacket(route.IP, buf, buf2)
+}
+
+func _sendDataPacket(route *peerRoute, pkt, buf1, buf2 []byte) {
+	h := header{
+		StreamID: dataStreamID,
+		Counter:  atomic.AddUint64(&sendCounters[route.IP], 1),
+		SourceIP: localIP,
+		DestIP:   route.IP,
+	}
+
+	enc := route.DataCipher.Encrypt(h, pkt, buf1)
+
+	if route.Direct {
+		_conn.WriteTo(enc, route.RemoteAddr)
+		return
+	}
+
+	_relayPacket(route.IP, enc, buf2)
+}
+
+func _relayPacket(destIP byte, data, buf []byte) {
+	relayRoute := getRelayRoute()
+	if relayRoute == nil || !relayRoute.Up || !relayRoute.Relay {
+		return
+	}
+
+	h := header{
+		StreamID: dataStreamID,
+		Counter:  atomic.AddUint64(&sendCounters[relayRoute.IP], 1),
+		SourceIP: localIP,
+		DestIP:   destIP,
+	}
+
+	enc := relayRoute.DataCipher.Encrypt(h, data, buf)
+	_conn.WriteTo(enc, relayRoute.RemoteAddr)
+}

node/globals.go

@@ -0,0 +1,86 @@
+package node
+
+import (
+	"net/netip"
+	"sync/atomic"
+	"time"
+	"vppn/m"
+)
+
+const (
+	bufferSize            = 1536
+	if_mtu                = 1200
+	if_queue_len          = 2048
+	controlCipherOverhead = 16
+	dataCipherOverhead    = 16
+)
+
+type peerRoute struct {
+	IP            byte
+	Up            bool // True if data can be sent on the route.
+	Relay         bool // True if the peer is a relay.
+	Direct        bool // True if this is a direct connection.
+	ControlCipher *controlCipher
+	DataCipher    *dataCipher
+	RemoteAddr    netip.AddrPort // Remote address if directly connected.
+}
+
+var (
+	// Configuration for this peer.
+	netName    string
+	localIP    byte
+	localPub   bool
+	privateKey []byte
+
+	// Shared interface for writing.
+	_iface *ifWriter
+
+	// Shared connection for writing.
+	_conn *connWriter
+
+	// Counters for sending to each peer.
+	sendCounters [256]uint64 = func() (out [256]uint64) {
+		for i := range out {
+			out[i] = uint64(time.Now().Unix()<<30 + 1)
+		}
+		return
+	}()
+
+	// Duplicate checkers for incoming packets.
+	dupChecks [256]*dupCheck = func() (out [256]*dupCheck) {
+		for i := range out {
+			out[i] = newDupCheck(0)
+		}
+		return
+	}()
+
+	// Channels for incoming control packets.
+	controlPackets [256]chan controlPacket = func() (out [256]chan controlPacket) {
+		for i := range out {
+			out[i] = make(chan controlPacket, 256)
+		}
+		return
+	}()
+
+	// Channels for incoming peer updates from the hub.
+	peerUpdates [256]chan *m.Peer = func() (out [256]chan *m.Peer) {
+		for i := range out {
+			out[i] = make(chan *m.Peer)
+		}
+		return
+	}()
+
+	// Global routing table.
+	routingTable [256]*atomic.Pointer[peerRoute] = func() (out [256]*atomic.Pointer[peerRoute]) {
+		for i := range out {
+			out[i] = &atomic.Pointer[peerRoute]{}
+			out[i].Store(&peerRoute{})
+		}
+		return
+	}()
+
+	// Managed by the relayManager.
+	discoveryPackets chan controlPacket
+	localAddr        *atomic.Pointer[netip.AddrPort] // May be nil.
+	relayIP          *atomic.Pointer[byte]           // May be nil.
+)

node/header.go

@@ -0,0 +1,35 @@
+package node
+
+import "unsafe"
+
+// ----------------------------------------------------------------------------
+
+const (
+	headerSize        = 12
+	controlStreamID   = 2
+	controlHeaderSize = 24
+	dataStreamID      = 1
+	dataHeaderSize    = 12
+)
+
+type header struct {
+	StreamID byte
+	Counter  uint64 // Init with time.Now().Unix << 30 to ensure monotonic.
+	SourceIP byte
+	DestIP   byte
+}
+
+func (h *header) Parse(b []byte) {
+	h.StreamID = b[0]
+	h.Counter = *(*uint64)(unsafe.Pointer(&b[1]))
+	h.SourceIP = b[9]
+	h.DestIP = b[10]
+}
+
+func (h *header) Marshal(buf []byte) {
+	buf[0] = h.StreamID
+	*(*uint64)(unsafe.Pointer(&buf[1])) = h.Counter
+	buf[9] = h.SourceIP
+	buf[10] = h.DestIP
+	buf[11] = 0
+}

node/header_test.go

@@ -1,9 +1,9 @@
-package peer
+package node
 
 import "testing"
 
 func TestHeaderMarshalParse(t *testing.T) {
-	nIn := Header{
+	nIn := header{
 		StreamID: 23,
 		Counter:  3212,
 		SourceIP: 34,
@@ -13,7 +13,7 @@ func TestHeaderMarshalParse(t *testing.T) {
 	buf := make([]byte, headerSize)
 	nIn.Marshal(buf)
 
-	nOut := Header{}
+	nOut := header{}
 	nOut.Parse(buf)
 	if nIn != nOut {
 		t.Fatal(nIn, nOut)

node/hubpoller.go

@@ -0,0 +1,94 @@
+package node
+
+import (
+	"encoding/json"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"time"
+	"vppn/m"
+)
+
+type hubPoller struct {
+	client   *http.Client
+	req      *http.Request
+	versions [256]int64
+}
+
+func newHubPoller(conf m.PeerConfig) *hubPoller {
+	u, err := url.Parse(conf.HubAddress)
+	if err != nil {
+		log.Fatalf("Failed to parse hub address %s: %v", conf.HubAddress, err)
+	}
+	u.Path = "/peer/fetch-state/"
+
+	client := &http.Client{Timeout: 8 * time.Second}
+
+	req := &http.Request{
+		Method: http.MethodGet,
+		URL:    u,
+		Header: http.Header{},
+	}
+	req.SetBasicAuth("", conf.APIKey)
+
+	return &hubPoller{
+		client: client,
+		req:    req,
+	}
+}
+
+func (hp *hubPoller) Run() {
+	defer panicHandler()
+
+	state, err := loadNetworkState(netName)
+	if err != nil {
+		log.Printf("Failed to load network state: %v", err)
+		log.Printf("Polling hub...")
+		hp.pollHub()
+	} else {
+		hp.applyNetworkState(state)
+	}
+
+	for range time.Tick(64 * time.Second) {
+		hp.pollHub()
+	}
+}
+
+func (hp *hubPoller) pollHub() {
+	var state m.NetworkState
+
+	resp, err := hp.client.Do(hp.req)
+	if err != nil {
+		log.Printf("Failed to fetch peer state: %v", err)
+		return
+	}
+	body, err := io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+	if err != nil {
+		log.Printf("Failed to read body from hub: %v", err)
+		return
+	}
+
+	if err := json.Unmarshal(body, &state); err != nil {
+		log.Printf("Failed to unmarshal response from hub: %v", err)
+		return
+	}
+
+	hp.applyNetworkState(state)
+
+	if err := storeNetworkState(netName, state); err != nil {
+		log.Printf("Failed to store network state: %v", err)
+	}
+}
+
+func (hp *hubPoller) applyNetworkState(state m.NetworkState) {
+	for i, peer := range state.Peers {
+		if i != int(localIP) {
+			if peer != nil && peer.Version != hp.versions[i] {
+				peerUpdates[i] <- state.Peers[i]
+				hp.versions[i] = peer.Version
+			}
+		}
+	}
+}

node/interface.go

@@ -0,0 +1,177 @@
+package node
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"os"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+// Get next packet, returning packet, ip, and possible error.
+func readNextPacket(iface io.ReadWriteCloser, buf []byte) ([]byte, byte, error) {
+	var (
+		version byte
+		ip      byte
+	)
+	for {
+		n, err := iface.Read(buf[:cap(buf)])
+		if err != nil {
+			return nil, ip, err
+		}
+
+		buf = buf[:n]
+		version = buf[0] >> 4
+
+		switch version {
+		case 4:
+			if n < 20 {
+				log.Printf("Short IPv4 packet: %d", len(buf))
+				continue
+			}
+			ip = buf[19]
+
+		case 6:
+			if len(buf) < 40 {
+				log.Printf("Short IPv6 packet: %d", len(buf))
+				continue
+			}
+			ip = buf[39]
+
+		default:
+			log.Printf("Invalid IP packet version: %v", version)
+			continue
+		}
+
+		return buf, ip, nil
+	}
+}
+
+func openInterface(network []byte, localIP byte, name string) (io.ReadWriteCloser, error) {
+	if len(network) != 4 {
+		return nil, fmt.Errorf("expected network to be 4 bytes, got %d", len(network))
+	}
+	ip := net.IPv4(network[0], network[1], network[2], localIP)
+
+	//////////////////////////
+	// Create TUN Interface //
+	//////////////////////////
+
+	tunFD, err := syscall.Open("/dev/net/tun", syscall.O_RDWR|unix.O_CLOEXEC, 0600)
+	if err != nil {
+		return nil, fmt.Errorf("failed to open TUN device: %w", err)
+	}
+
+	// New interface request.
+	req, err := unix.NewIfreq(name)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create new TUN interface request: %w", err)
+	}
+
+	// Flags:
+	//
+	// IFF_NO_PI => don't add packet info data to packets sent to the interface.
+	// IFF_TUN   => create a TUN device handling IP packets.
+	req.SetUint16(unix.IFF_NO_PI | unix.IFF_TUN)
+
+	err = unix.IoctlIfreq(tunFD, unix.TUNSETIFF, req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to set TUN device settings: %w", err)
+	}
+
+	// Name may not be exactly the same?
+	name = req.Name()
+
+	/////////////
+	// Set MTU //
+	/////////////
+
+	// We need a socket file descriptor to set other options for some reason.
+	sockFD, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
+	if err != nil {
+		return nil, fmt.Errorf("failed to open socket: %w", err)
+	}
+	defer unix.Close(sockFD)
+
+	req, err = unix.NewIfreq(name)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create MTU interface request: %w", err)
+	}
+
+	req.SetUint32(if_mtu)
+	if err = unix.IoctlIfreq(sockFD, unix.SIOCSIFMTU, req); err != nil {
+		return nil, fmt.Errorf("failed to set interface MTU: %w", err)
+	}
+
+	//////////////////////
+	// Set Queue Length //
+	//////////////////////
+
+	req, err = unix.NewIfreq(name)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create IP interface request: %w", err)
+	}
+
+	req.SetUint16(if_queue_len)
+	if err = unix.IoctlIfreq(sockFD, unix.SIOCSIFTXQLEN, req); err != nil {
+		return nil, fmt.Errorf("failed to set interface queue length: %w", err)
+	}
+
+	/////////////////////
+	// Set IP and Mask //
+	/////////////////////
+
+	req, err = unix.NewIfreq(name)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create IP interface request: %w", err)
+	}
+
+	if err := req.SetInet4Addr(ip.To4()); err != nil {
+		return nil, fmt.Errorf("failed to set interface request IP: %w", err)
+	}
+
+	if err = unix.IoctlIfreq(sockFD, unix.SIOCSIFADDR, req); err != nil {
+		return nil, fmt.Errorf("failed to set interface IP: %w", err)
+	}
+
+	// SET MASK - must happen after setting address.
+	req, err = unix.NewIfreq(name)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create mask interface request: %w", err)
+	}
+
+	if err := req.SetInet4Addr(net.IPv4(255, 255, 255, 0).To4()); err != nil {
+		return nil, fmt.Errorf("failed to set interface request mask: %w", err)
+	}
+
+	if err := unix.IoctlIfreq(sockFD, unix.SIOCSIFNETMASK, req); err != nil {
+		return nil, fmt.Errorf("failed to set interface mask: %w", err)
+	}
+
+	////////////////////////
+	// Bring Interface Up //
+	////////////////////////
+
+	req, err = unix.NewIfreq(name)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create up interface request: %w", err)
+	}
+
+	// Get current flags.
+	if err = unix.IoctlIfreq(sockFD, unix.SIOCGIFFLAGS, req); err != nil {
+		return nil, fmt.Errorf("failed to get interface flags: %w", err)
+	}
+
+	flags := req.Uint16() | unix.IFF_UP | unix.IFF_RUNNING
+
+	// Set UP flag / broadcast flags.
+	req.SetUint16(flags)
+	if err = unix.IoctlIfreq(sockFD, unix.SIOCSIFFLAGS, req); err != nil {
+		return nil, fmt.Errorf("failed to set interface up: %w", err)
+	}
+
+	return os.NewFile(uintptr(tunFD), "tun"), nil
+}

node/main.go

@@ -0,0 +1,309 @@
+package node
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"net/netip"
+	"os"
+	"runtime/debug"
+	"sync/atomic"
+	"vppn/m"
+)
+
+func panicHandler() {
+	if r := recover(); r != nil {
+		log.Fatalf("\n %v\n\nstacktrace from panic: %s\n", r, string(debug.Stack()))
+	}
+}
+
+func Main() {
+	defer panicHandler()
+
+	var (
+		initURL  string
+		listenIP string
+		port     int
+	)
+
+	flag.StringVar(&netName, "name", "", "[REQUIRED] The network name.")
+	flag.StringVar(&initURL, "init-url", "", "Initializes peer from the hub URL.")
+	flag.StringVar(&listenIP, "listen-ip", "", "IP address to listen on.")
+	flag.IntVar(&port, "port", 0, "Port to listen on.")
+	flag.Parse()
+
+	if netName == "" {
+		flag.Usage()
+		os.Exit(1)
+	}
+
+	if initURL != "" {
+		mainInit(initURL)
+		return
+	}
+
+	main(listenIP, uint16(port))
+}
+
+func mainInit(initURL string) {
+	if _, err := loadPeerConfig(netName); err == nil {
+		log.Fatalf("Network is already initialized.")
+	}
+
+	resp, err := http.Get(initURL)
+	if err != nil {
+		log.Fatalf("Failed to fetch data from hub: %v", err)
+	}
+	defer resp.Body.Close()
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		log.Fatalf("Failed to read response body: %v", err)
+	}
+
+	peerConfig := m.PeerConfig{}
+	if err := json.Unmarshal(data, &peerConfig); err != nil {
+		log.Fatalf("Failed to parse configuration: %v", err)
+	}
+
+	if err := storePeerConfig(netName, peerConfig); err != nil {
+		log.Fatalf("Failed to store configuration: %v", err)
+	}
+
+	log.Print("Initialization successful.")
+}
+
+// ----------------------------------------------------------------------------
+
+func main(listenIP string, port uint16) {
+	config, err := loadPeerConfig(netName)
+	if err != nil {
+		log.Fatalf("Failed to load configuration: %v", err)
+	}
+
+	port = determinePort(config.Port, port)
+
+	iface, err := openInterface(config.Network, config.PeerIP, netName)
+	if err != nil {
+		log.Fatalf("Failed to open interface: %v", err)
+	}
+
+	myAddr, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", listenIP, port))
+	if err != nil {
+		log.Fatalf("Failed to resolve UDP address: %v", err)
+	}
+
+	conn, err := net.ListenUDP("udp", myAddr)
+	if err != nil {
+		log.Fatalf("Failed to open UDP port: %v", err)
+	}
+
+	// Intialize globals.
+	_iface = newIFWriter(iface)
+	_conn = newConnWriter(conn)
+
+	localIP = config.PeerIP
+	discoveryPackets = make(chan controlPacket, 256)
+	localAddr = &atomic.Pointer[netip.AddrPort]{}
+	relayIP = &atomic.Pointer[byte]{}
+
+	ip, ok := netip.AddrFromSlice(config.PublicIP)
+	if ok {
+		localPub = true
+		addr := netip.AddrPortFrom(ip, config.Port)
+		localAddr.Store(&addr)
+	}
+
+	privateKey = config.PrivKey
+
+	// Start supervisors.
+	for i := range 256 {
+		go newPeerSupervisor(i).Run()
+	}
+
+	if localPub {
+		go addrDiscoveryServer()
+	} else {
+		go addrDiscoveryClient()
+		go relayManager()
+	}
+	go newHubPoller(config).Run()
+	go readFromConn(conn)
+	readFromIFace(iface)
+}
+
+// ----------------------------------------------------------------------------
+
+func determinePort(confPort, portFromCommandLine uint16) uint16 {
+	if portFromCommandLine != 0 {
+		return portFromCommandLine
+	}
+	if confPort != 0 {
+		return confPort
+	}
+	return 456
+}
+
+// ----------------------------------------------------------------------------
+
+func readFromConn(conn *net.UDPConn) {
+
+	defer panicHandler()
+
+	var (
+		remoteAddr netip.AddrPort
+		n          int
+		err        error
+		buf        = make([]byte, bufferSize)
+		decBuf     = make([]byte, bufferSize)
+		data       []byte
+		h          header
+	)
+
+	for {
+		n, remoteAddr, err = conn.ReadFromUDPAddrPort(buf[:bufferSize])
+		if err != nil {
+			log.Fatalf("Failed to read from UDP port: %v", err)
+		}
+
+		remoteAddr = netip.AddrPortFrom(remoteAddr.Addr().Unmap(), remoteAddr.Port())
+
+		data = buf[:n]
+
+		if n < headerSize {
+			continue // Packet it soo short.
+		}
+
+		h.Parse(data)
+		switch h.StreamID {
+		case controlStreamID:
+			handleControlPacket(remoteAddr, h, data, decBuf)
+
+		case dataStreamID:
+			handleDataPacket(h, data, decBuf)
+
+		default:
+			log.Printf("Unknown stream ID: %d", h.StreamID)
+		}
+	}
+}
+
+func handleControlPacket(addr netip.AddrPort, h header, data, decBuf []byte) {
+	route := routingTable[h.SourceIP].Load()
+	if route.ControlCipher == nil {
+		//log.Printf("Not connected (control).")
+		return
+	}
+
+	if h.DestIP != localIP {
+		log.Printf("Incorrect destination IP on control packet: %d != %d", h.DestIP, localIP)
+		return
+	}
+
+	out, ok := route.ControlCipher.Decrypt(data, decBuf)
+	if !ok {
+		//log.Printf("Failed to decrypt control packet.")
+		return
+	}
+
+	if len(out) == 0 {
+		//log.Printf("Empty control packet from: %d", h.SourceIP)
+		return
+	}
+
+	if dupChecks[h.SourceIP].IsDup(h.Counter) {
+		//log.Printf("[%03d] Duplicate control packet: %d", h.SourceIP, h.Counter)
+		return
+	}
+
+	pkt := controlPacket{
+		SrcIP:   h.SourceIP,
+		SrcAddr: addr,
+	}
+
+	if err := pkt.ParsePayload(out); err != nil {
+		log.Printf("Failed to parse control packet: %v", err)
+		return
+	}
+
+	switch pkt.Payload.(type) {
+
+	case addrDiscoveryPacket:
+		select {
+		case discoveryPackets <- pkt:
+		default:
+			log.Printf("Dropping discovery packet.")
+		}
+
+	default:
+		select {
+		case controlPackets[h.SourceIP] <- pkt:
+		default:
+			log.Printf("Dropping control packet.")
+		}
+	}
+
+}
+
+func handleDataPacket(h header, data []byte, decBuf []byte) {
+	route := routingTable[h.SourceIP].Load()
+	if !route.Up {
+		//log.Printf("Not connected (recv).")
+		return
+	}
+
+	dec, ok := route.DataCipher.Decrypt(data, decBuf)
+	if !ok {
+		log.Printf("Failed to decrypt data packet.")
+		return
+	}
+
+	if dupChecks[h.SourceIP].IsDup(h.Counter) {
+		//log.Printf("[%03d] Duplicate data packet: %d", h.SourceIP, h.Counter)
+		return
+	}
+
+	if h.DestIP == localIP {
+		_iface.Write(dec)
+		return
+	}
+
+	destRoute := routingTable[h.DestIP].Load()
+	if !destRoute.Up {
+		log.Printf("Not connected (relay): %v", destRoute)
+		return
+	}
+
+	_conn.WriteTo(dec, destRoute.RemoteAddr)
+}
+
+// ----------------------------------------------------------------------------
+
+func readFromIFace(iface io.ReadWriteCloser) {
+	var (
+		packet   = make([]byte, bufferSize)
+		buf1     = make([]byte, bufferSize)
+		buf2     = make([]byte, bufferSize)
+		remoteIP byte
+		err      error
+	)
+
+	for {
+		packet, remoteIP, err = readNextPacket(iface, packet)
+		if err != nil {
+			log.Fatalf("Failed to read from interface: %v", err)
+		}
+
+		route := routingTable[remoteIP].Load()
+		if !route.Up {
+			log.Printf("Route not connected: %d", remoteIP)
+			continue
+		}
+
+		_sendDataPacket(route, packet, buf1, buf2)
+	}
+}

node/packets-util.go

@@ -1,10 +1,18 @@
-package peer
+package node
 
 import (
 	"net/netip"
+	"sync/atomic"
+	"time"
 	"unsafe"
 )
 
+var traceIDCounter uint64 = uint64(time.Now().Unix()<<30) + 1
+
+func newTraceID() uint64 {
+	return atomic.AddUint64(&traceIDCounter, 1)
+}
+
 // ----------------------------------------------------------------------------
 
 type binWriter struct {
@@ -55,20 +63,12 @@ func (w *binWriter) Int64(x int64) *binWriter {
 }
 
 func (w *binWriter) AddrPort(addrPort netip.AddrPort) *binWriter {
-	w.Bool(addrPort.IsValid())
 	addr := addrPort.Addr().As16()
 	copy(w.b[w.i:w.i+16], addr[:])
 	w.i += 16
 	return w.Uint16(addrPort.Port())
 }
 
-func (w *binWriter) AddrPort8(l [8]netip.AddrPort) *binWriter {
-	for _, addrPort := range l {
-		w.AddrPort(addrPort)
-	}
-	return w
-}
-
 func (w *binWriter) Build() []byte {
 	return w.b[:w.i]
 }
@@ -146,34 +146,15 @@ func (r *binReader) Int64(x *int64) *binReader {
 }
 
 func (r *binReader) AddrPort(x *netip.AddrPort) *binReader {
-	if !r.hasBytes(19) {
+	if !r.hasBytes(18) {
 		return r
 	}
-
-	var (
-		valid bool
-		port  uint16
-	)
-
-	r.Bool(&valid)
 	addr := netip.AddrFrom16(([16]byte)(r.b[r.i : r.i+16])).Unmap()
 	r.i += 16
 
+	var port uint16
 	r.Uint16(&port)
-
-	if valid {
 	*x = netip.AddrPortFrom(addr, port)
-	} else {
-		*x = netip.AddrPort{}
-	}
-
-	return r
-}
-
-func (r *binReader) AddrPort8(x *[8]netip.AddrPort) *binReader {
-	for i := range x {
-		r.AddrPort(&x[i])
-	}
 	return r
 }
 

node/packets-util_test.go

@@ -0,0 +1,40 @@
+package node
+
+import (
+	"net/netip"
+	"reflect"
+	"testing"
+)
+
+func TestBinWriteRead(t *testing.T) {
+	buf := make([]byte, 1024)
+
+	type Item struct {
+		Type     byte
+		TraceID  uint64
+		DestAddr netip.AddrPort
+	}
+
+	in := Item{1, 2, netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 2, 3, 4}), 22)}
+
+	buf = newBinWriter(buf).
+		Byte(in.Type).
+		Uint64(in.TraceID).
+		AddrPort(in.DestAddr).
+		Build()
+
+	out := Item{}
+
+	err := newBinReader(buf).
+		Byte(&out.Type).
+		Uint64(&out.TraceID).
+		AddrPort(&out.DestAddr).
+		Error()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !reflect.DeepEqual(in, out) {
+		t.Fatal(in, out)
+	}
+}

node/packets.go

@@ -0,0 +1,140 @@
+package node
+
+import (
+	"errors"
+	"net/netip"
+)
+
+var (
+	errMalformedPacket   = errors.New("malformed packet")
+	errUnknownPacketType = errors.New("unknown packet type")
+)
+
+const (
+	packetTypeSyn = iota + 1
+	packetTypeSynAck
+	packetTypeAck
+	packetTypeProbe
+	packetTypeAddrDiscovery
+)
+
+// ----------------------------------------------------------------------------
+
+type controlPacket struct {
+	SrcIP   byte
+	SrcAddr netip.AddrPort
+	Payload any
+}
+
+func (p *controlPacket) ParsePayload(buf []byte) (err error) {
+	switch buf[0] {
+	case packetTypeSyn:
+		p.Payload, err = parseSynPacket(buf)
+	case packetTypeSynAck:
+		p.Payload, err = parseSynAckPacket(buf)
+	case packetTypeProbe:
+		p.Payload, err = parseProbePacket(buf)
+	case packetTypeAddrDiscovery:
+		p.Payload, err = parseAddrDiscoveryPacket(buf)
+	default:
+		return errUnknownPacketType
+	}
+	return err
+}
+
+// ----------------------------------------------------------------------------
+
+type synPacket struct {
+	TraceID   uint64   // TraceID to match response w/ request.
+	SharedKey [32]byte // Our shared key.
+	Direct    bool
+	FromAddr  netip.AddrPort // The client's sending address.
+}
+
+func (p synPacket) Marshal(buf []byte) []byte {
+	return newBinWriter(buf).
+		Byte(packetTypeSyn).
+		Uint64(p.TraceID).
+		SharedKey(p.SharedKey).
+		Bool(p.Direct).
+		AddrPort(p.FromAddr).
+		Build()
+}
+
+func parseSynPacket(buf []byte) (p synPacket, err error) {
+	err = newBinReader(buf[1:]).
+		Uint64(&p.TraceID).
+		SharedKey(&p.SharedKey).
+		Bool(&p.Direct).
+		AddrPort(&p.FromAddr).
+		Error()
+	return
+}
+
+// ----------------------------------------------------------------------------
+
+type synAckPacket struct {
+	TraceID  uint64
+	FromAddr netip.AddrPort
+}
+
+func (p synAckPacket) Marshal(buf []byte) []byte {
+	return newBinWriter(buf).
+		Byte(packetTypeSynAck).
+		Uint64(p.TraceID).
+		AddrPort(p.FromAddr).
+		Build()
+}
+
+func parseSynAckPacket(buf []byte) (p synAckPacket, err error) {
+	err = newBinReader(buf[1:]).
+		Uint64(&p.TraceID).
+		AddrPort(&p.FromAddr).
+		Error()
+	return
+}
+
+// ----------------------------------------------------------------------------
+
+type addrDiscoveryPacket struct {
+	TraceID uint64
+	ToAddr  netip.AddrPort
+}
+
+func (p addrDiscoveryPacket) Marshal(buf []byte) []byte {
+	return newBinWriter(buf).
+		Byte(packetTypeAddrDiscovery).
+		Uint64(p.TraceID).
+		AddrPort(p.ToAddr).
+		Build()
+}
+
+func parseAddrDiscoveryPacket(buf []byte) (p addrDiscoveryPacket, err error) {
+	err = newBinReader(buf[1:]).
+		Uint64(&p.TraceID).
+		AddrPort(&p.ToAddr).
+		Error()
+	return
+}
+
+// ----------------------------------------------------------------------------
+
+// A probeReqPacket is sent from a client to a server to determine if direct
+// UDP communication can be used.
+type probePacket struct {
+	TraceID uint64
+}
+
+func (p probePacket) Marshal(buf []byte) []byte {
+	return newBinWriter(buf).
+		Byte(packetTypeProbe).
+		Uint64(p.TraceID).
+		Build()
+}
+
+func parseProbePacket(buf []byte) (p probePacket, err error) {
+	err = newBinReader(buf[1:]).
+		Uint64(&p.TraceID).
+		Error()
+	return
+}

node/packets_test.go

@@ -0,0 +1,42 @@
+package node
+
+import (
+	"crypto/rand"
+	"net/netip"
+	"reflect"
+	"testing"
+)
+
+func TestPacketSyn(t *testing.T) {
+	in := synPacket{
+		TraceID:  newTraceID(),
+		RelayIP:  4,
+		FromAddr: netip.AddrPortFrom(netip.AddrFrom4([4]byte{4, 5, 6, 7}), 22),
+	}
+	rand.Read(in.SharedKey[:])
+
+	out, err := parseSynPacket(in.Marshal(make([]byte, bufferSize)))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !reflect.DeepEqual(in, out) {
+		t.Fatal("\n", in, "\n", out)
+	}
+}
+
+func TestPacketSynAck(t *testing.T) {
+	in := synAckPacket{
+		TraceID:  newTraceID(),
+		FromAddr: netip.AddrPortFrom(netip.AddrFrom4([4]byte{4, 5, 6, 7}), 22),
+	}
+
+	out, err := parseSynAckPacket(in.Marshal(make([]byte, bufferSize)))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !reflect.DeepEqual(in, out) {
+		t.Fatal("\n", in, "\n", out)
+	}
+}

node/peer-supervisor.go

@@ -0,0 +1,331 @@
+package node
+
+import (
+	"fmt"
+	"log"
+	"net/netip"
+	"sync/atomic"
+	"time"
+	"vppn/m"
+)
+
+const (
+	pingInterval    = 8 * time.Second
+	timeoutInterval = 25 * time.Second
+)
+
+// ----------------------------------------------------------------------------
+
+type peerSupervisor struct {
+	// The purpose of this state machine is to manage this published data.
+	published *atomic.Pointer[peerRoute]
+	staged    peerRoute // Local copy of shared data. See publish().
+
+	// Immutable data.
+	remoteIP byte // Remote VPN IP.
+
+	// Mutable peer data.
+	peer      *m.Peer
+	remotePub bool
+
+	// Incoming events.
+	peerUpdates    chan *m.Peer
+	controlPackets chan controlPacket
+
+	// Buffers for sending control packets.
+	buf1 []byte
+	buf2 []byte
+}
+
+func newPeerSupervisor(i int) *peerSupervisor {
+	return &peerSupervisor{
+		published:      routingTable[i],
+		remoteIP:       byte(i),
+		peerUpdates:    peerUpdates[i],
+		controlPackets: controlPackets[i],
+		buf1:           make([]byte, bufferSize),
+		buf2:           make([]byte, bufferSize),
+	}
+}
+
+type stateFunc func() stateFunc
+
+func (s *peerSupervisor) Run() {
+	state := s.noPeer
+	for {
+		state = state()
+	}
+}
+
+// ----------------------------------------------------------------------------
+
+func (s *peerSupervisor) sendControlPacket(pkt interface{ Marshal([]byte) []byte }) {
+	_sendControlPacket(pkt, s.staged, s.buf1, s.buf2)
+	time.Sleep(500 * time.Millisecond) // Rate limit packets.
+}
+
+func (s *peerSupervisor) sendControlPacketTo(
+	pkt interface{ Marshal([]byte) []byte },
+	addr netip.AddrPort,
+) {
+	if !addr.IsValid() {
+		s.logf("ERROR: Attepted to send packet to invalid address: %v", addr)
+		return
+	}
+	route := s.staged
+	route.Direct = true
+	route.RemoteAddr = addr
+	_sendControlPacket(pkt, route, s.buf1, s.buf2)
+	time.Sleep(500 * time.Millisecond) // Rate limit packets.
+}
+
+// ----------------------------------------------------------------------------
+
+func (s *peerSupervisor) logf(msg string, args ...any) {
+	log.Printf(fmt.Sprintf("[%03d] ", s.remoteIP)+msg, args...)
+}
+
+// ----------------------------------------------------------------------------
+
+func (s *peerSupervisor) publish() {
+	data := s.staged
+	s.published.Store(&data)
+}
+
+// ----------------------------------------------------------------------------
+
+func (s *peerSupervisor) noPeer() stateFunc {
+	return s.peerUpdate(<-s.peerUpdates)
+}
+
+// ----------------------------------------------------------------------------
+
+func (s *peerSupervisor) peerUpdate(peer *m.Peer) stateFunc {
+	return func() stateFunc { return s._peerUpdate(peer) }
+}
+
+func (s *peerSupervisor) _peerUpdate(peer *m.Peer) stateFunc {
+	defer s.publish()
+
+	s.peer = peer
+	s.staged = peerRoute{}
+
+	if s.peer == nil {
+		return s.noPeer
+	}
+
+	s.staged.IP = s.remoteIP
+	s.staged.ControlCipher = newControlCipher(privateKey, peer.PubKey)
+	s.staged.DataCipher = newDataCipher()
+
+	if ip, isValid := netip.AddrFromSlice(peer.PublicIP); isValid {
+		s.remotePub = true
+		s.staged.Relay = peer.Relay
+		s.staged.Direct = true
+		s.staged.RemoteAddr = netip.AddrPortFrom(ip, peer.Port)
+	} else if localPub {
+		s.staged.Direct = true
+	}
+
+	if s.remotePub == localPub {
+		if localIP < s.remoteIP {
+			return s.server
+		}
+		return s.client
+	}
+
+	if s.remotePub {
+		return s.client
+	}
+	return s.server
+}
+
+// ----------------------------------------------------------------------------
+
+func (s *peerSupervisor) server() stateFunc {
+	logf := func(format string, args ...any) { s.logf("SERVER "+format, args...) }
+
+	logf("DOWN")
+
+	var (
+		syn          synPacket
+		timeoutTimer = time.NewTimer(timeoutInterval)
+	)
+
+	for {
+		select {
+		case peer := <-s.peerUpdates:
+			return s.peerUpdate(peer)
+
+		case pkt := <-s.controlPackets:
+			switch p := pkt.Payload.(type) {
+
+			case synPacket:
+				// Before we can respond to this packet, we need to make sure the
+				// route is setup properly.
+				//
+				// The client will update the syn's TraceID whenever there's a change.
+				// The server will follow the client's request.
+				if p.TraceID != syn.TraceID || !s.staged.Up {
+					if p.Direct {
+						logf("UP - Direct")
+					} else {
+						logf("UP - Relayed")
+					}
+
+					syn = p
+					s.staged.Up = true
+					s.staged.Direct = syn.Direct
+					s.staged.DataCipher = newDataCipherFromKey(syn.SharedKey)
+					s.staged.RemoteAddr = pkt.SrcAddr
+
+					s.publish()
+				}
+
+				// We should always respond.
+				ack := synAckPacket{
+					TraceID:  syn.TraceID,
+					FromAddr: getLocalAddr(),
+				}
+				s.sendControlPacket(ack)
+
+				if s.staged.Direct {
+					continue
+				}
+
+				if !syn.FromAddr.IsValid() {
+					continue
+				}
+
+				probe := probePacket{TraceID: newTraceID()}
+				s.sendControlPacketTo(probe, syn.FromAddr)
+
+			case probePacket:
+				if pkt.SrcAddr.IsValid() {
+					s.sendControlPacketTo(probePacket{TraceID: p.TraceID}, pkt.SrcAddr)
+				} else {
+					logf("Invalid probe address")
+				}
+			}
+
+		case <-timeoutTimer.C:
+			logf("Connection timeout")
+			s.staged.Up = false
+			s.publish()
+		}
+	}
+}
+
+// ----------------------------------------------------------------------------
+
+func (s *peerSupervisor) client() stateFunc {
+	logf := func(format string, args ...any) { s.logf("CLIENT "+format, args...) }
+
+	logf("DOWN")
+
+	var (
+		syn = synPacket{
+			TraceID:   newTraceID(),
+			SharedKey: s.staged.DataCipher.Key(),
+			Direct:    s.staged.Direct,
+			FromAddr:  getLocalAddr(),
+		}
+
+		ack synAckPacket
+
+		probe     probePacket
+		probeAddr netip.AddrPort
+
+		lAddr netip.AddrPort
+
+		timeoutTimer = time.NewTimer(timeoutInterval)
+		pingTimer    = time.NewTimer(pingInterval)
+	)
+
+	defer timeoutTimer.Stop()
+	defer pingTimer.Stop()
+
+	s.sendControlPacket(syn)
+
+	for {
+		select {
+
+		case peer := <-s.peerUpdates:
+			return s.peerUpdate(peer)
+
+		case pkt := <-s.controlPackets:
+			switch p := pkt.Payload.(type) {
+
+			case synAckPacket:
+				if p.TraceID != syn.TraceID {
+					continue // Hmm...
+				}
+
+				ack = p
+				timeoutTimer.Reset(timeoutInterval)
+
+				if !s.staged.Up {
+					if s.staged.Direct {
+						logf("UP - Direct")
+					} else {
+						logf("UP - Relayed")
+					}
+
+					s.staged.Up = true
+					s.publish()
+				}
+
+			case probePacket:
+				if s.staged.Direct {
+					continue
+				}
+
+				if p.TraceID != probe.TraceID {
+					continue
+				}
+
+				// Upgrade connection.
+
+				logf("UP - Direct")
+				s.staged.Direct = true
+				s.staged.RemoteAddr = probeAddr
+				s.publish()
+
+				syn.TraceID = newTraceID()
+				syn.Direct = true
+				syn.FromAddr = getLocalAddr()
+				s.sendControlPacket(syn)
+			}
+
+		case <-pingTimer.C:
+			// Send syn.
+
+			syn.FromAddr = getLocalAddr()
+			if syn.FromAddr != lAddr {
+				syn.TraceID = newTraceID()
+				lAddr = syn.FromAddr
+			}
+
+			s.sendControlPacket(syn)
+
+			pingTimer.Reset(pingInterval)
+
+			if s.staged.Direct {
+				continue
+			}
+
+			if !ack.FromAddr.IsValid() {
+				continue
+			}
+
+			probe = probePacket{TraceID: newTraceID()}
+			probeAddr = ack.FromAddr
+
+			s.sendControlPacketTo(probe, ack.FromAddr)
+
+		case <-timeoutTimer.C:
+			logf("Connection timeout")
+			return s.peerUpdate(s.peer)
+		}
+	}
+}

node/relaymanager.go

@@ -0,0 +1,40 @@
+package node
+
+import (
+	"log"
+	"math/rand"
+	"time"
+)
+
+func relayManager() {
+	time.Sleep(2 * time.Second)
+	updateRelayRoute()
+
+	for range time.Tick(8 * time.Second) {
+		relay := getRelayRoute()
+		if relay == nil || !relay.Up || !relay.Relay {
+			updateRelayRoute()
+		}
+	}
+}
+
+func updateRelayRoute() {
+	possible := make([]*peerRoute, 0, 8)
+	for i := range routingTable {
+		route := routingTable[i].Load()
+		if !route.Up || !route.Relay {
+			continue
+		}
+		possible = append(possible, route)
+	}
+
+	if len(possible) == 0 {
+		log.Printf("No relay available.")
+		relayIP.Store(nil)
+		return
+	}
+
+	ip := possible[rand.Intn(len(possible))].IP
+	log.Printf("New relay IP: %d", ip)
+	relayIP.Store(&ip)
+}

peer/connreader.go

@@ -1,46 +0,0 @@
-package peer
-
-import (
-	"log"
-	"net"
-	"net/netip"
-)
-
-type ConnReader struct {
-	Globals
-	conn *net.UDPConn
-	buf  []byte
-}
-
-func NewConnReader(g Globals, conn *net.UDPConn) *ConnReader {
-	return &ConnReader{
-		Globals: g,
-		conn:    conn,
-		buf:     make([]byte, bufferSize),
-	}
-}
-
-func (r *ConnReader) Run() {
-	for {
-		r.handleNextPacket()
-	}
-}
-
-func (r *ConnReader) handleNextPacket() {
-	buf := r.buf[:bufferSize]
-	n, remoteAddr, err := r.conn.ReadFromUDPAddrPort(buf)
-	if err != nil {
-		log.Fatalf("Failed to read from UDP port: %v", err)
-	}
-
-	if n < headerSize {
-		return
-	}
-
-	remoteAddr = netip.AddrPortFrom(remoteAddr.Addr().Unmap(), remoteAddr.Port())
-
-	buf = buf[:n]
-	h := parseHeader(buf)
-
-	r.RemotePeers[h.SourceIP].Load().HandlePacket(h, remoteAddr, buf)
-}

peer/controlmessage.go

@@ -1,64 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"vppn/m"
-)
-
-// ----------------------------------------------------------------------------
-
-type controlMsg[T any] struct {
-	SrcIP   byte
-	SrcAddr netip.AddrPort
-	Packet  T
-}
-
-func parseControlMsg(srcIP byte, srcAddr netip.AddrPort, buf []byte) (any, error) {
-	switch buf[0] {
-
-	case packetTypeInit:
-		packet, err := parsePacketInit(buf)
-		return controlMsg[packetInit]{
-			SrcIP:   srcIP,
-			SrcAddr: srcAddr,
-			Packet:  packet,
-		}, err
-
-	case packetTypeSyn:
-		packet, err := parsePacketSyn(buf)
-		return controlMsg[packetSyn]{
-			SrcIP:   srcIP,
-			SrcAddr: srcAddr,
-			Packet:  packet,
-		}, err
-
-	case packetTypeAck:
-		packet, err := parsePacketAck(buf)
-		return controlMsg[packetAck]{
-			SrcIP:   srcIP,
-			SrcAddr: srcAddr,
-			Packet:  packet,
-		}, err
-
-	case packetTypeProbe:
-		packet, err := parsePacketProbe(buf)
-		return controlMsg[packetProbe]{
-			SrcIP:   srcIP,
-			SrcAddr: srcAddr,
-			Packet:  packet,
-		}, err
-
-	default:
-		return nil, errUnknownPacketType
-	}
-}
-
-// ----------------------------------------------------------------------------
-
-type peerUpdateMsg struct {
-	Peer *m.Peer
-}
-
-// ----------------------------------------------------------------------------
-
-type pingTimerMsg struct{}

peer/crypto.go

@@ -1,30 +0,0 @@
-package peer
-
-import (
-	"crypto/rand"
-	"log"
-
-	"golang.org/x/crypto/nacl/box"
-	"golang.org/x/crypto/nacl/sign"
-)
-
-type cryptoKeys struct {
-	PubKey      []byte
-	PrivKey     []byte
-	PubSignKey  []byte
-	PrivSignKey []byte
-}
-
-func generateKeys() cryptoKeys {
-	pubKey, privKey, err := box.GenerateKey(rand.Reader)
-	if err != nil {
-		log.Fatalf("Failed to generate encryption keys: %v", err)
-	}
-
-	pubSignKey, privSignKey, err := sign.GenerateKey(rand.Reader)
-	if err != nil {
-		log.Fatalf("Failed to generate signing keys: %v", err)
-	}
-
-	return cryptoKeys{pubKey[:], privKey[:], pubSignKey[:], privSignKey[:]}
-}

peer/data-flow.dot

@@ -1,13 +0,0 @@
-digraph d {
-    ifReader   -> remote;
-
-    connReader -> remote;
-    mcReader   -> remote;
-    remote -> connWriter;
-    remote -> ifWriter;
-    hubPoller  -> remote;
-
-    connWriter [shape="box"];
-    mcWriter [shape="box"];
-    ifWriter [shape="box"];
-}

peer/errors.go

@@ -1,8 +0,0 @@
-package peer
-
-import "errors"
-
-var (
-	errMalformedPacket   = errors.New("malformed packet")
-	errUnknownPacketType = errors.New("unknown packet type")
-)

peer/files_test.go

@@ -1,57 +0,0 @@
-package peer
-
-import (
-	"path/filepath"
-	"reflect"
-	"testing"
-)
-
-func TestFilePaths(t *testing.T) {
-	confDir := configDir("netName")
-	if filepath.Base(confDir) != "netName" {
-		t.Fatal(confDir)
-	}
-	if filepath.Base(filepath.Dir(confDir)) != ".vppn" {
-		t.Fatal(confDir)
-	}
-
-	path := peerConfigPath("netName")
-	if path != filepath.Join(confDir, "config.json") {
-		t.Fatal(path)
-	}
-
-	path = peerStatePath("netName")
-	if path != filepath.Join(confDir, "state.json") {
-		t.Fatal(path)
-	}
-}
-
-func TestStoreLoadJson(t *testing.T) {
-	type Object struct {
-		Name  string
-		Age   int
-		Price float64
-	}
-
-	tmpDir := t.TempDir()
-	outPath := filepath.Join(tmpDir, "object.json")
-
-	obj := Object{
-		Name:  "Jason",
-		Age:   22,
-		Price: 123.534,
-	}
-
-	if err := storeJson(obj, outPath); err != nil {
-		t.Fatal(err)
-	}
-
-	obj2 := Object{}
-	if err := loadJson(outPath, &obj2); err != nil {
-		t.Fatal(err)
-	}
-
-	if !reflect.DeepEqual(obj, obj2) {
-		t.Fatal(obj, obj2)
-	}
-}

peer/globals.go

@@ -1,109 +0,0 @@
-package peer
-
-import (
-	"io"
-	"net"
-	"net/netip"
-	"sync"
-	"sync/atomic"
-	"time"
-)
-
-const (
-	version = 1
-
-	bufferSize = 8192 // Enough for data packets and encryption buffers.
-
-	if_mtu       = 1200
-	if_queue_len = 2048
-
-	controlCipherOverhead = 16
-	dataCipherOverhead    = 16
-	signOverhead          = 64
-
-	pingInterval                  = 8 * time.Second
-	timeoutInterval               = 30 * time.Second
-	broadcastInterval             = 16 * time.Second
-	broadcastErrorTimeoutInterval = 8 * time.Second
-)
-
-var multicastAddr = net.UDPAddrFromAddrPort(netip.AddrPortFrom(
-	netip.AddrFrom4([4]byte{224, 0, 0, 157}),
-	4560))
-
-// ----------------------------------------------------------------------------
-
-type Globals struct {
-	LocalConfig // Embed, immutable.
-
-	// The number of startups
-	StartupCount uint16
-
-	// Local public address (if available). Immutable.
-	LocalAddr netip.AddrPort
-
-	// True if local public address is valid. Immutable.
-	LocalAddrValid bool
-
-	// All remote peers by VPN IP.
-	RemotePeers [256]*atomic.Pointer[Remote]
-
-	// Discovered public addresses.
-	PubAddrs *pubAddrStore
-
-	// Attempts to ensure that we have a relay available.
-	RelayHandler *relayHandler
-
-	// Send UDP - Global function to write UDP packets.
-	SendUDP func(b []byte, addr netip.AddrPort) (n int, err error)
-
-	// Global TUN interface.
-	IFace io.ReadWriteCloser
-
-	// For trace ID.
-	NewTraceID func() uint64
-}
-
-func NewGlobals(
-	localConfig LocalConfig,
-	startupCount startupCount,
-	localAddr netip.AddrPort,
-	conn *net.UDPConn,
-	iface io.ReadWriteCloser,
-) (g Globals) {
-	g.LocalConfig = localConfig
-	g.StartupCount = startupCount.Count
-
-	g.LocalAddr = localAddr
-	g.LocalAddrValid = localAddr.IsValid()
-
-	g.PubAddrs = newPubAddrStore(localAddr)
-
-	g.RelayHandler = newRelayHandler()
-
-	// Use a lock here avoids starvation, at least on my Linux machine.
-	sendLock := sync.Mutex{}
-	g.SendUDP = func(b []byte, addr netip.AddrPort) (int, error) {
-		sendLock.Lock()
-		n, err := conn.WriteToUDPAddrPort(b, addr)
-		sendLock.Unlock()
-		return n, err
-	}
-
-	g.IFace = iface
-
-	traceID := (uint64(g.StartupCount) << 48) + 1
-	g.NewTraceID = func() uint64 {
-		return atomic.AddUint64(&traceID, 1)
-	}
-
-	for i := range g.RemotePeers {
-		g.RemotePeers[i] = &atomic.Pointer[Remote]{}
-	}
-
-	for i := range g.RemotePeers {
-		g.RemotePeers[i].Store(newRemote(g, byte(i)))
-	}
-
-	return g
-}

peer/header.go

@@ -1,47 +0,0 @@
-package peer
-
-import "unsafe"
-
-// ----------------------------------------------------------------------------
-
-const (
-	headerSize        = 12
-	controlHeaderSize = 24
-	dataHeaderSize    = 12
-
-	dataStreamID    = 1
-	controlStreamID = 2
-)
-
-type Header struct {
-	Version  byte
-	StreamID byte
-	SourceIP byte
-	DestIP   byte
-	Counter  uint64 // Init with time.Now().Unix << 30 to ensure monotonic.
-}
-
-func parseHeader(b []byte) (h Header) {
-	h.Version = b[0]
-	h.StreamID = b[1]
-	h.SourceIP = b[2]
-	h.DestIP = b[3]
-	h.Counter = *(*uint64)(unsafe.Pointer(&b[4]))
-	return h
-}
-
-func (h *Header) Parse(b []byte) {
-	h.Version = b[0]
-	h.StreamID = b[1]
-	h.SourceIP = b[2]
-	h.DestIP = b[3]
-	h.Counter = *(*uint64)(unsafe.Pointer(&b[4]))
-}
-
-func (h *Header) Marshal(buf []byte) {
-	buf[0] = h.Version
-	buf[1] = h.StreamID
-	buf[2] = h.SourceIP
-	buf[3] = h.DestIP
-	*(*uint64)(unsafe.Pointer(&buf[4])) = h.Counter
-}

peer/hubpoller.go

@@ -1,111 +0,0 @@
-package peer
-
-import (
-	"encoding/json"
-	"io"
-	"log"
-	"net/http"
-	"net/url"
-	"time"
-	"vppn/m"
-)
-
-type HubPoller struct {
-	Globals
-	client   *http.Client
-	req      *http.Request
-	versions [256]int64
-	netName  string
-}
-
-func NewHubPoller(
-	g Globals,
-	netName,
-	hubURL,
-	apiKey string,
-) (*HubPoller, error) {
-	u, err := url.Parse(hubURL)
-	if err != nil {
-		return nil, err
-	}
-	u.Path = "/peer/fetch-state/"
-
-	client := &http.Client{Timeout: 8 * time.Second}
-
-	req := &http.Request{
-		Method: http.MethodGet,
-		URL:    u,
-		Header: http.Header{},
-	}
-	req.SetBasicAuth("", apiKey)
-
-	return &HubPoller{
-		Globals: g,
-		client:  client,
-		req:     req,
-		netName: netName,
-	}, nil
-}
-
-func (hp *HubPoller) logf(s string, args ...any) {
-	log.Printf("[HubPoller] "+s, args...)
-}
-
-func (hp *HubPoller) Run() {
-	state, err := loadNetworkState(hp.netName)
-	if err != nil {
-		hp.logf("Failed to load network state: %v", err)
-		hp.logf("Polling hub...")
-		hp.pollHub()
-	} else {
-		hp.applyNetworkState(state)
-	}
-
-	for range time.Tick(64 * time.Second) {
-		hp.pollHub()
-	}
-}
-
-func (hp *HubPoller) pollHub() {
-	var state m.NetworkState
-
-	resp, err := hp.client.Do(hp.req)
-	if err != nil {
-		hp.logf("Failed to fetch peer state: %v", err)
-		return
-	}
-	body, err := io.ReadAll(resp.Body)
-	_ = resp.Body.Close()
-	if err != nil {
-		hp.logf("Failed to read body from hub: %v", err)
-		return
-	}
-
-	if err := json.Unmarshal(body, &state); err != nil {
-		hp.logf("Failed to unmarshal response from hub: %v\n%s", err, body)
-		return
-	}
-
-	if err := storeNetworkState(hp.netName, state); err != nil {
-		hp.logf("Failed to store network state: %v", err)
-	}
-
-	hp.applyNetworkState(state)
-}
-
-func (hp *HubPoller) applyNetworkState(state m.NetworkState) {
-	for i, peer := range state.Peers {
-		if i == int(hp.LocalPeerIP) {
-			continue
-		}
-
-		if peer != nil && peer.Version == hp.versions[i] {
-			continue
-		}
-
-		hp.RemotePeers[i].Load().HandlePeerUpdate(peerUpdateMsg{Peer: state.Peers[i]})
-		if peer != nil {
-			hp.versions[i] = peer.Version
-		}
-	}
-}

peer/ifreader.go

@@ -1,73 +0,0 @@
-package peer
-
-import (
-	"log"
-)
-
-type IFReader struct {
-	Globals
-}
-
-func NewIFReader(g Globals) *IFReader {
-	return &IFReader{Globals: g}
-}
-
-func (r *IFReader) Run() {
-	packet := make([]byte, bufferSize)
-	for {
-		r.handleNextPacket(packet)
-	}
-}
-
-func (r *IFReader) handleNextPacket(packet []byte) {
-	packet = r.readNextPacket(packet)
-	remoteIP, ok := r.parsePacket(packet)
-	if !ok {
-		return
-	}
-	r.RemotePeers[remoteIP].Load().SendDataTo(packet)
-}
-
-func (r *IFReader) readNextPacket(buf []byte) []byte {
-	n, err := r.IFace.Read(buf[:cap(buf)])
-	if err != nil {
-		log.Fatalf("Failed to read from interface: %v", err)
-	}
-
-	return buf[:n]
-}
-
-// parsePacket returns the VPN ip for the packet, and a boolean indicating
-// success.
-func (r *IFReader) parsePacket(buf []byte) (byte, bool) {
-	n := len(buf)
-	if n == 0 {
-		return 0, false
-	}
-
-	version := buf[0] >> 4
-
-	switch version {
-	case 4:
-		if n < 20 {
-			r.logf("Short IPv4 packet: %d", len(buf))
-			return 0, false
-		}
-		return buf[19], true
-
-	case 6:
-		if len(buf) < 40 {
-			r.logf("Short IPv6 packet: %d", len(buf))
-			return 0, false
-		}
-		return buf[39], true
-
-	default:
-		r.logf("Invalid IP packet version: %v", version)
-		return 0, false
-	}
-}
-
-func (*IFReader) logf(s string, args ...any) {
-	log.Printf("[IFReader] "+s, args...)
-}

peer/ifreader_test.go

@@ -1,81 +0,0 @@
-package peer
-
-/*
-func TestIFReader_IPv4(t *testing.T) {
-	p1, p2, _ := NewPeersForTesting()
-
-	pkt := make([]byte, 1234)
-	pkt[0] = 4 << 4
-	pkt[19] = 2 // IP.
-
-	p1.IFace.UserWrite(pkt)
-	p1.IFReader.handleNextPacket(newBuf())
-
-	packets := p2.Conn.Packets()
-	if len(packets) != 1 {
-		t.Fatal(packets)
-	}
-}
-
-func TestIFReader_IPv6(t *testing.T) {
-	p1, p2, _ := NewPeersForTesting()
-
-	pkt := make([]byte, 1234)
-	pkt[0] = 6 << 4
-	pkt[39] = 2 // IP.
-
-	p1.IFace.UserWrite(pkt)
-	p1.IFReader.handleNextPacket(newBuf())
-
-	packets := p2.Conn.Packets()
-	if len(packets) != 1 {
-		t.Fatal(packets)
-	}
-}
-
-func TestIFReader_parsePacket_emptyPacket(t *testing.T) {
-	r := NewIFReader(nil, nil)
-	pkt := make([]byte, 0)
-	if ip, ok := r.parsePacket(pkt); ok {
-		t.Fatal(ip, ok)
-	}
-}
-
-func TestIFReader_parsePacket_invalidIPVersion(t *testing.T) {
-	r := NewIFReader(nil, nil)
-
-	for i := byte(1); i < 16; i++ {
-		if i == 4 || i == 6 {
-			continue
-		}
-		pkt := make([]byte, 1234)
-		pkt[0] = i << 4
-
-		if ip, ok := r.parsePacket(pkt); ok {
-			t.Fatal(i, ip, ok)
-		}
-	}
-}
-
-func TestIFReader_parsePacket_shortIPv4(t *testing.T) {
-	r := NewIFReader(nil, nil)
-
-	pkt := make([]byte, 19)
-	pkt[0] = 4 << 4
-
-	if ip, ok := r.parsePacket(pkt); ok {
-		t.Fatal(ip, ok)
-	}
-}
-
-func TestIFReader_parsePacket_shortIPv6(t *testing.T) {
-	r := NewIFReader(nil, nil)
-
-	pkt := make([]byte, 39)
-	pkt[0] = 6 << 4
-
-	if ip, ok := r.parsePacket(pkt); ok {
-		t.Fatal(ip, ok)
-	}
-}
-*/

peer/main.go

@@ -1,23 +0,0 @@
-package peer
-
-import (
-	"flag"
-	"os"
-)
-
-func Main() {
-	args := mainArgs{}
-
-	flag.StringVar(&args.NetName, "name", "", "[REQUIRED] The network name.")
-	flag.StringVar(&args.HubAddress, "hub-address", "", "[REQUIRED] The hub address.")
-	flag.StringVar(&args.APIKey, "api-key", "", "[REQUIRED] The node's API key.")
-	flag.Parse()
-
-	if args.NetName == "" || args.HubAddress == "" || args.APIKey == "" {
-		flag.Usage()
-		os.Exit(1)
-	}
-
-	peer := newPeerMain(args)
-	peer.Run()
-}

peer/main_test.go

@@ -1,5 +0,0 @@
-package peer
-
-func newBuf() []byte {
-	return make([]byte, bufferSize)
-}

peer/mcreader.go

@@ -1,47 +0,0 @@
-package peer
-
-import (
-	"log"
-	"net"
-	"time"
-)
-
-func RunMCReader(g Globals) {
-	for {
-		runMCReaderInner(g)
-		time.Sleep(broadcastErrorTimeoutInterval)
-	}
-}
-
-func runMCReaderInner(g Globals) {
-	var (
-		buf  = make([]byte, bufferSize)
-		logf = func(s string, args ...any) {
-			log.Printf("[MCReader] "+s, args...)
-		}
-	)
-
-	conn, err := net.ListenMulticastUDP("udp", nil, multicastAddr)
-	if err != nil {
-		logf("Failed to bind to multicast address: %v", err)
-		return
-	}
-
-	for {
-		conn.SetReadDeadline(time.Now().Add(32 * time.Second))
-		n, remoteAddr, err := conn.ReadFromUDPAddrPort(buf[:bufferSize])
-		if err != nil {
-			logf("Failed to read from UDP port): %v", err)
-			return
-		}
-
-		buf = buf[:n]
-		h, ok := headerFromLocalDiscoveryPacket(buf)
-		if !ok {
-			logf("Failed to open discovery packet?")
-			continue
-		}
-
-		g.RemotePeers[h.SourceIP].Load().HandleLocalDiscoveryPacket(h, remoteAddr, buf)
-	}
-}

peer/mcreader_test.go

@@ -1,132 +0,0 @@
-package peer
-
-/*
-type mcMockConn struct {
-	packets chan []byte
-}
-
-func newMCMockConn() *mcMockConn {
-	return &mcMockConn{make(chan []byte, 32)}
-}
-
-func (c *mcMockConn) WriteToUDP(in []byte, addr *net.UDPAddr) (int, error) {
-	c.packets <- bytes.Clone(in)
-	return len(in), nil
-}
-
-func (c *mcMockConn) ReadFromUDPAddrPort(b []byte) (n int, addr netip.AddrPort, err error) {
-	buf := <-c.packets
-	b = b[:len(buf)]
-	copy(b, buf)
-	return len(b), netip.AddrPort{}, nil
-}
-
-func TestMCReader(t *testing.T) {
-	keys := generateKeys()
-	super := &mockControlMsgHandler{}
-	conn := newMCMockConn()
-
-	peers := [256]*atomic.Pointer[RemotePeer]{}
-	peer := &RemotePeer{
-		IP:         1,
-		Up:         true,
-		PubSignKey: keys.PubSignKey,
-	}
-	peers[1] = &atomic.Pointer[RemotePeer]{}
-	peers[1].Store(peer)
-
-	w := newMCWriter(conn, 1, keys.PrivSignKey)
-	r := newMCReader(conn, super, peers)
-
-	w.SendLocalDiscovery()
-	r.handleNextPacket()
-
-	if len(super.Messages) != 1 {
-		t.Fatal(super.Messages)
-	}
-	msg, ok := super.Messages[0].(controlMsg[PacketLocalDiscovery])
-	if !ok || msg.SrcIP != 1 {
-		t.Fatal(ok, msg)
-	}
-}
-
-func TestMCReader_noHeader(t *testing.T) {
-	keys := generateKeys()
-	super := &mockControlMsgHandler{}
-	conn := newMCMockConn()
-
-	peers := [256]*atomic.Pointer[RemotePeer]{}
-	peer := &RemotePeer{
-		IP:         1,
-		Up:         true,
-		PubSignKey: keys.PubSignKey,
-	}
-	peers[1] = &atomic.Pointer[RemotePeer]{}
-	peers[1].Store(peer)
-
-	r := newMCReader(conn, super, peers)
-	conn.WriteToUDP([]byte("0123546789"), nil)
-	r.handleNextPacket()
-
-	if len(super.Messages) != 0 {
-		t.Fatal(super.Messages)
-	}
-}
-
-func TestMCReader_noPeer(t *testing.T) {
-	keys := generateKeys()
-	super := &mockControlMsgHandler{}
-	conn := newMCMockConn()
-
-	peers := [256]*atomic.Pointer[RemotePeer]{}
-	peer := &RemotePeer{
-		IP:         1,
-		Up:         true,
-		PubSignKey: keys.PubSignKey,
-	}
-	peers[1] = &atomic.Pointer[RemotePeer]{}
-	peers[2] = &atomic.Pointer[RemotePeer]{}
-	peers[1].Store(peer)
-
-	w := newMCWriter(conn, 2, keys.PrivSignKey)
-	r := newMCReader(conn, super, peers)
-
-	w.SendLocalDiscovery()
-	r.handleNextPacket()
-
-	if len(super.Messages) != 0 {
-		t.Fatal(super.Messages)
-	}
-}
-
-func TestMCReader_badSignature(t *testing.T) {
-	keys := generateKeys()
-	super := &mockControlMsgHandler{}
-	conn := newMCMockConn()
-
-	peers := [256]*atomic.Pointer[RemotePeer]{}
-	peer := &RemotePeer{
-		IP:         1,
-		Up:         true,
-		PubSignKey: keys.PubSignKey,
-	}
-	peers[1] = &atomic.Pointer[RemotePeer]{}
-	peers[1].Store(peer)
-
-	w := newMCWriter(conn, 1, keys.PrivSignKey)
-	w.SendLocalDiscovery()
-
-	// Break signing.
-	packet := <-conn.packets
-	packet[0]++
-	conn.packets <- packet
-
-	r := newMCReader(conn, super, peers)
-
-	r.handleNextPacket()
-
-	if len(super.Messages) != 0 {
-		t.Fatal(super.Messages)
-	}
-}
-*/

peer/mcwriter.go

@@ -1,54 +0,0 @@
-package peer
-
-import (
-	"log"
-	"net"
-	"time"
-
-	"golang.org/x/crypto/nacl/sign"
-)
-
-func createLocalDiscoveryPacket(localIP byte, signingKey []byte) []byte {
-	h := Header{
-		SourceIP: localIP,
-		DestIP:   255,
-	}
-	buf := make([]byte, headerSize)
-	h.Marshal(buf)
-	out := make([]byte, headerSize+signOverhead)
-	return sign.Sign(out[:0], buf, (*[64]byte)(signingKey))
-}
-
-func headerFromLocalDiscoveryPacket(pkt []byte) (h Header, ok bool) {
-	if len(pkt) != headerSize+signOverhead {
-		return
-	}
-
-	h.Parse(pkt[signOverhead:])
-	ok = true
-	return
-}
-
-func verifyLocalDiscoveryPacket(pkt, buf []byte, pubSignKey []byte) bool {
-	_, ok := sign.Open(buf[:0], pkt, (*[32]byte)(pubSignKey))
-	return ok
-}
-
-// ----------------------------------------------------------------------------
-
-func RunMCWriter(localIP byte, signingKey []byte) {
-	discoveryPacket := createLocalDiscoveryPacket(localIP, signingKey)
-
-	conn, err := net.ListenMulticastUDP("udp", nil, multicastAddr)
-	if err != nil {
-		log.Fatalf("[MCWriter] Failed to bind to multicast address: %v", err)
-	}
-
-	for range time.Tick(broadcastInterval) {
-		log.Printf("[MCWriter] Broadcasting on %v...", multicastAddr)
-		_, err := conn.WriteToUDP(discoveryPacket, multicastAddr)
-		if err != nil {
-			log.Printf("[MCWriter] Failed to write multicast: %v", err)
-		}
-	}
-}

peer/mcwriter_test.go

@@ -1,98 +0,0 @@
-package peer
-
-/*
-// ----------------------------------------------------------------------------
-
-// Testing that we can create and verify a local discovery packet.
-func TestVerifyLocalDiscoveryPacket_valid(t *testing.T) {
-	keys := generateKeys()
-
-	created := createLocalDiscoveryPacket(55, keys.PrivSignKey)
-
-	header, ok := headerFromLocalDiscoveryPacket(created)
-	if !ok {
-		t.Fatal(ok)
-	}
-	if header.SourceIP != 55 || header.DestIP != 255 {
-		t.Fatal(header)
-	}
-
-	if !verifyLocalDiscoveryPacket(created, make([]byte, 1024), keys.PubSignKey) {
-		t.Fatal("Not valid")
-	}
-}
-
-// Testing that we don't try to parse short packets.
-func TestVerifyLocalDiscoveryPacket_tooShort(t *testing.T) {
-	keys := generateKeys()
-
-	created := createLocalDiscoveryPacket(55, keys.PrivSignKey)
-
-	_, ok := headerFromLocalDiscoveryPacket(created[:len(created)-1])
-	if ok {
-		t.Fatal(ok)
-	}
-}
-
-// Testing that modifying a packet makes it invalid.
-func TestVerifyLocalDiscoveryPacket_invalid(t *testing.T) {
-	keys := generateKeys()
-
-	created := createLocalDiscoveryPacket(55, keys.PrivSignKey)
-	buf := make([]byte, 1024)
-	for i := range created {
-		modified := bytes.Clone(created)
-		modified[i]++
-		if verifyLocalDiscoveryPacket(modified, buf, keys.PubSignKey) {
-			t.Fatal("Verification should have failed.")
-		}
-	}
-}
-
-// ----------------------------------------------------------------------------
-
-type testUDPWriter struct {
-	written [][]byte
-}
-
-func (w *testUDPWriter) WriteToUDP(b []byte, addr *net.UDPAddr) (int, error) {
-	w.written = append(w.written, bytes.Clone(b))
-	return len(b), nil
-}
-
-func (w *testUDPWriter) Written() [][]byte {
-	out := w.written
-	w.written = [][]byte{}
-	return out
-}
-
-// ----------------------------------------------------------------------------
-
-// Testing that the mcWriter sends local discovery packets as expected.
-func TestMCWriter_SendLocalDiscovery(t *testing.T) {
-	keys := generateKeys()
-	writer := &testUDPWriter{}
-
-	mcw := newMCWriter(writer, 42, keys.PrivSignKey)
-	mcw.SendLocalDiscovery()
-
-	out := writer.Written()
-	if len(out) != 1 {
-		t.Fatal(out)
-	}
-
-	pkt := out[0]
-
-	header, ok := headerFromLocalDiscoveryPacket(pkt)
-	if !ok {
-		t.Fatal(ok)
-	}
-	if header.SourceIP != 42 || header.DestIP != 255 {
-		t.Fatal(header)
-	}
-
-	if !verifyLocalDiscoveryPacket(pkt, make([]byte, 1024), keys.PubSignKey) {
-		t.Fatal("Verification should succeed.")
-	}
-}
-*/

peer/mock-iface_test.go

@@ -1,31 +0,0 @@
-package peer
-
-import "bytes"
-
-type TestIFace struct {
-	out *bytes.Buffer // Toward the network.
-	in  *bytes.Buffer // From the network
-}
-
-func NewTestIFace() *TestIFace {
-	return &TestIFace{
-		out: &bytes.Buffer{},
-		in:  &bytes.Buffer{},
-	}
-}
-
-func (iface *TestIFace) Write(b []byte) (int, error) {
-	return iface.in.Write(b)
-}
-
-func (iface *TestIFace) Read(b []byte) (int, error) {
-	return iface.out.Read(b)
-}
-
-func (iface *TestIFace) UserWrite(b []byte) (int, error) {
-	return iface.out.Write(b)
-}
-
-func (iface *TestIFace) UserRead(b []byte) (int, error) {
-	return iface.in.Read(b)
-}

peer/mock-network_test.go

@@ -1,80 +0,0 @@
-package peer
-
-import (
-	"bytes"
-	"net"
-	"net/netip"
-	"sync"
-)
-
-type TestPacket struct {
-	Addr netip.AddrPort
-	Data []byte
-}
-
-type TestNetwork struct {
-	lock    sync.Mutex
-	packets map[netip.AddrPort]chan TestPacket
-}
-
-func NewTestNetwork() *TestNetwork {
-	return &TestNetwork{packets: map[netip.AddrPort]chan TestPacket{}}
-}
-
-func (n *TestNetwork) NewUDPConn(localAddr netip.AddrPort) *TestUDPConn {
-	n.lock.Lock()
-	defer n.lock.Unlock()
-	if _, ok := n.packets[localAddr]; !ok {
-		n.packets[localAddr] = make(chan TestPacket, 1024)
-	}
-	return &TestUDPConn{
-		addr:    localAddr,
-		n:       n,
-		packets: n.packets[localAddr],
-	}
-}
-
-func (n *TestNetwork) write(b []byte, from, to netip.AddrPort) {
-	n.lock.Lock()
-	defer n.lock.Unlock()
-	if _, ok := n.packets[to]; !ok {
-		n.packets[to] = make(chan TestPacket, 1024)
-	}
-	n.packets[to] <- TestPacket{
-		Addr: from,
-		Data: bytes.Clone(b),
-	}
-}
-
-type TestUDPConn struct {
-	addr    netip.AddrPort
-	n       *TestNetwork
-	packets chan TestPacket
-}
-
-func (c *TestUDPConn) WriteToUDPAddrPort(b []byte, addr netip.AddrPort) (int, error) {
-	c.n.write(b, c.addr, addr)
-	return len(b), nil
-}
-
-func (c *TestUDPConn) WriteToUDP(b []byte, addr *net.UDPAddr) (int, error) {
-	return c.WriteToUDPAddrPort(b, addr.AddrPort())
-}
-
-func (c *TestUDPConn) ReadFromUDPAddrPort(b []byte) (n int, addr netip.AddrPort, err error) {
-	pkt := <-c.packets
-	b = b[:len(pkt.Data)]
-	copy(b, pkt.Data)
-	return len(b), pkt.Addr, nil
-}
-
-func (c *TestUDPConn) Packets() (out []TestPacket) {
-	for {
-		select {
-		case pkt := <-c.packets:
-			out = append(out, pkt)
-		default:
-			return
-		}
-	}
-}

peer/packets-util_test.go

@@ -1,76 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"reflect"
-	"testing"
-)
-
-func TestBinWriteRead_invalidAddrPort(t *testing.T) {
-	addr := netip.AddrPort{}
-	buf := make([]byte, 1024)
-	buf = newBinWriter(buf).
-		AddrPort(addr).
-		Build()
-
-	var addr2 netip.AddrPort
-	err := newBinReader(buf).
-		AddrPort(&addr2).
-		Error()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if addr2.IsValid() {
-		t.Fatal(addr, addr2)
-	}
-}
-
-func TestBinWriteRead(t *testing.T) {
-	buf := make([]byte, 1024)
-
-	type Item struct {
-		Type     byte
-		TraceID  uint64
-		Addrs    [8]netip.AddrPort
-		DestAddr netip.AddrPort
-	}
-
-	in := Item{
-		1,
-		2,
-		[8]netip.AddrPort{},
-		netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 2, 3, 4}), 22),
-	}
-
-	in.Addrs[0] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{0, 1, 2, 3}), 20)
-	in.Addrs[2] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{2, 3, 4, 5}), 22)
-	in.Addrs[3] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{2, 3, 4, 3}), 23)
-	in.Addrs[4] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{2, 3, 4, 4}), 24)
-	in.Addrs[5] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{2, 3, 4, 5}), 25)
-	in.Addrs[6] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{2, 3, 4, 6}), 26)
-	in.Addrs[7] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{7, 8, 9, 7}), 27)
-
-	buf = newBinWriter(buf).
-		Byte(in.Type).
-		Uint64(in.TraceID).
-		AddrPort(in.DestAddr).
-		AddrPort8(in.Addrs).
-		Build()
-
-	out := Item{}
-
-	err := newBinReader(buf).
-		Byte(&out.Type).
-		Uint64(&out.TraceID).
-		AddrPort(&out.DestAddr).
-		AddrPort8(&out.Addrs).
-		Error()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !reflect.DeepEqual(in, out) {
-		t.Fatal(in, out)
-	}
-}

peer/packets.go

@@ -1,120 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-)
-
-const (
-	packetTypeSyn           = 1
-	packetTypeInit          = 2
-	packetTypeAck           = 3
-	packetTypeProbe         = 4
-	packetTypeAddrDiscovery = 5
-)
-
-// ----------------------------------------------------------------------------
-
-type packetInit struct {
-	TraceID uint64
-	Direct  bool
-	Version uint64
-}
-
-func (p packetInit) Marshal(buf []byte) []byte {
-	return newBinWriter(buf).
-		Byte(packetTypeInit).
-		Uint64(p.TraceID).
-		Bool(p.Direct).
-		Uint64(p.Version).
-		Build()
-}
-
-func parsePacketInit(buf []byte) (p packetInit, err error) {
-	err = newBinReader(buf[1:]).
-		Uint64(&p.TraceID).
-		Bool(&p.Direct).
-		Uint64(&p.Version).
-		Error()
-	return
-}
-
-// ----------------------------------------------------------------------------
-
-type packetSyn struct {
-	TraceID       uint64   // TraceID to match response w/ request.
-	SharedKey     [32]byte // Our shared key.
-	Direct        bool
-	PossibleAddrs [8]netip.AddrPort // Possible public addresses of the sender.
-}
-
-func (p packetSyn) Marshal(buf []byte) []byte {
-	return newBinWriter(buf).
-		Byte(packetTypeSyn).
-		Uint64(p.TraceID).
-		SharedKey(p.SharedKey).
-		Bool(p.Direct).
-		AddrPort8(p.PossibleAddrs).
-		Build()
-}
-
-func parsePacketSyn(buf []byte) (p packetSyn, err error) {
-	err = newBinReader(buf[1:]).
-		Uint64(&p.TraceID).
-		SharedKey(&p.SharedKey).
-		Bool(&p.Direct).
-		AddrPort8(&p.PossibleAddrs).
-		Error()
-	return
-}
-
-// ----------------------------------------------------------------------------
-
-type packetAck struct {
-	TraceID       uint64
-	ToAddr        netip.AddrPort
-	PossibleAddrs [8]netip.AddrPort // Possible public addresses of the sender.
-}
-
-func (p packetAck) Marshal(buf []byte) []byte {
-	return newBinWriter(buf).
-		Byte(packetTypeAck).
-		Uint64(p.TraceID).
-		AddrPort(p.ToAddr).
-		AddrPort8(p.PossibleAddrs).
-		Build()
-}
-
-func parsePacketAck(buf []byte) (p packetAck, err error) {
-	err = newBinReader(buf[1:]).
-		Uint64(&p.TraceID).
-		AddrPort(&p.ToAddr).
-		AddrPort8(&p.PossibleAddrs).
-		Error()
-	return
-}
-
-// ----------------------------------------------------------------------------
-
-// A probeReqPacket is sent from a client to a server to determine if direct
-// UDP communication can be used.
-type packetProbe struct {
-	TraceID uint64
-}
-
-func (p packetProbe) Marshal(buf []byte) []byte {
-	return newBinWriter(buf).
-		Byte(packetTypeProbe).
-		Uint64(p.TraceID).
-		Build()
-}
-
-func parsePacketProbe(buf []byte) (p packetProbe, err error) {
-	err = newBinReader(buf[1:]).
-		Uint64(&p.TraceID).
-		Error()
-	return
-}
-
-// ----------------------------------------------------------------------------
-
-type packetLocalDiscovery struct{}

peer/packets_test.go

@@ -1,64 +0,0 @@
-package peer
-
-import (
-	"crypto/rand"
-	"net/netip"
-	"reflect"
-	"testing"
-)
-
-func TestSynPacket(t *testing.T) {
-	p := packetSyn{
-		TraceID: 2342342345,
-		Direct:  true,
-	}
-	rand.Read(p.SharedKey[:])
-
-	p.PossibleAddrs[0] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 2, 3, 4}), 234)
-	p.PossibleAddrs[1] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{2, 2, 3, 4}), 12399)
-	p.PossibleAddrs[2] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{3, 2, 3, 4}), 60000)
-
-	buf := p.Marshal(newBuf())
-	p2, err := parsePacketSyn(buf)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(p, p2) {
-		t.Fatal(p2)
-	}
-}
-
-func TestAckPacket(t *testing.T) {
-	p := packetAck{
-		TraceID: 123213,
-		ToAddr:  netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 2, 3, 4}), 234),
-	}
-
-	p.PossibleAddrs[0] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{8, 2, 3, 4}), 100)
-	p.PossibleAddrs[1] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{2, 2, 3, 4}), 12399)
-	p.PossibleAddrs[2] = netip.AddrPortFrom(netip.AddrFrom4([4]byte{3, 2, 3, 4}), 60000)
-
-	buf := p.Marshal(newBuf())
-	p2, err := parsePacketAck(buf)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(p, p2) {
-		t.Fatal(p2)
-	}
-}
-
-func TestProbePacket(t *testing.T) {
-	p := packetProbe{
-		TraceID: 12345,
-	}
-
-	buf := p.Marshal(newBuf())
-	p2, err := parsePacketProbe(buf)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(p, p2) {
-		t.Fatal(p2)
-	}
-}

peer/peer.go

@@ -1,188 +0,0 @@
-package peer
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"log"
-	"math"
-	"net"
-	"net/http"
-	"net/netip"
-	"net/url"
-	"os"
-	"vppn/m"
-)
-
-type peerMain struct {
-	Globals
-	ifReader   *IFReader
-	connReader *ConnReader
-	hubPoller  *HubPoller
-}
-
-type mainArgs struct {
-	NetName    string
-	HubAddress string
-	APIKey     string
-}
-
-func newPeerMain(args mainArgs) *peerMain {
-	logf := func(s string, args ...any) {
-		log.Printf("[Main] "+s, args...)
-	}
-
-	config, err := loadPeerConfig(args.NetName)
-	if err != nil {
-		logf("Failed to load configuration: %v", err)
-		logf("Initializing...")
-		initPeerWithHub(args)
-
-		config, err = loadPeerConfig(args.NetName)
-		if err != nil {
-			log.Fatalf("Failed to load configuration: %v", err)
-		}
-	}
-
-	state, err := loadNetworkState(args.NetName)
-	if err != nil {
-		log.Fatalf("Failed to load network state: %v", err)
-	}
-
-	startupCount, err := loadStartupCount(args.NetName)
-	if err != nil {
-		if !os.IsNotExist(err) {
-			log.Fatalf("Failed to load startup count: %v", err)
-		}
-	}
-
-	if startupCount.Count == math.MaxUint16 {
-		log.Fatalf("Startup counter overflow.")
-	}
-	startupCount.Count += 1
-
-	if err := storeStartupCount(args.NetName, startupCount); err != nil {
-		log.Fatalf("Failed to write startup count: %v", err)
-	}
-
-	iface, err := openInterface(config.Network, config.LocalPeerIP, args.NetName)
-	if err != nil {
-		log.Fatalf("Failed to open interface: %v", err)
-	}
-
-	localPeer := state.Peers[config.LocalPeerIP]
-
-	myAddr, err := net.ResolveUDPAddr("udp", fmt.Sprintf(":%d", localPeer.Port))
-	if err != nil {
-		log.Fatalf("Failed to resolve UDP address: %v", err)
-	}
-
-	logf("Listening on %v...", myAddr)
-	conn, err := net.ListenUDP("udp", myAddr)
-	if err != nil {
-		log.Fatalf("Failed to open UDP port: %v", err)
-	}
-
-	conn.SetReadBuffer(1024 * 1024 * 8)
-	conn.SetWriteBuffer(1024 * 1024 * 8)
-
-	var localAddr netip.AddrPort
-	ip, localAddrValid := netip.AddrFromSlice(localPeer.PublicIP)
-	if localAddrValid {
-		localAddr = netip.AddrPortFrom(ip, localPeer.Port)
-	}
-
-	g := NewGlobals(config, startupCount, localAddr, conn, iface)
-
-	hubPoller, err := NewHubPoller(g, args.NetName, args.HubAddress, args.APIKey)
-	if err != nil {
-		log.Fatalf("Failed to create hub poller: %v", err)
-	}
-
-	return &peerMain{
-		Globals:    g,
-		ifReader:   NewIFReader(g),
-		connReader: NewConnReader(g, conn),
-		hubPoller:  hubPoller,
-	}
-}
-
-func (p *peerMain) Run() {
-	for i := range p.RemotePeers {
-		remote := p.RemotePeers[i].Load()
-		go newRemoteFSM(remote).Run()
-	}
-
-	go p.ifReader.Run()
-	go p.connReader.Run()
-
-	if !p.LocalAddrValid {
-		go RunMCWriter(p.LocalPeerIP, p.PrivSignKey)
-		go RunMCReader(p.Globals)
-	}
-
-	go p.hubPoller.Run()
-
-	select {}
-}
-
-func initPeerWithHub(args mainArgs) {
-	keys := generateKeys()
-
-	initURL, err := url.Parse(args.HubAddress)
-	if err != nil {
-		log.Fatalf("Failed to parse hub URL: %v", err)
-	}
-	initURL.Path = "/peer/init/"
-
-	initArgs := m.PeerInitArgs{
-		EncPubKey:  keys.PubKey,
-		PubSignKey: keys.PubSignKey,
-	}
-
-	buf := &bytes.Buffer{}
-	if err := json.NewEncoder(buf).Encode(initArgs); err != nil {
-		log.Fatalf("Failed to encode init args: %v", err)
-	}
-
-	req, err := http.NewRequest(http.MethodPost, initURL.String(), buf)
-	if err != nil {
-		log.Fatalf("Failed to construct request: %v", err)
-	}
-	req.SetBasicAuth("", args.APIKey)
-
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		log.Fatalf("Failed to init with hub: %v", err)
-	}
-	defer resp.Body.Close()
-
-	data, err := io.ReadAll(resp.Body)
-	if err != nil {
-		log.Fatalf("Failed to read response body: %v", err)
-	}
-
-	initResp := m.PeerInitResp{}
-	if err := json.Unmarshal(data, &initResp); err != nil {
-		log.Fatalf("Failed to parse configuration: %v\n%s", err, data)
-	}
-
-	config := LocalConfig{}
-	config.LocalPeerIP = initResp.PeerIP
-	config.Network = initResp.Network
-	config.PubKey = keys.PubKey
-	config.PrivKey = keys.PrivKey
-	config.PubSignKey = keys.PubSignKey
-	config.PrivSignKey = keys.PrivSignKey
-
-	if err := storeNetworkState(args.NetName, initResp.NetworkState); err != nil {
-		log.Fatalf("Failed to store network state: %v", err)
-	}
-
-	if err := storePeerConfig(args.NetName, config); err != nil {
-		log.Fatalf("Failed to store configuration: %v", err)
-	}
-
-	log.Print("Initialization successful.")
-}

peer/peerfsm.dot

@@ -1,28 +0,0 @@
-digraph d {
-        disconnected -> peerUpdating;
-        peerUpdating -> disconnected;
-        peerUpdating -> server;
-        peerUpdating -> clientInit;
-        server -> peerUpdating;
-        clientInit -> peerUpdating;
-        clientInit -> clientInit;
-        clientInit -> client;
-        client -> clientInit;
-        client -> peerUpdating;
-
-        clientInitializing -> clientSyncing;
-        clientSyncing -> clientInitializing;
-        clientSyncing -> clientUpIndirect;
-        clientSyncing -> clientUpDirect;
-        clientUpIndirect -> clientUpDirect;
-        clientUpIndirect -> clientInitializing;
-        clientUpDirect -> clientInitializing;
-
-        serverInitializing -> serverSyncing;
-        serverSyncing -> serverInitializing;
-        serverSyncing -> serverUpIndirect;
-        serverSyncing -> serverUpDirect;
-        serverUpIndirect -> serverUpDirect;
-        serverUpIndirect -> serverInitializing;
-        serverUpDirect -> serverInitializing;
-}

peer/pubaddrs.go

@@ -1,86 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"sort"
-	"sync"
-	"time"
-)
-
-type pubAddrStore struct {
-	lock      sync.Mutex
-	localPub  bool
-	localAddr netip.AddrPort
-	lastSeen  map[netip.AddrPort]time.Time
-	addrList  []netip.AddrPort
-}
-
-func newPubAddrStore(localAddr netip.AddrPort) *pubAddrStore {
-	return &pubAddrStore{
-		localPub:  localAddr.IsValid(),
-		localAddr: localAddr,
-		lastSeen:  map[netip.AddrPort]time.Time{},
-		addrList:  make([]netip.AddrPort, 0, 32),
-	}
-}
-
-func (store *pubAddrStore) Store(addr netip.AddrPort) {
-	if store.localPub {
-		return
-	}
-
-	if !addr.IsValid() {
-		return
-	}
-
-	if addr.Addr().IsPrivate() {
-		return
-	}
-
-	store.lock.Lock()
-	defer store.lock.Unlock()
-
-	if _, exists := store.lastSeen[addr]; !exists {
-		store.addrList = append(store.addrList, addr)
-	}
-	store.lastSeen[addr] = time.Now()
-	store.sort()
-}
-
-func (store *pubAddrStore) Get() (addrs [8]netip.AddrPort) {
-	store.lock.Lock()
-	defer store.lock.Unlock()
-
-	store.clean()
-
-	if store.localPub {
-		addrs[0] = store.localAddr
-		return
-	}
-
-	copy(addrs[:], store.addrList)
-	return
-}
-
-func (store *pubAddrStore) clean() {
-	if store.localPub {
-		return
-	}
-
-	for ip, lastSeen := range store.lastSeen {
-		if time.Since(lastSeen) > timeoutInterval {
-			delete(store.lastSeen, ip)
-		}
-	}
-	store.addrList = store.addrList[:0]
-	for ip := range store.lastSeen {
-		store.addrList = append(store.addrList, ip)
-	}
-	store.sort()
-}
-
-func (store *pubAddrStore) sort() {
-	sort.Slice(store.addrList, func(i, j int) bool {
-		return store.lastSeen[store.addrList[j]].Before(store.lastSeen[store.addrList[i]])
-	})
-}

peer/pubaddrs_test.go

@@ -1,29 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-)
-
-func TestPubAddrStore(t *testing.T) {
-	s := newPubAddrStore(netip.AddrPort{})
-
-	l := []netip.AddrPort{
-		netip.AddrPortFrom(netip.AddrFrom4([4]byte{0, 1, 2, 3}), 20),
-		netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 1, 2, 3}), 21),
-		netip.AddrPortFrom(netip.AddrFrom4([4]byte{2, 1, 2, 3}), 22),
-	}
-
-	for i := range l {
-		s.Store(l[i])
-		time.Sleep(time.Millisecond)
-	}
-
-	s.clean()
-
-	l2 := s.Get()
-	if l2[0] != l[2] || l2[1] != l[1] || l2[2] != l[0] {
-		t.Fatal(l, l2)
-	}
-}

peer/relayhandler.go

@@ -1,54 +0,0 @@
-package peer
-
-import (
-	"log"
-	"sync"
-	"sync/atomic"
-)
-
-type relayHandler struct {
-	lock   sync.Mutex
-	relays map[byte]*Remote
-	relay  atomic.Pointer[Remote]
-}
-
-func newRelayHandler() *relayHandler {
-	return &relayHandler{
-		relays: make(map[byte]*Remote, 256),
-	}
-}
-
-func (h *relayHandler) Add(r *Remote) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	h.relays[r.RemotePeerIP] = r
-
-	if h.relay.Load() == nil {
-		log.Printf("Setting Relay: %v", r.conf().Peer.Name)
-		h.relay.Store(r)
-	}
-}
-
-func (h *relayHandler) Remove(r *Remote) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	log.Printf("Removing relay %d...", r.RemotePeerIP)
-	delete(h.relays, r.RemotePeerIP)
-
-	if h.relay.Load() == r {
-		// Remove current relay.
-		h.relay.Store(nil)
-
-		// Find new relay.
-		for _, r := range h.relays {
-			h.relay.Store(r)
-			break
-		}
-	}
-}
-
-func (h *relayHandler) Load() *Remote {
-	return h.relay.Load()
-}

peer/remote.go

@@ -1,327 +0,0 @@
-package peer
-
-import (
-	"fmt"
-	"log"
-	"net/netip"
-	"strings"
-	"sync/atomic"
-	"vppn/m"
-)
-
-// ----------------------------------------------------------------------------
-// The remoteConfig is the shared, immutable configuration for a remote
-// peer. It's read and written atomically. See remote.config.
-// ----------------------------------------------------------------------------
-
-type remoteConfig struct {
-	Up            bool           // True if peer is up and we can send data.
-	Server        bool           // True if role is server.
-	Direct        bool           // True if this is a direct connection.
-	DirectAddr    netip.AddrPort // Remote address if directly connected.
-	ControlCipher *controlCipher
-	DataCipher    *dataCipher
-	Peer          *m.Peer
-}
-
-// CanRelay returns true if the remote configuration is able to relay packets.
-// to other hosts.
-func (rc remoteConfig) CanRelay() bool {
-	return rc.Up && rc.Direct && rc.Peer.Relay
-}
-
-// A Remote represents a remote peer and contains functions for handling
-// incoming control, data, and multicast packets, peer udpates, as well as
-// sending, forwarding, and relaying packets.
-type Remote struct {
-	Globals
-	RemotePeerIP byte // Immutable.
-
-	dupCheck    *dupCheck
-	sendCounter uint64 // init to startupCount << 48. Atomic access only.
-
-	// config should be accessed via conf() and updateConf(...) methods.
-	config   atomic.Pointer[remoteConfig]
-	messages chan any
-}
-
-func newRemote(g Globals, remotePeerIP byte) *Remote {
-	r := &Remote{
-		Globals:      g,
-		RemotePeerIP: remotePeerIP,
-		dupCheck:     newDupCheck(0),
-		sendCounter:  (uint64(g.StartupCount) << 48) + 1,
-		messages:     make(chan any, 8),
-	}
-	r.config.Store(&remoteConfig{})
-	return r
-}
-
-// ----------------------------------------------------------------------------
-
-func (r *Remote) conf() remoteConfig {
-	return *(r.config.Load())
-}
-
-func (r *Remote) updateConf(conf remoteConfig) {
-	old := r.config.Load()
-	r.config.Store(&conf)
-
-	if !old.CanRelay() && conf.CanRelay() {
-		r.RelayHandler.Add(r)
-	}
-
-	if old.CanRelay() && !conf.CanRelay() {
-		r.RelayHandler.Remove(r)
-	}
-}
-
-// ----------------------------------------------------------------------------
-
-func (r *Remote) sendUDP(b []byte, addr netip.AddrPort) {
-	if _, err := r.SendUDP(b, addr); err != nil {
-		r.logf("Failed to send UDP packet: %v", err)
-	}
-}
-
-// ----------------------------------------------------------------------------
-
-func (r *Remote) encryptData(conf remoteConfig, destIP byte, packet []byte) []byte {
-	h := Header{
-		StreamID: dataStreamID,
-		Counter:  atomic.AddUint64(&r.sendCounter, 1),
-		SourceIP: r.Globals.LocalPeerIP,
-		DestIP:   destIP,
-	}
-	return conf.DataCipher.Encrypt(h, packet, packet[len(packet):cap(packet)])
-}
-
-func (r *Remote) encryptControl(conf remoteConfig, packet []byte) []byte {
-	h := Header{
-		StreamID: controlStreamID,
-		Counter:  atomic.AddUint64(&r.sendCounter, 1),
-		SourceIP: r.LocalPeerIP,
-		DestIP:   r.RemotePeerIP,
-	}
-	return conf.ControlCipher.Encrypt(h, packet, packet[len(packet):cap(packet)])
-}
-
-// ----------------------------------------------------------------------------
-
-// SendDataTo sends a data packet to the remote, called by the IFReader.
-func (r *Remote) SendDataTo(data []byte) {
-	conf := r.conf()
-	if !conf.Up {
-		r.logf("Cannot send: link down")
-		return
-	}
-
-	// Direct:
-
-	if conf.Direct {
-		r.sendUDP(r.encryptData(conf, conf.Peer.PeerIP, data), conf.DirectAddr)
-		return
-	}
-
-	// Relayed:
-	relay := r.RelayHandler.Load()
-
-	if relay == nil {
-		r.logf("Connot send: no relay")
-		return
-	}
-
-	relay.relayData(conf.Peer.PeerIP, r.encryptData(conf, conf.Peer.PeerIP, data))
-}
-
-func (r *Remote) relayData(toIP byte, enc []byte) {
-	conf := r.conf()
-	if !conf.Up || !conf.Direct {
-		r.logf("Cannot relay: not up or not a direct connection")
-		return
-	}
-	r.sendUDP(r.encryptData(conf, toIP, enc), conf.DirectAddr)
-}
-
-func (r *Remote) sendControl(conf remoteConfig, data []byte) {
-	// Direct:
-
-	if conf.Direct {
-		enc := r.encryptControl(conf, data)
-		r.sendUDP(enc, conf.DirectAddr)
-		return
-	}
-
-	// Relayed:
-
-	relay := r.RelayHandler.Load()
-
-	if relay == nil {
-		r.logf("Connot send: no relay")
-		return
-	}
-
-	relay.relayData(conf.Peer.PeerIP, r.encryptControl(conf, data))
-}
-
-func (r *Remote) sendControlToAddr(buf []byte, addr netip.AddrPort) {
-	enc := r.encryptControl(r.conf(), buf)
-	r.sendUDP(enc, addr)
-}
-
-func (r *Remote) forwardPacket(data []byte) {
-	conf := r.conf()
-	if !conf.Up || !conf.Direct {
-		r.logf("Cannot forward to %d: not a direct connection", conf.Peer.PeerIP)
-		return
-	}
-	r.sendUDP(data, conf.DirectAddr)
-}
-
-// ----------------------------------------------------------------------------
-
-// HandlePacket is called by the ConnReader to handle an incoming packet.
-func (r *Remote) HandlePacket(h Header, srcAddr netip.AddrPort, data []byte) {
-	switch h.StreamID {
-	case controlStreamID:
-		r.handleControlPacket(h, srcAddr, data)
-	case dataStreamID:
-		r.handleDataPacket(h, data)
-	default:
-		r.logf("Unknown stream ID: %d", h.StreamID)
-	}
-}
-
-// Handle a control packet. Decrypt, verify, etc.
-func (r *Remote) handleControlPacket(h Header, srcAddr netip.AddrPort, data []byte) {
-	conf := r.conf()
-	if conf.ControlCipher == nil {
-		r.logf("No control cipher")
-		return
-	}
-
-	dec, ok := conf.ControlCipher.Decrypt(data, data[len(data):cap(data)])
-	if !ok {
-		r.logf("Failed to decrypt control packet")
-		return
-	}
-
-	if r.dupCheck.IsDup(h.Counter) {
-		r.logf("Dropping control packet as duplicate: %d", h.Counter)
-		return
-	}
-
-	msg, err := parseControlMsg(h.SourceIP, srcAddr, dec)
-	if err != nil {
-		r.logf("Failed to parse control packet: %v", err)
-		return
-	}
-
-	select {
-	case r.messages <- msg:
-	default:
-		r.logf("Dropping control message")
-	}
-}
-
-func (r *Remote) handleDataPacket(h Header, data []byte) {
-	conf := r.conf()
-	if conf.DataCipher == nil {
-		return
-	}
-
-	dec, ok := conf.DataCipher.Decrypt(data, data[len(data):cap(data)])
-	if !ok {
-		r.logf("Failed to decrypt data packet")
-		return
-	}
-
-	if r.dupCheck.IsDup(h.Counter) {
-		r.logf("Dropping data packet as duplicate: %d", h.Counter)
-		return
-	}
-
-	// For local.
-	if h.DestIP == r.LocalPeerIP {
-		if _, err := r.IFace.Write(dec); err != nil {
-			// This could be a malformed packet from a peer, so we don't crash if it
-			// happens.
-			r.logf("Failed to write to interface: %v", err)
-		}
-		return
-	}
-
-	// Forward.
-	dest := r.RemotePeers[h.DestIP].Load()
-	dest.forwardPacket(dec)
-}
-
-// ----------------------------------------------------------------------------
-
-// HandleLocalDiscoveryPacket is called by the MCReader.
-func (r *Remote) HandleLocalDiscoveryPacket(h Header, srcAddr netip.AddrPort, data []byte) {
-	conf := r.conf()
-	if conf.Peer.PubSignKey == nil {
-		r.logf("No signing key for discovery packet.")
-		return
-	}
-
-	if !verifyLocalDiscoveryPacket(data, data[len(data):cap(data)], conf.Peer.PubSignKey) {
-		r.logf("Invalid signature on discovery packet.")
-		return
-	}
-
-	msg := controlMsg[packetLocalDiscovery]{
-		SrcIP:   h.SourceIP,
-		SrcAddr: srcAddr,
-	}
-
-	select {
-	case r.messages <- msg:
-	default:
-		r.logf("Dropping discovery message.")
-	}
-}
-
-// ----------------------------------------------------------------------------
-
-// HandlePeerUpdate is called by the HubPoller when it gets a new version of
-// the associated peer configuration.
-func (r *Remote) HandlePeerUpdate(msg peerUpdateMsg) {
-	r.messages <- msg
-}
-
-// ----------------------------------------------------------------------------
-
-func (s *Remote) logf(format string, args ...any) {
-	conf := s.conf()
-
-	b := strings.Builder{}
-	name := ""
-	if conf.Peer != nil {
-		name = conf.Peer.Name
-	}
-	b.WriteString(fmt.Sprintf("%03d", s.RemotePeerIP))
-
-	b.WriteString(fmt.Sprintf("%30s: ", name))
-
-	if conf.Server {
-		b.WriteString("SERVER | ")
-	} else {
-		b.WriteString("CLIENT | ")
-	}
-
-	if conf.Direct {
-		b.WriteString("DIRECT  | ")
-	} else {
-		b.WriteString("RELAYED | ")
-	}
-
-	if conf.Up {
-		b.WriteString("UP   | ")
-	} else {
-		b.WriteString("DOWN | ")
-	}
-
-	log.Printf(b.String()+format, args...)
-}

peer/remotefsm.go

@@ -1,447 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"time"
-	"vppn/m"
-)
-
-type stateFunc func(msg any) stateFunc
-
-type sentProbe struct {
-	SentAt time.Time
-	Addr   netip.AddrPort
-}
-
-type remoteFSM struct {
-	*Remote
-
-	pingTimer *time.Ticker
-	lastSeen  time.Time
-	traceID   uint64
-	probes    map[uint64]sentProbe
-
-	buf []byte
-}
-
-func newRemoteFSM(r *Remote) *remoteFSM {
-	fsm := &remoteFSM{
-		Remote:    r,
-		pingTimer: time.NewTicker(timeoutInterval),
-		probes:    map[uint64]sentProbe{},
-		buf:       make([]byte, bufferSize),
-	}
-	fsm.pingTimer.Stop()
-	return fsm
-}
-
-func (r *remoteFSM) Run() {
-	go func() {
-		for range r.pingTimer.C {
-			r.messages <- pingTimerMsg{}
-		}
-	}()
-	state := r.enterDisconnected()
-	for msg := range r.messages {
-		state = state(msg)
-	}
-}
-
-// ----------------------------------------------------------------------------
-
-func (r *remoteFSM) enterDisconnected() stateFunc {
-	r.updateConf(remoteConfig{})
-	return r.stateDisconnected
-}
-
-func (r *remoteFSM) stateDisconnected(iMsg any) stateFunc {
-	switch msg := iMsg.(type) {
-	case peerUpdateMsg:
-		return r.enterPeerUpdating(msg.Peer)
-	case controlMsg[packetInit]:
-		r.logf("Unexpected INIT")
-	case controlMsg[packetSyn]:
-		r.logf("Unexpected SYN")
-	case controlMsg[packetAck]:
-		r.logf("Unexpected ACK")
-	case controlMsg[packetProbe]:
-		r.logf("Unexpected probe")
-	case controlMsg[packetLocalDiscovery]:
-		// Ignore
-	case pingTimerMsg:
-		r.logf("Unexpected ping")
-	default:
-		r.logf("Ignoring message: %#v", iMsg)
-	}
-
-	return r.stateDisconnected
-}
-
-// ----------------------------------------------------------------------------
-
-func (r *remoteFSM) enterPeerUpdating(peer *m.Peer) stateFunc {
-	if peer == nil {
-		return r.enterDisconnected()
-	}
-
-	conf := remoteConfig{
-		Peer:          peer,
-		ControlCipher: newControlCipher(r.PrivKey, peer.PubKey),
-	}
-	r.updateConf(conf)
-
-	if _, isValid := netip.AddrFromSlice(peer.PublicIP); isValid {
-		if r.LocalAddrValid && r.LocalPeerIP < peer.PeerIP {
-			return r.enterServer()
-		}
-		return r.enterClientInit()
-	}
-
-	if r.LocalAddrValid || r.LocalPeerIP < peer.PeerIP {
-		return r.enterServer()
-	}
-
-	return r.enterClientInit()
-}
-
-// ----------------------------------------------------------------------------
-
-func (r *remoteFSM) enterServer() stateFunc {
-
-	conf := r.conf()
-	conf.Server = true
-	r.updateConf(conf)
-	r.logf("==> Server")
-
-	r.pingTimer.Reset(pingInterval)
-	r.lastSeen = time.Now()
-	return r.stateServer
-}
-
-func (r *remoteFSM) stateServer(iMsg any) stateFunc {
-	switch msg := iMsg.(type) {
-	case peerUpdateMsg:
-		return r.enterPeerUpdating(msg.Peer)
-	case controlMsg[packetInit]:
-		r.stateServer_onInit(msg)
-	case controlMsg[packetSyn]:
-		r.stateServer_onSyn(msg)
-	case controlMsg[packetAck]:
-		r.logf("Unexpected ACK")
-	case controlMsg[packetProbe]:
-		r.stateServer_onProbe(msg)
-	case controlMsg[packetLocalDiscovery]:
-		// Ignore
-	case pingTimerMsg:
-		r.stateServer_onPingTimer()
-	default:
-		r.logf("Unexpected message: %#v", iMsg)
-	}
-
-	return r.stateServer
-}
-
-func (r *remoteFSM) stateServer_onInit(msg controlMsg[packetInit]) {
-	conf := r.conf()
-	conf.Up = false
-	conf.Direct = msg.Packet.Direct
-	conf.DirectAddr = msg.SrcAddr
-	r.updateConf(conf)
-
-	init := packetInit{
-		TraceID: msg.Packet.TraceID,
-		Direct:  conf.Direct,
-		Version: version,
-	}
-
-	r.sendControl(conf, init.Marshal(r.buf))
-}
-
-func (r *remoteFSM) stateServer_onSyn(msg controlMsg[packetSyn]) {
-	r.lastSeen = time.Now()
-	p := msg.Packet
-
-	// Before we can respond to this packet, we need to make sure the
-	// route is setup properly.
-	conf := r.conf()
-	logSyn := !conf.Up || conf.Direct != p.Direct
-
-	conf.Up = true
-	conf.Direct = p.Direct
-	conf.DirectAddr = msg.SrcAddr
-
-	// Update data cipher if the key has changed.
-	if !conf.DataCipher.HasKey(p.SharedKey) {
-		conf.DataCipher = newDataCipherFromKey(p.SharedKey)
-	}
-
-	r.updateConf(conf)
-
-	if logSyn {
-		r.logf("Got SYN.")
-	}
-
-	r.sendControl(conf, packetAck{
-		TraceID:       p.TraceID,
-		ToAddr:        conf.DirectAddr,
-		PossibleAddrs: r.PubAddrs.Get(),
-	}.Marshal(r.buf))
-
-	if p.Direct {
-		return
-	}
-
-	// Send probes if not a direct connection.
-	for _, addr := range msg.Packet.PossibleAddrs {
-		if !addr.IsValid() {
-			break
-		}
-		r.logf("Probing %v...", addr)
-		r.sendControlToAddr(packetProbe{TraceID: r.NewTraceID()}.Marshal(r.buf), addr)
-	}
-}
-
-func (r *remoteFSM) stateServer_onProbe(msg controlMsg[packetProbe]) {
-	if !msg.SrcAddr.IsValid() {
-		return
-	}
-
-	data := packetProbe{TraceID: msg.Packet.TraceID}.Marshal(r.buf)
-	r.sendControlToAddr(data, msg.SrcAddr)
-}
-
-func (r *remoteFSM) stateServer_onPingTimer() {
-	conf := r.conf()
-	if time.Since(r.lastSeen) > timeoutInterval && conf.Up {
-		conf.Up = false
-		r.updateConf(conf)
-		r.logf("Timeout.")
-	}
-}
-
-// ----------------------------------------------------------------------------
-
-func (r *remoteFSM) enterClientInit() stateFunc {
-	conf := r.conf()
-	ip, ipValid := netip.AddrFromSlice(conf.Peer.PublicIP)
-
-	conf.Up = false
-	conf.Server = false
-	conf.Direct = ipValid
-	conf.DirectAddr = netip.AddrPortFrom(ip, conf.Peer.Port)
-	conf.DataCipher = newDataCipher()
-
-	r.updateConf(conf)
-	r.logf("==> ClientInit")
-
-	r.lastSeen = time.Now()
-	r.pingTimer.Reset(pingInterval)
-	r.stateClientInit_sendInit()
-	return r.stateClientInit
-}
-
-func (r *remoteFSM) stateClientInit(iMsg any) stateFunc {
-	switch msg := iMsg.(type) {
-	case peerUpdateMsg:
-		return r.enterPeerUpdating(msg.Peer)
-	case controlMsg[packetInit]:
-		return r.stateClientInit_onInit(msg)
-	case controlMsg[packetSyn]:
-		r.logf("Unexpected SYN")
-	case controlMsg[packetAck]:
-		r.logf("Unexpected ACK")
-	case controlMsg[packetProbe]:
-		// Ignore
-	case controlMsg[packetLocalDiscovery]:
-		// Ignore
-	case pingTimerMsg:
-		return r.stateClientInit_onPing()
-	default:
-		r.logf("Unexpected message: %#v", iMsg)
-	}
-
-	return r.stateClientInit
-}
-
-func (r *remoteFSM) stateClientInit_sendInit() {
-	conf := r.conf()
-	r.traceID = r.NewTraceID()
-	init := packetInit{
-		TraceID: r.traceID,
-		Direct:  conf.Direct,
-		Version: version,
-	}
-	r.sendControl(conf, init.Marshal(r.buf))
-}
-
-func (r *remoteFSM) stateClientInit_onInit(msg controlMsg[packetInit]) stateFunc {
-	if msg.Packet.TraceID != r.traceID {
-		r.logf("Invalid trace ID on INIT.")
-		return r.stateClientInit
-	}
-	r.logf("Got INIT version %d.", msg.Packet.Version)
-	return r.enterClient()
-}
-
-func (r *remoteFSM) stateClientInit_onPing() stateFunc {
-	if time.Since(r.lastSeen) < timeoutInterval {
-		r.stateClientInit_sendInit()
-		return r.stateClientInit
-	}
-
-	// Direct connect failed. Try indirect.
-	conf := r.conf()
-
-	if conf.Direct {
-		conf.Direct = false
-		r.updateConf(conf)
-		r.lastSeen = time.Now()
-		r.stateClientInit_sendInit()
-		r.logf("Direct connection failed. Attempting indirect connection.")
-		return r.stateClientInit
-	}
-
-	// Indirect failed. Re-enter init state.
-	r.logf("Timeout.")
-	return r.enterClientInit()
-}
-
-// ----------------------------------------------------------------------------
-
-func (r *remoteFSM) enterClient() stateFunc {
-	conf := r.conf()
-	r.probes = make(map[uint64]sentProbe, 8)
-
-	r.traceID = r.NewTraceID()
-	r.stateClient_sendSyn(conf)
-
-	r.pingTimer.Reset(pingInterval)
-	r.logf("==> Client")
-	return r.stateClient
-}
-
-func (r *remoteFSM) stateClient(iMsg any) stateFunc {
-	switch msg := iMsg.(type) {
-	case peerUpdateMsg:
-		return r.enterPeerUpdating(msg.Peer)
-	case controlMsg[packetAck]:
-		r.stateClient_onAck(msg)
-	case controlMsg[packetProbe]:
-		r.stateClient_onProbe(msg)
-	case controlMsg[packetLocalDiscovery]:
-		r.stateClient_onLocalDiscovery(msg)
-	case pingTimerMsg:
-		return r.stateClient_onPingTimer()
-	default:
-		r.logf("Ignoring message: %v", iMsg)
-	}
-	return r.stateClient
-}
-
-func (r *remoteFSM) stateClient_onAck(msg controlMsg[packetAck]) {
-	if msg.Packet.TraceID != r.traceID {
-		return
-	}
-
-	r.lastSeen = time.Now()
-
-	conf := r.conf()
-	if !conf.Up {
-		conf.Up = true
-		r.updateConf(conf)
-		r.logf("Got ACK.")
-	}
-
-	if conf.Direct {
-		r.PubAddrs.Store(msg.Packet.ToAddr)
-		return
-	}
-
-	// Relayed.
-
-	r.stateClient_cleanProbes()
-
-	for _, addr := range msg.Packet.PossibleAddrs {
-		if !addr.IsValid() {
-			break
-		}
-		r.stateClient_sendProbeTo(addr)
-	}
-}
-
-func (r *remoteFSM) stateClient_cleanProbes() {
-	for key, sent := range r.probes {
-		if time.Since(sent.SentAt) > pingInterval {
-			delete(r.probes, key)
-		}
-	}
-}
-
-func (r *remoteFSM) stateClient_sendProbeTo(addr netip.AddrPort) {
-	probe := packetProbe{TraceID: r.NewTraceID()}
-	r.probes[probe.TraceID] = sentProbe{
-		SentAt: time.Now(),
-		Addr:   addr,
-	}
-	r.logf("Probing %v...", addr)
-	r.sendControlToAddr(probe.Marshal(r.buf), addr)
-}
-
-func (r *remoteFSM) stateClient_onProbe(msg controlMsg[packetProbe]) {
-	conf := r.conf()
-	if conf.Direct {
-		return
-	}
-
-	r.stateClient_cleanProbes()
-
-	sent, ok := r.probes[msg.Packet.TraceID]
-	if !ok {
-		return
-	}
-
-	conf.Direct = true
-	conf.DirectAddr = sent.Addr
-	r.updateConf(conf)
-
-	r.traceID = r.NewTraceID()
-	r.stateClient_sendSyn(conf)
-	r.logf("Successful probe to %v.", sent.Addr)
-}
-
-func (r *remoteFSM) stateClient_onLocalDiscovery(msg controlMsg[packetLocalDiscovery]) {
-	conf := r.conf()
-	if conf.Direct {
-		return
-	}
-
-	// The source port will be the multicast port, so we'll have to
-	// construct the correct address using the peer's listed port.
-	addr := netip.AddrPortFrom(msg.SrcAddr.Addr(), conf.Peer.Port)
-	r.stateClient_sendProbeTo(addr)
-}
-
-func (r *remoteFSM) stateClient_onPingTimer() stateFunc {
-	conf := r.conf()
-
-	if time.Since(r.lastSeen) > timeoutInterval {
-		if conf.Up {
-			r.logf("Timeout.")
-		}
-		return r.enterClientInit()
-	}
-
-	r.stateClient_sendSyn(conf)
-	return r.stateClient
-}
-
-func (r *remoteFSM) stateClient_sendSyn(conf remoteConfig) {
-	syn := packetSyn{
-		TraceID:       r.traceID,
-		SharedKey:     conf.DataCipher.Key(),
-		Direct:        conf.Direct,
-		PossibleAddrs: r.PubAddrs.Get(),
-	}
-
-	r.sendControl(conf, syn.Marshal(r.buf))
-}

stage1/README.md

@@ -0,0 +1 @@
+## Stage1: Point-to-point Tunnel w/ no Encryption