fix udp proxy not work when being exit node (#133)

* move launcher to eastier lib
* support auto start after reboot

.cargo/config

@@ -1,7 +0,0 @@
-[target.aarch64-unknown-linux-gnu]
-linker = "aarch64-linux-gnu-gcc"
-[target.aarch64-unknown-linux-musl]
-linker = "aarch64-linux-musl-gcc"
-rustflags = ["-C", "target-feature=+crt-static"]
-[target.'cfg(all(windows, target_env = "msvc"))']
-rustflags = ["-C", "target-feature=+crt-static"]

.cargo/config.toml

@@ -0,0 +1,77 @@
+[target.x86_64-unknown-linux-musl]
+linker = "rust-lld"
+rustflags = ["-C", "linker-flavor=ld.lld"]
+
+[target.aarch64-unknown-linux-gnu]
+linker = "aarch64-linux-gnu-gcc"
+
+[target.aarch64-unknown-linux-musl]
+linker = "aarch64-linux-musl-gcc"
+rustflags = ["-C", "target-feature=+crt-static"]
+
+[target.'cfg(all(windows, target_env = "msvc"))']
+rustflags = ["-C", "target-feature=+crt-static"]
+
+[target.mipsel-unknown-linux-musl]
+linker = "mipsel-linux-muslsf-gcc"
+rustflags = [
+    "-C",
+    "target-feature=+crt-static",
+    "-L",
+    "./musl_gcc/mipsel-linux-muslsf-cross/mipsel-linux-muslsf/lib",
+    "-L",
+    "./musl_gcc/mipsel-linux-muslsf-cross/lib/gcc/mipsel-linux-muslsf/11.2.1",
+    "-l",
+    "atomic",
+    "-l",
+    "ctz",
+]
+
+[target.mips-unknown-linux-musl]
+linker = "mips-linux-muslsf-gcc"
+rustflags = [
+    "-C",
+    "target-feature=+crt-static",
+    "-L",
+    "./musl_gcc/mips-linux-muslsf-cross/mips-linux-muslsf/lib",
+    "-L",
+    "./musl_gcc/mips-linux-muslsf-cross/lib/gcc/mips-linux-muslsf/11.2.1",
+    "-l",
+    "atomic",
+    "-l",
+    "ctz",
+]
+
+[target.armv7-unknown-linux-musleabihf]
+linker = "armv7l-linux-musleabihf-gcc"
+rustflags = ["-C", "target-feature=+crt-static"]
+
+[target.armv7-unknown-linux-musleabi]
+linker = "armv7m-linux-musleabi-gcc"
+rustflags = ["-C", "target-feature=+crt-static"]
+
+[target.arm-unknown-linux-musleabihf]
+linker = "arm-linux-musleabihf-gcc"
+rustflags = [
+    "-C",
+    "target-feature=+crt-static",
+    "-L",
+    "./musl_gcc/arm-linux-musleabihf-cross/arm-linux-musleabihf/lib",
+    "-L",
+    "./musl_gcc/arm-linux-musleabihf-cross/lib/gcc/arm-linux-musleabihf/11.2.1",
+    "-l",
+    "atomic",
+]
+
+[target.arm-unknown-linux-musleabi]
+linker = "arm-linux-musleabi-gcc"
+rustflags = [
+    "-C",
+    "target-feature=+crt-static",
+    "-L",
+    "./musl_gcc/arm-linux-musleabi-cross/arm-linux-musleabi/lib",
+    "-L",
+    "./musl_gcc/arm-linux-musleabi-cross/lib/gcc/arm-linux-musleabi/11.2.1",
+    "-l",
+    "atomic",
+]

.github/workflows/core.yml

@@ -0,0 +1,163 @@
+name: EasyTier Core
+
+on:
+  push:
+    branches: ["develop", "main"]
+  pull_request:
+    branches: ["develop", "main"]
+
+env:
+  CARGO_TERM_COLOR: always
+
+defaults:
+  run:
+    # necessary for windows
+    shell: bash
+
+jobs:
+  pre_job:
+    # continue-on-error: true # Uncomment once integration is finished
+    runs-on: ubuntu-latest
+    # Map a step output to a job output
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - id: skip_check
+        uses: fkirc/skip-duplicate-actions@v5
+        with:
+          # All of these options are optional, so you can remove them if you are happy with the defaults
+          concurrent_skipping: 'never'
+          skip_after_successful_duplicate: 'true'
+          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", ".github/workflows/core.yml"]'
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - TARGET: aarch64-unknown-linux-musl
+            OS: ubuntu-latest
+          - TARGET: x86_64-unknown-linux-musl
+            OS: ubuntu-latest
+          - TARGET: mips-unknown-linux-musl
+            OS: ubuntu-latest
+          - TARGET: mipsel-unknown-linux-musl
+            OS: ubuntu-latest
+
+          - TARGET: x86_64-apple-darwin
+            OS: macos-latest
+          - TARGET: aarch64-apple-darwin
+            OS: macos-latest
+
+          - TARGET: x86_64-pc-windows-msvc
+            OS: windows-latest
+
+          - TARGET: armv7-unknown-linux-musleabihf # raspberry pi 2-3-4, not tested
+            OS: ubuntu-latest
+          - TARGET: armv7-unknown-linux-musleabi # raspberry pi 2-3-4, not tested
+            OS: ubuntu-latest
+          - TARGET: arm-unknown-linux-musleabihf # raspberry pi 0-1, not tested
+            OS: ubuntu-latest
+          - TARGET: arm-unknown-linux-musleabi # raspberry pi 0-1, not tested
+            OS: ubuntu-latest
+    runs-on: ${{ matrix.OS }}
+    env:
+      NAME: easytier
+      TARGET: ${{ matrix.TARGET }}
+      OS: ${{ matrix.OS }}
+      OSS_BUCKET: ${{ secrets.ALIYUN_OSS_BUCKET }}
+    needs: pre_job
+    if: needs.pre_job.outputs.should_skip != 'true'
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 21
+
+      - name: Cargo cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo
+            ./target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Install rust target
+        run: bash ./.github/workflows/install_rust.sh
+
+      - name: Setup protoc
+        uses: arduino/setup-protoc@v2
+        with:
+          # GitHub repo token to use to avoid rate limiter
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build Core & Cli
+        run: |
+          if [[ $OS =~ ^ubuntu.*$ && $TARGET =~ ^mips.*$ ]]; then
+            cargo +nightly build -r --verbose --target $TARGET -Z build-std=std,panic_abort --no-default-features --features mips
+          else
+            cargo build --release --verbose --target $TARGET
+          fi
+
+      - name: Install UPX
+        if: ${{ matrix.OS != 'macos-latest' }}
+        uses: crazy-max/ghaction-upx@v3
+        with:
+          version: latest
+          install-only: true
+
+      - name: Compress
+        run: |
+          mkdir -p ./artifacts/objects/
+          # windows is the only OS using a different convention for executable file name
+          if [[ $OS =~ ^windows.*$ ]]; then
+              SUFFIX=.exe
+              cp easytier/third_party/Packet.dll ./artifacts/objects/
+              cp easytier/third_party/wintun.dll ./artifacts/objects/
+          fi
+          if [[ $GITHUB_REF_TYPE =~ ^tag$ ]]; then
+            TAG=$GITHUB_REF_NAME
+          else
+            TAG=$GITHUB_SHA
+          fi
+
+          if [[ ! $OS =~ ^macos.*$ ]]; then
+            upx --lzma --best ./target/$TARGET/release/easytier-core"$SUFFIX"
+            upx --lzma --best ./target/$TARGET/release/easytier-cli"$SUFFIX"
+          fi
+
+          mv ./target/$TARGET/release/easytier-core"$SUFFIX" ./artifacts/objects/
+          mv ./target/$TARGET/release/easytier-cli"$SUFFIX" ./artifacts/objects/
+
+          tar -cvf ./artifacts/$NAME-$TARGET-$TAG.tar -C ./artifacts/objects/ .
+          rm -rf ./artifacts/objects/
+
+      - name: Archive artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: easytier-${{ matrix.OS }}-${{ matrix.TARGET }}
+          path: |
+            ./artifacts/*
+
+      - name: Upload OSS
+        if: ${{ env.OSS_BUCKET != '' }}
+        uses: Menci/upload-to-oss@main
+        with:
+          access-key-id: ${{ secrets.ALIYUN_OSS_ACCESS_ID }}
+          access-key-secret: ${{ secrets.ALIYUN_OSS_ACCESS_KEY }}
+          endpoint: ${{ secrets.ALIYUN_OSS_ENDPOINT }}
+          bucket: ${{ secrets.ALIYUN_OSS_BUCKET }}
+          local-path: ./artifacts/
+          remote-path: /easytier-releases/${{ github.sha }}/
+          no-delete-remote-files: true
+          retry: 5
+  core-result:
+    if: needs.pre_job.outputs.should_skip != 'true' && always()
+    runs-on: ubuntu-latest
+    needs:
+      - pre_job
+      - build
+    steps:
+      - name: Mark result as failed
+        if: needs.build.result != 'success'
+        run: exit 1

.github/workflows/gui.yml

@@ -0,0 +1,204 @@
+name: EasyTier GUI
+
+on:
+  push:
+    branches: ["develop", "main"]
+  pull_request:
+    branches: ["develop", "main"]
+      
+env:
+  CARGO_TERM_COLOR: always
+
+defaults:
+  run:
+    # necessary for windows
+    shell: bash
+
+jobs:
+  pre_job:
+    # continue-on-error: true # Uncomment once integration is finished
+    runs-on: ubuntu-latest
+    # Map a step output to a job output
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - id: skip_check
+        uses: fkirc/skip-duplicate-actions@v5
+        with:
+          # All of these options are optional, so you can remove them if you are happy with the defaults
+          concurrent_skipping: 'never'
+          skip_after_successful_duplicate: 'true'
+          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-gui/**", ".github/workflows/gui.yml"]'
+  build-gui:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - TARGET: aarch64-unknown-linux-musl
+            OS: ubuntu-latest
+            GUI_TARGET: aarch64-unknown-linux-gnu
+          - TARGET: x86_64-unknown-linux-musl
+            OS: ubuntu-latest
+            GUI_TARGET: x86_64-unknown-linux-gnu
+
+          - TARGET: x86_64-apple-darwin
+            OS: macos-latest
+            GUI_TARGET: x86_64-apple-darwin
+          - TARGET: aarch64-apple-darwin
+            OS: macos-latest
+            GUI_TARGET: aarch64-apple-darwin
+
+          - TARGET: x86_64-pc-windows-msvc
+            OS: windows-latest
+            GUI_TARGET: x86_64-pc-windows-msvc
+    runs-on: ${{ matrix.OS }}
+    env:
+      NAME: easytier
+      TARGET: ${{ matrix.TARGET }}
+      OS: ${{ matrix.OS }}
+      GUI_TARGET: ${{ matrix.GUI_TARGET }}
+      OSS_BUCKET: ${{ secrets.ALIYUN_OSS_BUCKET }}
+    needs: pre_job
+    if: needs.pre_job.outputs.should_skip != 'true'    
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 21
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v3
+        with:
+          version: 9
+          run_install: false
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - name: Setup pnpm cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Install frontend dependencies
+        run: |
+          cd easytier-gui
+          pnpm install
+
+      - name: Cargo cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo
+            ./target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Install rust target
+        run: bash ./.github/workflows/install_rust.sh
+
+      - name: Setup protoc
+        uses: arduino/setup-protoc@v2
+        with:
+          # GitHub repo token to use to avoid rate limiter
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install GUI cross compile (aarch64 only)
+        if: ${{ matrix.TARGET == 'aarch64-unknown-linux-musl' }}
+        run: |
+          # see https://tauri.app/v1/guides/building/linux/
+          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy main restricted" | sudo tee /etc/apt/sources.list
+          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy-updates main restricted" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy universe" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy-updates universe" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy multiverse" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy-updates multiverse" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy-backports main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=amd64] http://security.ubuntu.com/ubuntu/ jammy-security main restricted" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=amd64] http://security.ubuntu.com/ubuntu/ jammy-security universe" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=amd64] http://security.ubuntu.com/ubuntu/ jammy-security multiverse" | sudo tee -a /etc/apt/sources.list
+
+          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy main restricted" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates main restricted" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy universe" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates universe" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy multiverse" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates multiverse" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-backports main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security main restricted" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security universe" | sudo tee -a /etc/apt/sources.list
+          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security multiverse" | sudo tee -a /etc/apt/sources.list
+
+          sudo dpkg --add-architecture arm64
+          sudo apt-get update && sudo apt-get upgrade -y
+          sudo apt install libwebkit2gtk-4.0-dev:arm64
+          sudo apt install libssl-dev:arm64
+          echo "PKG_CONFIG_SYSROOT_DIR=/usr/aarch64-linux-gnu/" >> "$GITHUB_ENV"
+
+      - name: Build GUI
+        if: ${{ matrix.GUI_TARGET != '' }}
+        uses: tauri-apps/tauri-action@v0
+        with:
+          projectPath: ./easytier-gui
+          # https://tauri.app/v1/guides/building/linux/#cross-compiling-tauri-applications-for-arm-based-devices
+          args: --verbose --target ${{ matrix.GUI_TARGET }} ${{ matrix.OS == 'ubuntu-latest' && contains(matrix.TARGET, 'aarch64') && '--bundles deb' || ''  }}
+
+      - name: Compress
+        run: |
+          mkdir -p ./artifacts/objects/
+          
+          if [[ $GITHUB_REF_TYPE =~ ^tag$ ]]; then
+            TAG=$GITHUB_REF_NAME
+          else
+            TAG=$GITHUB_SHA
+          fi
+          # copy gui bundle, gui is built without specific target
+          if [[ $OS =~ ^windows.*$ ]]; then
+              mv ./target/$GUI_TARGET/release/bundle/nsis/*.exe ./artifacts/objects/
+          elif [[ $OS =~ ^macos.*$ ]]; then
+              mv ./target/$GUI_TARGET/release/bundle/dmg/*.dmg ./artifacts/objects/
+          elif [[ $OS =~ ^ubuntu.*$ && ! $TARGET =~ ^mips.*$ ]]; then
+              mv ./target/$GUI_TARGET/release/bundle/deb/*.deb ./artifacts/objects/
+              if [[ $GUI_TARGET =~ ^x86_64.*$ ]]; then
+                # currently only x86 appimage is supported
+                mv ./target/$GUI_TARGET/release/bundle/appimage/*.AppImage ./artifacts/objects/
+              fi
+          fi
+
+          tar -cvf ./artifacts/$NAME-$TARGET-$TAG.tar -C ./artifacts/objects/ .
+          rm -rf ./artifacts/objects/
+
+      - name: Archive artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: easytier-gui-${{ matrix.OS }}-${{ matrix.TARGET }}
+          path: |
+            ./artifacts/*
+
+      - name: Upload OSS
+        if: ${{ env.OSS_BUCKET != '' }}
+        uses: Menci/upload-to-oss@main
+        with:
+          access-key-id: ${{ secrets.ALIYUN_OSS_ACCESS_ID }}
+          access-key-secret: ${{ secrets.ALIYUN_OSS_ACCESS_KEY }}
+          endpoint: ${{ secrets.ALIYUN_OSS_ENDPOINT }}
+          bucket: ${{ secrets.ALIYUN_OSS_BUCKET }}
+          local-path: ./artifacts/
+          remote-path: /easytier-releases/${{ github.sha }}/gui
+          no-delete-remote-files: true
+          retry: 5
+  gui-result:
+    if: needs.pre_job.outputs.should_skip != 'true' && always()
+    runs-on: ubuntu-latest
+    needs:
+      - pre_job
+      - build-gui
+    steps:
+      - name: Mark result as failed
+        if: needs.build-gui.result != 'success'
+        run: exit 1

.github/workflows/install_rust.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+
+# env needed:
+# - TARGET
+# - GUI_TARGET
+# - OS
+
+# dependencies are only needed on ubuntu as that's the only place where
+# we make cross-compilation
+if [[ $OS =~ ^ubuntu.*$ ]]; then
+    sudo apt-get update && sudo apt-get install -qq crossbuild-essential-arm64 crossbuild-essential-armhf musl-tools
+    # for easytier-gui
+    if [[ $GUI_TARGET != '' ]]; then
+        sudo apt install libwebkit2gtk-4.0-dev \
+            build-essential \
+            curl \
+            wget \
+            file \
+            libssl-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf
+    fi
+    #  curl -s musl.cc | grep mipsel
+    case $TARGET in
+    mipsel-unknown-linux-musl)
+        MUSL_URI=mipsel-linux-muslsf
+        ;;
+    mips-unknown-linux-musl)
+        MUSL_URI=mips-linux-muslsf
+        ;;
+    aarch64-unknown-linux-musl)
+        MUSL_URI=aarch64-linux-musl
+        ;;
+    armv7-unknown-linux-musleabihf)
+        MUSL_URI=armv7l-linux-musleabihf
+        ;;
+    armv7-unknown-linux-musleabi)
+        MUSL_URI=armv7m-linux-musleabi
+        ;;
+    arm-unknown-linux-musleabihf)
+        MUSL_URI=arm-linux-musleabihf
+        ;;
+    arm-unknown-linux-musleabi)
+        MUSL_URI=arm-linux-musleabi
+        ;;
+    esac
+
+    if [ -n "$MUSL_URI" ]; then
+        mkdir -p ./musl_gcc
+        wget -c https://musl.cc/${MUSL_URI}-cross.tgz -P ./musl_gcc/
+        tar zxf ./musl_gcc/${MUSL_URI}-cross.tgz -C ./musl_gcc/
+        sudo ln -s $(pwd)/musl_gcc/${MUSL_URI}-cross/bin/*gcc /usr/bin/
+    fi
+fi
+
+# see https://github.com/rust-lang/rustup/issues/3709
+rustup set auto-self-update disable
+rustup install 1.75
+rustup default 1.75
+
+# mips/mipsel cannot add target from rustup, need compile by ourselves
+if [[ $OS =~ ^ubuntu.*$ && $TARGET =~ ^mips.*$ ]]; then
+    cd "$PWD/musl_gcc/${MUSL_URI}-cross/lib/gcc/${MUSL_URI}/11.2.1" || exit 255
+    # for panic-abort
+    cp libgcc_eh.a libunwind.a
+
+    # for mimalloc
+    ar x libgcc.a _ctzsi2.o _clz.o _bswapsi2.o
+    ar rcs libctz.a _ctzsi2.o _clz.o _bswapsi2.o
+
+    rustup toolchain install nightly-x86_64-unknown-linux-gnu
+    rustup component add rust-src --toolchain nightly-x86_64-unknown-linux-gnu
+    cd -
+else
+    rustup target add $TARGET
+    if [[ $GUI_TARGET != '' ]]; then
+        rustup target add $GUI_TARGET
+    fi
+fi

.github/workflows/rust.yml

@@ -1,151 +0,0 @@
-name: Rust
-
-on:
-  push:
-    branches: [ "develop", "main" ]
-  pull_request:
-    branches: [ "develop", "main" ]
-
-env:
-  CARGO_TERM_COLOR: always
-
-defaults:
-  run:
-    # necessary for windows
-    shell: bash
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - TARGET: aarch64-unknown-linux-musl
-            OS: ubuntu-latest
-          - TARGET: x86_64-unknown-linux-musl
-            OS: ubuntu-latest
-          - TARGET: x86_64-apple-darwin
-            OS: macos-latest
-          - TARGET: aarch64-apple-darwin
-            OS: macos-latest
-          - TARGET: x86_64-pc-windows-msvc
-            OS: windows-latest
-    runs-on: ${{ matrix.OS }}
-    env:
-      NAME: easytier
-      TARGET: ${{ matrix.TARGET }}
-      OS: ${{ matrix.OS }}
-    steps:
-    - uses: actions/checkout@v3
-    - name: Setup protoc
-      uses: arduino/setup-protoc@v2
-      with:
-         # GitHub repo token to use to avoid rate limiter
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Cargo cache
-      uses: actions/cache@v4.0.0
-      with:
-        path: |
-          ~/.cargo
-          ./target
-        key: build-cargo-registry-${{matrix.TARGET}}
-    - name: Install rust target
-      run: |
-        # dependencies are only needed on ubuntu as that's the only place where
-        # we make cross-compilation
-        if [[ $OS =~ ^ubuntu.*$ ]]; then
-          sudo apt-get update && sudo apt-get install -qq crossbuild-essential-arm64 crossbuild-essential-armhf musl-tools
-          #  curl -s musl.cc | grep mipsel
-          case $TARGET in 
-            mipsel-unknown-linux-musl)
-              MUSL_URI=mipsel-linux-musl-cross
-              ;;
-            aarch64-unknown-linux-musl)
-              MUSL_URI=aarch64-linux-musl-cross
-              ;;
-            armv7-unknown-linux-musleabihf)
-              MUSL_URI=armv7l-linux-musleabihf-cross
-              ;;   
-            arm-unknown-linux-musleabihf)
-              MUSL_URI=arm-linux-musleabihf-cross
-              ;;        
-            mips-unknown-linux-musl)
-              MUSL_URI=mips-linux-musl-cross
-              ;;
-          esac
-        
-          if [  -n "$MUSL_URI" ]; then
-            mkdir -p ./musl_gcc 
-            wget -c https://musl.cc/$MUSL_URI.tgz -P ./musl_gcc/
-            tar zxf ./musl_gcc/$MUSL_URI.tgz -C ./musl_gcc/
-            sudo ln -s $(pwd)/musl_gcc/$MUSL_URI/bin/*gcc /usr/bin/
-          fi
-        fi
-        
-        # see https://github.com/rust-lang/rustup/issues/3709
-        rustup set auto-self-update disable
-        rustup install 1.75
-        rustup default 1.75
-        rustup target add $TARGET
-    - name: Run build
-      run: cargo build --release --verbose --target $TARGET
-    - name: Compress
-      run: |
-        mkdir -p ./artifacts/objects/
-        # windows is the only OS using a different convention for executable file name
-        if [[ $OS =~ ^windows.*$ ]]; then
-            SUFFIX=.exe
-            cp third_party/Packet.dll ./artifacts/objects/
-            cp third_party/wintun.dll ./artifacts/objects/
-        fi
-        if [[ $GITHUB_REF_TYPE =~ ^tag$ ]]; then
-          TAG=$GITHUB_REF_NAME
-        else
-          TAG=$GITHUB_SHA
-        fi
-        mv ./target/$TARGET/release/easytier-core"$SUFFIX" ./artifacts/objects/
-        mv ./target/$TARGET/release/easytier-cli"$SUFFIX" ./artifacts/objects/
-        tar -cvf ./artifacts/$NAME-$TARGET-$TAG.tar -C ./artifacts/objects/ .
-        rm -rf ./artifacts/objects/
-    - name: Archive artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: easytier-${{ matrix.OS }}-${{ matrix.TARGET }}
-        path: |
-          ./artifacts/*
-    - name: Upload OSS
-      uses: Menci/upload-to-oss@main
-      with:
-        access-key-id: ${{ secrets.ALIYUN_OSS_ACCESS_ID }}
-        access-key-secret: ${{ secrets.ALIYUN_OSS_ACCESS_KEY }}
-        endpoint: ${{ secrets.ALIYUN_OSS_ENDPOINT }}
-        bucket: ${{ secrets.ALIYUN_OSS_BUCKET }}
-        local-path: ./artifacts/
-        remote-path: /easytier-releases/${{ github.sha }}/
-        no-delete-remote-files: true
-        retry: 5
-        increment: true
-  test:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - name: Setup protoc
-      uses: arduino/setup-protoc@v2
-      with:
-         # GitHub repo token to use to avoid rate limiter
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup tools for test
-      run: sudo apt install bridge-utils
-    - name: Setup system for test
-      run: |
-        sudo sysctl net.bridge.bridge-nf-call-iptables=0
-        sudo sysctl net.bridge.bridge-nf-call-ip6tables=0
-    - name: Cargo cache
-      uses: actions/cache@v4.0.0
-      with:
-        path: |
-          ~/.cargo
-          ./target
-        key: build-cargo-registry-test
-    - name: Run tests
-      run: sudo -E env "PATH=$PATH" cargo test --verbose

.github/workflows/test.yml

@@ -0,0 +1,67 @@
+name: EasyTier Test
+
+on:
+  push:
+    branches: ["develop", "main"]
+  pull_request:
+    branches: ["develop", "main"]
+
+env:
+  CARGO_TERM_COLOR: always
+
+defaults:
+  run:
+    # necessary for windows
+    shell: bash
+
+jobs:
+  pre_job:
+    # continue-on-error: true # Uncomment once integration is finished
+    runs-on: ubuntu-latest
+    # Map a step output to a job output
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - id: skip_check
+        uses: fkirc/skip-duplicate-actions@v5
+        with:
+          # All of these options are optional, so you can remove them if you are happy with the defaults
+          concurrent_skipping: 'never'
+          skip_after_successful_duplicate: 'true'
+          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", ".github/workflows/test.yml"]'
+  test:
+    runs-on: ubuntu-latest
+    needs: pre_job
+    if: needs.pre_job.outputs.should_skip != 'true'    
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup protoc
+        uses: arduino/setup-protoc@v2
+        with:
+          # GitHub repo token to use to avoid rate limiter
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup tools for test
+        run: sudo apt install bridge-utils
+
+      - name: Setup system for test
+        run: |
+          sudo sysctl net.bridge.bridge-nf-call-iptables=0
+          sudo sysctl net.bridge.bridge-nf-call-ip6tables=0
+          sudo sysctl net.ipv6.conf.lo.disable_ipv6=0
+          sudo ip addr add 2001:db8::2/64 dev lo
+
+      - name: Cargo cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo
+            ./target
+          key: ${{ runner.os }}-cargo-test-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Run tests
+        run: |
+          sudo -E env "PATH=$PATH" cargo test --no-default-features --features=full --verbose
+          sudo chown -R $USER:$USER ./target
+          sudo chown -R $USER:$USER ~/.cargo

.gitignore

@@ -4,10 +4,6 @@ debug/
 target/
 target-*/
 
-# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
-# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
-Cargo.lock
-
 # These are backup files generated by rustfmt
 **/*.rs.bk
 
@@ -24,3 +20,12 @@ flamegraph.svg
 root-target
 
 nohup.out
+
+.DS_Store
+
+components.d.ts
+
+musl_gcc
+
+# log
+easytier-panic.log

Cargo.toml

@@ -1,144 +1,13 @@
-[package]
-name = "easytier"
-description = "A full meshed p2p VPN, connecting all your devices in one network with one command."
-homepage = "https://github.com/KKRainbow/EasyTier"
-repository = "https://github.com/KKRainbow/EasyTier"
-version = "0.1.1"
-edition = "2021"
-authors = ["kkrainbow"]
-keywords = ["vpn", "p2p", "network", "easytier"]
-categories = ["network-programming", "command-line-utilities"]
-rust-version = "1.75"
-license-file = "LICENSE"
-readme = "README.md"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[[bin]]
-name = "easytier-core"
-path = "src/easytier-core.rs"
-
-[[bin]]
-name = "easytier-cli"
-path = "src/easytier-cli.rs"
-test = false
-
-[dependencies]
-tracing = { version = "0.1", features = ["log"] }
-tracing-subscriber = { version = "0.3", features = [
-    "env-filter",
-    "local-time",
-    "time",
-] }
-tracing-appender = "0.2.3"
-log = "0.4"
-thiserror = "1.0"
-auto_impl = "1.1.0"
-crossbeam = "0.8.4"
-time = "0.3"
-toml = "0.8.12"
-chrono = "0.4.35"
-
-gethostname = "0.4.3"
-
-futures = "0.3"
-
-tokio = { version = "1", features = ["full"] }
-tokio-stream = "0.1"
-tokio-util = { version = "0.7.9", features = ["codec", "net"] }
-
-async-stream = "0.3.5"
-async-trait = "0.1.74"
-
-dashmap = "5.5.3"
-timedmap = "1.0.1"
-
-# for tap device
-tun = { version = "0.6.1", features = ["async"] }
-# for net ns
-nix = { version = "0.27", features = ["sched", "socket", "ioctl"] }
-
-uuid = { version = "1.5.0", features = [
-    "v4",
-    "fast-rng",
-    "macro-diagnostics",
-    "serde",
-] }
-
-# for ring tunnel
-crossbeam-queue = "0.3"
-once_cell = "1.18.0"
-
-# for packet
-rkyv = { "version" = "0.7.42", features = [
-    "validation",
-    "archive_le",
-    "strict",
-    "copy_unsafe",
-    "arbitrary_enum_discriminant",
-] }
-postcard = { "version" = "1.0.8", features = ["alloc"] }
-
-# for rpc
-tonic = "0.10"
-prost = "0.12"
-anyhow = "1.0"
-tarpc = { version = "0.32", features = ["tokio1", "serde1"] }
-
-url = { version = "2.5", features = ["serde"] }
-
-# for tun packet
-byteorder = "1.5.0"
-
-# for proxy
-cidr = "0.2.2"
-socket2 = "0.5.5"
-
-# for hole punching
-stun_codec = "0.3.4"
-bytecodec = "0.4.15"
-rand = "0.8.5"
-
-serde = { version = "1.0", features = ["derive"] }
-pnet = { version = "0.34.0", features = ["serde"] }
-public-ip = { version = "0.2", features = ["default"] }
-
-clap = { version = "4.4.8", features = ["unicode", "derive", "wrap_help"] }
-
-async-recursion = "1.0.5"
-
-network-interface = "1.1.1"
-
-# for ospf route
-pathfinding = "4.9.1"
-
-# for cli
-tabled = "0.15.*"
-humansize = "2.1.3"
-
-
-[target.'cfg(windows)'.dependencies]
-windows-sys = { version = "0.52", features = [
-    "Win32_Networking_WinSock",
-    "Win32_NetworkManagement_IpHelper",
-    "Win32_Foundation",
-    "Win32_System_IO",
-] }
-
-[build-dependencies]
-tonic-build = "0.10"
-
-[target.'cfg(windows)'.build-dependencies]
-reqwest = { version = "0.11", features = ["blocking"] }
-zip = "0.6.6"
-
-
-[dev-dependencies]
-serial_test = "3.0.0"
+[workspace]
+resolver = "2"
+members = ["easytier", "easytier-gui/src-tauri"]
+default-members = ["easytier"]
 
 [profile.dev]
-panic = "abort"
+panic = "unwind"
 
 [profile.release]
 panic = "abort"
 lto = true
+codegen-units = 1
+strip = true

EasyTier.code-workspace

@@ -0,0 +1,87 @@
+{
+	"folders": [
+		{
+			"path": "."
+		},
+		{
+			"path": "easytier-gui"
+		},
+		{
+			"path": "easytier"
+		}
+	],
+	"settings": {
+		"eslint.experimental.useFlatConfig": true,
+		"prettier.enable": false,
+		"editor.formatOnSave": false,
+		"editor.codeActionsOnSave": {
+			"source.fixAll.eslint": "explicit",
+			"source.organizeImports": "never"
+		},
+		"eslint.rules.customizations": [
+			{
+				"rule": "style/*",
+				"severity": "off"
+			},
+			{
+				"rule": "style/eol-last",
+				"severity": "error"
+			},
+			{
+				"rule": "format/*",
+				"severity": "off"
+			},
+			{
+				"rule": "*-indent",
+				"severity": "off"
+			},
+			{
+				"rule": "*-spacing",
+				"severity": "off"
+			},
+			{
+				"rule": "*-spaces",
+				"severity": "off"
+			},
+			{
+				"rule": "*-order",
+				"severity": "off"
+			},
+			{
+				"rule": "*-dangle",
+				"severity": "off"
+			},
+			{
+				"rule": "*-newline",
+				"severity": "off"
+			},
+			{
+				"rule": "*quotes",
+				"severity": "off"
+			},
+			{
+				"rule": "*semi",
+				"severity": "off"
+			}
+		],
+		"eslint.validate": [
+			"code-workspace",
+			"javascript",
+			"javascriptreact",
+			"typescript",
+			"typescriptreact",
+			"vue",
+			"html",
+			"markdown",
+			"json",
+			"jsonc",
+			"yaml",
+			"toml",
+			"gql",
+			"graphql"
+		],
+		"i18n-ally.localesPaths": [
+			"easytier-gui/locales"
+		]
+	}
+}

README.md

@@ -3,15 +3,25 @@
  [![GitHub](https://img.shields.io/github/license/KKRainbow/EasyTier)](https://github.com/KKRainbow/EasyTier/blob/main/LICENSE)
  [![GitHub last commit](https://img.shields.io/github/last-commit/KKRainbow/EasyTier)](https://github.com/KKRainbow/EasyTier/commits/main)
  [![GitHub issues](https://img.shields.io/github/issues/KKRainbow/EasyTier)](https://github.com/KKRainbow/EasyTier/issues)
- [![GitHub actions](https://github.com/KKRainbow/EasyTier/actions/workflows/rust.yml/badge.svg)](https://github.com/KKRainbow/EasyTier/actions/)
+ [![GitHub Core Actions](https://github.com/KKRainbow/EasyTier/actions/workflows/core.yml/badge.svg)](https://github.com/EasyTier/EasyTier/actions/workflows/core.yml)
+ [![GitHub GUI Actions](https://github.com/KKRainbow/EasyTier/actions/workflows/gui.yml/badge.svg)](https://github.com/EasyTier/EasyTier/actions/workflows/gui.yml)
  
 [简体中文](/README_CN.md) | [English](/README.md)
 
- EasyTier is a simple, plug-and-play, decentralized VPN networking solution implemented with the Rust language and Tokio framework.
+ **Please visit the [EasyTier Official Website](https://www.easytier.top/en/) to view the full documentation.**
+
+ EasyTier is a simple, safe and decentralized VPN networking solution implemented with the Rust language and Tokio framework.
+
+<p align="center">
+<img src="assets/image-5.png" width="300">
+<img src="assets/image-4.png" width="300">
+</p>
  
  ## Features
  
 - **Decentralized**: No need to rely on centralized services, nodes are equal and independent.
+- **Safe**: Use WireGuard protocol to encrypt data.
+- **High Performance**: Full-link zero-copy, with performance comparable to mainstream networking software.
 - **Cross-platform**: Supports MacOS/Linux/Windows, will support IOS and Android in the future. The executable file is statically linked, making deployment simple.
 - **Networking without public IP**: Supports networking using shared public nodes, refer to [Configuration Guide](#Networking-without-public-IP)
 - **NAT traversal**: Supports UDP-based NAT traversal, able to establish stable connections even in complex network environments.
@@ -19,13 +29,15 @@
 - **Smart Routing**: Selects links based on traffic to reduce latency and increase throughput.
 - **TCP Support**: Provides reliable data transmission through concurrent TCP links when UDP is limited, optimizing performance.
 - **High Availability**: Supports multi-path and switches to healthy paths when high packet loss or network errors are detected.
+- **IPv6 Support**: Supports networking using IPv6.
+- **Multiple Protocol Types**: Supports communication between nodes using protocols such as WebSocket and QUIC.
 
  
  ## Installation
  
  1. **Download the precompiled binary file**
  
-     Visit the [GitHub Release page](https://github.com/KKRainbow/EasyTier/releases) to download the binary file suitable for your operating system.
+     Visit the [GitHub Release page](https://github.com/KKRainbow/EasyTier/releases) to download the binary file suitable for your operating system. Release includes both command-line programs and GUI programs in the compressed package.
  
  2. **Install via crates.io**
     ```sh
@@ -38,6 +50,8 @@
     ```
  
  ## Quick Start
+
+ > The following text only describes the use of the command-line tool; the GUI program can be configured by referring to the following concepts.
  
  Make sure EasyTier is installed according to the [Installation Guide](#Installation), and both easytier-core and easytier-cli commands are available.
  
@@ -66,7 +80,7 @@
     ```
     Successful execution of the command will print the following.
  
-    ![alt text](assets/image-2.png)
+    ![alt text](/assets/image-2.png)
  
  2. Execute on Node B
     ```sh
@@ -84,11 +98,11 @@
     ```sh
     easytier-cli peer
     ```
-    ![alt text](assets/image.png)
+    ![alt text](/assets/image.png)
     ```sh
     easytier-cli route
     ```
-    ![alt text](assets/image-1.png)
+    ![alt text](/assets/image-1.png)
 
 ---
  
@@ -138,7 +152,7 @@
     ```sh
     easytier-cli route
     ```
-    ![alt text](assets/image-3.png)
+    ![alt text](/assets/image-3.png)
  
 2. Test whether Node A can access nodes under the proxied subnet
  
@@ -157,17 +171,75 @@
  Taking two nodes as an example, Node A executes:
  
  ```sh
- sudo easytier-core -i 10.144.144.1 --network-name abc --network-secret abc -e 'tcp://easytier.public.kkrainbow.top:11010'
+ sudo easytier-core -i 10.144.144.1 --network-name abc --network-secret abc -e tcp://easytier.public.kkrainbow.top:11010
  ```
  
  Node B executes
  
  ```sh
- sudo easytier-core --ipv4 10.144.144.2 --network-name abc --network-secret abc -e 'tcp://easytier.public.kkrainbow.top:11010'
+ sudo easytier-core --ipv4 10.144.144.2 --network-name abc --network-secret abc -e tcp://easytier.public.kkrainbow.top:11010
  ```
  
  After the command is successfully executed, Node A can access Node B through the virtual IP 10.144.144.2.
  
+ ### Use EasyTier with WireGuard Client
+
+ EasyTier can be used as a WireGuard server to allow any device with WireGuard client installed to access the EasyTier network. For platforms currently unsupported by EasyTier (such as iOS, Android, etc.), this method can be used to connect to the EasyTier network.
+
+Assuming the network topology is as follows:
+
+```mermaid
+flowchart LR
+
+ios[[iPhone \n WireGuard Installed]]
+
+subgraph Node A IP 22.1.1.1
+nodea[EasyTier\n10.144.144.1]
+end
+
+subgraph Node B
+nodeb[EasyTier\n10.144.144.2]
+end
+
+id1[[10.1.1.0/24]]
+
+ios <-.-> nodea <--> nodeb <-.-> id1
+```
+
+To enable an iPhone to access the EasyTier network through Node A, the following configuration can be applied:
+
+Include the --vpn-portal parameter in the easytier-core command on Node A to specify the port that the WireGuard service listens on and the subnet used by the WireGuard network.
+
+```
+# The following parameters mean: listen on port 0.0.0.0:11013, and use the 10.14.14.0/24 subnet for WireGuard
+sudo easytier-core --ipv4 10.144.144.1 --vpn-portal wg://0.0.0.0:11013/10.14.14.0/24
+```
+
+After successfully starting easytier-core, use easytier-cli to obtain the WireGuard client configuration.
+
+```
+$> easytier-cli vpn-portal
+portal_name: wireguard
+
+############### client_config_start ###############
+
+[Interface]
+PrivateKey = 9VDvlaIC9XHUvRuE06hD2CEDrtGF+0lDthgr9SZfIho=
+Address = 10.14.14.0/32 # should assign an ip from this cidr manually
+
+[Peer]
+PublicKey = zhrZQg4QdPZs8CajT3r4fmzcNsWpBL9ImQCUsnlXyGM=
+AllowedIPs = 10.144.144.0/24,10.14.14.0/24
+Endpoint = 0.0.0.0:11013 # should be the public ip(or domain) of the vpn server
+PersistentKeepalive = 25
+
+############### client_config_end ###############
+
+connected_clients:
+[]
+```
+
+Before using the Client Config, you need to modify the Interface Address and Peer Endpoint to the client's IP and the IP of the EasyTier node, respectively. Import the configuration file into the WireGuard client to access the EasyTier network.
  
  ### Configurations
  
@@ -190,6 +262,7 @@
  - [ZeroTier](https://www.zerotier.com/): A global virtual network for connecting devices.
  - [TailScale](https://tailscale.com/): A VPN solution aimed at simplifying network configuration.
  - [vpncloud](https://github.com/dswd/vpncloud): A P2P Mesh VPN
+ - [Candy](https://github.com/lanthora/candy): A reliable, low-latency, and anti-censorship virtual private network
  
  # License
  
@@ -199,4 +272,5 @@
  
  - Ask questions or report problems: [GitHub Issues](https://github.com/KKRainbow/EasyTier/issues)
  - Discussion and exchange: [GitHub Discussions](https://github.com/KKRainbow/EasyTier/discussions)
- - QQ Group: 949700262
+ - Telegram：https://t.me/easytier
+ - QQ Group: 949700262

README_CN.md

@@ -3,15 +3,25 @@
 [![GitHub](https://img.shields.io/github/license/KKRainbow/EasyTier)](https://github.com/KKRainbow/EasyTier/blob/main/LICENSE)
 [![GitHub last commit](https://img.shields.io/github/last-commit/KKRainbow/EasyTier)](https://github.com/KKRainbow/EasyTier/commits/main)
 [![GitHub issues](https://img.shields.io/github/issues/KKRainbow/EasyTier)](https://github.com/KKRainbow/EasyTier/issues)
-[![GitHub actions](https://github.com/KKRainbow/EasyTier/actions/workflows/rust.yml/badge.svg)](https://github.com/KKRainbow/EasyTier/actions/)
+[![GitHub Core Actions](https://github.com/KKRainbow/EasyTier/actions/workflows/core.yml/badge.svg)](https://github.com/EasyTier/EasyTier/actions/workflows/core.yml)
+[![GitHub GUI Actions](https://github.com/KKRainbow/EasyTier/actions/workflows/gui.yml/badge.svg)](https://github.com/EasyTier/EasyTier/actions/workflows/gui.yml)
 
 [简体中文](/README_CN.md) | [English](/README.md)
 
-一个简单、即插即用、去中心化的内网穿透 VPN 组网方案，使用 Rust 语言和 Tokio 框架实现。
+**请访问 [EasyTier 官网](https://www.easytier.top/) 以查看完整的文档。**
+
+一个简单、安全、去中心化的内网穿透 VPN 组网方案，使用 Rust 语言和 Tokio 框架实现。
+
+<p align="center">
+<img src="assets/image-6.png" width="300">
+<img src="assets/image-7.png" width="300">
+</p>
 
 ## 特点
 
 - **去中心化**：无需依赖中心化服务，节点平等且独立。
+- **安全**：支持利用 WireGuard 加密通信，也支持 AES-GCM 加密保护中转流量。
+- **高性能**：全链路零拷贝，性能与主流组网软件相当。
 - **跨平台**：支持 MacOS/Linux/Windows，未来将支持 IOS 和 Android。可执行文件静态链接，部署简单。
 - **无公网 IP 组网**：支持利用共享的公网节点组网，可参考 [配置指南](#无公网IP组网)
 - **NAT 穿透**：支持基于 UDP 的 NAT 穿透，即使在复杂的网络环境下也能建立稳定的连接。
@@ -19,12 +29,14 @@
 - **智能路由**：根据流量智能选择链路，减少延迟，提高吞吐量。
 - **TCP 支持**：在 UDP 受限的情况下，通过并发 TCP 链接提供可靠的数据传输，优化性能。
 - **高可用性**：支持多路径和在检测到高丢包率或网络错误时切换到健康路径。
+- **IPV6 支持**：支持利用 IPV6 组网。
+- **多协议类型**: 支持使用 WebSocket、QUIC 等协议进行节点间通信。
 
 ## 安装
 
 1. **下载预编译的二进制文件**
 
-    访问 [GitHub Release 页面](https://github.com/KKRainbow/EasyTier/releases) 下载适用于您操作系统的二进制文件。
+    访问 [GitHub Release 页面](https://github.com/KKRainbow/EasyTier/releases) 下载适用于您操作系统的二进制文件。Release 压缩包中同时包含命令行程序和图形界面程序。
 
 2. **通过 crates.io 安装**
    ```sh
@@ -39,6 +51,8 @@
 
 ## 快速开始
 
+> 下文仅描述命令行工具的使用，图形界面程序可参考下述概念自行配置。
+
 确保已按照 [安装指南](#安装) 安装 EasyTier，并且 easytier-core 和 easytier-cli 两个命令都已经可用。
 
 ### 双节点组网
@@ -66,7 +80,7 @@ nodea <-----> nodeb
    ```
    命令执行成功会有如下打印。
 
-   ![alt text](assets/image-2.png)
+   ![alt text](/assets/image-2.png)
 
 2. 在节点 B 执行
    ```sh
@@ -84,11 +98,11 @@ nodea <-----> nodeb
    ```sh
    easytier-cli peer
    ```
-   ![alt text](assets/image.png)
+   ![alt text](/assets/image.png)
    ```sh
    easytier-cli route
    ```
-   ![alt text](assets/image-1.png)
+   ![alt text](/assets/image-1.png)
 
 ---
 
@@ -138,7 +152,7 @@ sudo easytier-core --ipv4 10.144.144.2 -n 10.1.1.0/24
    ```sh
    easytier-cli route
    ```
-   ![alt text](assets/image-3.png)
+   ![alt text](/assets/image-3.png)
 
 2. 测试节点 A 是否可访问被代理子网下的节点
 
@@ -157,19 +171,80 @@ EasyTier 支持共享公网节点进行组网。目前已部署共享的公网
 以双节点为例，节点 A 执行：
 
 ```sh
-sudo easytier-core -i 10.144.144.1 --network-name abc --network-secret abc -e 'tcp://easytier.public.kkrainbow.top:11010'
+sudo easytier-core -i 10.144.144.1 --network-name abc --network-secret abc -e tcp://easytier.public.kkrainbow.top:11010
 ```
 
 节点 B 执行
 
 ```sh
-sudo easytier-core --ipv4 10.144.144.2 --network-name abc --network-secret abc -e 'tcp://easytier.public.kkrainbow.top:11010'
+sudo easytier-core --ipv4 10.144.144.2 --network-name abc --network-secret abc -e tcp://easytier.public.kkrainbow.top:11010
 ```
 
 命令执行成功后，节点 A 即可通过虚拟 IP 10.144.144.2 访问节点 B。
 
 ---
 
+### 使用 WireGuard 客户端接入
+
+EasyTier 可以用作 WireGuard 服务端，让任意安装了 WireGuard 客户端的设备访问 EasyTier 网络。对于目前 EasyTier 不支持的平台 （如 iOS、Android 等），可以使用这种方式接入 EasyTier 网络。
+
+假设网络拓扑如下：
+
+```mermaid
+flowchart LR
+
+ios[[iPhone \n 安装 WireGuard]]
+
+subgraph 节点 A IP 22.1.1.1
+nodea[EasyTier\n10.144.144.1]
+end
+
+subgraph 节点 B
+nodeb[EasyTier\n10.144.144.2]
+end
+
+id1[[10.1.1.0/24]]
+
+ios <-.-> nodea <--> nodeb <-.-> id1
+```
+
+我们需要 iPhone 通过节点 A 访问 EasyTier 网络，则可进行如下配置：
+
+在节点 A 的 easytier-core 命令中，加入 --vpn-portal 参数，指定 WireGuard 服务监听的端口，以及 WireGuard 网络使用的网段。
+
+```
+# 以下参数的含义为： 监听 0.0.0.0:11013 端口，WireGuard 使用 10.14.14.0/24 网段
+sudo easytier-core --ipv4 10.144.144.1 --vpn-portal wg://0.0.0.0:11013/10.14.14.0/24
+```
+
+easytier-core 启动成功后，使用 easytier-cli 获取 WireGuard Client 的配置。
+
+```
+$> easytier-cli vpn-portal
+portal_name: wireguard
+
+############### client_config_start ###############
+
+[Interface]
+PrivateKey = 9VDvlaIC9XHUvRuE06hD2CEDrtGF+0lDthgr9SZfIho=
+Address = 10.14.14.0/32 # should assign an ip from this cidr manually
+
+[Peer]
+PublicKey = zhrZQg4QdPZs8CajT3r4fmzcNsWpBL9ImQCUsnlXyGM=
+AllowedIPs = 10.144.144.0/24,10.14.14.0/24
+Endpoint = 0.0.0.0:11013 # should be the public ip(or domain) of the vpn server
+PersistentKeepalive = 25
+
+############### client_config_end ###############
+
+connected_clients:
+[]
+```
+
+使用 Client Config 前，需要将 Interface Address 和 Peer Endpoint 分别修改为客户端的 IP 和 EasyTier 节点的 IP。将配置文件导入 WireGuard 客户端，即可访问 EasyTier 网络。
+
+---
+
 ### 其他配置
 
 可使用 ``easytier-core --help`` 查看全部配置项
@@ -178,7 +253,7 @@ sudo easytier-core --ipv4 10.144.144.2 --network-name abc --network-secret abc -
 # 路线图
 
 - [ ] 完善文档和用户指南。
-- [ ] 支持加密、TCP 打洞等特性。
+- [ ] 支持 TCP 打洞等特性。
 - [ ] 支持 Android、IOS 等移动平台。
 - [ ] 支持 Web 配置管理。
 
@@ -191,6 +266,7 @@ sudo easytier-core --ipv4 10.144.144.2 --network-name abc --network-secret abc -
 - [ZeroTier](https://www.zerotier.com/): 一个全球虚拟网络，用于连接设备。
 - [TailScale](https://tailscale.com/): 一个旨在简化网络配置的 VPN 解决方案。
 - [vpncloud](https://github.com/dswd/vpncloud): 一个 P2P Mesh VPN
+- [Candy](https://github.com/lanthora/candy): 可靠、低延迟、抗审查的虚拟专用网络
 
 # 许可证
 
@@ -200,4 +276,5 @@ EasyTier 根据 [Apache License 2.0](https://github.com/KKRainbow/EasyTier/blob/
 
 - 提问或报告问题：[GitHub Issues](https://github.com/KKRainbow/EasyTier/issues)
 - 讨论和交流：[GitHub Discussions](https://github.com/KKRainbow/EasyTier/discussions)
-- QQ 群： 949700262
+- QQ 群： 949700262
+- Telegram：https://t.me/easytier

easytier-gui/.gitignore

@@ -0,0 +1,25 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist
+dist-ssr
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+!.vscode/settings.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?

easytier-gui/.npmrc

@@ -0,0 +1,2 @@
+shamefully-hoist=true
+strict-peer-dependencies=false

easytier-gui/.vscode/extensions.json

@@ -0,0 +1,7 @@
+{
+  "recommendations": [
+    "dbaeumer.vscode-eslint",
+    "vue.volar",
+    "lokalise.i18n-ally"
+  ]
+}

easytier-gui/.vscode/settings.json

@@ -0,0 +1,5 @@
+{
+  "i18n-ally.localesPaths": [
+    "locales"
+  ]
+}

easytier-gui/README.md

@@ -0,0 +1,16 @@
+# Tauri + Vue 3 + TypeScript
+
+This template should help get you started developing with Vue 3 and TypeScript in Vite. The template uses Vue 3 `<script setup>` SFCs, check out the [script setup docs](https://v3.vuejs.org/api/sfc-script-setup.html#sfc-script-setup) to learn more.
+
+## Recommended IDE Setup
+
+- [VS Code](https://code.visualstudio.com/) + [Volar](https://marketplace.visualstudio.com/items?itemName=Vue.volar) + [Tauri](https://marketplace.visualstudio.com/items?itemName=tauri-apps.tauri-vscode) + [rust-analyzer](https://marketplace.visualstudio.com/items?itemName=rust-lang.rust-analyzer)
+
+## Type Support For `.vue` Imports in TS
+
+Since TypeScript cannot handle type information for `.vue` imports, they are shimmed to be a generic Vue component type by default. In most cases this is fine if you don't really care about component prop types outside of templates. However, if you wish to get actual prop types in `.vue` imports (for example to get props validation when using manual `h(...)` calls), you can enable Volar's Take Over mode by following these steps:
+
+1. Run `Extensions: Show Built-in Extensions` from VS Code's command palette, look for `TypeScript and JavaScript Language Features`, then right click and select `Disable (Workspace)`. By default, Take Over mode will enable itself if the default TypeScript extension is disabled.
+2. Reload the VS Code window by running `Developer: Reload Window` from the command palette.
+
+You can learn more about Take Over mode [here](https://github.com/johnsoncodehk/volar/discussions/471).

easytier-gui/eslint.config.js

@@ -0,0 +1,12 @@
+// @ts-check
+import antfu from '@antfu/eslint-config'
+
+export default antfu({
+  formatters: true,
+  rules: {
+    'style/eol-last': ['error', 'always'],
+  },
+  ignores: [
+    'src-tauri/**',
+  ],
+})

easytier-gui/index.html

@@ -0,0 +1,14 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/svg+xml" href="/vite.svg" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Tauri + Vue + TS</title>
+  </head>
+
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>

easytier-gui/locales/cn.yml

@@ -0,0 +1,65 @@
+network: 网络
+networking_method: 网络方式
+public_server: 公共服务器
+manual: 手动
+standalone: 独立
+virtual_ipv4: 虚拟IPv4地址
+virtual_ipv4_dhcp: DHCP
+network_name: 网络名称
+network_secret: 网络密码
+public_server_url: 公共服务器地址
+peer_urls: 对等节点地址
+proxy_cidrs: 子网代理CIDR
+enable_vpn_portal: 启用VPN门户
+vpn_portal_listen_port: 监听端口
+vpn_portal_client_network: 客户端子网
+advanced_settings: 高级设置
+basic_settings: 基础设置
+listener_urls: 监听地址
+rpc_port: RPC端口
+config_network: 配置网络
+running: 运行中
+error_msg: 错误信息
+detail: 详情
+add_new_network: 添加新网络
+del_cur_network: 删除当前网络
+select_network: 选择网络
+network_instances: 网络实例
+instance_id: 实例ID
+network_infos: 网络信息
+parse_network_config: 解析网络配置
+retain_network_instance: 保留网络实例
+collect_network_infos: 收集网络信息
+settings: 设置
+exchange_language: Switch to English
+disable_auto_launch: 关闭开机自启
+enable_auto_launch: 开启开机自启
+exit: 退出
+chips_placeholder: 例如： {0}, 按回车添加
+hostname_placeholder: '留空默认为主机名: {0}'
+off_text: 点击关闭
+on_text: 点击开启
+show_config: 显示配置
+close: 关闭
+
+my_node_info: 当前节点信息
+peer_count: 已连接
+upload: 上传
+download: 下载
+show_vpn_portal_config: 显示VPN门户配置
+vpn_portal_config: VPN门户配置
+show_event_log: 显示事件日志
+event_log: 事件日志
+peer_info: 节点信息
+hostname: 主机名
+route_cost: 路由
+latency: 延迟
+upload_bytes: 上传
+download_bytes: 下载
+loss_rate: 丢包率
+
+run_network: 运行网络
+stop_network: 停止网络
+network_running: 运行中
+network_stopped: 已停止
+dhcp_experimental_warning: 实验性警告！使用DHCP时如果组网环境中发生IP冲突，将自动更改IP。

easytier-gui/locales/en.yml

@@ -0,0 +1,65 @@
+network: Network
+networking_method: Networking Method
+public_server: Public Server
+manual: Manual
+standalone: Standalone
+virtual_ipv4: Virtual IPv4
+virtual_ipv4_dhcp: DHCP
+network_name: Network Name
+network_secret: Network Secret
+public_server_url: Public Server URL
+peer_urls: Peer URLs
+proxy_cidrs: Subnet Proxy CIDRs
+enable_vpn_portal: Enable VPN Portal
+vpn_portal_listen_port: VPN Portal Listen Port
+vpn_portal_client_network: Client Sub Network
+advanced_settings: Advanced Settings
+basic_settings: Basic Settings
+listener_urls: Listener URLs
+rpc_port: RPC Port
+config_network: Config Network
+running: Running
+error_msg: Error Message
+detail: Detail
+add_new_network: Add New Network
+del_cur_network: Delete Current Network
+select_network: Select Network
+network_instances: Network Instances
+instance_id: Instance ID
+network_infos: Network Infos
+parse_network_config: Parse Network Config
+retain_network_instance: Retain Network Instance
+collect_network_infos: Collect Network Infos
+settings: Settings
+exchange_language: 切换中文
+disable_auto_launch: Disable Launch on Reboot
+enable_auto_launch: Enable Launch on Reboot
+exit: Exit
+
+chips_placeholder: 'e.g: {0}, press Enter to add'
+hostname_placeholder: 'Leave blank and default to host name: {0}'
+off_text: Press to disable
+on_text: Press to enable
+show_config: Show Config
+close: Close
+my_node_info: My Node Info
+peer_count: Connected
+upload: Upload
+download: Download
+show_vpn_portal_config: Show VPN Portal Config
+vpn_portal_config: VPN Portal Config
+show_event_log: Show Event Log
+event_log: Event Log
+peer_info: Peer Info
+route_cost: Route Cost
+hostname: Hostname
+latency: Latency
+upload_bytes: Upload
+download_bytes: Download
+loss_rate: Loss Rate
+
+run_network: Run Network
+stop_network: Stop Network
+network_running: running
+network_stopped: stopped
+dhcp_experimental_warning: Experimental warning! if there is an IP conflict in the network when using DHCP, the IP will be automatically changed.

easytier-gui/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "easytier-gui",
+  "type": "module",
+  "version": "0.0.0",
+  "private": true,
+  "scripts": {
+    "dev": "vite",
+    "build": "vue-tsc --noEmit && vite build",
+    "preview": "vite preview",
+    "tauri": "tauri",
+    "lint": "eslint . --ignore-pattern src-tauri",
+    "lint:fix": "eslint . --ignore-pattern src-tauri --fix"
+  },
+  "dependencies": {
+    "@tauri-apps/api": "^1.5.5",
+    "pinia": "^2.1.7",
+    "primeflex": "^3.3.1",
+    "primeicons": "^7.0.0",
+    "primevue": "^3.52.0",
+    "vue": "^3.4.27",
+    "vue-i18n": "^9.13.1",
+    "vue-router": "^4.3.2"
+  },
+  "devDependencies": {
+    "@antfu/eslint-config": "^2.17.0",
+    "@intlify/unplugin-vue-i18n": "^4.0.0",
+    "@tauri-apps/cli": "^1.5.13",
+    "@types/node": "^20.12.11",
+    "@types/uuid": "^9.0.8",
+    "@vitejs/plugin-vue": "^5.0.4",
+    "@vue-macros/volar": "^0.19.0",
+    "autoprefixer": "^10.4.19",
+    "eslint": "^9.2.0",
+    "eslint-plugin-format": "^0.1.1",
+    "postcss": "^8.4.38",
+    "tailwindcss": "^3.4.3",
+    "typescript": "^5.4.5",
+    "unplugin-auto-import": "^0.17.6",
+    "unplugin-vue-components": "^0.27.0",
+    "unplugin-vue-macros": "^2.9.2",
+    "unplugin-vue-markdown": "^0.26.2",
+    "unplugin-vue-router": "^0.8.6",
+    "uuid": "^9.0.1",
+    "vite": "^5.2.11",
+    "vite-plugin-vue-devtools": "^7.1.3",
+    "vite-plugin-vue-layouts": "^0.11.0",
+    "vue-i18n": "^9.13.1",
+    "vue-tsc": "^2.0.17"
+  }
+}

easytier-gui/postcss.config.js

@@ -0,0 +1,6 @@
+export default {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+}

easytier-gui/src-tauri/.gitignore

@@ -0,0 +1,7 @@
+# Generated by Cargo
+# will have compiled files and executables
+/target/
+
+# Generated by Tauri
+# will have schema files for capabilities auto-completion
+/gen/schemas

easytier-gui/src-tauri/Cargo.toml

@@ -0,0 +1,38 @@
+[package]
+name = "easytier-gui"
+version = "0.0.0"
+description = "EasyTier GUI"
+authors = ["you"]
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[build-dependencies]
+tauri-build = { version = "1", features = [] }
+
+[dependencies]
+tauri = { version = "1", features = [
+  "process-exit",
+  "system-tray",
+  "shell-open",
+] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+easytier = { path = "../../easytier" }
+tokio = { version = "1", features = ["full"] }
+anyhow = "1.0"
+chrono = { version = "0.4.37", features = ["serde"] }
+
+once_cell = "1.18.0"
+dashmap = "5.5.3"
+
+privilege = "0.3"
+gethostname = "0.4.3"
+
+auto-launch = "0.5.0"
+dunce = "1.0.4"
+
+[features]
+# This feature is used for production builds or when a dev server is not specified, DO NOT REMOVE!!
+custom-protocol = ["tauri/custom-protocol"]

easytier-gui/src-tauri/build.rs

@@ -0,0 +1,34 @@
+fn main() {
+    if !cfg!(debug_assertions) && cfg!(target_os = "windows") {
+        let mut windows = tauri_build::WindowsAttributes::new();
+        windows = windows.app_manifest(
+            r#"
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+  <dependency>
+    <dependentAssembly>
+      <assemblyIdentity
+        type="win32"
+        name="Microsoft.Windows.Common-Controls"
+        version="6.0.0.0"
+        processorArchitecture="*"
+        publicKeyToken="6595b64144ccf1df"
+        language="*"
+      />
+    </dependentAssembly>
+  </dependency>
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+    <security>
+        <requestedPrivileges>
+            <requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
+        </requestedPrivileges>
+    </security>
+  </trustInfo>
+</assembly>
+"#,
+        );
+        tauri_build::try_build(tauri_build::Attributes::new().windows_attributes(windows))
+            .expect("failed to run build script");
+    } else {
+        tauri_build::build();
+    }
+}

easytier-gui/src-tauri/src/main.rs

@@ -0,0 +1,356 @@
+// Prevents additional console window on Windows in release, DO NOT REMOVE!!
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+use std::{collections::BTreeMap, env::current_exe, process};
+
+use anyhow::Context;
+use auto_launch::AutoLaunchBuilder;
+use dashmap::DashMap;
+use easytier::{
+    common::config::{
+        ConfigLoader, NetworkIdentity, PeerConfig, TomlConfigLoader, VpnPortalConfig,
+    },
+    launcher::{NetworkInstance, NetworkInstanceRunningInfo},
+};
+use serde::{Deserialize, Serialize};
+
+use tauri::{
+    CustomMenuItem, Manager, SystemTray, SystemTrayEvent, SystemTrayMenu, SystemTrayMenuItem,
+    Window,
+};
+
+#[derive(Deserialize, Serialize, PartialEq, Debug)]
+enum NetworkingMethod {
+    PublicServer,
+    Manual,
+    Standalone,
+}
+
+impl Default for NetworkingMethod {
+    fn default() -> Self {
+        NetworkingMethod::PublicServer
+    }
+}
+
+#[derive(Deserialize, Serialize, Debug, Default)]
+struct NetworkConfig {
+    instance_id: String,
+
+    dhcp: bool,
+    virtual_ipv4: String,
+    hostname: Option<String>,
+    network_name: String,
+    network_secret: String,
+    networking_method: NetworkingMethod,
+
+    public_server_url: String,
+    peer_urls: Vec<String>,
+
+    proxy_cidrs: Vec<String>,
+
+    enable_vpn_portal: bool,
+    vpn_portal_listen_port: i32,
+    vpn_portal_client_network_addr: String,
+    vpn_portal_client_network_len: i32,
+
+    advanced_settings: bool,
+
+    listener_urls: Vec<String>,
+    rpc_port: i32,
+}
+
+impl NetworkConfig {
+    fn gen_config(&self) -> Result<TomlConfigLoader, anyhow::Error> {
+        let cfg = TomlConfigLoader::default();
+        cfg.set_id(
+            self.instance_id
+                .parse()
+                .with_context(|| format!("failed to parse instance id: {}", self.instance_id))?,
+        );
+        cfg.set_hostname(self.hostname.clone());
+        cfg.set_dhcp(self.dhcp);
+        cfg.set_inst_name(self.network_name.clone());
+        cfg.set_network_identity(NetworkIdentity::new(
+            self.network_name.clone(),
+            self.network_secret.clone(),
+        ));
+
+        if !self.dhcp {
+            if self.virtual_ipv4.len() > 0 {
+                cfg.set_ipv4(Some(self.virtual_ipv4.parse().with_context(|| {
+                    format!("failed to parse ipv4 address: {}", self.virtual_ipv4)
+                })?))
+            }
+        }
+
+        match self.networking_method {
+            NetworkingMethod::PublicServer => {
+                cfg.set_peers(vec![PeerConfig {
+                    uri: self.public_server_url.parse().with_context(|| {
+                        format!(
+                            "failed to parse public server uri: {}",
+                            self.public_server_url
+                        )
+                    })?,
+                }]);
+            }
+            NetworkingMethod::Manual => {
+                let mut peers = vec![];
+                for peer_url in self.peer_urls.iter() {
+                    if peer_url.is_empty() {
+                        continue;
+                    }
+                    peers.push(PeerConfig {
+                        uri: peer_url
+                            .parse()
+                            .with_context(|| format!("failed to parse peer uri: {}", peer_url))?,
+                    });
+                }
+
+                cfg.set_peers(peers);
+            }
+            NetworkingMethod::Standalone => {}
+        }
+
+        let mut listener_urls = vec![];
+        for listener_url in self.listener_urls.iter() {
+            if listener_url.is_empty() {
+                continue;
+            }
+            listener_urls.push(
+                listener_url
+                    .parse()
+                    .with_context(|| format!("failed to parse listener uri: {}", listener_url))?,
+            );
+        }
+        cfg.set_listeners(listener_urls);
+
+        for n in self.proxy_cidrs.iter() {
+            cfg.add_proxy_cidr(
+                n.parse()
+                    .with_context(|| format!("failed to parse proxy network: {}", n))?,
+            );
+        }
+
+        cfg.set_rpc_portal(
+            format!("127.0.0.1:{}", self.rpc_port)
+                .parse()
+                .with_context(|| format!("failed to parse rpc portal port: {}", self.rpc_port))?,
+        );
+
+        if self.enable_vpn_portal {
+            let cidr = format!(
+                "{}/{}",
+                self.vpn_portal_client_network_addr, self.vpn_portal_client_network_len
+            );
+            cfg.set_vpn_portal_config(VpnPortalConfig {
+                client_cidr: cidr
+                    .parse()
+                    .with_context(|| format!("failed to parse vpn portal client cidr: {}", cidr))?,
+                wireguard_listen: format!("0.0.0.0:{}", self.vpn_portal_listen_port)
+                    .parse()
+                    .with_context(|| {
+                        format!(
+                            "failed to parse vpn portal wireguard listen port. {}",
+                            self.vpn_portal_listen_port
+                        )
+                    })?,
+            });
+        }
+
+        Ok(cfg)
+    }
+}
+
+static INSTANCE_MAP: once_cell::sync::Lazy<DashMap<String, NetworkInstance>> =
+    once_cell::sync::Lazy::new(DashMap::new);
+
+// Learn more about Tauri commands at https://tauri.app/v1/guides/features/command
+#[tauri::command]
+fn parse_network_config(cfg: NetworkConfig) -> Result<String, String> {
+    let toml = cfg.gen_config().map_err(|e| e.to_string())?;
+    Ok(toml.dump())
+}
+
+#[tauri::command]
+fn run_network_instance(cfg: NetworkConfig) -> Result<(), String> {
+    if INSTANCE_MAP.contains_key(&cfg.instance_id) {
+        return Err("instance already exists".to_string());
+    }
+    let instance_id = cfg.instance_id.clone();
+
+    let cfg = cfg.gen_config().map_err(|e| e.to_string())?;
+    let mut instance = NetworkInstance::new(cfg);
+    instance.start().map_err(|e| e.to_string())?;
+
+    println!("instance {} started", instance_id);
+    INSTANCE_MAP.insert(instance_id, instance);
+    Ok(())
+}
+
+#[tauri::command]
+fn retain_network_instance(instance_ids: Vec<String>) -> Result<(), String> {
+    let _ = INSTANCE_MAP.retain(|k, _| instance_ids.contains(k));
+    println!(
+        "instance {:?} retained",
+        INSTANCE_MAP
+            .iter()
+            .map(|item| item.key().clone())
+            .collect::<Vec<_>>()
+    );
+    Ok(())
+}
+
+#[tauri::command]
+fn collect_network_infos() -> Result<BTreeMap<String, NetworkInstanceRunningInfo>, String> {
+    let mut ret = BTreeMap::new();
+    for instance in INSTANCE_MAP.iter() {
+        if let Some(info) = instance.get_running_info() {
+            ret.insert(instance.key().clone(), info);
+        }
+    }
+    Ok(ret)
+}
+
+#[tauri::command]
+fn get_os_hostname() -> Result<String, String> {
+    Ok(gethostname::gethostname().to_string_lossy().to_string())
+}
+
+#[tauri::command]
+fn set_auto_launch_status(app_handle: tauri::AppHandle, enable: bool) -> Result<bool, String> {
+    Ok(init_launch(&app_handle, enable).map_err(|e| e.to_string())?)
+}
+
+fn toggle_window_visibility(window: &Window) {
+    if window.is_visible().unwrap() {
+        window.hide().unwrap();
+    } else {
+        window.show().unwrap();
+        window.set_focus().unwrap();
+    }
+}
+
+fn check_sudo() -> bool {
+    let is_elevated = privilege::user::privileged();
+    if !is_elevated {
+        let Ok(my_exe) = current_exe() else {
+            return true;
+        };
+        let mut elevated_cmd = privilege::runas::Command::new(my_exe);
+        let _ = elevated_cmd.force_prompt(true).gui(true).run();
+    }
+    is_elevated
+}
+
+/// init the auto launch
+pub fn init_launch(_app_handle: &tauri::AppHandle, enable: bool) -> Result<bool, anyhow::Error> {
+    let app_exe = current_exe()?;
+    let app_exe = dunce::canonicalize(app_exe)?;
+    let app_name = app_exe
+        .file_stem()
+        .and_then(|f| f.to_str())
+        .ok_or(anyhow::anyhow!("failed to get file stem"))?;
+
+    let app_path = app_exe
+        .as_os_str()
+        .to_str()
+        .ok_or(anyhow::anyhow!("failed to get app_path"))?
+        .to_string();
+
+    #[cfg(target_os = "windows")]
+    let app_path = format!("\"{app_path}\"");
+
+    // use the /Applications/easytier-gui.app
+    #[cfg(target_os = "macos")]
+    let app_path = (|| -> Option<String> {
+        let path = std::path::PathBuf::from(&app_path);
+        let path = path.parent()?.parent()?.parent()?;
+        let extension = path.extension()?.to_str()?;
+        match extension == "app" {
+            true => Some(path.as_os_str().to_str()?.to_string()),
+            false => None,
+        }
+    })()
+    .unwrap_or(app_path);
+
+    #[cfg(target_os = "linux")]
+    let app_path = {
+        let appimage = _app_handle.env().appimage;
+        appimage
+            .and_then(|p| p.to_str().map(|s| s.to_string()))
+            .unwrap_or(app_path)
+    };
+
+    let auto = AutoLaunchBuilder::new()
+        .set_app_name(app_name)
+        .set_app_path(&app_path)
+        .build()
+        .with_context(|| "failed to build auto launch")?;
+
+    if enable && !auto.is_enabled().unwrap_or(false) {
+        // 避免重复设置登录项
+        let _ = auto.disable();
+        auto.enable()
+            .with_context(|| "failed to enable auto launch")?
+    } else if !enable {
+        let _ = auto.disable();
+    }
+
+    let enabled = auto.is_enabled()?;
+
+    Ok(enabled)
+}
+
+fn main() {
+    if !check_sudo() {
+        process::exit(0);
+    }
+    let quit = CustomMenuItem::new("quit".to_string(), "退出 Quit");
+    let hide = CustomMenuItem::new("hide".to_string(), "显示 Show / 隐藏 Hide");
+    let tray_menu = SystemTrayMenu::new()
+        .add_item(quit)
+        .add_native_item(SystemTrayMenuItem::Separator)
+        .add_item(hide);
+
+    tauri::Builder::default()
+        .invoke_handler(tauri::generate_handler![
+            parse_network_config,
+            run_network_instance,
+            retain_network_instance,
+            collect_network_infos,
+            get_os_hostname,
+            set_auto_launch_status
+        ])
+        .system_tray(SystemTray::new().with_menu(tray_menu))
+        .on_system_tray_event(|app, event| match event {
+            SystemTrayEvent::DoubleClick {
+                position: _,
+                size: _,
+                ..
+            } => {
+                let window = app.get_window("main").unwrap();
+                toggle_window_visibility(&window);
+            }
+            SystemTrayEvent::MenuItemClick { id, .. } => match id.as_str() {
+                "quit" => {
+                    std::process::exit(0);
+                }
+                "hide" => {
+                    let window = app.get_window("main").unwrap();
+                    toggle_window_visibility(&window);
+                }
+                _ => {}
+            },
+            _ => {}
+        })
+        .on_window_event(|event| match event.event() {
+            tauri::WindowEvent::CloseRequested { api, .. } => {
+                event.window().hide().unwrap();
+                api.prevent_close();
+            }
+            _ => {}
+        })
+        .run(tauri::generate_context!())
+        .expect("error while running tauri application");
+}

easytier-gui/src-tauri/tauri.conf.json

@@ -0,0 +1,49 @@
+{
+  "build": {
+    "beforeDevCommand": "pnpm dev",
+    "beforeBuildCommand": "pnpm build",
+    "devPath": "http://localhost:1420",
+    "distDir": "../dist"
+  },
+  "package": {
+    "productName": "easytier-gui",
+    "version": "0.0.0"
+  },
+  "tauri": {
+    "allowlist": {
+      "all": false,
+      "shell": {
+        "all": false,
+        "open": true
+      },
+      "process": {
+        "exit": true
+      }
+    },
+    "windows": [
+      {
+        "title": "easytier-gui",
+        "width": 800,
+        "height": 600
+      }
+    ],
+    "security": {
+      "csp": null
+    },
+    "systemTray": {
+      "iconPath": "icons/icon.ico",
+      "iconAsTemplate": true
+    },
+    "bundle": {
+      "active": true,
+      "targets": "all",
+      "identifier": "com.kkrainbow.easyiter-client",
+      "icon": [
+        "icons/icon.png",
+        "icons/icon.rgba",
+        "icons/icon.icns",
+        "icons/icon.ico"
+      ]
+    }
+  }
+}

easytier-gui/src-tauri/tauri.windows.conf.json

@@ -0,0 +1,16 @@
+{
+    "tauri": {
+        "bundle": {
+            "externalBin": [],
+            "resources": [
+                "./wintun.dll",
+                "./Packet.dll"
+            ],
+            "windows": {
+                "webviewInstallMode": {
+                    "type": "embedBootstrapper"
+                }
+            }
+        }
+    }
+}

easytier-gui/src/App.vue

@@ -0,0 +1,3 @@
+<template>
+  <RouterView />
+</template>

easytier-gui/src/auto-imports.d.ts

@@ -0,0 +1,263 @@
+/* eslint-disable */
+/* prettier-ignore */
+// @ts-nocheck
+// noinspection JSUnusedGlobalSymbols
+// Generated by unplugin-auto-import
+export {}
+declare global {
+  const EffectScope: typeof import('vue')['EffectScope']
+  const acceptHMRUpdate: typeof import('pinia')['acceptHMRUpdate']
+  const collectNetworkInfos: typeof import('./composables/network')['collectNetworkInfos']
+  const computed: typeof import('vue')['computed']
+  const createApp: typeof import('vue')['createApp']
+  const createPinia: typeof import('pinia')['createPinia']
+  const customRef: typeof import('vue')['customRef']
+  const defineAsyncComponent: typeof import('vue')['defineAsyncComponent']
+  const defineComponent: typeof import('vue')['defineComponent']
+  const definePage: typeof import('unplugin-vue-router/runtime')['definePage']
+  const defineStore: typeof import('pinia')['defineStore']
+  const effectScope: typeof import('vue')['effectScope']
+  const getActivePinia: typeof import('pinia')['getActivePinia']
+  const getCurrentInstance: typeof import('vue')['getCurrentInstance']
+  const getCurrentScope: typeof import('vue')['getCurrentScope']
+  const getOsHostname: typeof import('./composables/network')['getOsHostname']
+  const h: typeof import('vue')['h']
+  const inject: typeof import('vue')['inject']
+  const isProxy: typeof import('vue')['isProxy']
+  const isReactive: typeof import('vue')['isReactive']
+  const isReadonly: typeof import('vue')['isReadonly']
+  const isRef: typeof import('vue')['isRef']
+  const loadRunningInstanceIdsFromLocalStorage: typeof import('./stores/network')['loadRunningInstanceIdsFromLocalStorage']
+  const mapActions: typeof import('pinia')['mapActions']
+  const mapGetters: typeof import('pinia')['mapGetters']
+  const mapState: typeof import('pinia')['mapState']
+  const mapStores: typeof import('pinia')['mapStores']
+  const mapWritableState: typeof import('pinia')['mapWritableState']
+  const markRaw: typeof import('vue')['markRaw']
+  const nextTick: typeof import('vue')['nextTick']
+  const onActivated: typeof import('vue')['onActivated']
+  const onBeforeMount: typeof import('vue')['onBeforeMount']
+  const onBeforeRouteLeave: typeof import('vue-router/auto')['onBeforeRouteLeave']
+  const onBeforeRouteUpdate: typeof import('vue-router/auto')['onBeforeRouteUpdate']
+  const onBeforeUnmount: typeof import('vue')['onBeforeUnmount']
+  const onBeforeUpdate: typeof import('vue')['onBeforeUpdate']
+  const onDeactivated: typeof import('vue')['onDeactivated']
+  const onErrorCaptured: typeof import('vue')['onErrorCaptured']
+  const onMounted: typeof import('vue')['onMounted']
+  const onRenderTracked: typeof import('vue')['onRenderTracked']
+  const onRenderTriggered: typeof import('vue')['onRenderTriggered']
+  const onScopeDispose: typeof import('vue')['onScopeDispose']
+  const onServerPrefetch: typeof import('vue')['onServerPrefetch']
+  const onUnmounted: typeof import('vue')['onUnmounted']
+  const onUpdated: typeof import('vue')['onUpdated']
+  const parseNetworkConfig: typeof import('./composables/network')['parseNetworkConfig']
+  const provide: typeof import('vue')['provide']
+  const reactive: typeof import('vue')['reactive']
+  const readonly: typeof import('vue')['readonly']
+  const ref: typeof import('vue')['ref']
+  const resolveComponent: typeof import('vue')['resolveComponent']
+  const retainNetworkInstance: typeof import('./composables/network')['retainNetworkInstance']
+  const runNetworkInstance: typeof import('./composables/network')['runNetworkInstance']
+  const setActivePinia: typeof import('pinia')['setActivePinia']
+  const setAutoLaunchStatus: typeof import('./composables/network')['setAutoLaunchStatus']
+  const setMapStoreSuffix: typeof import('pinia')['setMapStoreSuffix']
+  const shallowReactive: typeof import('vue')['shallowReactive']
+  const shallowReadonly: typeof import('vue')['shallowReadonly']
+  const shallowRef: typeof import('vue')['shallowRef']
+  const storeToRefs: typeof import('pinia')['storeToRefs']
+  const toRaw: typeof import('vue')['toRaw']
+  const toRef: typeof import('vue')['toRef']
+  const toRefs: typeof import('vue')['toRefs']
+  const toValue: typeof import('vue')['toValue']
+  const triggerRef: typeof import('vue')['triggerRef']
+  const unref: typeof import('vue')['unref']
+  const useAttrs: typeof import('vue')['useAttrs']
+  const useCssModule: typeof import('vue')['useCssModule']
+  const useCssVars: typeof import('vue')['useCssVars']
+  const useI18n: typeof import('vue-i18n')['useI18n']
+  const useLink: typeof import('vue-router/auto')['useLink']
+  const useNetworkStore: typeof import('./stores/network')['useNetworkStore']
+  const useRoute: typeof import('vue-router/auto')['useRoute']
+  const useRouter: typeof import('vue-router/auto')['useRouter']
+  const useSlots: typeof import('vue')['useSlots']
+  const watch: typeof import('vue')['watch']
+  const watchEffect: typeof import('vue')['watchEffect']
+  const watchPostEffect: typeof import('vue')['watchPostEffect']
+  const watchSyncEffect: typeof import('vue')['watchSyncEffect']
+}
+// for type re-export
+declare global {
+  // @ts-ignore
+  export type { Component, ComponentPublicInstance, ComputedRef, ExtractDefaultPropTypes, ExtractPropTypes, ExtractPublicPropTypes, InjectionKey, PropType, Ref, VNode, WritableComputedRef } from 'vue'
+  import('vue')
+}
+// for vue template auto import
+import { UnwrapRef } from 'vue'
+declare module 'vue' {
+  interface GlobalComponents {}
+  interface ComponentCustomProperties {
+    readonly EffectScope: UnwrapRef<typeof import('vue')['EffectScope']>
+    readonly acceptHMRUpdate: UnwrapRef<typeof import('pinia')['acceptHMRUpdate']>
+    readonly collectNetworkInfos: UnwrapRef<typeof import('./composables/network')['collectNetworkInfos']>
+    readonly computed: UnwrapRef<typeof import('vue')['computed']>
+    readonly createApp: UnwrapRef<typeof import('vue')['createApp']>
+    readonly createPinia: UnwrapRef<typeof import('pinia')['createPinia']>
+    readonly customRef: UnwrapRef<typeof import('vue')['customRef']>
+    readonly defineAsyncComponent: UnwrapRef<typeof import('vue')['defineAsyncComponent']>
+    readonly defineComponent: UnwrapRef<typeof import('vue')['defineComponent']>
+    readonly definePage: UnwrapRef<typeof import('unplugin-vue-router/runtime')['definePage']>
+    readonly defineStore: UnwrapRef<typeof import('pinia')['defineStore']>
+    readonly effectScope: UnwrapRef<typeof import('vue')['effectScope']>
+    readonly getActivePinia: UnwrapRef<typeof import('pinia')['getActivePinia']>
+    readonly getCurrentInstance: UnwrapRef<typeof import('vue')['getCurrentInstance']>
+    readonly getCurrentScope: UnwrapRef<typeof import('vue')['getCurrentScope']>
+    readonly getOsHostname: UnwrapRef<typeof import('./composables/network')['getOsHostname']>
+    readonly h: UnwrapRef<typeof import('vue')['h']>
+    readonly inject: UnwrapRef<typeof import('vue')['inject']>
+    readonly isProxy: UnwrapRef<typeof import('vue')['isProxy']>
+    readonly isReactive: UnwrapRef<typeof import('vue')['isReactive']>
+    readonly isReadonly: UnwrapRef<typeof import('vue')['isReadonly']>
+    readonly isRef: UnwrapRef<typeof import('vue')['isRef']>
+    readonly loadRunningInstanceIdsFromLocalStorage: UnwrapRef<typeof import('./stores/network')['loadRunningInstanceIdsFromLocalStorage']>
+    readonly mapActions: UnwrapRef<typeof import('pinia')['mapActions']>
+    readonly mapGetters: UnwrapRef<typeof import('pinia')['mapGetters']>
+    readonly mapState: UnwrapRef<typeof import('pinia')['mapState']>
+    readonly mapStores: UnwrapRef<typeof import('pinia')['mapStores']>
+    readonly mapWritableState: UnwrapRef<typeof import('pinia')['mapWritableState']>
+    readonly markRaw: UnwrapRef<typeof import('vue')['markRaw']>
+    readonly nextTick: UnwrapRef<typeof import('vue')['nextTick']>
+    readonly onActivated: UnwrapRef<typeof import('vue')['onActivated']>
+    readonly onBeforeMount: UnwrapRef<typeof import('vue')['onBeforeMount']>
+    readonly onBeforeRouteLeave: UnwrapRef<typeof import('vue-router/auto')['onBeforeRouteLeave']>
+    readonly onBeforeRouteUpdate: UnwrapRef<typeof import('vue-router/auto')['onBeforeRouteUpdate']>
+    readonly onBeforeUnmount: UnwrapRef<typeof import('vue')['onBeforeUnmount']>
+    readonly onBeforeUpdate: UnwrapRef<typeof import('vue')['onBeforeUpdate']>
+    readonly onDeactivated: UnwrapRef<typeof import('vue')['onDeactivated']>
+    readonly onErrorCaptured: UnwrapRef<typeof import('vue')['onErrorCaptured']>
+    readonly onMounted: UnwrapRef<typeof import('vue')['onMounted']>
+    readonly onRenderTracked: UnwrapRef<typeof import('vue')['onRenderTracked']>
+    readonly onRenderTriggered: UnwrapRef<typeof import('vue')['onRenderTriggered']>
+    readonly onScopeDispose: UnwrapRef<typeof import('vue')['onScopeDispose']>
+    readonly onServerPrefetch: UnwrapRef<typeof import('vue')['onServerPrefetch']>
+    readonly onUnmounted: UnwrapRef<typeof import('vue')['onUnmounted']>
+    readonly onUpdated: UnwrapRef<typeof import('vue')['onUpdated']>
+    readonly parseNetworkConfig: UnwrapRef<typeof import('./composables/network')['parseNetworkConfig']>
+    readonly provide: UnwrapRef<typeof import('vue')['provide']>
+    readonly reactive: UnwrapRef<typeof import('vue')['reactive']>
+    readonly readonly: UnwrapRef<typeof import('vue')['readonly']>
+    readonly ref: UnwrapRef<typeof import('vue')['ref']>
+    readonly resolveComponent: UnwrapRef<typeof import('vue')['resolveComponent']>
+    readonly retainNetworkInstance: UnwrapRef<typeof import('./composables/network')['retainNetworkInstance']>
+    readonly runNetworkInstance: UnwrapRef<typeof import('./composables/network')['runNetworkInstance']>
+    readonly setActivePinia: UnwrapRef<typeof import('pinia')['setActivePinia']>
+    readonly setAutoLaunchStatus: UnwrapRef<typeof import('./composables/network')['setAutoLaunchStatus']>
+    readonly setMapStoreSuffix: UnwrapRef<typeof import('pinia')['setMapStoreSuffix']>
+    readonly shallowReactive: UnwrapRef<typeof import('vue')['shallowReactive']>
+    readonly shallowReadonly: UnwrapRef<typeof import('vue')['shallowReadonly']>
+    readonly shallowRef: UnwrapRef<typeof import('vue')['shallowRef']>
+    readonly storeToRefs: UnwrapRef<typeof import('pinia')['storeToRefs']>
+    readonly toRaw: UnwrapRef<typeof import('vue')['toRaw']>
+    readonly toRef: UnwrapRef<typeof import('vue')['toRef']>
+    readonly toRefs: UnwrapRef<typeof import('vue')['toRefs']>
+    readonly toValue: UnwrapRef<typeof import('vue')['toValue']>
+    readonly triggerRef: UnwrapRef<typeof import('vue')['triggerRef']>
+    readonly unref: UnwrapRef<typeof import('vue')['unref']>
+    readonly useAttrs: UnwrapRef<typeof import('vue')['useAttrs']>
+    readonly useCssModule: UnwrapRef<typeof import('vue')['useCssModule']>
+    readonly useCssVars: UnwrapRef<typeof import('vue')['useCssVars']>
+    readonly useI18n: UnwrapRef<typeof import('vue-i18n')['useI18n']>
+    readonly useLink: UnwrapRef<typeof import('vue-router/auto')['useLink']>
+    readonly useNetworkStore: UnwrapRef<typeof import('./stores/network')['useNetworkStore']>
+    readonly useRoute: UnwrapRef<typeof import('vue-router/auto')['useRoute']>
+    readonly useRouter: UnwrapRef<typeof import('vue-router/auto')['useRouter']>
+    readonly useSlots: UnwrapRef<typeof import('vue')['useSlots']>
+    readonly watch: UnwrapRef<typeof import('vue')['watch']>
+    readonly watchEffect: UnwrapRef<typeof import('vue')['watchEffect']>
+    readonly watchPostEffect: UnwrapRef<typeof import('vue')['watchPostEffect']>
+    readonly watchSyncEffect: UnwrapRef<typeof import('vue')['watchSyncEffect']>
+  }
+}
+declare module '@vue/runtime-core' {
+  interface GlobalComponents {}
+  interface ComponentCustomProperties {
+    readonly EffectScope: UnwrapRef<typeof import('vue')['EffectScope']>
+    readonly acceptHMRUpdate: UnwrapRef<typeof import('pinia')['acceptHMRUpdate']>
+    readonly collectNetworkInfos: UnwrapRef<typeof import('./composables/network')['collectNetworkInfos']>
+    readonly computed: UnwrapRef<typeof import('vue')['computed']>
+    readonly createApp: UnwrapRef<typeof import('vue')['createApp']>
+    readonly createPinia: UnwrapRef<typeof import('pinia')['createPinia']>
+    readonly customRef: UnwrapRef<typeof import('vue')['customRef']>
+    readonly defineAsyncComponent: UnwrapRef<typeof import('vue')['defineAsyncComponent']>
+    readonly defineComponent: UnwrapRef<typeof import('vue')['defineComponent']>
+    readonly definePage: UnwrapRef<typeof import('unplugin-vue-router/runtime')['definePage']>
+    readonly defineStore: UnwrapRef<typeof import('pinia')['defineStore']>
+    readonly effectScope: UnwrapRef<typeof import('vue')['effectScope']>
+    readonly getActivePinia: UnwrapRef<typeof import('pinia')['getActivePinia']>
+    readonly getCurrentInstance: UnwrapRef<typeof import('vue')['getCurrentInstance']>
+    readonly getCurrentScope: UnwrapRef<typeof import('vue')['getCurrentScope']>
+    readonly getOsHostname: UnwrapRef<typeof import('./composables/network')['getOsHostname']>
+    readonly h: UnwrapRef<typeof import('vue')['h']>
+    readonly inject: UnwrapRef<typeof import('vue')['inject']>
+    readonly isProxy: UnwrapRef<typeof import('vue')['isProxy']>
+    readonly isReactive: UnwrapRef<typeof import('vue')['isReactive']>
+    readonly isReadonly: UnwrapRef<typeof import('vue')['isReadonly']>
+    readonly isRef: UnwrapRef<typeof import('vue')['isRef']>
+    readonly loadRunningInstanceIdsFromLocalStorage: UnwrapRef<typeof import('./stores/network')['loadRunningInstanceIdsFromLocalStorage']>
+    readonly mapActions: UnwrapRef<typeof import('pinia')['mapActions']>
+    readonly mapGetters: UnwrapRef<typeof import('pinia')['mapGetters']>
+    readonly mapState: UnwrapRef<typeof import('pinia')['mapState']>
+    readonly mapStores: UnwrapRef<typeof import('pinia')['mapStores']>
+    readonly mapWritableState: UnwrapRef<typeof import('pinia')['mapWritableState']>
+    readonly markRaw: UnwrapRef<typeof import('vue')['markRaw']>
+    readonly nextTick: UnwrapRef<typeof import('vue')['nextTick']>
+    readonly onActivated: UnwrapRef<typeof import('vue')['onActivated']>
+    readonly onBeforeMount: UnwrapRef<typeof import('vue')['onBeforeMount']>
+    readonly onBeforeRouteLeave: UnwrapRef<typeof import('vue-router/auto')['onBeforeRouteLeave']>
+    readonly onBeforeRouteUpdate: UnwrapRef<typeof import('vue-router/auto')['onBeforeRouteUpdate']>
+    readonly onBeforeUnmount: UnwrapRef<typeof import('vue')['onBeforeUnmount']>
+    readonly onBeforeUpdate: UnwrapRef<typeof import('vue')['onBeforeUpdate']>
+    readonly onDeactivated: UnwrapRef<typeof import('vue')['onDeactivated']>
+    readonly onErrorCaptured: UnwrapRef<typeof import('vue')['onErrorCaptured']>
+    readonly onMounted: UnwrapRef<typeof import('vue')['onMounted']>
+    readonly onRenderTracked: UnwrapRef<typeof import('vue')['onRenderTracked']>
+    readonly onRenderTriggered: UnwrapRef<typeof import('vue')['onRenderTriggered']>
+    readonly onScopeDispose: UnwrapRef<typeof import('vue')['onScopeDispose']>
+    readonly onServerPrefetch: UnwrapRef<typeof import('vue')['onServerPrefetch']>
+    readonly onUnmounted: UnwrapRef<typeof import('vue')['onUnmounted']>
+    readonly onUpdated: UnwrapRef<typeof import('vue')['onUpdated']>
+    readonly parseNetworkConfig: UnwrapRef<typeof import('./composables/network')['parseNetworkConfig']>
+    readonly provide: UnwrapRef<typeof import('vue')['provide']>
+    readonly reactive: UnwrapRef<typeof import('vue')['reactive']>
+    readonly readonly: UnwrapRef<typeof import('vue')['readonly']>
+    readonly ref: UnwrapRef<typeof import('vue')['ref']>
+    readonly resolveComponent: UnwrapRef<typeof import('vue')['resolveComponent']>
+    readonly retainNetworkInstance: UnwrapRef<typeof import('./composables/network')['retainNetworkInstance']>
+    readonly runNetworkInstance: UnwrapRef<typeof import('./composables/network')['runNetworkInstance']>
+    readonly setActivePinia: UnwrapRef<typeof import('pinia')['setActivePinia']>
+    readonly setAutoLaunchStatus: UnwrapRef<typeof import('./composables/network')['setAutoLaunchStatus']>
+    readonly setMapStoreSuffix: UnwrapRef<typeof import('pinia')['setMapStoreSuffix']>
+    readonly shallowReactive: UnwrapRef<typeof import('vue')['shallowReactive']>
+    readonly shallowReadonly: UnwrapRef<typeof import('vue')['shallowReadonly']>
+    readonly shallowRef: UnwrapRef<typeof import('vue')['shallowRef']>
+    readonly storeToRefs: UnwrapRef<typeof import('pinia')['storeToRefs']>
+    readonly toRaw: UnwrapRef<typeof import('vue')['toRaw']>
+    readonly toRef: UnwrapRef<typeof import('vue')['toRef']>
+    readonly toRefs: UnwrapRef<typeof import('vue')['toRefs']>
+    readonly toValue: UnwrapRef<typeof import('vue')['toValue']>
+    readonly triggerRef: UnwrapRef<typeof import('vue')['triggerRef']>
+    readonly unref: UnwrapRef<typeof import('vue')['unref']>
+    readonly useAttrs: UnwrapRef<typeof import('vue')['useAttrs']>
+    readonly useCssModule: UnwrapRef<typeof import('vue')['useCssModule']>
+    readonly useCssVars: UnwrapRef<typeof import('vue')['useCssVars']>
+    readonly useI18n: UnwrapRef<typeof import('vue-i18n')['useI18n']>
+    readonly useLink: UnwrapRef<typeof import('vue-router/auto')['useLink']>
+    readonly useNetworkStore: UnwrapRef<typeof import('./stores/network')['useNetworkStore']>
+    readonly useRoute: UnwrapRef<typeof import('vue-router/auto')['useRoute']>
+    readonly useRouter: UnwrapRef<typeof import('vue-router/auto')['useRouter']>
+    readonly useSlots: UnwrapRef<typeof import('vue')['useSlots']>
+    readonly watch: UnwrapRef<typeof import('vue')['watch']>
+    readonly watchEffect: UnwrapRef<typeof import('vue')['watchEffect']>
+    readonly watchPostEffect: UnwrapRef<typeof import('vue')['watchPostEffect']>
+    readonly watchSyncEffect: UnwrapRef<typeof import('vue')['watchSyncEffect']>
+  }
+}

easytier-gui/src/components/Config.vue

@@ -0,0 +1,210 @@
+<script setup lang="ts">
+import InputGroup from 'primevue/inputgroup'
+import InputGroupAddon from 'primevue/inputgroupaddon'
+import { getOsHostname } from '~/composables/network'
+import { NetworkingMethod } from '~/types/network'
+const { t } = useI18n()
+
+const props = defineProps<{
+  configInvalid?: boolean
+  instanceId?: string
+}>()
+
+defineEmits(['runNetwork'])
+
+const networking_methods = ref([
+  { value: NetworkingMethod.PublicServer, label: t('public_server') },
+  { value: NetworkingMethod.Manual, label: t('manual') },
+  { value: NetworkingMethod.Standalone, label: t('standalone') },
+])
+
+const networkStore = useNetworkStore()
+const curNetwork = computed(() => {
+  if (props.instanceId) {
+    // console.log('instanceId', props.instanceId)
+    const c = networkStore.networkList.find(n => n.instance_id === props.instanceId)
+    if (c !== undefined)
+      return c
+  }
+
+  return networkStore.curNetwork
+})
+
+const presetPublicServers = [
+  'tcp://easytier.public.kkrainbow.top:11010',
+]
+
+function validateHostname() {
+  if (curNetwork.value.hostname) {
+    // eslint no-useless-escape
+    let name = curNetwork.value.hostname!.replaceAll(/[^\u4E00-\u9FA5a-zA-Z0-9\-]*/g, '')
+    if (name.length > 32)
+      name = name.substring(0, 32)
+
+    if (curNetwork.value.hostname !== name)
+      curNetwork.value.hostname = name
+  }
+}
+
+const osHostname = ref<string>('')
+
+onMounted(async () => {
+  osHostname.value = await getOsHostname()
+})
+</script>
+
+<template>
+  <div class="flex flex-column h-full">
+    <div class="flex flex-column">
+      <div class="w-7/12 self-center ">
+        <Message severity="warn">
+          {{ t('dhcp_experimental_warning') }}
+        </Message>
+      </div>
+      <div class="w-7/12 self-center ">
+        <Panel :header="t('basic_settings')">
+          <div class="flex flex-column gap-y-2">
+            <div class="flex flex-row gap-x-9 flex-wrap">
+              <div class="flex flex-column gap-2 basis-5/12 grow">
+                <div class="flex align-items-center" for="virtual_ip">
+                  <label class="mr-2"> {{ t('virtual_ipv4') }} </label>
+                  <Checkbox v-model="curNetwork.dhcp" input-id="virtual_ip_auto" :binary="true" />
+
+                  <label for="virtual_ip_auto" class="ml-2">
+                    {{ t('virtual_ipv4_dhcp') }}
+                  </label>
+                </div>
+                <InputGroup>
+                  <InputText
+                    id="virtual_ip" v-model="curNetwork.virtual_ipv4" :disabled="curNetwork.dhcp"
+                    aria-describedby="virtual_ipv4-help"
+                  />
+                  <InputGroupAddon>
+                    <span>/24</span>
+                  </InputGroupAddon>
+                </InputGroup>
+              </div>
+            </div>
+
+            <div class="flex flex-row gap-x-9 flex-wrap">
+              <div class="flex flex-column gap-2 basis-5/12 grow">
+                <label for="network_name">{{ t('network_name') }}</label>
+                <InputText id="network_name" v-model="curNetwork.network_name" aria-describedby="network_name-help" />
+              </div>
+              <div class="flex flex-column gap-2 basis-5/12 grow">
+                <label for="network_secret">{{ t('network_secret') }}</label>
+                <InputText
+                  id="network_secret" v-model="curNetwork.network_secret"
+                  aria-describedby=" network_secret-help"
+                />
+              </div>
+            </div>
+
+            <div class="flex flex-row gap-x-9 flex-wrap">
+              <div class="flex flex-column gap-2 basis-5/12 grow">
+                <label for="nm">{{ t('networking_method') }}</label>
+                <div class="items-center flex flex-row p-fluid gap-x-1">
+                  <Dropdown
+                    v-model="curNetwork.networking_method" :options="networking_methods" option-label="label"
+                    option-value="value" placeholder="Select Method" class=""
+                  />
+                  <Chips
+                    v-if="curNetwork.networking_method === NetworkingMethod.Manual" id="chips"
+                    v-model="curNetwork.peer_urls" :placeholder="t('chips_placeholder', ['tcp://8.8.8.8:11010'])"
+                    separator=" " class="grow"
+                  />
+
+                  <Dropdown
+                    v-if="curNetwork.networking_method === NetworkingMethod.PublicServer"
+                    v-model="curNetwork.public_server_url" :editable="true" class="grow"
+                    :options="presetPublicServers"
+                  />
+                </div>
+              </div>
+            </div>
+          </div>
+        </Panel>
+
+        <Divider />
+
+        <Panel :header="t('advanced_settings')" toggleable collapsed>
+          <div class="flex flex-column gap-y-2">
+            <div class="flex flex-row gap-x-9 flex-wrap">
+              <div class="flex flex-column gap-2 basis-5/12 grow">
+                <label for="hostname">{{ t('hostname') }}</label>
+                <InputText
+                  id="hostname" v-model="curNetwork.hostname" aria-describedby="hostname-help" :format="true"
+                  :placeholder="t('hostname_placeholder', [osHostname])" @blur="validateHostname"
+                />
+              </div>
+            </div>
+
+            <div class="flex flex-row gap-x-9 flex-wrap w-full">
+              <div class="flex flex-column gap-2 grow p-fluid">
+                <label for="username">{{ t('proxy_cidrs') }}</label>
+                <Chips
+                  id="chips" v-model="curNetwork.proxy_cidrs"
+                  :placeholder="t('chips_placeholder', ['10.0.0.0/24'])" separator=" " class="w-full"
+                />
+              </div>
+            </div>
+
+            <div class="flex flex-row gap-x-9 flex-wrap ">
+              <div class="flex flex-column gap-2 grow">
+                <label for="username">VPN Portal</label>
+                <div class="items-center flex flex-row gap-x-4">
+                  <ToggleButton
+                    v-model="curNetwork.enable_vpn_portal" on-icon="pi pi-check" off-icon="pi pi-times"
+                    :on-label="t('off_text')" :off-label="t('on_text')"
+                  />
+                  <div v-if="curNetwork.enable_vpn_portal" class="grow">
+                    <InputGroup>
+                      <InputText
+                        v-model="curNetwork.vpn_portal_client_network_addr"
+                        :placeholder="t('vpn_portal_client_network')"
+                      />
+                      <InputGroupAddon>
+                        <span>/{{ curNetwork.vpn_portal_client_network_len }}</span>
+                      </InputGroupAddon>
+                    </InputGroup>
+                  </div>
+                  <InputNumber
+                    v-if="curNetwork.enable_vpn_portal" v-model="curNetwork.vpn_portal_listen_port"
+                    :placeholder="t('vpn_portal_listen_port')" class="" :format="false" :min="0" :max="65535"
+                  />
+                </div>
+              </div>
+            </div>
+
+            <div class="flex flex-row gap-x-9 flex-wrap">
+              <div class="flex flex-column gap-2 grow p-fluid">
+                <label for="listener_urls">{{ t('listener_urls') }}</label>
+                <Chips
+                  id="listener_urls" v-model="curNetwork.listener_urls"
+                  :placeholder="t('chips_placeholder', ['tcp://1.1.1.1:11010'])" separator=" " class="w-full"
+                />
+              </div>
+            </div>
+
+            <div class="flex flex-row gap-x-9 flex-wrap">
+              <div class="flex flex-column gap-2 basis-5/12 grow">
+                <label for="rpc_port">{{ t('rpc_port') }}</label>
+                <InputNumber
+                  id="rpc_port" v-model="curNetwork.rpc_port" aria-describedby="username-help"
+                  :format="false" :min="0" :max="65535"
+                />
+              </div>
+            </div>
+          </div>
+        </Panel>
+
+        <div class="flex pt-4 justify-content-center">
+          <Button
+            :label="t('run_network')" icon="pi pi-arrow-right" icon-pos="right" :disabled="configInvalid"
+            @click="$emit('runNetwork', curNetwork)"
+          />
+        </div>
+      </div>
+    </div>
+  </div>
+</template>

easytier-gui/src/components/Status.vue

@@ -0,0 +1,381 @@
+<script setup lang="ts">
+import type { NodeInfo } from '~/types/network'
+const { t } = useI18n()
+
+const props = defineProps<{
+  instanceId?: string
+}>()
+
+const networkStore = useNetworkStore()
+
+const curNetwork = computed(() => {
+  if (props.instanceId) {
+    // console.log('instanceId', props.instanceId)
+    const c = networkStore.networkList.find(n => n.instance_id === props.instanceId)
+    if (c !== undefined)
+      return c
+  }
+
+  return networkStore.curNetwork
+})
+
+const curNetworkInst = computed(() => {
+  return networkStore.networkInstances.find(n => n.instance_id === curNetwork.value.instance_id)
+})
+
+const peerRouteInfos = computed(() => {
+  if (curNetworkInst.value)
+    return curNetworkInst.value.detail?.peer_route_pairs || []
+
+  return []
+})
+
+function routeCost(info: any) {
+  if (info.route) {
+    const cost = info.route.cost
+    return cost === 1 ? 'p2p' : `relay(${cost})`
+  }
+  return '?'
+}
+
+function resolveObjPath(path: string, obj = globalThis, separator = '.') {
+  const properties = Array.isArray(path) ? path : path.split(separator)
+  return properties.reduce((prev, curr) => prev?.[curr], obj)
+}
+
+function statsCommon(info: any, field: string): number | undefined {
+  if (!info.peer)
+    return undefined
+
+  const conns = info.peer.conns
+  return conns.reduce((acc: number, conn: any) => {
+    return acc + resolveObjPath(field, conn)
+  }, 0)
+}
+
+function humanFileSize(bytes: number, si = false, dp = 1) {
+  const thresh = si ? 1000 : 1024
+
+  if (Math.abs(bytes) < thresh)
+    return `${bytes} B`
+
+  const units = si
+    ? ['kB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB']
+    : ['KiB', 'MiB', 'GiB', 'TiB', 'PiB', 'EiB', 'ZiB', 'YiB']
+  let u = -1
+  const r = 10 ** dp
+
+  do {
+    bytes /= thresh
+    ++u
+  } while (Math.round(Math.abs(bytes) * r) / r >= thresh && u < units.length - 1)
+
+  return `${bytes.toFixed(dp)} ${units[u]}`
+}
+
+function latencyMs(info: any) {
+  let lat_us_sum = statsCommon(info, 'stats.latency_us')
+  if (lat_us_sum === undefined)
+    return ''
+  lat_us_sum = lat_us_sum / 1000 / info.peer.conns.length
+  return `${lat_us_sum % 1 > 0 ? Math.round(lat_us_sum) + 1 : Math.round(lat_us_sum)}ms`
+}
+
+function txBytes(info: any) {
+  const tx = statsCommon(info, 'stats.tx_bytes')
+  return tx ? humanFileSize(tx) : ''
+}
+
+function rxBytes(info: any) {
+  const rx = statsCommon(info, 'stats.rx_bytes')
+  return rx ? humanFileSize(rx) : ''
+}
+
+function lossRate(info: any) {
+  const lossRate = statsCommon(info, 'loss_rate')
+  return lossRate !== undefined ? `${Math.round(lossRate * 100)}%` : ''
+}
+
+const myNodeInfo = computed(() => {
+  if (!curNetworkInst.value)
+    return {} as NodeInfo
+
+  return curNetworkInst.value.detail?.my_node_info
+})
+
+interface Chip {
+  label: string
+  icon: string
+}
+
+const myNodeInfoChips = computed(() => {
+  if (!curNetworkInst.value)
+    return []
+
+  const chips: Array<Chip> = []
+  const my_node_info = curNetworkInst.value.detail?.my_node_info
+  if (!my_node_info)
+    return chips
+
+  // virtual ipv4
+
+  chips.push({
+    label: `Virtual IPv4: ${my_node_info.virtual_ipv4}`,
+    icon: '',
+  } as Chip)
+
+  // local ipv4s
+  const local_ipv4s = my_node_info.ips?.interface_ipv4s
+  for (const [idx, ip] of local_ipv4s?.entries()) {
+    chips.push({
+      label: `Local IPv4 ${idx}: ${ip}`,
+      icon: '',
+    } as Chip)
+  }
+
+  // local ipv6s
+  const local_ipv6s = my_node_info.ips?.interface_ipv6s
+  for (const [idx, ip] of local_ipv6s?.entries()) {
+    chips.push({
+      label: `Local IPv6 ${idx}: ${ip}`,
+      icon: '',
+    } as Chip)
+  }
+
+  // public ip
+  const public_ip = my_node_info.ips?.public_ipv4
+  if (public_ip) {
+    chips.push({
+      label: `Public IP: ${public_ip}`,
+      icon: '',
+    } as Chip)
+  }
+
+  // listeners:
+  const listeners = my_node_info.listeners
+  for (const [idx, listener] of listeners?.entries()) {
+    chips.push({
+      label: `Listener ${idx}: ${listener}`,
+      icon: '',
+    } as Chip)
+  }
+
+  // udp nat type
+  enum NatType {
+    // has NAT; but own a single public IP, port is not changed
+    Unknown = 0,
+    OpenInternet = 1,
+    NoPAT = 2,
+    FullCone = 3,
+    Restricted = 4,
+    PortRestricted = 5,
+    Symmetric = 6,
+    SymUdpFirewall = 7,
+  };
+  const udpNatType: NatType = my_node_info.stun_info?.udp_nat_type
+  if (udpNatType !== undefined) {
+    const udpNatTypeStrMap = {
+      [NatType.Unknown]: 'Unknown',
+      [NatType.OpenInternet]: 'Open Internet',
+      [NatType.NoPAT]: 'No PAT',
+      [NatType.FullCone]: 'Full Cone',
+      [NatType.Restricted]: 'Restricted',
+      [NatType.PortRestricted]: 'Port Restricted',
+      [NatType.Symmetric]: 'Symmetric',
+      [NatType.SymUdpFirewall]: 'Symmetric UDP Firewall',
+    }
+
+    chips.push({
+      label: `UDP NAT Type: ${udpNatTypeStrMap[udpNatType]}`,
+      icon: '',
+    } as Chip)
+  }
+
+  return chips
+})
+
+function globalSumCommon(field: string) {
+  let sum = 0
+  if (!peerRouteInfos.value)
+    return sum
+
+  for (const info of peerRouteInfos.value) {
+    const tx = statsCommon(info, field)
+    if (tx)
+      sum += tx
+  }
+  return sum
+}
+
+function txGlobalSum() {
+  return globalSumCommon('stats.tx_bytes')
+}
+
+function rxGlobalSum() {
+  return globalSumCommon('stats.rx_bytes')
+}
+
+const peerCount = computed(() => {
+  if (!peerRouteInfos.value)
+    return 0
+
+  return peerRouteInfos.value.length
+})
+
+// calculate tx/rx rate every 2 seconds
+let rateIntervalId = 0
+const rateInterval = 2000
+let prevTxSum = 0
+let prevRxSum = 0
+const txRate = ref('0')
+const rxRate = ref('0')
+onMounted(() => {
+  rateIntervalId = window.setInterval(() => {
+    const curTxSum = txGlobalSum()
+    txRate.value = humanFileSize((curTxSum - prevTxSum) / (rateInterval / 1000))
+    prevTxSum = curTxSum
+
+    const curRxSum = rxGlobalSum()
+    rxRate.value = humanFileSize((curRxSum - prevRxSum) / (rateInterval / 1000))
+    prevRxSum = curRxSum
+  }, rateInterval)
+})
+
+onUnmounted(() => {
+  clearInterval(rateIntervalId)
+})
+
+const dialogVisible = ref(false)
+const dialogContent = ref<any>('')
+const dialogHeader = ref('event_log')
+
+function showVpnPortalConfig() {
+  const my_node_info = myNodeInfo.value
+  if (!my_node_info)
+    return
+
+  const url = 'https://www.wireguardconfig.com/qrcode'
+  dialogContent.value = `${my_node_info.vpn_portal_cfg}\n\n # can generate QR code: ${url}`
+  dialogHeader.value = 'vpn_portal_config'
+  dialogVisible.value = true
+}
+
+function showEventLogs() {
+  const detail = curNetworkInst.value?.detail
+  if (!detail)
+    return
+
+  dialogContent.value = detail.events
+  dialogHeader.value = 'event_log'
+  dialogVisible.value = true
+}
+</script>
+
+<template>
+  <div>
+    <Dialog v-model:visible="dialogVisible" modal :header="t(dialogHeader)" :style="{ width: '70%' }">
+      <Panel>
+        <ScrollPanel style="width: 100%; height: 400px">
+          <pre>{{ dialogContent }}</pre>
+        </ScrollPanel>
+      </Panel>
+      <Divider />
+      <div class="flex justify-content-end gap-2">
+        <Button type="button" :label="t('close')" @click="dialogVisible = false" />
+      </div>
+    </Dialog>
+
+    <Card v-if="curNetworkInst?.error_msg">
+      <template #title>
+        Run Network Error
+      </template>
+      <template #content>
+        <div class="flex flex-column gap-y-5">
+          <div class="text-red-500">
+            {{ curNetworkInst.error_msg }}
+          </div>
+        </div>
+      </template>
+    </Card>
+
+    <template v-else>
+      <Card>
+        <template #title>
+          {{ t('my_node_info') }}
+        </template>
+        <template #content>
+          <div class="flex w-full flex-column gap-y-5">
+            <div class="m-0 flex flex-row justify-center gap-x-5">
+              <div
+                class="rounded-full w-32 h-32 flex flex-column align-items-center pt-4"
+                style="border: 1px solid green"
+              >
+                <div class="font-bold">
+                  {{ t('peer_count') }}
+                </div>
+                <div class="text-5xl mt-1">
+                  {{ peerCount }}
+                </div>
+              </div>
+
+              <div
+                class="rounded-full w-32 h-32 flex flex-column align-items-center pt-4"
+                style="border: 1px solid purple"
+              >
+                <div class="font-bold">
+                  {{ t('upload') }}
+                </div>
+                <div class="text-xl mt-2">
+                  {{ txRate }}/s
+                </div>
+              </div>
+
+              <div
+                class="rounded-full w-32 h-32 flex flex-column align-items-center pt-4"
+                style="border: 1px solid fuchsia"
+              >
+                <div class="font-bold">
+                  {{ t('download') }}
+                </div>
+                <div class="text-xl mt-2">
+                  {{ rxRate }}/s
+                </div>
+              </div>
+            </div>
+
+            <div class="flex flex-row align-items-center flex-wrap w-full">
+              <Chip
+                v-for="(chip, i) in myNodeInfoChips" :key="i" :label="chip.label" :icon="chip.icon"
+                class="mr-2 mt-2"
+              />
+            </div>
+
+            <div v-if="myNodeInfo" class="m-0 flex flex-row justify-center gap-x-5 text-sm">
+              <Button severity="info" :label="t('show_vpn_portal_config')" @click="showVpnPortalConfig" />
+              <Button severity="info" :label="t('show_event_log')" @click="showEventLogs" />
+            </div>
+          </div>
+        </template>
+      </Card>
+
+      <Divider />
+
+      <Card>
+        <template #title>
+          {{ t('peer_info') }}
+        </template>
+        <template #content>
+          <DataTable :value="peerRouteInfos" column-resize-mode="fit" table-style="width: 100%">
+            <Column field="route.ipv4_addr" style="width: 100px;" :header="t('virtual_ipv4')" />
+            <Column field="route.hostname" style="max-width: 250px;" :header="t('hostname')" />
+            <Column :field="routeCost" style="width: 100px;" :header="t('route_cost')" />
+            <Column :field="latencyMs" style="width: 80px;" :header="t('latency')" />
+            <Column :field="txBytes" style="width: 80px;" :header="t('upload_bytes')" />
+            <Column :field="rxBytes" style="width: 80px;" :header="t('download_bytes')" />
+            <Column :field="lossRate" style="width: 100px;" :header="t('loss_rate')" />
+          </DataTable>
+        </template>
+      </Card>
+    </template>
+  </div>
+</template>

easytier-gui/src/composables/network.ts

@@ -0,0 +1,26 @@
+import { invoke } from '@tauri-apps/api/tauri'
+import type { NetworkConfig, NetworkInstanceRunningInfo } from '~/types/network'
+
+export async function parseNetworkConfig(cfg: NetworkConfig) {
+  return invoke<string>('parse_network_config', { cfg })
+}
+
+export async function runNetworkInstance(cfg: NetworkConfig) {
+  return invoke('run_network_instance', { cfg })
+}
+
+export async function retainNetworkInstance(instanceIds: string[]) {
+  return invoke('retain_network_instance', { instanceIds })
+}
+
+export async function collectNetworkInfos() {
+  return await invoke<Record<string, NetworkInstanceRunningInfo>>('collect_network_infos')
+}
+
+export async function getOsHostname() {
+  return await invoke<string>('get_os_hostname')
+}
+
+export async function setAutoLaunchStatus(enable: boolean) {
+  return await invoke<boolean>('set_auto_launch_status', { enable })
+}

easytier-gui/src/layouts/default.vue

@@ -0,0 +1,3 @@
+<template>
+  <RouterView />
+</template>

easytier-gui/src/main.ts

@@ -0,0 +1,49 @@
+import { setupLayouts } from 'virtual:generated-layouts'
+import { createRouter, createWebHistory } from 'vue-router/auto'
+
+import PrimeVue from 'primevue/config'
+import ToastService from 'primevue/toastservice'
+import App from '~/App.vue'
+
+import '~/styles.css'
+import 'primevue/resources/themes/aura-light-green/theme.css'
+import 'primeicons/primeicons.css'
+import 'primeflex/primeflex.css'
+import { i18n, loadLanguageAsync } from '~/modules/i18n'
+import { loadAutoLaunchStatusAsync, getAutoLaunchStatusAsync } from './modules/auto_launch'
+
+if (import.meta.env.PROD) {
+  document.addEventListener('keydown', (event) => {
+    if (
+      event.key === 'F5'
+      || (event.ctrlKey && event.key === 'r')
+      || (event.metaKey && event.key === 'r')
+    )
+      event.preventDefault()
+  })
+
+  document.addEventListener('contextmenu', (event) => {
+    event.preventDefault()
+  })
+}
+
+async function main() {
+  await loadLanguageAsync(localStorage.getItem('lang') || 'en')
+  await loadAutoLaunchStatusAsync(getAutoLaunchStatusAsync())
+
+  const app = createApp(App)
+
+  const router = createRouter({
+    history: createWebHistory(),
+    extendRoutes: routes => setupLayouts(routes),
+  })
+
+  app.use(router)
+  app.use(createPinia())
+  app.use(i18n, { useScope: 'global' })
+  app.use(PrimeVue)
+  app.use(ToastService)
+  app.mount('#app')
+}
+
+main()

easytier-gui/src/modules/auto_launch.ts

@@ -0,0 +1,16 @@
+import { setAutoLaunchStatus } from "~/composables/network"
+
+export async function loadAutoLaunchStatusAsync(enable: boolean): Promise<boolean> {
+    try {
+        const ret = await setAutoLaunchStatus(enable)
+        localStorage.setItem('auto_launch', JSON.stringify(ret))
+        return ret
+    } catch (e) {
+        console.error(e)
+        return false
+    }
+}
+
+export function getAutoLaunchStatusAsync(): boolean {
+    return localStorage.getItem('auto_launch') === 'true'
+}

easytier-gui/src/modules/i18n.ts

@@ -0,0 +1,50 @@
+import type { Locale } from 'vue-i18n'
+import { createI18n } from 'vue-i18n'
+
+// Import i18n resources
+// https://vitejs.dev/guide/features.html#glob-import
+export const i18n = createI18n({
+  legacy: false,
+  locale: '',
+  fallbackLocale: '',
+  messages: {},
+})
+
+const localesMap = Object.fromEntries(
+  Object.entries(import.meta.glob('../../locales/*.yml'))
+    .map(([path, loadLocale]) => [path.match(/([\w-]*)\.yml$/)?.[1], loadLocale]),
+) as Record<Locale, () => Promise<{ default: Record<string, string> }>>
+
+export const availableLocales = Object.keys(localesMap)
+
+const loadedLanguages: string[] = []
+
+function setI18nLanguage(lang: Locale) {
+  i18n.global.locale.value = lang as any
+  localStorage.setItem('lang', lang)
+  return lang
+}
+
+export async function loadLanguageAsync(lang: string): Promise<Locale> {
+  // If the same language
+  if (i18n.global.locale.value === lang)
+    return setI18nLanguage(lang)
+
+  // If the language was already loaded
+  if (loadedLanguages.includes(lang))
+    return setI18nLanguage(lang)
+
+  // If the language hasn't been loaded yet
+  let messages
+
+  try {
+    messages = await localesMap[lang]()
+  }
+  catch {
+    messages = await localesMap.en()
+  }
+
+  i18n.global.setLocaleMessage(lang, messages.default)
+  loadedLanguages.push(lang)
+  return setI18nLanguage(lang)
+}

easytier-gui/src/pages/index.vue

@@ -0,0 +1,297 @@
+<script setup lang="ts">
+import Stepper from 'primevue/stepper'
+import StepperPanel from 'primevue/stepperpanel'
+
+import { useToast } from 'primevue/usetoast'
+
+import { exit } from '@tauri-apps/api/process'
+import Config from '~/components/Config.vue'
+import Status from '~/components/Status.vue'
+
+import type { NetworkConfig } from '~/types/network'
+import { loadLanguageAsync } from '~/modules/i18n'
+import { getAutoLaunchStatusAsync as getAutoLaunchStatus, loadAutoLaunchStatusAsync } from '~/modules/auto_launch'
+import { loadRunningInstanceIdsFromLocalStorage } from '~/stores/network'
+
+const { t, locale } = useI18n()
+const visible = ref(false)
+const tomlConfig = ref('')
+
+const items = ref([
+  {
+    label: () => t('show_config'),
+    icon: 'pi pi-file-edit',
+    command: async () => {
+      try {
+        const ret = await parseNetworkConfig(networkStore.curNetwork)
+        tomlConfig.value = ret
+      }
+      catch (e: any) {
+        tomlConfig.value = e
+      }
+      visible.value = true
+    },
+  },
+  {
+    label: () => t('del_cur_network'),
+    icon: 'pi pi-times',
+    command: async () => {
+      networkStore.removeNetworkInstance(networkStore.curNetwork.instance_id)
+      await retainNetworkInstance(networkStore.networkInstanceIds)
+      networkStore.delCurNetwork()
+    },
+    disabled: () => networkStore.networkList.length <= 1,
+  },
+])
+
+enum Severity {
+  None = 'none',
+  Success = 'success',
+  Info = 'info',
+  Warn = 'warn',
+  Error = 'error',
+}
+
+const messageBarSeverity = ref(Severity.None)
+const messageBarContent = ref('')
+const toast = useToast()
+
+const networkStore = useNetworkStore()
+
+function addNewNetwork() {
+  networkStore.addNewNetwork()
+  networkStore.curNetwork = networkStore.lastNetwork
+}
+
+networkStore.$subscribe(async () => {
+  networkStore.saveToLocalStorage()
+  networkStore.saveRunningInstanceIdsToLocalStorage()
+  try {
+    await parseNetworkConfig(networkStore.curNetwork)
+    messageBarSeverity.value = Severity.None
+  }
+  catch (e: any) {
+    messageBarContent.value = e
+    messageBarSeverity.value = Severity.Error
+  }
+})
+
+async function runNetworkCb(cfg: NetworkConfig, cb: (e: MouseEvent) => void) {
+  cb({} as MouseEvent)
+  networkStore.removeNetworkInstance(cfg.instance_id)
+  await retainNetworkInstance(networkStore.networkInstanceIds)
+  networkStore.addNetworkInstance(cfg.instance_id)
+
+  try {
+    await runNetworkInstance(cfg)
+  }
+  catch (e: any) {
+    // console.error(e)
+    toast.add({ severity: 'info', detail: e })
+  }
+}
+
+async function stopNetworkCb(cfg: NetworkConfig, cb: (e: MouseEvent) => void) {
+  // console.log('stopNetworkCb', cfg, cb)
+  cb({} as MouseEvent)
+  networkStore.removeNetworkInstance(cfg.instance_id)
+  await retainNetworkInstance(networkStore.networkInstanceIds)
+}
+
+async function updateNetworkInfos() {
+  networkStore.updateWithNetworkInfos(await collectNetworkInfos())
+}
+
+let intervalId = 0
+onMounted(() => {
+  intervalId = window.setInterval(async () => {
+    await updateNetworkInfos()
+  }, 500)
+})
+onUnmounted(() => clearInterval(intervalId))
+
+const activeStep = computed(() => {
+  return networkStore.networkInstanceIds.includes(networkStore.curNetworkId) ? 1 : 0
+})
+
+const setting_menu = ref()
+const setting_menu_items = ref([
+  {
+    label: () => t('settings'),
+    items: [
+      {
+        label: () => t('exchange_language'),
+        icon: 'pi pi-language',
+        command: async () => {
+          await loadLanguageAsync((locale.value === 'en' ? 'cn' : 'en'))
+        },
+      },
+      {
+        label: () => getAutoLaunchStatus() ? t('disable_auto_launch') : t('enable_auto_launch'),
+        icon: 'pi pi-desktop',
+        command: async () => {
+          await loadAutoLaunchStatusAsync(!getAutoLaunchStatus())
+        },
+      },
+      {
+        label: () => t('exit'),
+        icon: 'pi pi-power-off',
+        command: async () => {
+          await exit(1)
+        },
+      },
+    ],
+  },
+])
+
+function toggle_setting_menu(event: any) {
+  setting_menu.value.toggle(event)
+}
+
+onMounted(async () => {
+  networkStore.loadFromLocalStorage()
+  if (getAutoLaunchStatus()) {
+    let prev_running_ids = loadRunningInstanceIdsFromLocalStorage()
+    for (let id of prev_running_ids) {
+      let cfg = networkStore.networkList.find((item) => item.instance_id === id)
+      if (cfg) {
+        networkStore.addNetworkInstance(cfg.instance_id)
+        await runNetworkInstance(cfg)
+      }
+    }
+  }
+})
+
+function isRunning(id: string) {
+  return networkStore.networkInstanceIds.includes(id)
+}
+</script>
+
+<script lang="ts">
+</script>
+
+<template>
+  <div id="root" class="flex flex-column">
+    <Dialog v-model:visible="visible" modal header="Config File" :style="{ width: '70%' }">
+      <Panel>
+        <ScrollPanel style="width: 100%; height: 300px">
+          <pre>{{ tomlConfig }}</pre>
+        </ScrollPanel>
+      </Panel>
+      <Divider />
+      <div class="flex justify-content-end gap-2">
+        <Button type="button" :label="t('close')" @click="visible = false" />
+      </div>
+    </Dialog>
+
+    <div>
+      <Toolbar>
+        <template #start>
+          <div class="flex align-items-center gap-2">
+            <Button icon="pi pi-plus" class="mr-2" severity="primary" :label="t('add_new_network')"
+              @click="addNewNetwork" />
+          </div>
+        </template>
+
+        <template #center>
+          <div class="min-w-80 mr-20">
+            <Dropdown v-model="networkStore.curNetwork" :options="networkStore.networkList" :highlight-on-select="false"
+              :placeholder="t('select_network')" class="w-full">
+              <template #value="slotProps">
+                <div class="flex items-start content-center">
+                  <div class="mr-3">
+                    <span>{{ slotProps.value.network_name }}</span>
+                    <span
+                      v-if="isRunning(slotProps.value.instance_id) && networkStore.instances[slotProps.value.instance_id].detail && (networkStore.instances[slotProps.value.instance_id].detail?.my_node_info.virtual_ipv4 !== '')"
+                      class="ml-3">
+                      {{ networkStore.instances[slotProps.value.instance_id].detail
+                        ? networkStore.instances[slotProps.value.instance_id].detail?.my_node_info.virtual_ipv4 : '' }}
+                    </span>
+                  </div>
+                  <Tag class="my-auto" :severity="isRunning(slotProps.value.instance_id) ? 'success' : 'info'"
+                    :value="t(isRunning(slotProps.value.instance_id) ? 'network_running' : 'network_stopped')" />
+                </div>
+              </template>
+              <template #option="slotProps">
+                <div class="flex flex-col items-start content-center">
+                  <div class="flex">
+                    <div class="mr-3">
+                      {{ t('network_name') }}: {{ slotProps.option.network_name }}
+                    </div>
+                    <Tag class="my-auto" :severity="isRunning(slotProps.option.instance_id) ? 'success' : 'info'"
+                      :value="t(isRunning(slotProps.option.instance_id) ? 'network_running' : 'network_stopped')" />
+                  </div>
+                  <div>{{ slotProps.option.public_server_url }}</div>
+                </div>
+              </template>
+            </Dropdown>
+          </div>
+        </template>
+
+        <template #end>
+          <Button icon="pi pi-cog" class="mr-2" severity="secondary" aria-haspopup="true" :label="t('settings')"
+            aria-controls="overlay_setting_menu" @click="toggle_setting_menu" />
+          <Menu id="overlay_setting_menu" ref="setting_menu" :model="setting_menu_items" :popup="true" />
+        </template>
+      </Toolbar>
+    </div>
+
+    <Stepper class="h-full overflow-y-auto" :active-step="activeStep">
+      <StepperPanel :header="t('config_network')">
+        <template #content="{ nextCallback }">
+          <Config :instance-id="networkStore.curNetworkId" :config-invalid="messageBarSeverity !== Severity.None"
+            @run-network="runNetworkCb($event, nextCallback)" />
+        </template>
+      </StepperPanel>
+      <StepperPanel :header="t('running')">
+        <template #content="{ prevCallback }">
+          <div class="flex flex-column">
+            <Status :instance-id="networkStore.curNetworkId" />
+          </div>
+          <div class="flex pt-4 justify-content-center">
+            <Button :label="t('stop_network')" severity="danger" icon="pi pi-arrow-left"
+              @click="stopNetworkCb(networkStore.curNetwork, prevCallback)" />
+          </div>
+        </template>
+      </StepperPanel>
+    </Stepper>
+
+    <div>
+      <Menubar :model="items" breakpoint="300px" />
+      <InlineMessage v-if="messageBarSeverity !== Severity.None" class="absolute bottom-0 right-0" severity="error">
+        {{ messageBarContent }}
+      </InlineMessage>
+    </div>
+  </div>
+</template>
+
+<style scoped lang="postcss">
+#root {
+  height: 100vh;
+  width: 100vw;
+}
+
+.p-dropdown :deep(.p-dropdown-panel .p-dropdown-items .p-dropdown-item) {
+  padding: 0 0.5rem;
+}
+</style>
+
+<style>
+body {
+  height: 100vh;
+  width: 100vw;
+  padding: 0;
+  margin: 0;
+  overflow: hidden;
+}
+
+.p-menubar .p-menuitem {
+  margin: 0;
+}
+
+/*
+
+.p-tabview-panel {
+  height: 100%;
+} */
+</style>

easytier-gui/src/stores/network.ts

@@ -0,0 +1,114 @@
+import type { NetworkConfig, NetworkInstance, NetworkInstanceRunningInfo } from '~/types/network'
+import { DEFAULT_NETWORK_CONFIG } from '~/types/network'
+
+export const useNetworkStore = defineStore('networkStore', {
+  state: () => {
+    const networkList = [DEFAULT_NETWORK_CONFIG()]
+    return {
+      // for initially empty lists
+      networkList: networkList as NetworkConfig[],
+      // for data that is not yet loaded
+      curNetwork: networkList[0],
+
+      // uuid -> instance
+      instances: {} as Record<string, NetworkInstance>,
+
+      networkInfos: {} as Record<string, NetworkInstanceRunningInfo>,
+    }
+  },
+
+  getters: {
+    lastNetwork(): NetworkConfig {
+      return this.networkList[this.networkList.length - 1]
+    },
+
+    curNetworkId(): string {
+      return this.curNetwork.instance_id
+    },
+
+    networkInstances(): Array<NetworkInstance> {
+      return Object.values(this.instances)
+    },
+
+    networkInstanceIds(): Array<string> {
+      return Object.keys(this.instances)
+    },
+  },
+
+  actions: {
+    addNewNetwork() {
+      this.networkList.push(DEFAULT_NETWORK_CONFIG())
+    },
+
+    delCurNetwork() {
+      const curNetworkIdx = this.networkList.indexOf(this.curNetwork)
+      this.networkList.splice(curNetworkIdx, 1)
+      const nextCurNetworkIdx = Math.min(curNetworkIdx, this.networkList.length - 1)
+      this.curNetwork = this.networkList[nextCurNetworkIdx]
+    },
+
+    removeNetworkInstance(instanceId: string) {
+      delete this.instances[instanceId]
+    },
+
+    addNetworkInstance(instanceId: string) {
+      this.instances[instanceId] = {
+        instance_id: instanceId,
+        running: false,
+        error_msg: '',
+        detail: undefined,
+      }
+    },
+
+    updateWithNetworkInfos(networkInfos: Record<string, NetworkInstanceRunningInfo>) {
+      this.networkInfos = networkInfos
+      for (const [instanceId, info] of Object.entries(networkInfos)) {
+        if (this.instances[instanceId] === undefined)
+          this.addNetworkInstance(instanceId)
+
+        this.instances[instanceId].running = info.running
+        this.instances[instanceId].error_msg = info.error_msg || ''
+        this.instances[instanceId].detail = info
+      }
+      this.saveRunningInstanceIdsToLocalStorage()
+    },
+
+    loadFromLocalStorage() {
+      let networkList: NetworkConfig[]
+
+      // if localStorage default is [{}], instanceId will be undefined
+      networkList = JSON.parse(localStorage.getItem('networkList') || '[]')
+      networkList = networkList.map((cfg) => {
+        return { ...DEFAULT_NETWORK_CONFIG(), ...cfg } as NetworkConfig
+      })
+
+      // prevent a empty list from localStorage, should not happen
+      if (networkList.length === 0)
+        networkList = [DEFAULT_NETWORK_CONFIG()]
+
+      this.networkList = networkList
+      this.curNetwork = this.networkList[0]
+    },
+
+    saveToLocalStorage() {
+      localStorage.setItem('networkList', JSON.stringify(this.networkList))
+    },
+
+    saveRunningInstanceIdsToLocalStorage() {
+      let instance_ids = Object.keys(this.instances).filter((instanceId) => this.instances[instanceId].running)
+      localStorage.setItem('runningInstanceIds', JSON.stringify(instance_ids))
+    }
+  },
+})
+
+if (import.meta.hot)
+  import.meta.hot.accept(acceptHMRUpdate(useNetworkStore as any, import.meta.hot))
+
+export function loadRunningInstanceIdsFromLocalStorage(): string[] {
+  try {
+    return JSON.parse(localStorage.getItem('runningInstanceIds') || '[]')
+  } catch (e) {
+    console.error(e)
+    return []
+  }
+}

easytier-gui/src/styles.css

@@ -0,0 +1,48 @@
+@layer tailwind-base, primevue, tailwind-utilities;
+
+@layer tailwind-base {
+  @tailwind base;
+}
+
+@layer tailwind-utilities {
+  @tailwind components;
+  @tailwind utilities;
+}
+
+:root {
+  font-family: Inter, Avenir, Helvetica, Arial, sans-serif;
+  font-size: 12px;
+  line-height: 24px;
+  font-weight: 400;
+
+  color: #0f0f0f;
+  background-color: white;
+
+  font-synthesis: none;
+  text-rendering: optimizeLegibility;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+  -webkit-text-size-adjust: 100%;
+}
+
+.card {
+  background: var(--surface-card);
+  padding: 2rem;
+  border-radius: 10px;
+  margin-bottom: 1rem;
+}
+
+::-webkit-scrollbar {
+  width: 4px;
+  height: 4px;
+  border-radius: 4px;
+}
+
+::-webkit-scrollbar-track {
+  border-radius: 4px;
+}
+
+::-webkit-scrollbar-thumb {
+  border-radius: 4px;
+  background-color: #0000005d;
+}

easytier-gui/src/typed-router.d.ts

@@ -0,0 +1,23 @@
+/* eslint-disable */
+/* prettier-ignore */
+// @ts-nocheck
+// Generated by unplugin-vue-router. ‼️ DO NOT MODIFY THIS FILE ‼️
+// It's recommended to commit this file.
+// Make sure to add this file to your tsconfig.json file as an "includes" or "files" entry.
+
+declare module 'vue-router/auto-routes' {
+  import type {
+    RouteRecordInfo,
+    ParamValue,
+    ParamValueOneOrMore,
+    ParamValueZeroOrMore,
+    ParamValueZeroOrOne,
+  } from 'unplugin-vue-router/types'
+
+  /**
+   * Route name map generated by unplugin-vue-router
+   */
+  export interface RouteNamedMap {
+    '/': RouteRecordInfo<'/', '/', Record<never, never>, Record<never, never>>,
+  }
+}

easytier-gui/src/types/network.ts

@@ -0,0 +1,162 @@
+import { v4 as uuidv4 } from 'uuid'
+
+export enum NetworkingMethod {
+  PublicServer = 'PublicServer',
+  Manual = 'Manual',
+  Standalone = 'Standalone',
+}
+
+export interface NetworkConfig {
+  instance_id: string
+
+  dhcp: boolean
+  virtual_ipv4: string
+  hostname?: string
+  network_name: string
+  network_secret: string
+
+  networking_method: NetworkingMethod
+
+  public_server_url: string
+  peer_urls: string[]
+
+  proxy_cidrs: string[]
+
+  enable_vpn_portal: boolean
+  vpn_portal_listen_port: number
+  vpn_portal_client_network_addr: string
+  vpn_portal_client_network_len: number
+
+  advanced_settings: boolean
+
+  listener_urls: string[]
+  rpc_port: number
+}
+
+export function DEFAULT_NETWORK_CONFIG(): NetworkConfig {
+  return {
+    instance_id: uuidv4(),
+
+    dhcp: false,
+    virtual_ipv4: '',
+    network_name: 'easytier',
+    network_secret: '',
+
+    networking_method: NetworkingMethod.PublicServer,
+
+    public_server_url: 'tcp://easytier.public.kkrainbow.top:11010',
+    peer_urls: [],
+
+    proxy_cidrs: [],
+
+    enable_vpn_portal: false,
+    vpn_portal_listen_port: 22022,
+    vpn_portal_client_network_addr: '',
+    vpn_portal_client_network_len: 24,
+
+    advanced_settings: false,
+
+    listener_urls: [
+      'tcp://0.0.0.0:11010',
+      'udp://0.0.0.0:11010',
+      'wg://0.0.0.0:11011',
+    ],
+    rpc_port: 0,
+  }
+}
+
+export interface NetworkInstance {
+  instance_id: string
+
+  running: boolean
+  error_msg: string
+
+  detail?: NetworkInstanceRunningInfo
+}
+
+export interface NetworkInstanceRunningInfo {
+  my_node_info: NodeInfo
+  events: Record<string, any>
+  node_info: NodeInfo
+  routes: Route[]
+  peers: PeerInfo[]
+  peer_route_pairs: PeerRoutePair[]
+  running: boolean
+  error_msg?: string
+}
+
+export interface NodeInfo {
+  virtual_ipv4: string
+  ips: {
+    public_ipv4: string
+    interface_ipv4s: string[]
+    public_ipv6: string
+    interface_ipv6s: string[]
+    listeners: {
+      serialization: string
+      scheme_end: number
+      username_end: number
+      host_start: number
+      host_end: number
+      host: any
+      port?: number
+      path_start: number
+      query_start?: number
+      fragment_start?: number
+    }[]
+  }
+  stun_info: StunInfo
+  listeners: string[]
+  vpn_portal_cfg?: string
+}
+
+export interface StunInfo {
+  udp_nat_type: number
+  tcp_nat_type: number
+  last_update_time: number
+}
+
+export interface Route {
+  peer_id: number
+  ipv4_addr: string
+  next_hop_peer_id: number
+  cost: number
+  proxy_cidrs: string[]
+  hostname: string
+  stun_info?: StunInfo
+  inst_id: string
+}
+
+export interface PeerInfo {
+  peer_id: number
+  conns: PeerConnInfo[]
+}
+
+export interface PeerConnInfo {
+  conn_id: string
+  my_peer_id: number
+  peer_id: number
+  features: string[]
+  tunnel?: TunnelInfo
+  stats?: PeerConnStats
+  loss_rate: number
+}
+
+export interface PeerRoutePair {
+  route: Route
+  peer?: PeerInfo
+}
+
+export interface TunnelInfo {
+  tunnel_type: string
+  local_addr: string
+  remote_addr: string
+}
+
+export interface PeerConnStats {
+  rx_bytes: number
+  tx_bytes: number
+  rx_packets: number
+  tx_packets: number
+  latency_us: number
+}

easytier-gui/src/vite-env.d.ts

@@ -0,0 +1,8 @@
+/// <reference types="vite/client" />
+
+declare module '*.vue' {
+  import type { DefineComponent } from 'vue'
+
+  const component: DefineComponent<object, object, any>
+  export default component
+}

easytier-gui/tailwind.config.js

@@ -0,0 +1,11 @@
+/** @type {import('tailwindcss').Config} */
+export default {
+  content: [
+    './index.html',
+    './src/**/*.{vue,js,ts,jsx,tsx}',
+  ],
+  theme: {
+    extend: {},
+  },
+  plugins: [],
+}

easytier-gui/tsconfig.json

@@ -0,0 +1,45 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "jsx": "preserve",
+    "lib": [
+      "DOM",
+      "ESNext"
+    ],
+    "baseUrl": ".",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "paths": {
+      "~/*": [
+        "src/*"
+      ]
+    },
+    "resolveJsonModule": true,
+    "types": [
+      "vite/client",
+      "vite-plugin-vue-layouts/client",
+      "unplugin-vue-macros/macros-global",
+      "unplugin-vue-router/client"
+    ],
+    "allowImportingTsExtensions": true,
+    "allowJs": true,
+    "strict": true,
+    "strictNullChecks": true,
+    "noUnusedLocals": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "isolatedModules": true,
+    "skipLibCheck": true
+  },
+  "vueCompilerOptions": {
+    "plugins": [
+      "@vue-macros/volar/define-models",
+      "@vue-macros/volar/define-slots"
+    ]
+  },
+  "exclude": [
+    "dist",
+    "node_modules"
+  ]
+}

easytier-gui/vite.config.ts

@@ -0,0 +1,96 @@
+import path from 'node:path'
+import { defineConfig } from 'vite'
+import Vue from '@vitejs/plugin-vue'
+import Layouts from 'vite-plugin-vue-layouts'
+import Components from 'unplugin-vue-components/vite'
+import AutoImport from 'unplugin-auto-import/vite'
+import VueMacros from 'unplugin-vue-macros/vite'
+import VueI18n from '@intlify/unplugin-vue-i18n/vite'
+import VueDevTools from 'vite-plugin-vue-devtools'
+import VueRouter from 'unplugin-vue-router/vite'
+import { VueRouterAutoImports } from 'unplugin-vue-router'
+import { PrimeVueResolver } from 'unplugin-vue-components/resolvers'
+
+// https://vitejs.dev/config/
+export default defineConfig(async () => ({
+  resolve: {
+    alias: {
+      '~/': `${path.resolve(__dirname, 'src')}/`,
+    },
+  },
+  plugins: [
+    VueMacros({
+      plugins: {
+        vue: Vue({
+          include: [/\.vue$/, /\.md$/],
+        }),
+      },
+    }),
+
+    // https://github.com/posva/unplugin-vue-router
+    VueRouter({
+      extensions: ['.vue', '.md'],
+      dts: 'src/typed-router.d.ts',
+    }),
+
+    // https://github.com/JohnCampionJr/vite-plugin-vue-layouts
+    Layouts(),
+
+    // https://github.com/antfu/unplugin-auto-import
+    AutoImport({
+      imports: [
+        'vue',
+        'vue-i18n',
+        'pinia',
+        VueRouterAutoImports,
+        {
+          // add any other imports you were relying on
+          'vue-router/auto': ['useLink'],
+        },
+      ],
+      dts: 'src/auto-imports.d.ts',
+      dirs: [
+        'src/composables',
+        'src/stores',
+      ],
+      vueTemplate: true,
+    }),
+
+    // https://github.com/antfu/unplugin-vue-components
+    Components({
+      // allow auto load markdown components under `./src/components/`
+      extensions: ['vue', 'md'],
+      // allow auto import and register components used in markdown
+      include: [/\.vue$/, /\.vue\?vue/, /\.md$/],
+      dts: 'src/components.d.ts',
+      resolvers: [
+        PrimeVueResolver(),
+      ],
+    }),
+
+    // https://github.com/intlify/bundle-tools/tree/main/packages/unplugin-vue-i18n
+    VueI18n({
+      runtimeOnly: true,
+      compositionOnly: true,
+      fullInstall: true,
+      include: [path.resolve(__dirname, 'locales/**')],
+    }),
+
+    // https://github.com/webfansplz/vite-plugin-vue-devtools
+    VueDevTools(),
+  ],
+
+  // Vite options tailored for Tauri development and only applied in `tauri dev` or `tauri build`
+  //
+  // 1. prevent vite from obscuring rust errors
+  clearScreen: false,
+  // 2. tauri expects a fixed port, fail if that port is not available
+  server: {
+    port: 1420,
+    strictPort: true,
+    watch: {
+      // 3. tell vite to ignore watching `src-tauri`
+      ignored: ['**/src-tauri/**'],
+    },
+  },
+}))

easytier/Cargo.toml

@@ -0,0 +1,195 @@
+[package]
+name = "easytier"
+description = "A full meshed p2p VPN, connecting all your devices in one network with one command."
+homepage = "https://github.com/KKRainbow/EasyTier"
+repository = "https://github.com/KKRainbow/EasyTier"
+version = "1.1.0"
+edition = "2021"
+authors = ["kkrainbow"]
+keywords = ["vpn", "p2p", "network", "easytier"]
+categories = ["network-programming", "command-line-utilities"]
+rust-version = "1.75"
+license-file = "LICENSE"
+readme = "README.md"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[[bin]]
+name = "easytier-core"
+path = "src/easytier-core.rs"
+
+[[bin]]
+name = "easytier-cli"
+path = "src/easytier-cli.rs"
+test = false
+
+[lib]
+name = "easytier"
+path = "src/lib.rs"
+test = false
+
+[dependencies]
+tracing = { version = "0.1", features = ["log"] }
+tracing-subscriber = { version = "0.3", features = [
+    "env-filter",
+    "local-time",
+    "time",
+] }
+tracing-appender = "0.2.3"
+log = "0.4"
+thiserror = "1.0"
+auto_impl = "1.1.0"
+crossbeam = "0.8.4"
+time = "0.3"
+toml = "0.8.12"
+chrono = { version = "0.4.37", features = ["serde"] }
+
+gethostname = "0.4.3"
+
+futures = { version = "0.3", features = ["bilock", "unstable"] }
+
+tokio = { version = "1", features = ["full"] }
+tokio-stream = "0.1"
+tokio-util = { version = "0.7.9", features = ["codec", "net"] }
+
+async-stream = "0.3.5"
+async-trait = "0.1.74"
+
+dashmap = "5.5.3"
+timedmap = "=1.0.1"
+
+# for full-path zero-copy
+zerocopy = { version = "0.7.32", features = ["derive", "simd"] }
+bytes = "1.5.0"
+pin-project-lite = "0.2.13"
+atomicbox = "0.4.0"
+tachyonix = "0.2.1"
+
+quinn = { version = "0.11.0", optional = true, features = ["ring"] }
+rustls = { version = "0.23.0", features = [
+    "ring",
+], default-features = false, optional = true }
+rcgen = { version = "0.11.1", optional = true }
+
+# for websocket
+tokio-websockets = { version = "0.8.2", optional = true, features = [
+    "rustls-webpki-roots",
+    "client",
+    "server",
+    "fastrand",
+    "ring",
+] }
+http = { version = "1", default-features = false, features = [
+    "std",
+], optional = true }
+tokio-rustls = { version = "0.26", default-features = false, optional = true }
+
+# for tap device
+tun = { package = "tun-easytier", version = "0.6.1", features = ["async"] }
+# for net ns
+nix = { version = "0.27", features = ["sched", "socket", "ioctl"] }
+
+uuid = { version = "1.5.0", features = [
+    "v4",
+    "fast-rng",
+    "macro-diagnostics",
+    "serde",
+] }
+
+# for ring tunnel
+crossbeam-queue = "0.3"
+once_cell = "1.18.0"
+
+# for packet
+postcard = { "version" = "1.0.8", features = ["alloc"] }
+
+# for rpc
+tonic = "0.10"
+prost = "0.12"
+anyhow = "1.0"
+tarpc = { version = "0.32", features = ["tokio1", "serde1"] }
+
+url = { version = "2.5", features = ["serde"] }
+percent-encoding = "2.3.1"
+
+# for tun packet
+byteorder = "1.5.0"
+
+# for proxy
+cidr = { version = "0.2.2", features = ["serde"] }
+socket2 = "0.5.5"
+
+# for hole punching
+stun_codec = "0.3.4"
+bytecodec = "0.4.15"
+rand = "0.8.5"
+
+serde = { version = "1.0", features = ["derive"] }
+pnet = { version = "0.34.0", features = ["serde"] }
+
+clap = { version = "4.4.8", features = ["unicode", "derive", "wrap_help"] }
+
+async-recursion = "1.0.5"
+
+network-interface = "1.1.1"
+
+# for ospf route
+petgraph = "0.6.5"
+
+boringtun = { package = "boringtun-easytier", version = "*", optional = true } # for encryption
+ring = { version = "0.17", optional = true }
+bitflags = "2.5"
+aes-gcm = { version = "0.10.3", optional = true }
+
+# for cli
+tabled = "0.15.*"
+humansize = "2.1.3"
+
+base64 = "0.21.7"
+
+derivative = "2.2.0"
+
+mimalloc-rust = { version = "0.2.1", optional = true }
+
+indexmap = { version = "~1.9.3", optional = false, features = ["std"] }
+
+atomic-shim = "0.2.0"
+
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.52", features = [
+    "Win32_Networking_WinSock",
+    "Win32_NetworkManagement_IpHelper",
+    "Win32_Foundation",
+    "Win32_System_IO",
+] }
+encoding = "0.2"
+
+[build-dependencies]
+tonic-build = "0.10"
+
+[target.'cfg(windows)'.build-dependencies]
+reqwest = { version = "0.11", features = ["blocking"] }
+zip = "0.6.6"
+
+
+[dev-dependencies]
+serial_test = "3.0.0"
+rstest = "0.18.2"
+defguard_wireguard_rs = "0.4.2"
+
+
+[features]
+default = ["wireguard", "mimalloc", "websocket"]
+full = ["quic", "websocket", "wireguard", "mimalloc", "aes-gcm"]
+mips = ["aes-gcm", "mimalloc", "wireguard"]
+wireguard = ["dep:boringtun", "dep:ring"]
+quic = ["dep:quinn", "dep:rustls", "dep:rcgen"]
+mimalloc = ["dep:mimalloc-rust"]
+aes-gcm = ["dep:aes-gcm"]
+websocket = [
+    "dep:tokio-websockets",
+    "dep:http",
+    "dep:tokio-rustls",
+    "dep:rustls",
+    "dep:rcgen",
+]

easytier/LICENSE

@@ -0,0 +1 @@
+../LICENSE

easytier/README.md

@@ -0,0 +1 @@
+../README.md

easytier/README_CN.md

@@ -0,0 +1 @@
+../README_CN.md

easytier/assets

@@ -0,0 +1 @@
+../assets

easytier/build.rs

@@ -19,8 +19,8 @@ impl WindowsBuild {
 
         let path = env::var_os("PATH").unwrap_or_default();
         for p in env::split_paths(&path) {
-            let p = p.join("protoc");
-            if p.exists() {
+            let p = p.join("protoc.exe");
+            if p.exists() && p.is_file() {
                 return Some(p);
             }
         }
@@ -75,7 +75,7 @@ impl WindowsBuild {
 
     pub fn check_for_win() {
         // add third_party dir to link search path
-        println!("cargo:rustc-link-search=native=third_party/");
+        println!("cargo:rustc-link-search=native=easytier/third_party/");
         let protoc_path = if let Some(o) = Self::check_protoc_exist() {
             println!("cargo:info=use os exist protoc: {:?}", o);
             o

easytier/proto/cli.proto

@@ -59,6 +59,9 @@ message StunInfo {
     NatType udp_nat_type = 1;
     NatType tcp_nat_type = 2;
     int64 last_update_time = 3;
+    repeated string public_ip = 4;
+    uint32 min_port = 5;
+    uint32 max_port = 6;
 }
 
 message Route {
@@ -117,16 +120,8 @@ service ConnectorManageRpc {
     rpc ManageConnector (ManageConnectorRequest) returns (ManageConnectorResponse);
 }
 
-enum LatencyLevel {
-    VeryLow = 0;
-    Low = 1;
-    Normal = 2;
-    High = 3;
-    VeryHigh = 4;
-}
-
 message DirectConnectedPeerInfo {
-    LatencyLevel latency_level = 2;
+    int32 latency_ms = 1;
 }
 
 message PeerInfoForGlobalMap {
@@ -142,3 +137,39 @@ message GetGlobalPeerMapResponse {
 service PeerCenterRpc {
     rpc GetGlobalPeerMap (GetGlobalPeerMapRequest) returns (GetGlobalPeerMapResponse);
 }
+
+message VpnPortalInfo {
+    string vpn_type = 1;
+    string client_config = 2;
+    repeated string connected_clients = 3;
+}
+
+message GetVpnPortalInfoRequest {}
+message GetVpnPortalInfoResponse {
+    VpnPortalInfo vpn_portal_info = 1;
+}
+
+service VpnPortalRpc {
+    rpc GetVpnPortalInfo (GetVpnPortalInfoRequest) returns (GetVpnPortalInfoResponse);
+}
+
+message HandshakeRequest {
+    uint32 magic = 1;
+    uint32 my_peer_id = 2;
+    uint32 version = 3;
+    repeated string features = 4;
+    string network_name = 5;
+    bytes network_secret_digrest = 6;
+}
+
+message TaRpcPacket {
+    uint32 from_peer = 1;
+    uint32 to_peer = 2;
+    uint32 service_id = 3;
+    uint32 transact_id = 4;
+    bool is_req = 5;
+    bytes content = 6;
+
+    uint32 total_pieces = 7;
+    uint32 piece_idx = 8;
+}

easytier/src/arch/windows.rs

@@ -19,8 +19,6 @@ use windows_sys::{
     },
 };
 
-use crate::tunnels::common::get_interface_name_by_ip;
-
 pub fn disable_connection_reset<S: AsRawSocket>(socket: &S) -> io::Result<()> {
     let handle = socket.as_raw_socket() as SOCKET;
 
@@ -62,6 +60,16 @@ pub fn disable_connection_reset<S: AsRawSocket>(socket: &S) -> io::Result<()> {
     Ok(())
 }
 
+pub fn interface_count() -> io::Result<usize> {
+    let ifaces = network_interface::NetworkInterface::show().map_err(|e| {
+        io::Error::new(
+            ErrorKind::NotFound,
+            format!("Failed to get interfaces. error: {}", e),
+        )
+    })?;
+    Ok(ifaces.len())
+}
+
 pub fn find_interface_index(iface_name: &str) -> io::Result<u32> {
     let ifaces = network_interface::NetworkInterface::show().map_err(|e| {
         io::Error::new(
@@ -132,13 +140,14 @@ pub fn set_ip_unicast_if<S: AsRawSocket>(
 pub fn setup_socket_for_win<S: AsRawSocket>(
     socket: &S,
     bind_addr: &SocketAddr,
+    bind_dev: Option<String>,
     is_udp: bool,
 ) -> io::Result<()> {
     if is_udp {
         disable_connection_reset(socket)?;
     }
 
-    if let Some(iface) = get_interface_name_by_ip(&bind_addr.ip()) {
+    if let Some(iface) = bind_dev {
         set_ip_unicast_if(socket, bind_addr, iface.as_str())?;
     }
 

easytier/src/common/config.rs

@@ -1,14 +1,21 @@
 use std::{
-    net::SocketAddr,
+    net::{Ipv4Addr, SocketAddr},
+    path::PathBuf,
     sync::{Arc, Mutex},
 };
 
 use anyhow::Context;
 use serde::{Deserialize, Serialize};
 
+use crate::tunnel::generate_digest_from_str;
+
 #[auto_impl::auto_impl(Box, &)]
 pub trait ConfigLoader: Send + Sync {
     fn get_id(&self) -> uuid::Uuid;
+    fn set_id(&self, id: uuid::Uuid);
+
+    fn get_hostname(&self) -> String;
+    fn set_hostname(&self, name: Option<String>);
 
     fn get_inst_name(&self) -> String;
     fn set_inst_name(&self, name: String);
@@ -17,7 +24,10 @@ pub trait ConfigLoader: Send + Sync {
     fn set_netns(&self, ns: Option<String>);
 
     fn get_ipv4(&self) -> Option<std::net::Ipv4Addr>;
-    fn set_ipv4(&self, addr: std::net::Ipv4Addr);
+    fn set_ipv4(&self, addr: Option<std::net::Ipv4Addr>);
+
+    fn get_dhcp(&self) -> bool;
+    fn set_dhcp(&self, dhcp: bool);
 
     fn add_proxy_cidr(&self, cidr: cidr::IpCidr);
     fn remove_proxy_cidr(&self, cidr: cidr::IpCidr);
@@ -42,20 +52,61 @@ pub trait ConfigLoader: Send + Sync {
     fn get_rpc_portal(&self) -> Option<SocketAddr>;
     fn set_rpc_portal(&self, addr: SocketAddr);
 
+    fn get_vpn_portal_config(&self) -> Option<VpnPortalConfig>;
+    fn set_vpn_portal_config(&self, config: VpnPortalConfig);
+
+    fn get_flags(&self) -> Flags;
+    fn set_flags(&self, flags: Flags);
+
+    fn get_exit_nodes(&self) -> Vec<Ipv4Addr>;
+    fn set_exit_nodes(&self, nodes: Vec<Ipv4Addr>);
+
     fn dump(&self) -> String;
 }
 
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq)]
+pub type NetworkSecretDigest = [u8; 32];
+
+#[derive(Debug, Clone, Deserialize, Serialize, Default)]
 pub struct NetworkIdentity {
     pub network_name: String,
-    pub network_secret: String,
+    pub network_secret: Option<String>,
+    #[serde(skip)]
+    pub network_secret_digest: Option<NetworkSecretDigest>,
+}
+
+impl PartialEq for NetworkIdentity {
+    fn eq(&self, other: &Self) -> bool {
+        if self.network_name != other.network_name {
+            return false;
+        }
+
+        if self.network_secret.is_some()
+            && other.network_secret.is_some()
+            && self.network_secret != other.network_secret
+        {
+            return false;
+        }
+
+        if self.network_secret_digest.is_some()
+            && other.network_secret_digest.is_some()
+            && self.network_secret_digest != other.network_secret_digest
+        {
+            return false;
+        }
+
+        return true;
+    }
 }
 
 impl NetworkIdentity {
     pub fn new(network_name: String, network_secret: String) -> Self {
+        let mut network_secret_digest = [0u8; 32];
+        generate_digest_from_str(&network_name, &network_secret, &mut network_secret_digest);
+
         NetworkIdentity {
             network_name,
-            network_secret,
+            network_secret: Some(network_secret),
+            network_secret_digest: Some(network_secret_digest),
         }
     }
 
@@ -87,14 +138,41 @@ pub struct ConsoleLoggerConfig {
     pub level: Option<String>,
 }
 
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq)]
+pub struct VpnPortalConfig {
+    pub client_cidr: cidr::Ipv4Cidr,
+    pub wireguard_listen: SocketAddr,
+}
+
+// Flags is used to control the behavior of the program
+#[derive(derivative::Derivative, Deserialize, Serialize)]
+#[derivative(Debug, Clone, PartialEq, Default)]
+pub struct Flags {
+    #[derivative(Default(value = "\"tcp\".to_string()"))]
+    pub default_protocol: String,
+    #[derivative(Default(value = "true"))]
+    pub enable_encryption: bool,
+    #[derivative(Default(value = "true"))]
+    pub enable_ipv6: bool,
+    #[derivative(Default(value = "1380"))]
+    pub mtu: u16,
+    #[derivative(Default(value = "true"))]
+    pub latency_first: bool,
+    #[derivative(Default(value = "false"))]
+    pub enable_exit_node: bool,
+}
+
 #[derive(Debug, Clone, Deserialize, Serialize, PartialEq)]
 struct Config {
     netns: Option<String>,
+    hostname: Option<String>,
     instance_name: Option<String>,
-    instance_id: Option<String>,
+    instance_id: Option<uuid::Uuid>,
     ipv4: Option<String>,
+    dhcp: Option<bool>,
     network_identity: Option<NetworkIdentity>,
     listeners: Option<Vec<url::Url>>,
+    exit_nodes: Option<Vec<Ipv4Addr>>,
 
     peer: Option<Vec<PeerConfig>>,
     proxy_network: Option<Vec<NetworkConfig>>,
@@ -103,6 +181,10 @@ struct Config {
     console_logger: Option<ConsoleLoggerConfig>,
 
     rpc_portal: Option<SocketAddr>,
+
+    vpn_portal_config: Option<VpnPortalConfig>,
+
+    flags: Option<Flags>,
 }
 
 #[derive(Debug, Clone)]
@@ -124,15 +206,23 @@ impl TomlConfigLoader {
                 config_str, config_str
             )
         })?;
+
         Ok(TomlConfigLoader {
             config: Arc::new(Mutex::new(config)),
         })
     }
 
-    pub fn new(config_path: &str) -> Result<Self, anyhow::Error> {
+    pub fn new(config_path: &PathBuf) -> Result<Self, anyhow::Error> {
         let config_str = std::fs::read_to_string(config_path)
-            .with_context(|| format!("failed to read config file: {}", config_path))?;
-        Self::new_from_str(&config_str)
+            .with_context(|| format!("failed to read config file: {:?}", config_path))?;
+        let ret = Self::new_from_str(&config_str)?;
+        let old_ns = ret.get_network_identity();
+        ret.set_network_identity(NetworkIdentity::new(
+            old_ns.network_name,
+            old_ns.network_secret.unwrap_or_default(),
+        ));
+
+        Ok(ret)
     }
 }
 
@@ -150,6 +240,39 @@ impl ConfigLoader for TomlConfigLoader {
         self.config.lock().unwrap().instance_name = Some(name);
     }
 
+    fn get_hostname(&self) -> String {
+        let hostname = self.config.lock().unwrap().hostname.clone();
+
+        match hostname {
+            Some(hostname) => {
+                if !hostname.is_empty() {
+                    let mut name = hostname
+                        .chars()
+                        .filter(|c| c.is_ascii_alphanumeric() || *c == '-' || *c == '_')
+                        .take(32)
+                        .collect::<String>();
+
+                    if name.len() > 32 {
+                        name = name.chars().take(32).collect::<String>();
+                    }
+
+                    if hostname != name {
+                        self.set_hostname(Some(name.clone()));
+                    }
+                    name
+                } else {
+                    self.set_hostname(None);
+                    gethostname::gethostname().to_string_lossy().to_string()
+                }
+            }
+            None => gethostname::gethostname().to_string_lossy().to_string(),
+        }
+    }
+
+    fn set_hostname(&self, name: Option<String>) {
+        self.config.lock().unwrap().hostname = name;
+    }
+
     fn get_netns(&self) -> Option<String> {
         self.config.lock().unwrap().netns.clone()
     }
@@ -167,8 +290,20 @@ impl ConfigLoader for TomlConfigLoader {
             .flatten()
     }
 
-    fn set_ipv4(&self, addr: std::net::Ipv4Addr) {
-        self.config.lock().unwrap().ipv4 = Some(addr.to_string());
+    fn set_ipv4(&self, addr: Option<std::net::Ipv4Addr>) {
+        self.config.lock().unwrap().ipv4 = if let Some(addr) = addr {
+            Some(addr.to_string())
+        } else {
+            None
+        };
+    }
+
+    fn get_dhcp(&self) -> bool {
+        self.config.lock().unwrap().dhcp.unwrap_or_default()
+    }
+
+    fn set_dhcp(&self, dhcp: bool) {
+        self.config.lock().unwrap().dhcp = Some(dhcp);
     }
 
     fn add_proxy_cidr(&self, cidr: cidr::IpCidr) {
@@ -222,21 +357,17 @@ impl ConfigLoader for TomlConfigLoader {
         let mut locked_config = self.config.lock().unwrap();
         if locked_config.instance_id.is_none() {
             let id = uuid::Uuid::new_v4();
-            locked_config.instance_id = Some(id.to_string());
+            locked_config.instance_id = Some(id);
             id
         } else {
-            uuid::Uuid::parse_str(locked_config.instance_id.as_ref().unwrap())
-                .with_context(|| {
-                    format!(
-                        "failed to parse instance id as uuid: {}, you can use this id: {}",
-                        locked_config.instance_id.as_ref().unwrap(),
-                        uuid::Uuid::new_v4()
-                    )
-                })
-                .unwrap()
+            locked_config.instance_id.as_ref().unwrap().clone()
         }
     }
 
+    fn set_id(&self, id: uuid::Uuid) {
+        self.config.lock().unwrap().instance_id = Some(id);
+    }
+
     fn get_network_identity(&self) -> NetworkIdentity {
         self.config
             .lock()
@@ -314,6 +445,39 @@ impl ConfigLoader for TomlConfigLoader {
         self.config.lock().unwrap().rpc_portal = Some(addr);
     }
 
+    fn get_vpn_portal_config(&self) -> Option<VpnPortalConfig> {
+        self.config.lock().unwrap().vpn_portal_config.clone()
+    }
+    fn set_vpn_portal_config(&self, config: VpnPortalConfig) {
+        self.config.lock().unwrap().vpn_portal_config = Some(config);
+    }
+
+    fn get_flags(&self) -> Flags {
+        self.config
+            .lock()
+            .unwrap()
+            .flags
+            .clone()
+            .unwrap_or_default()
+    }
+
+    fn set_flags(&self, flags: Flags) {
+        self.config.lock().unwrap().flags = Some(flags);
+    }
+
+    fn get_exit_nodes(&self) -> Vec<Ipv4Addr> {
+        self.config
+            .lock()
+            .unwrap()
+            .exit_nodes
+            .clone()
+            .unwrap_or_default()
+    }
+
+    fn set_exit_nodes(&self, nodes: Vec<Ipv4Addr>) {
+        self.config.lock().unwrap().exit_nodes = Some(nodes);
+    }
+
     fn dump(&self) -> String {
         toml::to_string_pretty(&*self.config.lock().unwrap()).unwrap()
     }

easytier/src/common/constants.rs

@@ -1,7 +1,3 @@
-pub const DIRECT_CONNECTOR_SERVICE_ID: u32 = 1;
-pub const DIRECT_CONNECTOR_BLACKLIST_TIMEOUT_SEC: u64 = 60;
-pub const DIRECT_CONNECTOR_IP_LIST_TIMEOUT_SEC: u64 = 60;
-
 macro_rules! define_global_var {
     ($name:ident, $type:ty, $init:expr) => {
         pub static $name: once_cell::sync::Lazy<tokio::sync::Mutex<$type>> =

easytier/src/common/defer.rs

@@ -0,0 +1,24 @@
+#[doc(hidden)]
+pub struct Defer<F: FnOnce()> {
+    // internal struct used by defer! macro
+    func: Option<F>,
+}
+
+impl<F: FnOnce()> Defer<F> {
+    pub fn new(func: F) -> Self {
+        Self { func: Some(func) }
+    }
+}
+
+impl<F: FnOnce()> Drop for Defer<F> {
+    fn drop(&mut self) {
+        self.func.take().map(|f| f());
+    }
+}
+
+#[macro_export]
+macro_rules! defer {
+	( $($tt:tt)* ) => {
+		let _deferred = $crate::common::defer::Defer::new(|| { $($tt)* });
+	};
+}

easytier/src/common/error.rs

@@ -2,7 +2,7 @@ use std::{io, result};
 
 use thiserror::Error;
 
-use crate::tunnels;
+use crate::tunnel;
 
 use super::PeerId;
 
@@ -13,7 +13,7 @@ pub enum Error {
     #[error("rust tun error {0}")]
     TunError(#[from] tun::Error),
     #[error("tunnel error {0}")]
-    TunnelError(#[from] tunnels::TunnelError),
+    TunnelError(#[from] tunnel::TunnelError),
     #[error("Peer has no conn, PeerId: {0}")]
     PeerNoConnectionError(PeerId),
     #[error("RouteError: {0:?}")]
@@ -38,6 +38,15 @@ pub enum Error {
     Unknown,
     #[error("anyhow error: {0}")]
     AnyhowError(#[from] anyhow::Error),
+
+    #[error("wait resp error: {0}")]
+    WaitRespError(String),
+
+    #[error("message decode error: {0}")]
+    MessageDecodeError(String),
+
+    #[error("secret key error: {0}")]
+    SecretKeyError(String),
 }
 
 pub type Result<T> = result::Result<T, Error>;

easytier/src/common/global_ctx.rs

@@ -1,10 +1,14 @@
-use std::sync::{Arc, Mutex};
+use std::collections::hash_map::DefaultHasher;
+use std::{
+    hash::Hasher,
+    sync::{Arc, Mutex},
+};
 
 use crate::rpc::PeerConnInfo;
 use crossbeam::atomic::AtomicCell;
 
 use super::{
-    config::ConfigLoader,
+    config::{ConfigLoader, Flags},
     netns::NetNS,
     network::IPCollector,
     stun::{StunInfoCollector, StunInfoCollectorTrait},
@@ -13,7 +17,7 @@ use super::{
 
 pub type NetworkIdentity = crate::common::config::NetworkIdentity;
 
-#[derive(Debug, Clone, PartialEq)]
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
 pub enum GlobalCtxEvent {
     TunDeviceReady(String),
 
@@ -23,11 +27,18 @@ pub enum GlobalCtxEvent {
     PeerConnRemoved(PeerConnInfo),
 
     ListenerAdded(url::Url),
-    ConnectionAccepted(String, String), // (local url, remote url)
+    ListenerAddFailed(url::Url, String), // (url, error message)
+    ConnectionAccepted(String, String),  // (local url, remote url)
     ConnectionError(String, String, String), // (local url, remote url, error message)
 
     Connecting(url::Url),
-    ConnectError(String, String), // (dst, error message)
+    ConnectError(String, String, String), // (dst, ip version, error message)
+
+    VpnPortalClientConnected(String, String), // (portal, client ip)
+    VpnPortalClientDisconnected(String, String), // (portal, client ip)
+
+    DhcpIpv4Changed(Option<std::net::Ipv4Addr>, Option<std::net::Ipv4Addr>), // (old, new)
+    DhcpIpv4Conflicted(Option<std::net::Ipv4Addr>),
 }
 
 type EventBus = tokio::sync::broadcast::Sender<GlobalCtxEvent>;
@@ -47,11 +58,13 @@ pub struct GlobalCtx {
 
     ip_collector: Arc<IPCollector>,
 
-    hotname: AtomicCell<Option<String>>,
+    hostname: String,
 
     stun_info_collection: Box<dyn StunInfoCollectorTrait>,
 
     running_listeners: Mutex<Vec<url::Url>>,
+
+    enable_exit_node: bool,
 }
 
 impl std::fmt::Debug for GlobalCtx {
@@ -73,9 +86,14 @@ impl GlobalCtx {
         let id = config_fs.get_id();
         let network = config_fs.get_network_identity();
         let net_ns = NetNS::new(config_fs.get_netns());
+        let hostname = config_fs.get_hostname();
 
         let (event_bus, _) = tokio::sync::broadcast::channel(100);
 
+        let stun_info_collection = Arc::new(StunInfoCollector::new_with_default_servers());
+
+        let enable_exit_node = config_fs.get_flags().enable_exit_node;
+
         GlobalCtx {
             inst_name: config_fs.get_inst_name(),
             id,
@@ -87,13 +105,15 @@ impl GlobalCtx {
             cached_ipv4: AtomicCell::new(None),
             cached_proxy_cidrs: AtomicCell::new(None),
 
-            ip_collector: Arc::new(IPCollector::new(net_ns)),
+            ip_collector: Arc::new(IPCollector::new(net_ns, stun_info_collection.clone())),
 
-            hotname: AtomicCell::new(None),
+            hostname,
 
-            stun_info_collection: Box::new(StunInfoCollector::new_with_default_servers()),
+            stun_info_collection: Box::new(stun_info_collection),
 
             running_listeners: Mutex::new(Vec::new()),
+
+            enable_exit_node,
         }
     }
 
@@ -118,7 +138,7 @@ impl GlobalCtx {
         return addr;
     }
 
-    pub fn set_ipv4(&mut self, addr: std::net::Ipv4Addr) {
+    pub fn set_ipv4(&self, addr: Option<std::net::Ipv4Addr>) {
         self.config.set_ipv4(addr);
         self.cached_ipv4.store(None);
     }
@@ -158,15 +178,8 @@ impl GlobalCtx {
         self.ip_collector.clone()
     }
 
-    pub fn get_hostname(&self) -> Option<String> {
-        if let Some(hostname) = self.hotname.take() {
-            self.hotname.store(Some(hostname.clone()));
-            return Some(hostname);
-        }
-
-        let hostname = gethostname::gethostname().to_string_lossy().to_string();
-        self.hotname.store(Some(hostname.clone()));
-        return Some(hostname);
+    pub fn get_hostname(&self) -> String {
+        return self.hostname.clone();
     }
 
     pub fn get_stun_info_collector(&self) -> impl StunInfoCollectorTrait + '_ {
@@ -192,6 +205,35 @@ impl GlobalCtx {
     pub fn add_running_listener(&self, url: url::Url) {
         self.running_listeners.lock().unwrap().push(url);
     }
+
+    pub fn get_vpn_portal_cidr(&self) -> Option<cidr::Ipv4Cidr> {
+        self.config.get_vpn_portal_config().map(|x| x.client_cidr)
+    }
+
+    pub fn get_flags(&self) -> Flags {
+        self.config.get_flags()
+    }
+
+    pub fn get_128_key(&self) -> [u8; 16] {
+        let mut key = [0u8; 16];
+        let secret = self
+            .config
+            .get_network_identity()
+            .network_secret
+            .unwrap_or_default();
+        // fill key according to network secret
+        let mut hasher = DefaultHasher::new();
+        hasher.write(secret.as_bytes());
+        key[0..8].copy_from_slice(&hasher.finish().to_be_bytes());
+        hasher.write(&key[0..8]);
+        key[8..16].copy_from_slice(&hasher.finish().to_be_bytes());
+        hasher.write(&key[0..16]);
+        key
+    }
+
+    pub fn enable_exit_node(&self) -> bool {
+        self.enable_exit_node
+    }
 }
 
 #[cfg(test)]

easytier/src/common/ifcfg.rs

@@ -6,7 +6,7 @@ use tokio::process::Command;
 use super::error::Error;
 
 #[async_trait]
-pub trait IfConfiguerTrait {
+pub trait IfConfiguerTrait: Send + Sync {
     async fn add_ipv4_route(
         &self,
         name: &str,
@@ -30,6 +30,7 @@ pub trait IfConfiguerTrait {
     async fn wait_interface_show(&self, _name: &str) -> Result<(), Error> {
         return Ok(());
     }
+    async fn set_mtu(&self, _name: &str, _mtu: u32) -> Result<(), Error>;
 }
 
 fn cidr_to_subnet_mask(prefix_length: u8) -> Ipv4Addr {
@@ -49,21 +50,36 @@ fn cidr_to_subnet_mask(prefix_length: u8) -> Ipv4Addr {
 }
 
 async fn run_shell_cmd(cmd: &str) -> Result<(), Error> {
-    let cmd_out = if cfg!(target_os = "windows") {
-        Command::new("cmd").arg("/C").arg(cmd).output().await?
-    } else {
-        Command::new("sh").arg("-c").arg(cmd).output().await?
+    let cmd_out: std::process::Output;
+    let stdout: String;
+    let stderr: String;
+    #[cfg(target_os = "windows")]
+    {
+        const CREATE_NO_WINDOW: u32 = 0x08000000;
+        cmd_out = Command::new("cmd")
+            .stdin(std::process::Stdio::null())
+            .arg("/C")
+            .arg(cmd)
+            .creation_flags(CREATE_NO_WINDOW)
+            .output()
+            .await?;
+        stdout = crate::utils::utf8_or_gbk_to_string(cmd_out.stdout.as_slice());
+        stderr = crate::utils::utf8_or_gbk_to_string(cmd_out.stderr.as_slice());
     };
-    let stdout = String::from_utf8_lossy(cmd_out.stdout.as_slice());
-    let stderr = String::from_utf8_lossy(cmd_out.stderr.as_slice());
+
+    #[cfg(not(target_os = "windows"))]
+    {
+        cmd_out = Command::new("sh").arg("-c").arg(cmd).output().await?;
+        stdout = String::from_utf8_lossy(cmd_out.stdout.as_slice()).to_string();
+        stderr = String::from_utf8_lossy(cmd_out.stderr.as_slice()).to_string();
+    };
+
     let ec = cmd_out.status.code();
     let succ = cmd_out.status.success();
     tracing::info!(?cmd, ?ec, ?succ, ?stdout, ?stderr, "run shell cmd");
 
     if !cmd_out.status.success() {
-        return Err(Error::ShellCommandError(
-            stdout.to_string() + &stderr.to_string(),
-        ));
+        return Err(Error::ShellCommandError(stdout + &stderr));
     }
     Ok(())
 }
@@ -138,6 +154,10 @@ impl IfConfiguerTrait for MacIfConfiger {
             .await
         }
     }
+
+    async fn set_mtu(&self, name: &str, mtu: u32) -> Result<(), Error> {
+        run_shell_cmd(format!("ifconfig {} mtu {}", name, mtu).as_str()).await
+    }
 }
 
 pub struct LinuxIfConfiger {}
@@ -194,6 +214,10 @@ impl IfConfiguerTrait for LinuxIfConfiger {
             .await
         }
     }
+
+    async fn set_mtu(&self, name: &str, mtu: u32) -> Result<(), Error> {
+        run_shell_cmd(format!("ip link set dev {} mtu {}", name, mtu).as_str()).await
+    }
 }
 
 #[cfg(target_os = "windows")]
@@ -346,6 +370,13 @@ impl IfConfiguerTrait for WindowsIfConfiger {
             .await??,
         )
     }
+
+    async fn set_mtu(&self, name: &str, mtu: u32) -> Result<(), Error> {
+        run_shell_cmd(
+            format!("netsh interface ipv4 set subinterface {} mtu={}", name, mtu).as_str(),
+        )
+        .await
+    }
 }
 
 #[cfg(target_os = "macos")]

easytier/src/common/mod.rs

@@ -0,0 +1,120 @@
+use std::{
+    fmt::Debug,
+    future,
+    sync::{Arc, Mutex},
+};
+use tokio::task::JoinSet;
+use tracing::Instrument;
+
+pub mod config;
+pub mod constants;
+pub mod defer;
+pub mod error;
+pub mod global_ctx;
+pub mod ifcfg;
+pub mod netns;
+pub mod network;
+pub mod stun;
+pub mod stun_codec_ext;
+
+pub fn get_logger_timer<F: time::formatting::Formattable>(
+    format: F,
+) -> tracing_subscriber::fmt::time::OffsetTime<F> {
+    unsafe {
+        time::util::local_offset::set_soundness(time::util::local_offset::Soundness::Unsound)
+    };
+    let local_offset = time::UtcOffset::current_local_offset()
+        .unwrap_or(time::UtcOffset::from_whole_seconds(0).unwrap());
+    tracing_subscriber::fmt::time::OffsetTime::new(local_offset, format)
+}
+
+pub fn get_logger_timer_rfc3339(
+) -> tracing_subscriber::fmt::time::OffsetTime<time::format_description::well_known::Rfc3339> {
+    get_logger_timer(time::format_description::well_known::Rfc3339)
+}
+
+pub type PeerId = u32;
+
+pub fn new_peer_id() -> PeerId {
+    rand::random()
+}
+
+pub fn join_joinset_background<T: Debug + Send + Sync + 'static>(
+    js: Arc<Mutex<JoinSet<T>>>,
+    origin: String,
+) {
+    let js = Arc::downgrade(&js);
+    tokio::spawn(
+        async move {
+            loop {
+                tokio::time::sleep(std::time::Duration::from_secs(1)).await;
+                if js.weak_count() == 0 {
+                    tracing::info!("joinset task exit");
+                    break;
+                }
+
+                future::poll_fn(|cx| {
+                    tracing::debug!("try join joinset tasks");
+                    let Some(js) = js.upgrade() else {
+                        return std::task::Poll::Ready(());
+                    };
+
+                    let mut js = js.lock().unwrap();
+                    while !js.is_empty() {
+                        let ret = js.poll_join_next(cx);
+                        if ret.is_pending() {
+                            return std::task::Poll::Pending;
+                        }
+                    }
+
+                    std::task::Poll::Ready(())
+                })
+                .await;
+            }
+        }
+        .instrument(tracing::info_span!(
+            "join_joinset_background",
+            origin = origin
+        )),
+    );
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_join_joinset_backgroud() {
+        let js = Arc::new(Mutex::new(JoinSet::<()>::new()));
+        join_joinset_background(js.clone(), "TEST".to_owned());
+        js.try_lock().unwrap().spawn(async {
+            tokio::time::sleep(std::time::Duration::from_secs(1)).await;
+        });
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+        assert!(js.try_lock().unwrap().is_empty());
+
+        for _ in 0..5 {
+            js.try_lock().unwrap().spawn(async {
+                tokio::time::sleep(std::time::Duration::from_secs(3)).await;
+            });
+            tokio::task::yield_now().await;
+        }
+
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+
+        for _ in 0..5 {
+            js.try_lock().unwrap().spawn(async {
+                tokio::time::sleep(std::time::Duration::from_secs(1)).await;
+            });
+            tokio::task::yield_now().await;
+        }
+
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+        assert!(js.try_lock().unwrap().is_empty());
+
+        let weak_js = Arc::downgrade(&js);
+        drop(js);
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+        assert_eq!(weak_js.weak_count(), 0);
+    }
+}

easytier/src/common/netns.rs

@@ -75,7 +75,7 @@ impl NetNSGuard {
     }
 }
 
-#[derive(Clone)]
+#[derive(Clone, Debug)]
 pub struct NetNS {
     name: Option<String>,
 }

easytier/src/common/network.rs

@@ -1,4 +1,4 @@
-use std::{ops::Deref, sync::Arc};
+use std::{net::IpAddr, ops::Deref, sync::Arc};
 
 use crate::rpc::peer::GetIpListResponse;
 use pnet::datalink::NetworkInterface;
@@ -7,7 +7,9 @@ use tokio::{
     task::JoinSet,
 };
 
-use super::{constants::DIRECT_CONNECTOR_IP_LIST_TIMEOUT_SEC, netns::NetNS};
+use super::{netns::NetNS, stun::StunInfoCollectorTrait};
+
+pub const CACHED_IP_LIST_TIMEOUT_SEC: u64 = 60;
 
 struct InterfaceFilter {
     iface: NetworkInterface,
@@ -15,33 +17,37 @@ struct InterfaceFilter {
 
 #[cfg(target_os = "linux")]
 impl InterfaceFilter {
-    async fn is_iface_bridge(&self) -> bool {
-        let path = format!("/sys/class/net/{}/bridge", self.iface.name);
+    async fn is_tun_tap_device(&self) -> bool {
+        let path = format!("/sys/class/net/{}/tun_flags", self.iface.name);
         tokio::fs::metadata(&path).await.is_ok()
     }
 
-    async fn is_iface_phsical(&self) -> bool {
-        let path = format!("/sys/class/net/{}/device", self.iface.name);
-        tokio::fs::metadata(&path).await.is_ok()
+    async fn has_valid_ip(&self) -> bool {
+        self.iface
+            .ips
+            .iter()
+            .map(|ip| ip.ip())
+            .any(|ip| !ip.is_loopback() && !ip.is_unspecified() && !ip.is_multicast())
     }
 
     async fn filter_iface(&self) -> bool {
         tracing::trace!(
-            "filter linux iface: {:?}, is_point_to_point: {}, is_loopback: {}, is_up: {}, is_lower_up: {}, is_bridge: {}, is_physical: {}",
+            "filter linux iface: {:?}, is_point_to_point: {}, is_loopback: {}, is_up: {}, is_lower_up: {}, is_tun: {}, has_valid_ip: {}",
             self.iface,
             self.iface.is_point_to_point(),
             self.iface.is_loopback(),
             self.iface.is_up(),
             self.iface.is_lower_up(),
-            self.is_iface_bridge().await,
-            self.is_iface_phsical().await,
+            self.is_tun_tap_device().await,
+            self.has_valid_ip().await
         );
 
         !self.iface.is_point_to_point()
             && !self.iface.is_loopback()
             && self.iface.is_up()
             && self.iface.is_lower_up()
-            && (self.is_iface_bridge().await || self.is_iface_phsical().await)
+            && !self.is_tun_tap_device().await
+            && self.has_valid_ip().await
     }
 }
 
@@ -85,7 +91,22 @@ impl InterfaceFilter {
 #[cfg(target_os = "windows")]
 impl InterfaceFilter {
     async fn filter_iface(&self) -> bool {
-        !self.iface.is_point_to_point() && !self.iface.is_loopback() && self.iface.is_up()
+        tracing::debug!(
+            "iface_name: {:?}, p2p: {:?}, is_up: {:?}, iface: {:?}",
+            self.iface.name,
+            self.iface.is_point_to_point(),
+            self.iface.is_up(),
+            self.iface
+        );
+        !self.iface.is_point_to_point()
+            && !self.iface.is_loopback()
+            && self
+                .iface
+                .ips
+                .iter()
+                .map(|ip| ip.ip())
+                .any(|ip| !ip.is_loopback() && !ip.is_unspecified() && !ip.is_multicast())
+            && self.iface.mac.map(|mac| !mac.is_zero()).unwrap_or(false)
     }
 }
 
@@ -121,14 +142,16 @@ pub struct IPCollector {
     cached_ip_list: Arc<RwLock<GetIpListResponse>>,
     collect_ip_task: Mutex<JoinSet<()>>,
     net_ns: NetNS,
+    stun_info_collector: Arc<Box<dyn StunInfoCollectorTrait>>,
 }
 
 impl IPCollector {
-    pub fn new(net_ns: NetNS) -> Self {
+    pub fn new<T: StunInfoCollectorTrait + 'static>(net_ns: NetNS, stun_info_collector: T) -> Self {
         Self {
             cached_ip_list: Arc::new(RwLock::new(GetIpListResponse::new())),
             collect_ip_task: Mutex::new(JoinSet::new()),
             net_ns,
+            stun_info_collector: Arc::new(Box::new(stun_info_collector)),
         }
     }
 
@@ -137,16 +160,39 @@ impl IPCollector {
         if task.is_empty() {
             let cached_ip_list = self.cached_ip_list.clone();
             *cached_ip_list.write().await =
-                Self::do_collect_ip_addrs(false, self.net_ns.clone()).await;
+                Self::do_collect_local_ip_addrs(self.net_ns.clone()).await;
             let net_ns = self.net_ns.clone();
+            let stun_info_collector = self.stun_info_collector.clone();
             task.spawn(async move {
                 loop {
-                    let ip_addrs = Self::do_collect_ip_addrs(true, net_ns.clone()).await;
+                    let ip_addrs = Self::do_collect_local_ip_addrs(net_ns.clone()).await;
                     *cached_ip_list.write().await = ip_addrs;
-                    tokio::time::sleep(std::time::Duration::from_secs(
-                        DIRECT_CONNECTOR_IP_LIST_TIMEOUT_SEC,
-                    ))
-                    .await;
+                    tokio::time::sleep(std::time::Duration::from_secs(CACHED_IP_LIST_TIMEOUT_SEC))
+                        .await;
+                }
+            });
+
+            let cached_ip_list = self.cached_ip_list.clone();
+            task.spawn(async move {
+                loop {
+                    let stun_info = stun_info_collector.get_stun_info();
+                    for ip in stun_info.public_ip.iter() {
+                        let Ok(ip_addr) = ip.parse::<IpAddr>() else {
+                            continue;
+                        };
+                        if ip_addr.is_ipv4() {
+                            cached_ip_list.write().await.public_ipv4 = ip.clone();
+                        } else {
+                            cached_ip_list.write().await.public_ipv6 = ip.clone();
+                        }
+                    }
+
+                    let sleep_sec = if !cached_ip_list.read().await.public_ipv4.is_empty() {
+                        CACHED_IP_LIST_TIMEOUT_SEC
+                    } else {
+                        3
+                    };
+                    tokio::time::sleep(std::time::Duration::from_secs(sleep_sec)).await;
                 }
             });
         }
@@ -154,24 +200,10 @@ impl IPCollector {
         return self.cached_ip_list.read().await.deref().clone();
     }
 
-    #[tracing::instrument(skip(net_ns))]
-    async fn do_collect_ip_addrs(with_public: bool, net_ns: NetNS) -> GetIpListResponse {
-        let mut ret = crate::rpc::peer::GetIpListResponse::new();
-
-        if with_public {
-            if let Some(v4_addr) =
-                public_ip::addr_with(public_ip::http::ALL, public_ip::Version::V4).await
-            {
-                ret.public_ipv4 = v4_addr.to_string();
-            }
-
-            if let Some(v6_addr) = public_ip::addr_v6().await {
-                ret.public_ipv6 = v6_addr.to_string();
-            }
-        }
-
+    pub async fn collect_interfaces(net_ns: NetNS) -> Vec<NetworkInterface> {
         let _g = net_ns.guard();
         let ifaces = pnet::datalink::interfaces();
+        let mut ret = vec![];
         for iface in ifaces {
             let f = InterfaceFilter {
                 iface: iface.clone(),
@@ -181,6 +213,19 @@ impl IPCollector {
                 continue;
             }
 
+            ret.push(iface);
+        }
+
+        ret
+    }
+
+    #[tracing::instrument(skip(net_ns))]
+    async fn do_collect_local_ip_addrs(net_ns: NetNS) -> GetIpListResponse {
+        let mut ret = crate::rpc::peer::GetIpListResponse::new();
+
+        let ifaces = Self::collect_interfaces(net_ns.clone()).await;
+        let _g = net_ns.guard();
+        for iface in ifaces {
             for ip in iface.ips {
                 let ip: std::net::IpAddr = ip.ip();
                 if ip.is_loopback() || ip.is_multicast() {

easytier/src/common/stun.rs

@@ -0,0 +1,735 @@
+use std::collections::BTreeSet;
+use std::net::{IpAddr, SocketAddr};
+use std::sync::{Arc, RwLock};
+use std::time::{Duration, Instant};
+
+use crate::rpc::{NatType, StunInfo};
+use anyhow::Context;
+use chrono::Local;
+use crossbeam::atomic::AtomicCell;
+use rand::seq::IteratorRandom;
+use tokio::net::{lookup_host, UdpSocket};
+use tokio::sync::{broadcast, Mutex};
+use tokio::task::JoinSet;
+use tracing::{Instrument, Level};
+
+use bytecodec::{DecodeExt, EncodeExt};
+use stun_codec::rfc5389::methods::BINDING;
+use stun_codec::{Message, MessageClass, MessageDecoder, MessageEncoder};
+
+use crate::common::error::Error;
+
+use super::stun_codec_ext::*;
+
+struct HostResolverIter {
+    hostnames: Vec<String>,
+    ips: Vec<SocketAddr>,
+    max_ip_per_domain: u32,
+}
+
+impl HostResolverIter {
+    fn new(hostnames: Vec<String>, max_ip_per_domain: u32) -> Self {
+        Self {
+            hostnames,
+            ips: vec![],
+            max_ip_per_domain,
+        }
+    }
+
+    #[async_recursion::async_recursion]
+    async fn next(&mut self) -> Option<SocketAddr> {
+        if self.ips.is_empty() {
+            if self.hostnames.is_empty() {
+                return None;
+            }
+
+            let host = self.hostnames.remove(0);
+            let host = if host.contains(':') {
+                host
+            } else {
+                format!("{}:3478", host)
+            };
+
+            match lookup_host(&host).await {
+                Ok(ips) => {
+                    self.ips = ips
+                        .filter(|x| x.is_ipv4())
+                        .choose_multiple(&mut rand::thread_rng(), self.max_ip_per_domain as usize);
+                }
+                Err(e) => {
+                    tracing::warn!(?host, ?e, "lookup host for stun failed");
+                    return self.next().await;
+                }
+            };
+        }
+
+        Some(self.ips.remove(0))
+    }
+}
+
+#[derive(Debug, Clone)]
+struct StunPacket {
+    data: Vec<u8>,
+    addr: SocketAddr,
+}
+
+type StunPacketReceiver = tokio::sync::broadcast::Receiver<StunPacket>;
+
+#[derive(Debug, Clone, Copy)]
+struct BindRequestResponse {
+    local_addr: SocketAddr,
+    stun_server_addr: SocketAddr,
+
+    recv_from_addr: SocketAddr,
+    mapped_socket_addr: Option<SocketAddr>,
+    changed_socket_addr: Option<SocketAddr>,
+
+    change_ip: bool,
+    change_port: bool,
+
+    real_ip_changed: bool,
+    real_port_changed: bool,
+
+    latency_us: u32,
+}
+
+impl BindRequestResponse {
+    pub fn get_mapped_addr_no_check(&self) -> &SocketAddr {
+        self.mapped_socket_addr.as_ref().unwrap()
+    }
+}
+
+#[derive(Debug, Clone)]
+struct StunClient {
+    stun_server: SocketAddr,
+    resp_timeout: Duration,
+    req_repeat: u32,
+    socket: Arc<UdpSocket>,
+    stun_packet_receiver: Arc<Mutex<StunPacketReceiver>>,
+}
+
+impl StunClient {
+    pub fn new(
+        stun_server: SocketAddr,
+        socket: Arc<UdpSocket>,
+        stun_packet_receiver: StunPacketReceiver,
+    ) -> Self {
+        Self {
+            stun_server,
+            resp_timeout: Duration::from_millis(3000),
+            req_repeat: 2,
+            socket,
+            stun_packet_receiver: Arc::new(Mutex::new(stun_packet_receiver)),
+        }
+    }
+
+    #[tracing::instrument(skip(self, buf))]
+    async fn wait_stun_response<'a, const N: usize>(
+        &self,
+        buf: &'a mut [u8; N],
+        tids: &Vec<u128>,
+        expected_ip_changed: bool,
+        expected_port_changed: bool,
+        stun_host: &SocketAddr,
+    ) -> Result<(Message<Attribute>, SocketAddr), Error> {
+        let mut now = tokio::time::Instant::now();
+        let deadline = now + self.resp_timeout;
+
+        while now < deadline {
+            let mut locked_receiver = self.stun_packet_receiver.lock().await;
+            let stun_packet_raw = tokio::time::timeout(deadline - now, locked_receiver.recv())
+                .await?
+                .with_context(|| "recv stun packet from broadcast channel error")?;
+            now = tokio::time::Instant::now();
+
+            let (len, remote_addr) = (stun_packet_raw.data.len(), stun_packet_raw.addr);
+
+            if len < 20 {
+                continue;
+            }
+
+            let udp_buf = stun_packet_raw.data;
+
+            // TODO:: we cannot borrow `buf` directly in udp recv_from, so we copy it here
+            unsafe { std::ptr::copy(udp_buf.as_ptr(), buf.as_ptr() as *mut u8, len) };
+
+            let mut decoder = MessageDecoder::<Attribute>::new();
+            let Ok(msg) = decoder
+                .decode_from_bytes(&buf[..len])
+                .with_context(|| format!("decode stun msg {:?}", buf))?
+            else {
+                continue;
+            };
+
+            tracing::debug!(b = ?&udp_buf[..len], ?tids, ?remote_addr, ?stun_host, "recv stun response, msg: {:#?}", msg);
+
+            if msg.class() != MessageClass::SuccessResponse
+                || msg.method() != BINDING
+                || !tids.contains(&tid_to_u128(&msg.transaction_id()))
+            {
+                continue;
+            }
+
+            return Ok((msg, remote_addr));
+        }
+
+        Err(Error::Unknown)
+    }
+
+    fn extrace_mapped_addr(msg: &Message<Attribute>) -> Option<SocketAddr> {
+        let mut mapped_addr = None;
+        for x in msg.attributes() {
+            match x {
+                Attribute::MappedAddress(addr) => {
+                    if mapped_addr.is_none() {
+                        let _ = mapped_addr.insert(addr.address());
+                    }
+                }
+                Attribute::XorMappedAddress(addr) => {
+                    if mapped_addr.is_none() {
+                        let _ = mapped_addr.insert(addr.address());
+                    }
+                }
+                _ => {}
+            }
+        }
+        mapped_addr
+    }
+
+    fn extract_changed_addr(msg: &Message<Attribute>) -> Option<SocketAddr> {
+        let mut changed_addr = None;
+        for x in msg.attributes() {
+            match x {
+                Attribute::OtherAddress(m) => {
+                    if changed_addr.is_none() {
+                        let _ = changed_addr.insert(m.address());
+                    }
+                }
+                Attribute::ChangedAddress(m) => {
+                    if changed_addr.is_none() {
+                        let _ = changed_addr.insert(m.address());
+                    }
+                }
+                _ => {}
+            }
+        }
+        changed_addr
+    }
+
+    #[tracing::instrument(ret, err, level = Level::DEBUG)]
+    pub async fn bind_request(
+        self,
+        change_ip: bool,
+        change_port: bool,
+    ) -> Result<BindRequestResponse, Error> {
+        let stun_host = self.stun_server;
+        // repeat req in case of packet loss
+        let mut tids = vec![];
+
+        for _ in 0..self.req_repeat {
+            let tid = rand::random::<u32>();
+            // let tid = 1;
+            let mut buf = [0u8; 28];
+            // memset buf
+            unsafe { std::ptr::write_bytes(buf.as_mut_ptr(), 0, buf.len()) };
+
+            let mut message =
+                Message::<Attribute>::new(MessageClass::Request, BINDING, u128_to_tid(tid as u128));
+            message.add_attribute(ChangeRequest::new(change_ip, change_port));
+
+            // Encodes the message
+            let mut encoder = MessageEncoder::new();
+            let msg = encoder
+                .encode_into_bytes(message.clone())
+                .with_context(|| "encode stun message")?;
+            tids.push(tid as u128);
+            tracing::debug!(?message, ?msg, tid, "send stun request");
+            self.socket
+                .send_to(msg.as_slice().into(), &stun_host)
+                .await?;
+        }
+
+        let now = Instant::now();
+
+        tracing::trace!("waiting stun response");
+        let mut buf = [0; 1620];
+        let (msg, recv_addr) = self
+            .wait_stun_response(&mut buf, &tids, change_ip, change_port, &stun_host)
+            .await?;
+
+        let changed_socket_addr = Self::extract_changed_addr(&msg);
+        let real_ip_changed = stun_host.ip() != recv_addr.ip();
+        let real_port_changed = stun_host.port() != recv_addr.port();
+
+        let resp = BindRequestResponse {
+            local_addr: self.socket.local_addr()?,
+            stun_server_addr: stun_host,
+            recv_from_addr: recv_addr,
+            mapped_socket_addr: Self::extrace_mapped_addr(&msg),
+            changed_socket_addr,
+            change_ip,
+            change_port,
+
+            real_ip_changed,
+            real_port_changed,
+
+            latency_us: now.elapsed().as_micros() as u32,
+        };
+
+        tracing::debug!(
+            ?stun_host,
+            ?recv_addr,
+            ?changed_socket_addr,
+            "finish stun bind request"
+        );
+
+        Ok(resp)
+    }
+}
+
+struct StunClientBuilder {
+    udp: Arc<UdpSocket>,
+    task_set: JoinSet<()>,
+    stun_packet_sender: broadcast::Sender<StunPacket>,
+}
+
+impl StunClientBuilder {
+    pub fn new(udp: Arc<UdpSocket>) -> Self {
+        let (stun_packet_sender, _) = broadcast::channel(1024);
+        let mut task_set = JoinSet::new();
+
+        let udp_clone = udp.clone();
+        let stun_packet_sender_clone = stun_packet_sender.clone();
+        task_set.spawn(
+            async move {
+                let mut buf = [0; 1620];
+                tracing::info!("start stun packet listener");
+                loop {
+                    let Ok((len, addr)) = udp_clone.recv_from(&mut buf).await else {
+                        tracing::error!("udp recv_from error");
+                        break;
+                    };
+                    let data = buf[..len].to_vec();
+                    tracing::debug!(?addr, ?data, "recv udp stun packet");
+                    let _ = stun_packet_sender_clone.send(StunPacket { data, addr });
+                }
+            }
+            .instrument(tracing::info_span!("stun_packet_listener")),
+        );
+
+        Self {
+            udp,
+            task_set,
+            stun_packet_sender,
+        }
+    }
+
+    pub fn new_stun_client(&self, stun_server: SocketAddr) -> StunClient {
+        StunClient::new(
+            stun_server,
+            self.udp.clone(),
+            self.stun_packet_sender.subscribe(),
+        )
+    }
+
+    pub async fn stop(&mut self) {
+        self.task_set.abort_all();
+        while let Some(_) = self.task_set.join_next().await {}
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct UdpNatTypeDetectResult {
+    source_addr: SocketAddr,
+    stun_resps: Vec<BindRequestResponse>,
+}
+
+impl UdpNatTypeDetectResult {
+    fn new(source_addr: SocketAddr, stun_resps: Vec<BindRequestResponse>) -> Self {
+        Self {
+            source_addr,
+            stun_resps,
+        }
+    }
+
+    fn has_ip_changed_resp(&self) -> bool {
+        for resp in self.stun_resps.iter() {
+            if resp.real_ip_changed {
+                return true;
+            }
+        }
+        false
+    }
+
+    fn has_port_changed_resp(&self) -> bool {
+        for resp in self.stun_resps.iter() {
+            if resp.real_port_changed {
+                return true;
+            }
+        }
+        false
+    }
+
+    fn is_open_internet(&self) -> bool {
+        for resp in self.stun_resps.iter() {
+            if resp.mapped_socket_addr == Some(self.source_addr) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    fn is_pat(&self) -> bool {
+        for resp in self.stun_resps.iter() {
+            if resp.mapped_socket_addr.map(|x| x.port()) == Some(self.source_addr.port()) {
+                return true;
+            }
+        }
+        false
+    }
+
+    fn stun_server_count(&self) -> usize {
+        // find resp with distinct stun server
+        self.stun_resps
+            .iter()
+            .map(|x| x.stun_server_addr)
+            .collect::<BTreeSet<_>>()
+            .len()
+    }
+
+    fn is_cone(&self) -> bool {
+        // if unique mapped addr count is less than stun server count, it is cone
+        let mapped_addr_count = self
+            .stun_resps
+            .iter()
+            .filter_map(|x| x.mapped_socket_addr)
+            .collect::<BTreeSet<_>>()
+            .len();
+        mapped_addr_count < self.stun_server_count()
+    }
+
+    pub fn nat_type(&self) -> NatType {
+        if self.stun_server_count() < 2 {
+            return NatType::Unknown;
+        }
+
+        if self.is_cone() {
+            if self.has_ip_changed_resp() {
+                if self.is_open_internet() {
+                    return NatType::OpenInternet;
+                } else if self.is_pat() {
+                    return NatType::NoPat;
+                } else {
+                    return NatType::FullCone;
+                }
+            } else if self.has_port_changed_resp() {
+                return NatType::Restricted;
+            } else {
+                return NatType::PortRestricted;
+            }
+        } else if !self.stun_resps.is_empty() {
+            return NatType::Symmetric;
+        } else {
+            return NatType::Unknown;
+        }
+    }
+
+    pub fn public_ips(&self) -> Vec<IpAddr> {
+        self.stun_resps
+            .iter()
+            .filter_map(|x| x.mapped_socket_addr.map(|x| x.ip()))
+            .collect::<BTreeSet<_>>()
+            .into_iter()
+            .collect()
+    }
+
+    pub fn collect_available_stun_server(&self) -> Vec<SocketAddr> {
+        let mut ret = vec![];
+        for resp in self.stun_resps.iter() {
+            if !ret.contains(&resp.stun_server_addr) {
+                ret.push(resp.stun_server_addr);
+            }
+        }
+        ret
+    }
+
+    pub fn local_addr(&self) -> SocketAddr {
+        self.source_addr
+    }
+
+    pub fn extend_result(&mut self, other: UdpNatTypeDetectResult) {
+        self.stun_resps.extend(other.stun_resps);
+    }
+
+    pub fn min_port(&self) -> u16 {
+        self.stun_resps
+            .iter()
+            .filter_map(|x| x.mapped_socket_addr.map(|x| x.port()))
+            .min()
+            .unwrap_or(0)
+    }
+
+    pub fn max_port(&self) -> u16 {
+        self.stun_resps
+            .iter()
+            .filter_map(|x| x.mapped_socket_addr.map(|x| x.port()))
+            .max()
+            .unwrap_or(u16::MAX)
+    }
+}
+
+pub struct UdpNatTypeDetector {
+    stun_server_hosts: Vec<String>,
+    max_ip_per_domain: u32,
+}
+
+impl UdpNatTypeDetector {
+    pub fn new(stun_server_hosts: Vec<String>, max_ip_per_domain: u32) -> Self {
+        Self {
+            stun_server_hosts,
+            max_ip_per_domain,
+        }
+    }
+
+    pub async fn detect_nat_type(&self, source_port: u16) -> Result<UdpNatTypeDetectResult, Error> {
+        let udp = Arc::new(UdpSocket::bind(format!("0.0.0.0:{}", source_port)).await?);
+        self.detect_nat_type_with_socket(udp).await
+    }
+
+    #[tracing::instrument(skip(self))]
+    pub async fn detect_nat_type_with_socket(
+        &self,
+        udp: Arc<UdpSocket>,
+    ) -> Result<UdpNatTypeDetectResult, Error> {
+        let mut stun_servers = vec![];
+        let mut host_resolver =
+            HostResolverIter::new(self.stun_server_hosts.clone(), self.max_ip_per_domain);
+        while let Some(addr) = host_resolver.next().await {
+            stun_servers.push(addr);
+        }
+
+        let client_builder = StunClientBuilder::new(udp.clone());
+        let mut stun_task_set = JoinSet::new();
+
+        for stun_server in stun_servers.iter() {
+            stun_task_set.spawn(
+                client_builder
+                    .new_stun_client(*stun_server)
+                    .bind_request(false, false),
+            );
+            stun_task_set.spawn(
+                client_builder
+                    .new_stun_client(*stun_server)
+                    .bind_request(false, true),
+            );
+            stun_task_set.spawn(
+                client_builder
+                    .new_stun_client(*stun_server)
+                    .bind_request(true, true),
+            );
+        }
+
+        let mut bind_resps = vec![];
+        while let Some(resp) = stun_task_set.join_next().await {
+            if let Ok(Ok(resp)) = resp {
+                bind_resps.push(resp);
+            }
+        }
+
+        Ok(UdpNatTypeDetectResult::new(udp.local_addr()?, bind_resps))
+    }
+}
+
+#[async_trait::async_trait]
+#[auto_impl::auto_impl(&, Arc, Box)]
+pub trait StunInfoCollectorTrait: Send + Sync {
+    fn get_stun_info(&self) -> StunInfo;
+    async fn get_udp_port_mapping(&self, local_port: u16) -> Result<SocketAddr, Error>;
+}
+
+pub struct StunInfoCollector {
+    stun_servers: Arc<RwLock<Vec<String>>>,
+    udp_nat_test_result: Arc<RwLock<Option<UdpNatTypeDetectResult>>>,
+    nat_test_result_time: Arc<AtomicCell<chrono::DateTime<Local>>>,
+    redetect_notify: Arc<tokio::sync::Notify>,
+    tasks: JoinSet<()>,
+}
+
+#[async_trait::async_trait]
+impl StunInfoCollectorTrait for StunInfoCollector {
+    fn get_stun_info(&self) -> StunInfo {
+        let Some(result) = self.udp_nat_test_result.read().unwrap().clone() else {
+            return Default::default();
+        };
+        StunInfo {
+            udp_nat_type: result.nat_type() as i32,
+            tcp_nat_type: 0,
+            last_update_time: self.nat_test_result_time.load().timestamp(),
+            public_ip: result.public_ips().iter().map(|x| x.to_string()).collect(),
+            min_port: result.min_port() as u32,
+            max_port: result.max_port() as u32,
+        }
+    }
+
+    async fn get_udp_port_mapping(&self, local_port: u16) -> Result<SocketAddr, Error> {
+        let stun_servers = self
+            .udp_nat_test_result
+            .read()
+            .unwrap()
+            .clone()
+            .map(|x| x.collect_available_stun_server())
+            .ok_or(Error::NotFound)?;
+
+        let udp = Arc::new(UdpSocket::bind(format!("0.0.0.0:{}", local_port)).await?);
+        let mut client_builder = StunClientBuilder::new(udp.clone());
+
+        for server in stun_servers.iter() {
+            let Ok(ret) = client_builder
+                .new_stun_client(*server)
+                .bind_request(false, false)
+                .await
+            else {
+                tracing::warn!(?server, "stun bind request failed");
+                continue;
+            };
+            if let Some(mapped_addr) = ret.mapped_socket_addr {
+                // make sure udp socket is available after return ok.
+                client_builder.stop().await;
+                return Ok(mapped_addr);
+            }
+        }
+
+        Err(Error::NotFound)
+    }
+}
+
+impl StunInfoCollector {
+    pub fn new(stun_servers: Vec<String>) -> Self {
+        let mut ret = Self {
+            stun_servers: Arc::new(RwLock::new(stun_servers)),
+            udp_nat_test_result: Arc::new(RwLock::new(None)),
+            nat_test_result_time: Arc::new(AtomicCell::new(Local::now())),
+            redetect_notify: Arc::new(tokio::sync::Notify::new()),
+            tasks: JoinSet::new(),
+        };
+
+        ret.start_stun_routine();
+
+        ret
+    }
+
+    pub fn new_with_default_servers() -> Self {
+        Self::new(Self::get_default_servers())
+    }
+
+    pub fn get_default_servers() -> Vec<String> {
+        // NOTICE: we may need to choose stun stun server based on geo location
+        // stun server cross nation may return a external ip address with high latency and loss rate
+        vec![
+            "stun.miwifi.com",
+            "stun.cdnbye.com",
+            "stun.hitv.com",
+            "stun.chat.bilibili.com",
+            "stun.douyucdn.cn:18000",
+            "fwa.lifesizecloud.com",
+            "global.turn.twilio.com",
+            "turn.cloudflare.com",
+            "stun.isp.net.au",
+            "stun.nextcloud.com",
+            "stun.freeswitch.org",
+            "stun.voip.blackberry.com",
+            "stunserver.stunprotocol.org",
+            "stun.sipnet.com",
+            "stun.radiojar.com",
+            "stun.sonetel.com",
+        ]
+        .iter()
+        .map(|x| x.to_string())
+        .collect()
+    }
+
+    fn start_stun_routine(&mut self) {
+        let stun_servers = self.stun_servers.clone();
+        let udp_nat_test_result = self.udp_nat_test_result.clone();
+        let udp_test_time = self.nat_test_result_time.clone();
+        let redetect_notify = self.redetect_notify.clone();
+        self.tasks.spawn(async move {
+            loop {
+                let servers = stun_servers.read().unwrap().clone();
+                // use first three and random choose one from the rest
+                let servers = servers
+                    .iter()
+                    .take(2)
+                    .chain(servers.iter().skip(2).choose(&mut rand::thread_rng()))
+                    .map(|x| x.to_string())
+                    .collect();
+                let detector = UdpNatTypeDetector::new(servers, 1);
+                let ret = detector.detect_nat_type(0).await;
+                tracing::debug!(?ret, "finish udp nat type detect");
+                let mut nat_type = NatType::Unknown;
+                let sleep_sec = match &ret {
+                    Ok(resp) => {
+                        *udp_nat_test_result.write().unwrap() = Some(resp.clone());
+                        udp_test_time.store(Local::now());
+                        nat_type = resp.nat_type();
+                        if nat_type == NatType::Unknown {
+                            15
+                        } else {
+                            600
+                        }
+                    }
+                    _ => 15,
+                };
+
+                // if nat type is symmtric, detect with another port to gather more info
+                if nat_type == NatType::Symmetric {
+                    let old_resp = ret.unwrap();
+                    let old_local_port = old_resp.local_addr().port();
+                    let new_port = if old_local_port >= 65535 {
+                        old_local_port - 1
+                    } else {
+                        old_local_port + 1
+                    };
+                    let ret = detector.detect_nat_type(new_port).await;
+                    tracing::debug!(?ret, "finish udp nat type detect with another port");
+                    if let Ok(resp) = ret {
+                        udp_nat_test_result.write().unwrap().as_mut().map(|x| {
+                            x.extend_result(resp);
+                        });
+                    }
+                }
+
+                tokio::select! {
+                    _ = redetect_notify.notified() => {}
+                    _ = tokio::time::sleep(Duration::from_secs(sleep_sec)) => {}
+                }
+            }
+        });
+    }
+
+    pub fn update_stun_info(&self) {
+        self.redetect_notify.notify_one();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_udp_nat_type_detector() {
+        let collector = StunInfoCollector::new_with_default_servers();
+        collector.update_stun_info();
+        loop {
+            let ret = collector.get_stun_info();
+            if ret.udp_nat_type != NatType::Unknown as i32 {
+                println!("{:#?}", ret);
+                break;
+            }
+            tokio::time::sleep(Duration::from_secs(1)).await;
+        }
+
+        let port_mapping = collector.get_udp_port_mapping(3000).await;
+        println!("{:#?}", port_mapping);
+    }
+}

easytier/src/common/stun_codec_ext.rs

@@ -1,11 +1,12 @@
 use std::net::SocketAddr;
 
+use bytecodec::fixnum::{U32beDecoder, U32beEncoder};
 use stun_codec::net::{socket_addr_xor, SocketAddrDecoder, SocketAddrEncoder};
 
 use stun_codec::rfc5389::attributes::{
     MappedAddress, Software, XorMappedAddress, XorMappedAddress2,
 };
-use stun_codec::rfc5780::attributes::{ChangeRequest, OtherAddress, ResponseOrigin};
+use stun_codec::rfc5780::attributes::{OtherAddress, ResponseOrigin};
 use stun_codec::{define_attribute_enums, AttributeType, Message, TransactionId};
 
 use bytecodec::{ByteCount, Decode, Encode, Eos, Result, SizedEncode, TryTaggedDecode};
@@ -197,6 +198,75 @@ impl_encode!(SourceAddressEncoder, SourceAddress, |item: Self::Item| {
     item.0
 });
 
+/// `CHANGE-REQUEST` attribute.
+///
+/// See [RFC 5780 -- 7.2. CHANGE-REQUEST] about this attribute.
+///
+/// [RFC 5780 -- 7.2. CHANGE-REQUEST]: https://tools.ietf.org/html/rfc5780#section-7.2
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct ChangeRequest(bool, bool);
+
+impl ChangeRequest {
+    /// The codepoint of the type of the attribute.
+    pub const CODEPOINT: u16 = 0x0003;
+
+    /// Makes a new `ChangeRequest` instance.
+    pub fn new(ip: bool, port: bool) -> Self {
+        ChangeRequest(ip, port)
+    }
+
+    /// Returns whether the client requested the server to send the Binding Response with a
+    /// different IP address than the one the Binding Request was received on
+    pub fn ip(&self) -> bool {
+        self.0
+    }
+
+    /// Returns whether the client requested the server to send the Binding Response with a
+    /// different port than the one the Binding Request was received on
+    pub fn port(&self) -> bool {
+        self.1
+    }
+}
+
+impl stun_codec::Attribute for ChangeRequest {
+    type Decoder = ChangeRequestDecoder;
+    type Encoder = ChangeRequestEncoder;
+
+    fn get_type(&self) -> AttributeType {
+        AttributeType::new(Self::CODEPOINT)
+    }
+}
+
+/// [`ChangeRequest`] decoder.
+#[derive(Debug, Default)]
+pub struct ChangeRequestDecoder(U32beDecoder);
+
+impl ChangeRequestDecoder {
+    /// Makes a new `ChangeRequestDecoder` instance.
+    pub fn new() -> Self {
+        Self::default()
+    }
+}
+impl_decode!(ChangeRequestDecoder, ChangeRequest, |item| {
+    Ok(ChangeRequest((item & 0x4) != 0, (item & 0x2) != 0))
+});
+
+/// [`ChangeRequest`] encoder.
+#[derive(Debug, Default)]
+pub struct ChangeRequestEncoder(U32beEncoder);
+
+impl ChangeRequestEncoder {
+    /// Makes a new `ChangeRequestEncoder` instance.
+    pub fn new() -> Self {
+        Self::default()
+    }
+}
+impl_encode!(ChangeRequestEncoder, ChangeRequest, |item: Self::Item| {
+    let ip = item.0 as u8;
+    let port = item.1 as u8;
+    ((ip << 1 | port) << 1) as u32
+});
+
 pub fn tid_to_u128(tid: &TransactionId) -> u128 {
     let mut tid_buf = [0u8; 16];
     // copy bytes from msg_tid to tid_buf

easytier/src/connector/direct.rs

@@ -1,23 +1,22 @@
 // try connect peers directly, with either its public ip or lan ip
 
-use std::sync::Arc;
+use std::{net::SocketAddr, sync::Arc};
 
 use crate::{
-    common::{
-        constants::{self, DIRECT_CONNECTOR_BLACKLIST_TIMEOUT_SEC},
-        error::Error,
-        global_ctx::ArcGlobalCtx,
-        PeerId,
-    },
+    common::{error::Error, global_ctx::ArcGlobalCtx, PeerId},
     peers::{peer_manager::PeerManager, peer_rpc::PeerRpcManager},
 };
 
 use crate::rpc::{peer::GetIpListResponse, PeerConnInfo};
 use tokio::{task::JoinSet, time::timeout};
 use tracing::Instrument;
+use url::Host;
 
 use super::create_connector_by_url;
 
+pub const DIRECT_CONNECTOR_SERVICE_ID: u32 = 1;
+pub const DIRECT_CONNECTOR_BLACKLIST_TIMEOUT_SEC: u64 = 300;
+
 #[tarpc::service]
 pub trait DirectConnectorRpc {
     async fn get_ip_list() -> GetIpListResponse;
@@ -76,10 +75,25 @@ impl DirectConnectorManagerRpcServer {
 #[derive(Hash, Eq, PartialEq, Clone)]
 struct DstBlackListItem(PeerId, String);
 
+#[derive(Hash, Eq, PartialEq, Clone)]
+struct DstSchemeBlackListItem(PeerId, String);
+
 struct DirectConnectorManagerData {
     global_ctx: ArcGlobalCtx,
     peer_manager: Arc<PeerManager>,
     dst_blacklist: timedmap::TimedMap<DstBlackListItem, ()>,
+    dst_sceme_blacklist: timedmap::TimedMap<DstSchemeBlackListItem, ()>,
+}
+
+impl DirectConnectorManagerData {
+    pub fn new(global_ctx: ArcGlobalCtx, peer_manager: Arc<PeerManager>) -> Self {
+        Self {
+            global_ctx,
+            peer_manager,
+            dst_blacklist: timedmap::TimedMap::new(),
+            dst_sceme_blacklist: timedmap::TimedMap::new(),
+        }
+    }
 }
 
 impl std::fmt::Debug for DirectConnectorManagerData {
@@ -101,11 +115,7 @@ impl DirectConnectorManager {
     pub fn new(global_ctx: ArcGlobalCtx, peer_manager: Arc<PeerManager>) -> Self {
         Self {
             global_ctx: global_ctx.clone(),
-            data: Arc::new(DirectConnectorManagerData {
-                global_ctx,
-                peer_manager,
-                dst_blacklist: timedmap::TimedMap::new(),
-            }),
+            data: Arc::new(DirectConnectorManagerData::new(global_ctx, peer_manager)),
             tasks: JoinSet::new(),
         }
     }
@@ -117,7 +127,7 @@ impl DirectConnectorManager {
 
     pub fn run_as_server(&mut self) {
         self.data.peer_manager.get_peer_rpc_mgr().run_service(
-            constants::DIRECT_CONNECTOR_SERVICE_ID,
+            DIRECT_CONNECTOR_SERVICE_ID,
             DirectConnectorManagerRpcServer::new(self.global_ctx.clone()).serve(),
         );
     }
@@ -163,7 +173,7 @@ impl DirectConnectorManager {
             return Err(Error::UrlInBlacklist);
         }
 
-        let connector = create_connector_by_url(&addr, data.global_ctx.get_ip_collector()).await?;
+        let connector = create_connector_by_url(&addr, &data.global_ctx).await?;
         let (peer_id, conn_id) = timeout(
             std::time::Duration::from_secs(5),
             data.peer_manager.try_connect(connector),
@@ -193,7 +203,7 @@ impl DirectConnectorManager {
         data: Arc<DirectConnectorManagerData>,
         dst_peer_id: PeerId,
         addr: String,
-    ) {
+    ) -> Result<(), Error> {
         let ret = Self::do_try_connect_to_ip(data.clone(), dst_peer_id, addr.clone()).await;
         if let Err(e) = ret {
             if !matches!(e, Error::UrlInBlacklist) {
@@ -208,11 +218,119 @@ impl DirectConnectorManager {
                     std::time::Duration::from_secs(DIRECT_CONNECTOR_BLACKLIST_TIMEOUT_SEC),
                 );
             }
+            return Err(e);
         } else {
             log::info!("try_connect_to_ip success, peer_id: {}", dst_peer_id);
+            return Ok(());
         }
     }
 
+    #[tracing::instrument]
+    async fn do_try_direct_connect_internal(
+        data: Arc<DirectConnectorManagerData>,
+        dst_peer_id: PeerId,
+        ip_list: GetIpListResponse,
+    ) -> Result<(), Error> {
+        let enable_ipv6 = data.global_ctx.get_flags().enable_ipv6;
+        let available_listeners = ip_list
+            .listeners
+            .iter()
+            .filter_map(|l| if l.scheme() != "ring" { Some(l) } else { None })
+            .filter(|l| l.port().is_some() && l.host().is_some())
+            .filter(|l| {
+                !data.dst_sceme_blacklist.contains(&DstSchemeBlackListItem(
+                    dst_peer_id.clone(),
+                    l.scheme().to_string(),
+                ))
+            })
+            .filter(|l| enable_ipv6 || !matches!(l.host().unwrap().to_owned(), Host::Ipv6(_)))
+            .collect::<Vec<_>>();
+
+        let mut listener = available_listeners.get(0).ok_or(anyhow::anyhow!(
+            "peer {} have no valid listener",
+            dst_peer_id
+        ))?;
+
+        // if have default listener, use it first
+        listener = available_listeners
+            .iter()
+            .find(|l| l.scheme() == data.global_ctx.get_flags().default_protocol)
+            .unwrap_or(listener);
+
+        let mut tasks = JoinSet::new();
+
+        let listener_host = listener.socket_addrs(|| None).unwrap().pop();
+        match listener_host {
+            Some(SocketAddr::V4(_)) => {
+                ip_list.interface_ipv4s.iter().for_each(|ip| {
+                    let mut addr = (*listener).clone();
+                    if addr.set_host(Some(ip.as_str())).is_ok() {
+                        tasks.spawn(Self::try_connect_to_ip(
+                            data.clone(),
+                            dst_peer_id.clone(),
+                            addr.to_string(),
+                        ));
+                    }
+                });
+
+                let mut addr = (*listener).clone();
+                if addr.set_host(Some(ip_list.public_ipv4.as_str())).is_ok() {
+                    tasks.spawn(Self::try_connect_to_ip(
+                        data.clone(),
+                        dst_peer_id.clone(),
+                        addr.to_string(),
+                    ));
+                }
+            }
+            Some(SocketAddr::V6(_)) => {
+                ip_list.interface_ipv6s.iter().for_each(|ip| {
+                    let mut addr = (*listener).clone();
+                    if addr.set_host(Some(format!("[{}]", ip).as_str())).is_ok() {
+                        tasks.spawn(Self::try_connect_to_ip(
+                            data.clone(),
+                            dst_peer_id.clone(),
+                            addr.to_string(),
+                        ));
+                    }
+                });
+
+                let mut addr = (*listener).clone();
+                if addr
+                    .set_host(Some(format!("[{}]", ip_list.public_ipv6).as_str()))
+                    .is_ok()
+                {
+                    tasks.spawn(Self::try_connect_to_ip(
+                        data.clone(),
+                        dst_peer_id.clone(),
+                        addr.to_string(),
+                    ));
+                }
+            }
+            p => {
+                tracing::error!(?p, ?listener, "failed to parse ip version from listener");
+            }
+        }
+
+        let mut has_succ = false;
+        while let Some(ret) = tasks.join_next().await {
+            if let Err(e) = ret {
+                log::error!("join direct connect task failed: {:?}", e);
+            } else if let Ok(Ok(_)) = ret {
+                has_succ = true;
+            }
+        }
+
+        if !has_succ {
+            data.dst_sceme_blacklist.insert(
+                DstSchemeBlackListItem(dst_peer_id.clone(), listener.scheme().to_string()),
+                (),
+                std::time::Duration::from_secs(DIRECT_CONNECTOR_BLACKLIST_TIMEOUT_SEC),
+            );
+        }
+
+        Ok(())
+    }
+
     #[tracing::instrument]
     async fn do_try_direct_connect(
         data: Arc<DirectConnectorManagerData>,
@@ -240,67 +358,37 @@ impl DirectConnectorManager {
             })
             .await?;
 
-        let available_listeners = ip_list
-            .listeners
-            .iter()
-            .filter_map(|l| if l.scheme() != "ring" { Some(l) } else { None })
-            .collect::<Vec<_>>();
-
-        let listener = available_listeners
-            .get(0)
-            .ok_or(anyhow::anyhow!("peer {} have no listener", dst_peer_id))?;
-
-        let mut tasks = JoinSet::new();
-        ip_list.interface_ipv4s.iter().for_each(|ip| {
-            let addr = format!(
-                "{}://{}:{}",
-                listener.scheme(),
-                ip,
-                listener.port().unwrap_or(11010)
-            );
-            tasks.spawn(Self::try_connect_to_ip(
-                data.clone(),
-                dst_peer_id.clone(),
-                addr,
-            ));
-        });
-
-        let addr = format!(
-            "{}://{}:{}",
-            listener.scheme(),
-            ip_list.public_ipv4.clone(),
-            listener.port().unwrap_or(11010)
-        );
-        tasks.spawn(Self::try_connect_to_ip(
-            data.clone(),
-            dst_peer_id.clone(),
-            addr,
-        ));
-
-        while let Some(ret) = tasks.join_next().await {
-            if let Err(e) = ret {
-                log::error!("join direct connect task failed: {:?}", e);
-            }
-        }
-
-        Ok(())
+        Self::do_try_direct_connect_internal(data, dst_peer_id, ip_list).await
     }
 }
 
 #[cfg(test)]
 mod tests {
+    use std::sync::Arc;
+
     use crate::{
-        connector::direct::DirectConnectorManager,
+        connector::direct::{
+            DirectConnectorManager, DirectConnectorManagerData, DstBlackListItem,
+            DstSchemeBlackListItem,
+        },
         instance::listeners::ListenerManager,
         peers::tests::{
             connect_peer_manager, create_mock_peer_manager, wait_route_appear,
             wait_route_appear_with_cost,
         },
-        tunnels::tcp_tunnel::TcpTunnelListener,
+        rpc::peer::GetIpListResponse,
     };
 
+    #[rstest::rstest]
     #[tokio::test]
-    async fn direct_connector_basic_test() {
+    async fn direct_connector_basic_test(
+        #[values("tcp", "udp", "wg")] proto: &str,
+        #[values("true", "false")] ipv6: bool,
+    ) {
+        if ipv6 && proto != "udp" {
+            return;
+        }
+
         let p_a = create_mock_peer_manager().await;
         let p_b = create_mock_peer_manager().await;
         let p_c = create_mock_peer_manager().await;
@@ -315,14 +403,20 @@ mod tests {
         dm_a.run_as_client();
         dm_c.run_as_server();
 
+        if !ipv6 {
+            let port = if proto == "wg" { 11040 } else { 11041 };
+            p_c.get_global_ctx().config.set_listeners(vec![format!(
+                "{}://0.0.0.0:{}",
+                proto, port
+            )
+            .parse()
+            .unwrap()]);
+        }
+        let mut f = p_c.get_global_ctx().config.get_flags();
+        f.enable_ipv6 = ipv6;
+        p_c.get_global_ctx().config.set_flags(f);
         let mut lis_c = ListenerManager::new(p_c.get_global_ctx(), p_c.clone());
-
-        lis_c
-            .add_listener(TcpTunnelListener::new(
-                "tcp://0.0.0.0:11040".parse().unwrap(),
-            ))
-            .await
-            .unwrap();
+        lis_c.prepare_listeners().await.unwrap();
 
         lis_c.run().await.unwrap();
 
@@ -330,4 +424,31 @@ mod tests {
             .await
             .unwrap();
     }
+
+    #[tokio::test]
+    async fn direct_connector_scheme_blacklist() {
+        let p_a = create_mock_peer_manager().await;
+        let data = Arc::new(DirectConnectorManagerData::new(
+            p_a.get_global_ctx(),
+            p_a.clone(),
+        ));
+        let mut ip_list = GetIpListResponse::new();
+        ip_list
+            .listeners
+            .push("tcp://127.0.0.1:10222".parse().unwrap());
+
+        ip_list.interface_ipv4s.push("127.0.0.1".to_string());
+
+        DirectConnectorManager::do_try_direct_connect_internal(data.clone(), 1, ip_list.clone())
+            .await
+            .unwrap();
+
+        assert!(data
+            .dst_sceme_blacklist
+            .contains(&DstSchemeBlackListItem(1, "tcp".into())));
+
+        assert!(data
+            .dst_blacklist
+            .contains(&DstBlackListItem(1, ip_list.listeners[0].to_string())));
+    }
 }

easytier/src/connector/manual.rs

@@ -1,5 +1,6 @@
 use std::{collections::BTreeSet, sync::Arc};
 
+use anyhow::Context;
 use dashmap::{DashMap, DashSet};
 use tokio::{
     sync::{broadcast::Receiver, mpsc, Mutex},
@@ -7,7 +8,12 @@ use tokio::{
     time::timeout,
 };
 
-use crate::{common::PeerId, peers::peer_conn::PeerConnId, rpc as easytier_rpc};
+use crate::{
+    common::PeerId,
+    peers::peer_conn::PeerConnId,
+    rpc as easytier_rpc,
+    tunnel::{IpVersion, TunnelConnector},
+};
 
 use crate::{
     common::{
@@ -21,13 +27,13 @@ use crate::{
         connector_manage_rpc_server::ConnectorManageRpc, Connector, ConnectorStatus,
         ListConnectorRequest, ManageConnectorRequest,
     },
-    tunnels::{Tunnel, TunnelConnector},
     use_global_var,
 };
 
 use super::create_connector_by_url;
 
-type ConnectorMap = Arc<DashMap<String, Box<dyn TunnelConnector + Send + Sync>>>;
+type MutexConnector = Arc<Mutex<Box<dyn TunnelConnector>>>;
+type ConnectorMap = Arc<DashMap<String, MutexConnector>>;
 
 #[derive(Debug, Clone)]
 struct ReconnResult {
@@ -81,16 +87,17 @@ impl ManualConnectorManager {
 
     pub fn add_connector<T>(&self, connector: T)
     where
-        T: TunnelConnector + Send + Sync + 'static,
+        T: TunnelConnector + 'static,
     {
         log::info!("add_connector: {}", connector.remote_url());
-        self.data
-            .connectors
-            .insert(connector.remote_url().into(), Box::new(connector));
+        self.data.connectors.insert(
+            connector.remote_url().into(),
+            Arc::new(Mutex::new(Box::new(connector))),
+        );
     }
 
     pub async fn add_connector_by_url(&self, url: &str) -> Result<(), Error> {
-        self.add_connector(create_connector_by_url(url, self.global_ctx.get_ip_collector()).await?);
+        self.add_connector(create_connector_by_url(url, &self.global_ctx).await?);
         Ok(())
     }
 
@@ -160,7 +167,6 @@ impl ManualConnectorManager {
         let mut reconn_interval = tokio::time::interval(std::time::Duration::from_millis(
             use_global_var!(MANUAL_CONNECTOR_RECONNECT_INTERVAL_MS),
         ));
-        let mut reconn_tasks = JoinSet::new();
         let (reconn_result_send, mut reconn_result_recv) = mpsc::channel(100);
 
         loop {
@@ -169,8 +175,8 @@ impl ManualConnectorManager {
                     if let Ok(event) = event {
                         Self::handle_event(&event, data.clone()).await;
                     } else {
-                        log::warn!("event_recv closed");
-                        panic!("event_recv closed");
+                        tracing::warn!(?event, "event_recv got error");
+                        panic!("event_recv got error, err: {:?}", event);
                     }
                 }
 
@@ -185,16 +191,20 @@ impl ManualConnectorManager {
                         let (_, connector) = data.connectors.remove(&dead_url).unwrap();
                         let insert_succ = data.reconnecting.insert(dead_url.clone());
                         assert!(insert_succ);
-                        reconn_tasks.spawn(async move {
-                            sender.send(Self::conn_reconnect(data_clone.clone(), dead_url, connector).await).await.unwrap();
+
+                        tokio::spawn(async move {
+                            let reconn_ret = Self::conn_reconnect(data_clone.clone(), dead_url.clone(), connector.clone()).await;
+                            sender.send(reconn_ret).await.unwrap();
+
+                            data_clone.reconnecting.remove(&dead_url).unwrap();
+                            data_clone.connectors.insert(dead_url.clone(), connector);
                         });
                     }
                     log::info!("reconn_interval tick, done");
                 }
 
                 ret = reconn_result_recv.recv() => {
-                    log::warn!("reconn_tasks done, out: {:?}", ret);
-                    let _ = reconn_tasks.join_next().await.unwrap();
+                    log::warn!("reconn_tasks done, reconn result: {:?}", ret);
                 }
             }
         }
@@ -251,64 +261,112 @@ impl ManualConnectorManager {
         &all_urls - &curr_alive
     }
 
+    async fn conn_reconnect_with_ip_version(
+        data: Arc<ConnectorManagerData>,
+        dead_url: String,
+        connector: MutexConnector,
+        ip_version: IpVersion,
+    ) -> Result<ReconnResult, Error> {
+        let ip_collector = data.global_ctx.get_ip_collector();
+        let net_ns = data.net_ns.clone();
+
+        connector.lock().await.set_ip_version(ip_version);
+
+        set_bind_addr_for_peer_connector(
+            connector.lock().await.as_mut(),
+            ip_version == IpVersion::V4,
+            &ip_collector,
+        )
+        .await;
+
+        data.global_ctx.issue_event(GlobalCtxEvent::Connecting(
+            connector.lock().await.remote_url().clone(),
+        ));
+
+        let _g = net_ns.guard();
+        log::info!("reconnect try connect... conn: {:?}", connector);
+        let tunnel = connector.lock().await.connect().await?;
+        log::info!("reconnect get tunnel succ: {:?}", tunnel);
+        assert_eq!(
+            dead_url,
+            tunnel.info().unwrap().remote_addr,
+            "info: {:?}",
+            tunnel.info()
+        );
+        let (peer_id, conn_id) = data.peer_manager.add_client_tunnel(tunnel).await?;
+        log::info!("reconnect succ: {} {} {}", peer_id, conn_id, dead_url);
+        Ok(ReconnResult {
+            dead_url,
+            peer_id,
+            conn_id,
+        })
+    }
+
     async fn conn_reconnect(
         data: Arc<ConnectorManagerData>,
         dead_url: String,
-        connector: Box<dyn TunnelConnector + Send + Sync>,
+        connector: MutexConnector,
     ) -> Result<ReconnResult, Error> {
-        let connector = Arc::new(Mutex::new(Some(connector)));
-        let net_ns = data.net_ns.clone();
-
         log::info!("reconnect: {}", dead_url);
 
-        let connector_clone = connector.clone();
-        let data_clone = data.clone();
-        let url_clone = dead_url.clone();
-        let ip_collector = data.global_ctx.get_ip_collector();
-        let reconn_task = async move {
-            let mut locked = connector_clone.lock().await;
-            let conn = locked.as_mut().unwrap();
-            // TODO: should support set v6 here, use url in connector array
-            set_bind_addr_for_peer_connector(conn, true, &ip_collector).await;
-
-            data_clone
-                .global_ctx
-                .issue_event(GlobalCtxEvent::Connecting(conn.remote_url().clone()));
-
-            let _g = net_ns.guard();
-            log::info!("reconnect try connect... conn: {:?}", conn);
-            let tunnel = conn.connect().await?;
-            log::info!("reconnect get tunnel succ: {:?}", tunnel);
-            assert_eq!(
-                url_clone,
-                tunnel.info().unwrap().remote_addr,
-                "info: {:?}",
-                tunnel.info()
-            );
-            let (peer_id, conn_id) = data_clone.peer_manager.add_client_tunnel(tunnel).await?;
-            log::info!("reconnect succ: {} {} {}", peer_id, conn_id, url_clone);
-            Ok(ReconnResult {
-                dead_url: url_clone,
-                peer_id,
-                conn_id,
-            })
-        };
-
-        let ret = timeout(std::time::Duration::from_secs(1), reconn_task).await;
-        log::info!("reconnect: {} done, ret: {:?}", dead_url, ret);
-
-        if ret.is_err() || ret.as_ref().unwrap().is_err() {
-            data.global_ctx.issue_event(GlobalCtxEvent::ConnectError(
-                dead_url.clone(),
-                format!("{:?}", ret),
-            ));
+        let mut ip_versions = vec![];
+        let u = url::Url::parse(&dead_url)
+            .with_context(|| format!("failed to parse connector url {:?}", dead_url))?;
+        if u.scheme() == "ring" {
+            ip_versions.push(IpVersion::Both);
+        } else {
+            let addrs = u.socket_addrs(|| Some(1000))?;
+            let mut has_ipv4 = false;
+            let mut has_ipv6 = false;
+            for addr in addrs {
+                if addr.is_ipv4() {
+                    if !has_ipv4 {
+                        ip_versions.insert(0, IpVersion::V4);
+                    }
+                    has_ipv4 = true;
+                } else if addr.is_ipv6() {
+                    if !has_ipv6 {
+                        ip_versions.push(IpVersion::V6);
+                    }
+                    has_ipv6 = true;
+                }
+            }
         }
 
-        let conn = connector.lock().await.take().unwrap();
-        data.reconnecting.remove(&dead_url).unwrap();
-        data.connectors.insert(dead_url.clone(), conn);
+        let mut reconn_ret = Err(Error::AnyhowError(anyhow::anyhow!(
+            "cannot get ip from url"
+        )));
+        for ip_version in ip_versions {
+            let ret = timeout(
+                std::time::Duration::from_secs(1),
+                Self::conn_reconnect_with_ip_version(
+                    data.clone(),
+                    dead_url.clone(),
+                    connector.clone(),
+                    ip_version,
+                ),
+            )
+            .await;
+            log::info!("reconnect: {} done, ret: {:?}", dead_url, ret);
 
-        ret?
+            if ret.is_ok() && ret.as_ref().unwrap().is_ok() {
+                reconn_ret = ret.unwrap();
+                break;
+            } else {
+                if ret.is_err() {
+                    reconn_ret = Err(ret.unwrap_err().into());
+                } else if ret.as_ref().unwrap().is_err() {
+                    reconn_ret = Err(ret.unwrap().unwrap_err());
+                }
+                data.global_ctx.issue_event(GlobalCtxEvent::ConnectError(
+                    dead_url.clone(),
+                    format!("{:?}", ip_version),
+                    format!("{:?}", reconn_ret),
+                ));
+            }
+        }
+
+        reconn_ret
     }
 }
 
@@ -359,7 +417,7 @@ mod tests {
     use crate::{
         peers::tests::create_mock_peer_manager,
         set_global_var,
-        tunnels::{Tunnel, TunnelError},
+        tunnel::{Tunnel, TunnelError},
     };
 
     use super::*;
@@ -379,7 +437,7 @@ mod tests {
             }
             async fn connect(&mut self) -> Result<Box<dyn Tunnel>, TunnelError> {
                 tokio::time::sleep(std::time::Duration::from_millis(10)).await;
-                Err(TunnelError::CommonError("fake error".into()))
+                Err(TunnelError::InvalidPacket("fake error".into()))
             }
         }
 

easytier/src/connector/mod.rs

@@ -0,0 +1,124 @@
+use std::{
+    net::{SocketAddr, SocketAddrV4, SocketAddrV6},
+    sync::Arc,
+};
+
+#[cfg(feature = "quic")]
+use crate::tunnel::quic::QUICTunnelConnector;
+#[cfg(feature = "wireguard")]
+use crate::tunnel::wireguard::{WgConfig, WgTunnelConnector};
+use crate::{
+    common::{error::Error, global_ctx::ArcGlobalCtx, network::IPCollector},
+    tunnel::{
+        check_scheme_and_get_socket_addr, ring::RingTunnelConnector, tcp::TcpTunnelConnector,
+        udp::UdpTunnelConnector, FromUrl, IpVersion, TunnelConnector,
+    },
+};
+
+pub mod direct;
+pub mod manual;
+pub mod udp_hole_punch;
+
+async fn set_bind_addr_for_peer_connector(
+    connector: &mut (impl TunnelConnector + ?Sized),
+    is_ipv4: bool,
+    ip_collector: &Arc<IPCollector>,
+) {
+    let ips = ip_collector.collect_ip_addrs().await;
+    if is_ipv4 {
+        let mut bind_addrs = vec![];
+        for ipv4 in ips.interface_ipv4s {
+            let socket_addr = SocketAddrV4::new(ipv4.parse().unwrap(), 0).into();
+            bind_addrs.push(socket_addr);
+        }
+        connector.set_bind_addrs(bind_addrs);
+    } else {
+        let mut bind_addrs = vec![];
+        for ipv6 in ips.interface_ipv6s {
+            let socket_addr = SocketAddrV6::new(ipv6.parse().unwrap(), 0, 0, 0).into();
+            bind_addrs.push(socket_addr);
+        }
+        connector.set_bind_addrs(bind_addrs);
+    }
+    let _ = connector;
+}
+
+pub async fn create_connector_by_url(
+    url: &str,
+    global_ctx: &ArcGlobalCtx,
+) -> Result<Box<dyn TunnelConnector + 'static>, Error> {
+    let url = url::Url::parse(url).map_err(|_| Error::InvalidUrl(url.to_owned()))?;
+    match url.scheme() {
+        "tcp" => {
+            let dst_addr = check_scheme_and_get_socket_addr::<SocketAddr>(&url, "tcp")?;
+            let mut connector = TcpTunnelConnector::new(url);
+            set_bind_addr_for_peer_connector(
+                &mut connector,
+                dst_addr.is_ipv4(),
+                &global_ctx.get_ip_collector(),
+            )
+            .await;
+            return Ok(Box::new(connector));
+        }
+        "udp" => {
+            let dst_addr = check_scheme_and_get_socket_addr::<SocketAddr>(&url, "udp")?;
+            let mut connector = UdpTunnelConnector::new(url);
+            set_bind_addr_for_peer_connector(
+                &mut connector,
+                dst_addr.is_ipv4(),
+                &global_ctx.get_ip_collector(),
+            )
+            .await;
+            return Ok(Box::new(connector));
+        }
+        "ring" => {
+            check_scheme_and_get_socket_addr::<uuid::Uuid>(&url, "ring")?;
+            let connector = RingTunnelConnector::new(url);
+            return Ok(Box::new(connector));
+        }
+        #[cfg(feature = "quic")]
+        "quic" => {
+            let dst_addr = check_scheme_and_get_socket_addr::<SocketAddr>(&url, "quic")?;
+            let mut connector = QUICTunnelConnector::new(url);
+            set_bind_addr_for_peer_connector(
+                &mut connector,
+                dst_addr.is_ipv4(),
+                &global_ctx.get_ip_collector(),
+            )
+            .await;
+            return Ok(Box::new(connector));
+        }
+        #[cfg(feature = "wireguard")]
+        "wg" => {
+            let dst_addr = check_scheme_and_get_socket_addr::<SocketAddr>(&url, "wg")?;
+            let nid = global_ctx.get_network_identity();
+            let wg_config = WgConfig::new_from_network_identity(
+                &nid.network_name,
+                &nid.network_secret.unwrap_or_default(),
+            );
+            let mut connector = WgTunnelConnector::new(url, wg_config);
+            set_bind_addr_for_peer_connector(
+                &mut connector,
+                dst_addr.is_ipv4(),
+                &global_ctx.get_ip_collector(),
+            )
+            .await;
+            return Ok(Box::new(connector));
+        }
+        #[cfg(feature = "websocket")]
+        "ws" | "wss" => {
+            let dst_addr = SocketAddr::from_url(url.clone(), IpVersion::Both)?;
+            let mut connector = crate::tunnel::websocket::WSTunnelConnector::new(url);
+            set_bind_addr_for_peer_connector(
+                &mut connector,
+                dst_addr.is_ipv4(),
+                &global_ctx.get_ip_collector(),
+            )
+            .await;
+            return Ok(Box::new(connector));
+        }
+        _ => {
+            return Err(Error::InvalidUrl(url.into()));
+        }
+    }
+}

easytier/src/easytier-cli.rs

@@ -1,27 +1,33 @@
 #![allow(dead_code)]
 
-use std::{net::SocketAddr, vec};
+use std::{net::SocketAddr, time::Duration, vec};
 
 use clap::{command, Args, Parser, Subcommand};
+use common::stun::StunInfoCollectorTrait;
+use rpc::vpn_portal_rpc_client::VpnPortalRpcClient;
+use tokio::time::timeout;
+use utils::{list_peer_route_pair, PeerRoutePair};
 
 mod arch;
 mod common;
 mod rpc;
-mod tunnels;
+mod tunnel;
+mod utils;
 
 use crate::{
-    common::stun::{StunInfoCollector, UdpNatTypeDetector},
+    common::stun::StunInfoCollector,
     rpc::{
         connector_manage_rpc_client::ConnectorManageRpcClient,
         peer_center_rpc_client::PeerCenterRpcClient, peer_manage_rpc_client::PeerManageRpcClient,
         *,
     },
+    utils::{cost_to_str, float_to_str},
 };
 use humansize::format_size;
 use tabled::settings::Style;
 
 #[derive(Parser, Debug)]
-#[command(author, version, about, long_about = None)]
+#[command(name = "easytier-cli", author, version, about, long_about = None)]
 struct Cli {
     /// the instance name
     #[arg(short = 'p', long, default_value = "127.0.0.1:15888")]
@@ -38,6 +44,7 @@ enum SubCommand {
     Stun,
     Route,
     PeerCenter,
+    VpnPortal,
 }
 
 #[derive(Args, Debug)]
@@ -92,107 +99,6 @@ enum Error {
     TonicRpcError(#[from] tonic::Status),
 }
 
-#[derive(Debug)]
-struct PeerRoutePair {
-    route: Route,
-    peer: Option<PeerInfo>,
-}
-
-impl PeerRoutePair {
-    fn get_latency_ms(&self) -> Option<f64> {
-        let mut ret = u64::MAX;
-        let p = self.peer.as_ref()?;
-        for conn in p.conns.iter() {
-            let Some(stats) = &conn.stats else {
-                continue;
-            };
-            ret = ret.min(stats.latency_us);
-        }
-
-        if ret == u64::MAX {
-            None
-        } else {
-            Some(f64::from(ret as u32) / 1000.0)
-        }
-    }
-
-    fn get_rx_bytes(&self) -> Option<u64> {
-        let mut ret = 0;
-        let p = self.peer.as_ref()?;
-        for conn in p.conns.iter() {
-            let Some(stats) = &conn.stats else {
-                continue;
-            };
-            ret += stats.rx_bytes;
-        }
-
-        if ret == 0 {
-            None
-        } else {
-            Some(ret)
-        }
-    }
-
-    fn get_tx_bytes(&self) -> Option<u64> {
-        let mut ret = 0;
-        let p = self.peer.as_ref()?;
-        for conn in p.conns.iter() {
-            let Some(stats) = &conn.stats else {
-                continue;
-            };
-            ret += stats.tx_bytes;
-        }
-
-        if ret == 0 {
-            None
-        } else {
-            Some(ret)
-        }
-    }
-
-    fn get_loss_rate(&self) -> Option<f64> {
-        let mut ret = 0.0;
-        let p = self.peer.as_ref()?;
-        for conn in p.conns.iter() {
-            ret += conn.loss_rate;
-        }
-
-        if ret == 0.0 {
-            None
-        } else {
-            Some(ret as f64)
-        }
-    }
-
-    fn get_conn_protos(&self) -> Option<Vec<String>> {
-        let mut ret = vec![];
-        let p = self.peer.as_ref()?;
-        for conn in p.conns.iter() {
-            let Some(tunnel_info) = &conn.tunnel else {
-                continue;
-            };
-            // insert if not exists
-            if !ret.contains(&tunnel_info.tunnel_type) {
-                ret.push(tunnel_info.tunnel_type.clone());
-            }
-        }
-
-        if ret.is_empty() {
-            None
-        } else {
-            Some(ret)
-        }
-    }
-
-    fn get_udp_nat_type(self: &Self) -> String {
-        let mut ret = NatType::Unknown;
-        if let Some(r) = &self.route.stun_info {
-            ret = NatType::try_from(r.udp_nat_type).unwrap();
-        }
-        format!("{:?}", ret)
-    }
-}
-
 struct CommandHandler {
     addr: String,
 }
@@ -216,6 +122,12 @@ impl CommandHandler {
         Ok(PeerCenterRpcClient::connect(self.addr.clone()).await?)
     }
 
+    async fn get_vpn_portal_client(
+        &self,
+    ) -> Result<VpnPortalRpcClient<tonic::transport::Channel>, Error> {
+        Ok(VpnPortalRpcClient::connect(self.addr.clone()).await?)
+    }
+
     async fn list_peers(&self) -> Result<ListPeerResponse, Error> {
         let mut client = self.get_peer_manager_client().await?;
         let request = tonic::Request::new(ListPeerRequest::default());
@@ -231,19 +143,9 @@ impl CommandHandler {
     }
 
     async fn list_peer_route_pair(&self) -> Result<Vec<PeerRoutePair>, Error> {
-        let mut peers = self.list_peers().await?.peer_infos;
-        let mut routes = self.list_routes().await?.routes;
-        let mut pairs: Vec<PeerRoutePair> = vec![];
-
-        for route in routes.iter_mut() {
-            let peer = peers.iter_mut().find(|peer| peer.peer_id == route.peer_id);
-            pairs.push(PeerRoutePair {
-                route: route.clone(),
-                peer: peer.cloned(),
-            });
-        }
-
-        Ok(pairs)
+        let peers = self.list_peers().await?.peer_infos;
+        let routes = self.list_routes().await?.routes;
+        Ok(list_peer_route_pair(peers, routes))
     }
 
     #[allow(dead_code)]
@@ -261,9 +163,9 @@ impl CommandHandler {
         struct PeerTableItem {
             ipv4: String,
             hostname: String,
-            cost: i32,
-            lat_ms: f64,
-            loss_rate: f64,
+            cost: String,
+            lat_ms: String,
+            loss_rate: String,
             rx_bytes: String,
             tx_bytes: String,
             tunnel_proto: String,
@@ -276,9 +178,9 @@ impl CommandHandler {
                 PeerTableItem {
                     ipv4: p.route.ipv4_addr.clone(),
                     hostname: p.route.hostname.clone(),
-                    cost: p.route.cost,
-                    lat_ms: p.get_latency_ms().unwrap_or(0.0),
-                    loss_rate: p.get_loss_rate().unwrap_or(0.0),
+                    cost: cost_to_str(p.route.cost),
+                    lat_ms: float_to_str(p.get_latency_ms().unwrap_or(0.0), 3),
+                    loss_rate: float_to_str(p.get_loss_rate().unwrap_or(0.0), 3),
                     rx_bytes: format_size(p.get_rx_bytes().unwrap_or(0), humansize::DECIMAL),
                     tx_bytes: format_size(p.get_tx_bytes().unwrap_or(0), humansize::DECIMAL),
                     tunnel_proto: p.get_conn_protos().unwrap_or(vec![]).join(",").to_string(),
@@ -409,8 +311,19 @@ async fn main() -> Result<(), Error> {
             handler.handle_route_list().await?;
         }
         SubCommand::Stun => {
-            let stun = UdpNatTypeDetector::new(StunInfoCollector::get_default_servers());
-            println!("udp type: {:?}", stun.get_udp_nat_type(0).await);
+            timeout(Duration::from_secs(5), async move {
+                let collector = StunInfoCollector::new_with_default_servers();
+                loop {
+                    let ret = collector.get_stun_info();
+                    if ret.udp_nat_type != NatType::Unknown as i32 {
+                        println!("stun info: {:#?}", ret);
+                        break;
+                    }
+                    tokio::time::sleep(Duration::from_millis(200)).await;
+                }
+            })
+            .await
+            .unwrap();
         }
         SubCommand::PeerCenter => {
             let mut peer_center_client = handler.get_peer_center_client().await?;
@@ -431,13 +344,7 @@ async fn main() -> Result<(), Error> {
                 let direct_peers = v
                     .direct_peers
                     .iter()
-                    .map(|(k, v)| {
-                        format!(
-                            "{}:{:?}",
-                            k,
-                            LatencyLevel::try_from(v.latency_level).unwrap()
-                        )
-                    })
+                    .map(|(k, v)| format!("{}: {:?}ms", k, v.latency_ms,))
                     .collect::<Vec<_>>();
                 table_rows.push(PeerCenterTableItem {
                     node_id: node_id.to_string(),
@@ -452,6 +359,25 @@ async fn main() -> Result<(), Error> {
                     .to_string()
             );
         }
+        SubCommand::VpnPortal => {
+            let mut vpn_portal_client = handler.get_vpn_portal_client().await?;
+            let resp = vpn_portal_client
+                .get_vpn_portal_info(GetVpnPortalInfoRequest::default())
+                .await?
+                .into_inner()
+                .vpn_portal_info
+                .unwrap_or_default();
+            println!("portal_name: {}", resp.vpn_type);
+            println!(
+                r#"
+############### client_config_start ###############
+{}
+############### client_config_end ###############
+"#,
+                resp.client_config
+            );
+            println!("connected_clients:\n{:#?}", resp.connected_clients);
+        }
     }
 
     Ok(())

easytier/src/easytier-core.rs

@@ -0,0 +1,581 @@
+#![allow(dead_code)]
+
+#[cfg(test)]
+mod tests;
+
+use std::{
+    backtrace,
+    io::Write as _,
+    net::{Ipv4Addr, SocketAddr},
+    path::PathBuf,
+};
+
+use anyhow::Context;
+use clap::Parser;
+
+mod arch;
+mod common;
+mod connector;
+mod gateway;
+mod instance;
+mod peer_center;
+mod peers;
+mod rpc;
+mod tunnel;
+mod utils;
+mod vpn_portal;
+
+use common::config::{
+    ConsoleLoggerConfig, FileLoggerConfig, NetworkIdentity, PeerConfig, VpnPortalConfig,
+};
+use instance::instance::Instance;
+use tokio::net::TcpSocket;
+
+use crate::{
+    common::{
+        config::{ConfigLoader, TomlConfigLoader},
+        global_ctx::GlobalCtxEvent,
+    },
+    utils::init_logger,
+};
+
+#[cfg(feature = "mimalloc")]
+use mimalloc_rust::*;
+
+#[cfg(feature = "mimalloc")]
+#[global_allocator]
+static GLOBAL_MIMALLOC: GlobalMiMalloc = GlobalMiMalloc;
+
+#[derive(Parser, Debug)]
+#[command(name = "easytier-core", author, version, about, long_about = None)]
+struct Cli {
+    #[arg(
+        short,
+        long,
+        help = "path to the config file, NOTE: if this is set, all other options will be ignored"
+    )]
+    config_file: Option<PathBuf>,
+
+    #[arg(
+        long,
+        help = "network name to identify this vpn network",
+        default_value = "default"
+    )]
+    network_name: String,
+    #[arg(
+        long,
+        help = "network secret to verify this node belongs to the vpn network",
+        default_value = ""
+    )]
+    network_secret: String,
+
+    #[arg(
+        short,
+        long,
+        help = "ipv4 address of this vpn node, if empty, this node will only forward packets and no TUN device will be created"
+    )]
+    ipv4: Option<String>,
+
+    #[arg(
+        short,
+        long,
+        help = "automatically determine and set IP address by Easytier, and the IP address starts from 10.0.0.1 by default. Warning, if there is an IP conflict in the network when using DHCP, the IP will be automatically changed."
+    )]
+    dhcp: bool,
+
+    #[arg(short, long, help = "peers to connect initially", num_args = 0..)]
+    peers: Vec<String>,
+
+    #[arg(short, long, help = "use a public shared node to discover peers")]
+    external_node: Option<String>,
+
+    #[arg(
+        short = 'n',
+        long,
+        help = "export local networks to other peers in the vpn"
+    )]
+    proxy_networks: Vec<String>,
+
+    #[arg(
+        short,
+        long,
+        default_value = "0",
+        help = "rpc portal address to listen for management. 0 means random
+port, 12345 means listen on 12345 of localhost, 0.0.0.0:12345 means
+listen on 12345 of all interfaces. default is 0 and will try 15888 first"
+    )]
+    rpc_portal: String,
+
+    #[arg(short, long, help = "listeners to accept connections, allow format:
+a port number: 11010, means tcp/udp will listen on 11010, ws/wss will listen on 11010 and 11011, wg will listen on 11011
+url: tcp://0.0.0.0:11010, tcp can be tcp, udp, ring, wg, ws, wss,
+proto:port: wg:11011, means listen on 11011 with wireguard protocol
+url and proto:port can occur multiple times.
+            ", default_values_t = ["11010".to_string()],
+        num_args = 0..)]
+    listeners: Vec<String>,
+
+    #[arg(
+        long,
+        help = "do not listen on any port, only connect to peers",
+        default_value = "false"
+    )]
+    no_listener: bool,
+
+    #[arg(long, help = "console log level", 
+        value_parser = clap::builder::PossibleValuesParser::new(["trace", "debug", "info", "warn", "error", "off"]))]
+    console_log_level: Option<String>,
+
+    #[arg(long, help = "file log level", 
+        value_parser = clap::builder::PossibleValuesParser::new(["trace", "debug", "info", "warn", "error", "off"]))]
+    file_log_level: Option<String>,
+    #[arg(long, help = "directory to store log files")]
+    file_log_dir: Option<String>,
+
+    #[arg(long, help = "host name to identify this device")]
+    hostname: Option<String>,
+
+    #[arg(
+        short = 'm',
+        long,
+        default_value = "default",
+        help = "instance name to identify this vpn node in same machine"
+    )]
+    instance_name: String,
+
+    #[arg(
+        long,
+        help = "url that defines the vpn portal, allow other vpn clients to connect.
+example: wg://0.0.0.0:11010/10.14.14.0/24, means the vpn portal is a wireguard server listening on vpn.example.com:11010,
+and the vpn client is in network of 10.14.14.0/24"
+    )]
+    vpn_portal: Option<String>,
+
+    #[arg(long, help = "default protocol to use when connecting to peers")]
+    default_protocol: Option<String>,
+
+    #[arg(
+        short = 'u',
+        long,
+        help = "disable encryption for peers communication, default is false, must be same with peers",
+        default_value = "false"
+    )]
+    disable_encryption: bool,
+
+    #[arg(
+        long,
+        help = "use multi-thread runtime, default is single-thread",
+        default_value = "false"
+    )]
+    multi_thread: bool,
+
+    #[arg(long, help = "do not use ipv6", default_value = "false")]
+    disable_ipv6: bool,
+
+    #[arg(
+        long,
+        help = "mtu of the TUN device, default is 1420 for non-encryption, 1400 for encryption"
+    )]
+    mtu: Option<u16>,
+
+    #[arg(
+        long,
+        help = "path to the log file, if not set, will print to stdout",
+        default_value = "false"
+    )]
+    latency_first: bool,
+
+    #[arg(
+        long,
+        help = "exit nodes to forward all traffic to, a virtual ipv4 address, priority is determined by the order of the list",
+        num_args = 0..
+    )]
+    exit_nodes: Vec<Ipv4Addr>,
+
+    #[arg(
+        long,
+        help = "allow this node to be an exit node, default is false",
+        default_value = "false"
+    )]
+    enable_exit_node: bool,
+}
+
+impl Cli {
+    fn parse_listeners(&self) -> Vec<String> {
+        println!("parsing listeners: {:?}", self.listeners);
+        let proto_port_offset = vec![("tcp", 0), ("udp", 0), ("wg", 1), ("ws", 1), ("wss", 2)];
+
+        if self.no_listener || self.listeners.is_empty() {
+            return vec![];
+        }
+
+        let origin_listners = self.listeners.clone();
+        let mut listeners: Vec<String> = Vec::new();
+        if origin_listners.len() == 1 {
+            if let Ok(port) = origin_listners[0].parse::<u16>() {
+                for (proto, offset) in proto_port_offset {
+                    listeners.push(format!("{}://0.0.0.0:{}", proto, port + offset));
+                }
+                return listeners;
+            }
+        }
+
+        for l in &origin_listners {
+            let proto_port: Vec<&str> = l.split(':').collect();
+            if proto_port.len() > 2 {
+                if let Ok(url) = l.parse::<url::Url>() {
+                    listeners.push(url.to_string());
+                } else {
+                    panic!("failed to parse listener: {}", l);
+                }
+            } else {
+                let Some((proto, offset)) = proto_port_offset
+                    .iter()
+                    .find(|(proto, _)| *proto == proto_port[0])
+                else {
+                    panic!("unknown protocol: {}", proto_port[0]);
+                };
+
+                let port = if proto_port.len() == 2 {
+                    proto_port[1].parse::<u16>().unwrap()
+                } else {
+                    11010 + offset
+                };
+
+                listeners.push(format!("{}://0.0.0.0:{}", proto, port));
+            }
+        }
+
+        println!("parsed listeners: {:?}", listeners);
+
+        listeners
+    }
+
+    fn check_tcp_available(port: u16) -> Option<SocketAddr> {
+        let s = format!("127.0.0.1:{}", port).parse::<SocketAddr>().unwrap();
+        TcpSocket::new_v4().unwrap().bind(s).map(|_| s).ok()
+    }
+
+    fn parse_rpc_portal(&self) -> SocketAddr {
+        if let Ok(port) = self.rpc_portal.parse::<u16>() {
+            if port == 0 {
+                // check tcp 15888 first
+                for i in 15888..15900 {
+                    if let Some(s) = Cli::check_tcp_available(i) {
+                        return s;
+                    }
+                }
+                return "127.0.0.1:0".parse().unwrap();
+            }
+            return format!("127.0.0.1:{}", port).parse().unwrap();
+        }
+
+        self.rpc_portal.parse().unwrap()
+    }
+}
+
+impl From<Cli> for TomlConfigLoader {
+    fn from(cli: Cli) -> Self {
+        if let Some(config_file) = &cli.config_file {
+            println!(
+                "NOTICE: loading config file: {:?}, will ignore all command line flags\n",
+                config_file
+            );
+            return TomlConfigLoader::new(config_file)
+                .with_context(|| format!("failed to load config file: {:?}", cli.config_file))
+                .unwrap();
+        }
+
+        let cfg = TomlConfigLoader::default();
+
+        cfg.set_inst_name(cli.instance_name.clone());
+
+        cfg.set_hostname(cli.hostname.clone());
+
+        cfg.set_network_identity(NetworkIdentity::new(
+            cli.network_name.clone(),
+            cli.network_secret.clone(),
+        ));
+
+        cfg.set_dhcp(cli.dhcp);
+
+        if !cli.dhcp {
+            if let Some(ipv4) = &cli.ipv4 {
+                cfg.set_ipv4(Some(
+                    ipv4.parse()
+                        .with_context(|| format!("failed to parse ipv4 address: {}", ipv4))
+                        .unwrap(),
+                ))
+            }
+        }
+
+        cfg.set_peers(
+            cli.peers
+                .iter()
+                .map(|s| PeerConfig {
+                    uri: s
+                        .parse()
+                        .with_context(|| format!("failed to parse peer uri: {}", s))
+                        .unwrap(),
+                })
+                .collect(),
+        );
+
+        cfg.set_listeners(
+            cli.parse_listeners()
+                .into_iter()
+                .map(|s| s.parse().unwrap())
+                .collect(),
+        );
+
+        for n in cli.proxy_networks.iter() {
+            cfg.add_proxy_cidr(
+                n.parse()
+                    .with_context(|| format!("failed to parse proxy network: {}", n))
+                    .unwrap(),
+            );
+        }
+
+        cfg.set_rpc_portal(cli.parse_rpc_portal());
+
+        if cli.external_node.is_some() {
+            let mut old_peers = cfg.get_peers();
+            old_peers.push(PeerConfig {
+                uri: cli
+                    .external_node
+                    .clone()
+                    .unwrap()
+                    .parse()
+                    .with_context(|| {
+                        format!(
+                            "failed to parse external node uri: {}",
+                            cli.external_node.unwrap()
+                        )
+                    })
+                    .unwrap(),
+            });
+            cfg.set_peers(old_peers);
+        }
+
+        if cli.console_log_level.is_some() {
+            cfg.set_console_logger_config(ConsoleLoggerConfig {
+                level: cli.console_log_level.clone(),
+            });
+        }
+
+        if cli.file_log_dir.is_some() || cli.file_log_level.is_some() {
+            cfg.set_file_logger_config(FileLoggerConfig {
+                level: cli.file_log_level.clone(),
+                dir: cli.file_log_dir.clone(),
+                file: Some(format!("easytier-{}", cli.instance_name)),
+            });
+        }
+
+        if cli.vpn_portal.is_some() {
+            let url: url::Url = cli
+                .vpn_portal
+                .clone()
+                .unwrap()
+                .parse()
+                .with_context(|| {
+                    format!(
+                        "failed to parse vpn portal url: {}",
+                        cli.vpn_portal.unwrap()
+                    )
+                })
+                .unwrap();
+            cfg.set_vpn_portal_config(VpnPortalConfig {
+                client_cidr: url.path()[1..]
+                    .parse()
+                    .with_context(|| {
+                        format!("failed to parse vpn portal client cidr: {}", url.path())
+                    })
+                    .unwrap(),
+                wireguard_listen: format!("{}:{}", url.host_str().unwrap(), url.port().unwrap())
+                    .parse()
+                    .with_context(|| {
+                        format!(
+                            "failed to parse vpn portal wireguard listen address: {}",
+                            url.host_str().unwrap()
+                        )
+                    })
+                    .unwrap(),
+            });
+        }
+
+        let mut f = cfg.get_flags();
+        if cli.default_protocol.is_some() {
+            f.default_protocol = cli.default_protocol.as_ref().unwrap().clone();
+        }
+        f.enable_encryption = !cli.disable_encryption;
+        f.enable_ipv6 = !cli.disable_ipv6;
+        f.latency_first = cli.latency_first;
+        if let Some(mtu) = cli.mtu {
+            f.mtu = mtu;
+        }
+        f.enable_exit_node = cli.enable_exit_node;
+        cfg.set_flags(f);
+
+        cfg.set_exit_nodes(cli.exit_nodes.clone());
+
+        cfg
+    }
+}
+
+fn print_event(msg: String) {
+    println!(
+        "{}: {}",
+        chrono::Local::now().format("%Y-%m-%d %H:%M:%S"),
+        msg
+    );
+}
+
+fn peer_conn_info_to_string(p: crate::rpc::PeerConnInfo) -> String {
+    format!(
+        "my_peer_id: {}, dst_peer_id: {}, tunnel_info: {:?}",
+        p.my_peer_id, p.peer_id, p.tunnel
+    )
+}
+
+fn setup_panic_handler() {
+    std::panic::set_hook(Box::new(|info| {
+        let backtrace = backtrace::Backtrace::force_capture();
+        println!("panic occurred: {:?}", info);
+        let _ = std::fs::File::create("easytier-panic.log")
+            .and_then(|mut f| f.write_all(format!("{:?}\n{:#?}", info, backtrace).as_bytes()));
+        std::process::exit(1);
+    }));
+}
+
+#[tracing::instrument]
+pub async fn async_main(cli: Cli) {
+    let cfg: TomlConfigLoader = cli.into();
+
+    init_logger(&cfg, false).unwrap();
+    let mut inst = Instance::new(cfg.clone());
+
+    let mut events = inst.get_global_ctx().subscribe();
+    tokio::spawn(async move {
+        while let Ok(e) = events.recv().await {
+            match e {
+                GlobalCtxEvent::PeerAdded(p) => {
+                    print_event(format!("new peer added. peer_id: {}", p));
+                }
+
+                GlobalCtxEvent::PeerRemoved(p) => {
+                    print_event(format!("peer removed. peer_id: {}", p));
+                }
+
+                GlobalCtxEvent::PeerConnAdded(p) => {
+                    print_event(format!(
+                        "new peer connection added. conn_info: {}",
+                        peer_conn_info_to_string(p)
+                    ));
+                }
+
+                GlobalCtxEvent::PeerConnRemoved(p) => {
+                    print_event(format!(
+                        "peer connection removed. conn_info: {}",
+                        peer_conn_info_to_string(p)
+                    ));
+                }
+
+                GlobalCtxEvent::ListenerAddFailed(p, msg) => {
+                    print_event(format!(
+                        "listener add failed. listener: {}, msg: {}",
+                        p, msg
+                    ));
+                }
+
+                GlobalCtxEvent::ListenerAdded(p) => {
+                    if p.scheme() == "ring" {
+                        continue;
+                    }
+                    print_event(format!("new listener added. listener: {}", p));
+                }
+
+                GlobalCtxEvent::ConnectionAccepted(local, remote) => {
+                    print_event(format!(
+                        "new connection accepted. local: {}, remote: {}",
+                        local, remote
+                    ));
+                }
+
+                GlobalCtxEvent::ConnectionError(local, remote, err) => {
+                    print_event(format!(
+                        "connection error. local: {}, remote: {}, err: {}",
+                        local, remote, err
+                    ));
+                }
+
+                GlobalCtxEvent::TunDeviceReady(dev) => {
+                    print_event(format!("tun device ready. dev: {}", dev));
+                }
+
+                GlobalCtxEvent::Connecting(dst) => {
+                    print_event(format!("connecting to peer. dst: {}", dst));
+                }
+
+                GlobalCtxEvent::ConnectError(dst, ip_version, err) => {
+                    print_event(format!(
+                        "connect to peer error. dst: {}, ip_version: {}, err: {}",
+                        dst, ip_version, err
+                    ));
+                }
+
+                GlobalCtxEvent::VpnPortalClientConnected(portal, client_addr) => {
+                    print_event(format!(
+                        "vpn portal client connected. portal: {}, client_addr: {}",
+                        portal, client_addr
+                    ));
+                }
+
+                GlobalCtxEvent::VpnPortalClientDisconnected(portal, client_addr) => {
+                    print_event(format!(
+                        "vpn portal client disconnected. portal: {}, client_addr: {}",
+                        portal, client_addr
+                    ));
+                }
+
+                GlobalCtxEvent::DhcpIpv4Changed(old, new) => {
+                    print_event(format!("dhcp ip changed. old: {:?}, new: {:?}", old, new));
+                }
+
+                GlobalCtxEvent::DhcpIpv4Conflicted(ip) => {
+                    print_event(format!("dhcp ip conflict. ip: {:?}", ip));
+                }
+            }
+        }
+    });
+
+    println!("Starting easytier with config:");
+    println!("############### TOML ###############\n");
+    println!("{}", cfg.dump());
+    println!("-----------------------------------");
+
+    inst.run().await.unwrap();
+
+    inst.wait().await;
+}
+
+fn main() {
+    setup_panic_handler();
+
+    let cli = Cli::parse();
+    tracing::info!(cli = ?cli, "cli args parsed");
+
+    if cli.multi_thread {
+        tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(2)
+            .enable_all()
+            .build()
+            .unwrap()
+            .block_on(async move { async_main(cli).await })
+    } else {
+        tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .unwrap()
+            .block_on(async move { async_main(cli).await })
+    }
+}

easytier/src/gateway/icmp_proxy.rs

@@ -16,12 +16,13 @@ use tokio::{
     sync::{mpsc::UnboundedSender, Mutex},
     task::JoinSet,
 };
-use tokio_util::bytes::Bytes;
+
 use tracing::Instrument;
 
 use crate::{
     common::{error::Error, global_ctx::ArcGlobalCtx, PeerId},
-    peers::{packet, peer_manager::PeerManager, PeerPacketFilter},
+    peers::{peer_manager::PeerManager, PeerPacketFilter},
+    tunnel::packet_def::{PacketType, ZCPacket},
 };
 
 use super::CidrSet;
@@ -62,7 +63,7 @@ pub struct IcmpProxy {
     peer_manager: Arc<PeerManager>,
 
     cidr_set: CidrSet,
-    socket: socket2::Socket,
+    socket: std::sync::Mutex<Option<socket2::Socket>>,
 
     nat_table: IcmpNatTable,
 
@@ -78,13 +79,9 @@ fn socket_recv(socket: &Socket, buf: &mut [MaybeUninit<u8>]) -> Result<(usize, I
     Ok((size, addr))
 }
 
-fn socket_recv_loop(
-    socket: Socket,
-    nat_table: IcmpNatTable,
-    sender: UnboundedSender<packet::Packet>,
-) {
-    let mut buf = [0u8; 4096];
-    let data: &mut [MaybeUninit<u8>] = unsafe { std::mem::transmute(&mut buf[12..]) };
+fn socket_recv_loop(socket: Socket, nat_table: IcmpNatTable, sender: UnboundedSender<ZCPacket>) {
+    let mut buf = [0u8; 2048];
+    let data: &mut [MaybeUninit<u8>] = unsafe { std::mem::transmute(&mut buf[..]) };
 
     loop {
         let Ok((len, peer_ip)) = socket_recv(&socket, data) else {
@@ -95,7 +92,7 @@ fn socket_recv_loop(
             continue;
         }
 
-        let Some(mut ipv4_packet) = MutableIpv4Packet::new(&mut buf[12..12 + len]) else {
+        let Some(mut ipv4_packet) = MutableIpv4Packet::new(&mut buf[..len]) else {
             continue;
         };
 
@@ -124,15 +121,20 @@ fn socket_recv_loop(
         };
 
         ipv4_packet.set_destination(dest_ip);
+
+        // MacOS do not correctly set ip length when receiving from raw socket
+        ipv4_packet.set_total_length(len as u16);
+
         ipv4_packet.set_checksum(ipv4::checksum(&ipv4_packet.to_immutable()));
 
-        let peer_packet = packet::Packet::new_data_packet(
-            v.my_peer_id,
-            v.src_peer_id,
-            &ipv4_packet.to_immutable().packet(),
+        let mut p = ZCPacket::new_with_payload(ipv4_packet.packet());
+        p.fill_peer_manager_hdr(
+            v.my_peer_id.into(),
+            v.src_peer_id.into(),
+            PacketType::Data as u8,
         );
 
-        if let Err(e) = sender.send(peer_packet) {
+        if let Err(e) = sender.send(p) {
             tracing::error!("send icmp packet to peer failed: {:?}, may exiting..", e);
             break;
         }
@@ -141,25 +143,129 @@ fn socket_recv_loop(
 
 #[async_trait::async_trait]
 impl PeerPacketFilter for IcmpProxy {
-    async fn try_process_packet_from_peer(
-        &self,
-        packet: &packet::ArchivedPacket,
-        _: &Bytes,
-    ) -> Option<()> {
-        let _ = self.global_ctx.get_ipv4()?;
+    async fn try_process_packet_from_peer(&self, packet: ZCPacket) -> Option<ZCPacket> {
+        if let Some(_) = self.try_handle_peer_packet(&packet).await {
+            return None;
+        } else {
+            return Some(packet);
+        }
+    }
+}
 
-        if packet.packet_type != packet::PacketType::Data {
+impl IcmpProxy {
+    pub fn new(
+        global_ctx: ArcGlobalCtx,
+        peer_manager: Arc<PeerManager>,
+    ) -> Result<Arc<Self>, Error> {
+        let cidr_set = CidrSet::new(global_ctx.clone());
+        let ret = Self {
+            global_ctx,
+            peer_manager,
+            cidr_set,
+            socket: std::sync::Mutex::new(None),
+
+            nat_table: Arc::new(dashmap::DashMap::new()),
+            tasks: Mutex::new(JoinSet::new()),
+        };
+
+        Ok(Arc::new(ret))
+    }
+
+    pub async fn start(self: &Arc<Self>) -> Result<(), Error> {
+        let _g = self.global_ctx.net_ns.guard();
+        let socket = socket2::Socket::new(
+            socket2::Domain::IPV4,
+            socket2::Type::RAW,
+            Some(socket2::Protocol::ICMPV4),
+        )?;
+        socket.bind(&socket2::SockAddr::from(SocketAddrV4::new(
+            std::net::Ipv4Addr::UNSPECIFIED,
+            0,
+        )))?;
+        self.socket.lock().unwrap().replace(socket);
+
+        self.start_icmp_proxy().await?;
+        self.start_nat_table_cleaner().await?;
+        Ok(())
+    }
+
+    async fn start_nat_table_cleaner(self: &Arc<Self>) -> Result<(), Error> {
+        let nat_table = self.nat_table.clone();
+        self.tasks.lock().await.spawn(
+            async move {
+                loop {
+                    tokio::time::sleep(std::time::Duration::from_secs(1)).await;
+                    nat_table.retain(|_, v| v.start_time.elapsed().as_secs() < 20);
+                }
+            }
+            .instrument(tracing::info_span!("icmp proxy nat table cleaner")),
+        );
+        Ok(())
+    }
+
+    async fn start_icmp_proxy(self: &Arc<Self>) -> Result<(), Error> {
+        let socket = self.socket.lock().unwrap().as_ref().unwrap().try_clone()?;
+        let (sender, mut receiver) = tokio::sync::mpsc::unbounded_channel();
+        let nat_table = self.nat_table.clone();
+        thread::spawn(|| {
+            socket_recv_loop(socket, nat_table, sender);
+        });
+
+        let peer_manager = self.peer_manager.clone();
+        self.tasks.lock().await.spawn(
+            async move {
+                while let Some(msg) = receiver.recv().await {
+                    let hdr = msg.peer_manager_header().unwrap();
+                    let to_peer_id = hdr.to_peer_id.into();
+                    let ret = peer_manager.send_msg(msg, to_peer_id).await;
+                    if ret.is_err() {
+                        tracing::error!("send icmp packet to peer failed: {:?}", ret);
+                    }
+                }
+            }
+            .instrument(tracing::info_span!("icmp proxy send loop")),
+        );
+
+        self.peer_manager
+            .add_packet_process_pipeline(Box::new(self.clone()))
+            .await;
+        Ok(())
+    }
+
+    fn send_icmp_packet(
+        &self,
+        dst_ip: Ipv4Addr,
+        icmp_packet: &icmp::echo_request::EchoRequestPacket,
+    ) -> Result<(), Error> {
+        self.socket.lock().unwrap().as_ref().unwrap().send_to(
+            icmp_packet.packet(),
+            &SocketAddrV4::new(dst_ip.into(), 0).into(),
+        )?;
+
+        Ok(())
+    }
+
+    async fn try_handle_peer_packet(&self, packet: &ZCPacket) -> Option<()> {
+        if self.cidr_set.is_empty() && !self.global_ctx.enable_exit_node() {
+            return None;
+        }
+
+        let _ = self.global_ctx.get_ipv4()?;
+        let hdr = packet.peer_manager_header().unwrap();
+        let is_exit_node = hdr.is_exit_node();
+
+        if hdr.packet_type != PacketType::Data as u8 {
             return None;
         };
 
-        let ipv4 = Ipv4Packet::new(&packet.payload.as_bytes())?;
+        let ipv4 = Ipv4Packet::new(&packet.payload())?;
 
         if ipv4.get_version() != 4 || ipv4.get_next_level_protocol() != IpNextHeaderProtocols::Icmp
         {
             return None;
         }
 
-        if !self.cidr_set.contains_v4(ipv4.get_destination()) {
+        if !self.cidr_set.contains_v4(ipv4.get_destination()) && !is_exit_node {
             return None;
         }
 
@@ -181,8 +287,8 @@ impl PeerPacketFilter for IcmpProxy {
         };
 
         let value = IcmpNatEntry::new(
-            packet.from_peer.into(),
-            packet.to_peer.into(),
+            hdr.from_peer_id.into(),
+            hdr.to_peer_id.into(),
             ipv4.get_source().into(),
         )
         .ok()?;
@@ -198,96 +304,3 @@ impl PeerPacketFilter for IcmpProxy {
         Some(())
     }
 }
-
-impl IcmpProxy {
-    pub fn new(
-        global_ctx: ArcGlobalCtx,
-        peer_manager: Arc<PeerManager>,
-    ) -> Result<Arc<Self>, Error> {
-        let cidr_set = CidrSet::new(global_ctx.clone());
-
-        let _g = global_ctx.net_ns.guard();
-        let socket = socket2::Socket::new(
-            socket2::Domain::IPV4,
-            socket2::Type::RAW,
-            Some(socket2::Protocol::ICMPV4),
-        )?;
-        socket.bind(&socket2::SockAddr::from(SocketAddrV4::new(
-            std::net::Ipv4Addr::UNSPECIFIED,
-            0,
-        )))?;
-
-        let ret = Self {
-            global_ctx,
-            peer_manager,
-            cidr_set,
-            socket,
-
-            nat_table: Arc::new(dashmap::DashMap::new()),
-            tasks: Mutex::new(JoinSet::new()),
-        };
-
-        Ok(Arc::new(ret))
-    }
-
-    pub async fn start(self: &Arc<Self>) -> Result<(), Error> {
-        self.start_icmp_proxy().await?;
-        self.start_nat_table_cleaner().await?;
-        Ok(())
-    }
-
-    async fn start_nat_table_cleaner(self: &Arc<Self>) -> Result<(), Error> {
-        let nat_table = self.nat_table.clone();
-        self.tasks.lock().await.spawn(
-            async move {
-                loop {
-                    tokio::time::sleep(std::time::Duration::from_secs(1)).await;
-                    nat_table.retain(|_, v| v.start_time.elapsed().as_secs() < 20);
-                }
-            }
-            .instrument(tracing::info_span!("icmp proxy nat table cleaner")),
-        );
-        Ok(())
-    }
-
-    async fn start_icmp_proxy(self: &Arc<Self>) -> Result<(), Error> {
-        let socket = self.socket.try_clone()?;
-        let (sender, mut receiver) = tokio::sync::mpsc::unbounded_channel();
-        let nat_table = self.nat_table.clone();
-        thread::spawn(|| {
-            socket_recv_loop(socket, nat_table, sender);
-        });
-
-        let peer_manager = self.peer_manager.clone();
-        self.tasks.lock().await.spawn(
-            async move {
-                while let Some(msg) = receiver.recv().await {
-                    let to_peer_id = msg.to_peer.into();
-                    let ret = peer_manager.send_msg(msg.into(), to_peer_id).await;
-                    if ret.is_err() {
-                        tracing::error!("send icmp packet to peer failed: {:?}", ret);
-                    }
-                }
-            }
-            .instrument(tracing::info_span!("icmp proxy send loop")),
-        );
-
-        self.peer_manager
-            .add_packet_process_pipeline(Box::new(self.clone()))
-            .await;
-        Ok(())
-    }
-
-    fn send_icmp_packet(
-        &self,
-        dst_ip: Ipv4Addr,
-        icmp_packet: &icmp::echo_request::EchoRequestPacket,
-    ) -> Result<(), Error> {
-        self.socket.send_to(
-            icmp_packet.packet(),
-            &SocketAddrV4::new(dst_ip.into(), 0).into(),
-        )?;
-
-        Ok(())
-    }
-}

easytier/src/gateway/mod.rs

@@ -1,5 +1,4 @@
-use dashmap::DashSet;
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 use tokio::task::JoinSet;
 
 use crate::common::global_ctx::ArcGlobalCtx;
@@ -11,7 +10,7 @@ pub mod udp_proxy;
 #[derive(Debug)]
 struct CidrSet {
     global_ctx: ArcGlobalCtx,
-    cidr_set: Arc<DashSet<cidr::IpCidr>>,
+    cidr_set: Arc<Mutex<Vec<cidr::IpCidr>>>,
     tasks: JoinSet<()>,
 }
 
@@ -19,7 +18,7 @@ impl CidrSet {
     pub fn new(global_ctx: ArcGlobalCtx) -> Self {
         let mut ret = Self {
             global_ctx,
-            cidr_set: Arc::new(DashSet::new()),
+            cidr_set: Arc::new(Mutex::new(vec![])),
             tasks: JoinSet::new(),
         };
         ret.run_cidr_updater();
@@ -35,9 +34,9 @@ impl CidrSet {
                 let cidrs = global_ctx.get_proxy_cidrs();
                 if cidrs != last_cidrs {
                     last_cidrs = cidrs.clone();
-                    cidr_set.clear();
+                    cidr_set.lock().unwrap().clear();
                     for cidr in cidrs.iter() {
-                        cidr_set.insert(cidr.clone());
+                        cidr_set.lock().unwrap().push(cidr.clone());
                     }
                 }
                 tokio::time::sleep(std::time::Duration::from_secs(1)).await;
@@ -47,10 +46,16 @@ impl CidrSet {
 
     pub fn contains_v4(&self, ip: std::net::Ipv4Addr) -> bool {
         let ip = ip.into();
-        return self.cidr_set.iter().any(|cidr| cidr.contains(&ip));
+        let s = self.cidr_set.lock().unwrap();
+        for cidr in s.iter() {
+            if cidr.contains(&ip) {
+                return true;
+            }
+        }
+        false
     }
 
     pub fn is_empty(&self) -> bool {
-        return self.cidr_set.is_empty();
+        self.cidr_set.lock().unwrap().is_empty()
     }
 }

easytier/src/gateway/tcp_proxy.rs

@@ -2,7 +2,9 @@ use crossbeam::atomic::AtomicCell;
 use dashmap::DashMap;
 use pnet::packet::ip::IpNextHeaderProtocols;
 use pnet::packet::ipv4::{Ipv4Packet, MutableIpv4Packet};
-use pnet::packet::tcp::{ipv4_checksum, MutableTcpPacket};
+use pnet::packet::tcp::{ipv4_checksum, MutableTcpPacket, TcpPacket};
+use pnet::packet::MutablePacket;
+use pnet::packet::Packet;
 use std::net::{IpAddr, Ipv4Addr, SocketAddr, SocketAddrV4};
 use std::sync::atomic::AtomicU16;
 use std::sync::Arc;
@@ -11,15 +13,16 @@ use tokio::io::copy_bidirectional;
 use tokio::net::{TcpListener, TcpSocket, TcpStream};
 use tokio::sync::Mutex;
 use tokio::task::JoinSet;
-use tokio_util::bytes::{Bytes, BytesMut};
 use tracing::Instrument;
 
 use crate::common::error::Result;
 use crate::common::global_ctx::GlobalCtx;
+use crate::common::join_joinset_background;
 use crate::common::netns::NetNS;
-use crate::peers::packet::{self, ArchivedPacket};
+
 use crate::peers::peer_manager::PeerManager;
 use crate::peers::{NicPacketFilter, PeerPacketFilter};
+use crate::tunnel::packet_def::{PacketType, ZCPacket};
 
 use super::CidrSet;
 
@@ -71,7 +74,7 @@ pub struct TcpProxy {
     peer_manager: Arc<PeerManager>,
     local_port: AtomicU16,
 
-    tasks: Arc<Mutex<JoinSet<()>>>,
+    tasks: Arc<std::sync::Mutex<JoinSet<()>>>,
 
     syn_map: SynSockMap,
     conn_map: ConnSockMap,
@@ -82,98 +85,37 @@ pub struct TcpProxy {
 
 #[async_trait::async_trait]
 impl PeerPacketFilter for TcpProxy {
-    async fn try_process_packet_from_peer(&self, packet: &ArchivedPacket, _: &Bytes) -> Option<()> {
-        let ipv4_addr = self.global_ctx.get_ipv4()?;
-
-        if packet.packet_type != packet::PacketType::Data {
-            return None;
-        };
-
-        let payload_bytes = packet.payload.as_bytes();
-
-        let ipv4 = Ipv4Packet::new(payload_bytes)?;
-        if ipv4.get_version() != 4 || ipv4.get_next_level_protocol() != IpNextHeaderProtocols::Tcp {
+    async fn try_process_packet_from_peer(&self, mut packet: ZCPacket) -> Option<ZCPacket> {
+        if let Some(_) = self.try_handle_peer_packet(&mut packet).await {
+            if let Err(e) = self.peer_manager.get_nic_channel().send(packet).await {
+                tracing::error!("send to nic failed: {:?}", e);
+            }
             return None;
+        } else {
+            Some(packet)
         }
-
-        if !self.cidr_set.contains_v4(ipv4.get_destination()) {
-            return None;
-        }
-
-        tracing::trace!(ipv4 = ?ipv4, cidr_set = ?self.cidr_set, "proxy tcp packet received");
-
-        let mut packet_buffer = BytesMut::with_capacity(payload_bytes.len());
-        packet_buffer.extend_from_slice(&payload_bytes.to_vec());
-
-        let (ip_buffer, tcp_buffer) =
-            packet_buffer.split_at_mut(ipv4.get_header_length() as usize * 4);
-
-        let mut ip_packet = MutableIpv4Packet::new(ip_buffer).unwrap();
-        let mut tcp_packet = MutableTcpPacket::new(tcp_buffer).unwrap();
-
-        let is_tcp_syn = tcp_packet.get_flags() & pnet::packet::tcp::TcpFlags::SYN != 0;
-        if is_tcp_syn {
-            let source_ip = ip_packet.get_source();
-            let source_port = tcp_packet.get_source();
-            let src = SocketAddr::V4(SocketAddrV4::new(source_ip, source_port));
-
-            let dest_ip = ip_packet.get_destination();
-            let dest_port = tcp_packet.get_destination();
-            let dst = SocketAddr::V4(SocketAddrV4::new(dest_ip, dest_port));
-
-            let old_val = self
-                .syn_map
-                .insert(src, Arc::new(NatDstEntry::new(src, dst)));
-            tracing::trace!(src = ?src, dst = ?dst, old_entry = ?old_val, "tcp syn received");
-        }
-
-        ip_packet.set_destination(ipv4_addr);
-        tcp_packet.set_destination(self.get_local_port());
-        Self::update_ipv4_packet_checksum(&mut ip_packet, &mut tcp_packet);
-
-        tracing::trace!(ip_packet = ?ip_packet, tcp_packet = ?tcp_packet, "tcp packet forwarded");
-
-        if let Err(e) = self
-            .peer_manager
-            .get_nic_channel()
-            .send(packet_buffer.freeze())
-            .await
-        {
-            tracing::error!("send to nic failed: {:?}", e);
-        }
-
-        Some(())
     }
 }
 
 #[async_trait::async_trait]
 impl NicPacketFilter for TcpProxy {
-    async fn try_process_packet_from_nic(&self, mut data: BytesMut) -> BytesMut {
+    async fn try_process_packet_from_nic(&self, zc_packet: &mut ZCPacket) {
         let Some(my_ipv4) = self.global_ctx.get_ipv4() else {
-            return data;
+            return;
         };
 
-        let header_len = {
-            let Some(ipv4) = &Ipv4Packet::new(&data[..]) else {
-                return data;
-            };
-
-            if ipv4.get_version() != 4
-                || ipv4.get_source() != my_ipv4
-                || ipv4.get_next_level_protocol() != IpNextHeaderProtocols::Tcp
-            {
-                return data;
-            }
-
-            ipv4.get_header_length() as usize * 4
-        };
-
-        let (ip_buffer, tcp_buffer) = data.split_at_mut(header_len);
-        let mut ip_packet = MutableIpv4Packet::new(ip_buffer).unwrap();
-        let mut tcp_packet = MutableTcpPacket::new(tcp_buffer).unwrap();
+        let data = zc_packet.payload();
+        let ip_packet = Ipv4Packet::new(data).unwrap();
+        if ip_packet.get_version() != 4
+            || ip_packet.get_source() != my_ipv4
+            || ip_packet.get_next_level_protocol() != IpNextHeaderProtocols::Tcp
+        {
+            return;
+        }
 
+        let tcp_packet = TcpPacket::new(ip_packet.payload()).unwrap();
         if tcp_packet.get_source() != self.get_local_port() {
-            return data;
+            return;
         }
 
         let dst_addr = SocketAddr::V4(SocketAddrV4::new(
@@ -186,7 +128,7 @@ impl NicPacketFilter for TcpProxy {
             entry
         } else {
             let Some(syn_entry) = self.syn_map.get(&dst_addr) else {
-                return data;
+                return;
             };
             syn_entry
         };
@@ -198,13 +140,18 @@ impl NicPacketFilter for TcpProxy {
             panic!("v4 nat entry src ip is not v4");
         };
 
+        let mut ip_packet = MutableIpv4Packet::new(zc_packet.mut_payload()).unwrap();
         ip_packet.set_source(ip);
+        let dst = ip_packet.get_destination();
+
+        let mut tcp_packet = MutableTcpPacket::new(ip_packet.payload_mut()).unwrap();
         tcp_packet.set_source(nat_entry.dst.port());
-        Self::update_ipv4_packet_checksum(&mut ip_packet, &mut tcp_packet);
+
+        Self::update_tcp_packet_checksum(&mut tcp_packet, &ip, &dst);
+        drop(tcp_packet);
+        Self::update_ip_packet_checksum(&mut ip_packet);
 
         tracing::trace!(dst_addr = ?dst_addr, nat_entry = ?nat_entry, packet = ?ip_packet, "tcp packet after modified");
-
-        data
     }
 }
 
@@ -215,7 +162,7 @@ impl TcpProxy {
             peer_manager,
 
             local_port: AtomicU16::new(0),
-            tasks: Arc::new(Mutex::new(JoinSet::new())),
+            tasks: Arc::new(std::sync::Mutex::new(JoinSet::new())),
 
             syn_map: Arc::new(DashMap::new()),
             conn_map: Arc::new(DashMap::new()),
@@ -225,17 +172,20 @@ impl TcpProxy {
         })
     }
 
-    fn update_ipv4_packet_checksum(
-        ipv4_packet: &mut MutableIpv4Packet,
+    fn update_tcp_packet_checksum(
         tcp_packet: &mut MutableTcpPacket,
+        ipv4_src: &Ipv4Addr,
+        ipv4_dst: &Ipv4Addr,
     ) {
         tcp_packet.set_checksum(ipv4_checksum(
             &tcp_packet.to_immutable(),
-            &ipv4_packet.get_source(),
-            &ipv4_packet.get_destination(),
+            ipv4_src,
+            ipv4_dst,
         ));
+    }
 
-        ipv4_packet.set_checksum(pnet::packet::ipv4::checksum(&ipv4_packet.to_immutable()));
+    fn update_ip_packet_checksum(ip_packet: &mut MutableIpv4Packet) {
+        ip_packet.set_checksum(pnet::packet::ipv4::checksum(&ip_packet.to_immutable()));
     }
 
     pub async fn start(self: &Arc<Self>) -> Result<()> {
@@ -247,6 +197,7 @@ impl TcpProxy {
         self.peer_manager
             .add_nic_packet_process_pipeline(Box::new(self.clone()))
             .await;
+        join_joinset_background(self.tasks.clone(), "TcpProxy".to_owned());
 
         Ok(())
     }
@@ -268,7 +219,7 @@ impl TcpProxy {
                 tokio::time::sleep(Duration::from_secs(10)).await;
             }
         };
-        tasks.lock().await.spawn(syn_map_cleaner_task);
+        tasks.lock().unwrap().spawn(syn_map_cleaner_task);
 
         Ok(())
     }
@@ -300,6 +251,7 @@ impl TcpProxy {
                     tracing::error!("tcp connection from unknown source: {:?}", socket_addr);
                     continue;
                 };
+                tracing::info!(?socket_addr, "tcp connection accepted for proxy");
                 assert_eq!(entry.state.load(), NatDstEntryState::SynReceived);
 
                 let entry_clone = entry.clone();
@@ -312,7 +264,7 @@ impl TcpProxy {
                 let old_nat_val = conn_map.insert(entry_clone.id, entry_clone.clone());
                 assert!(old_nat_val.is_none());
 
-                tasks.lock().await.spawn(Self::connect_to_nat_dst(
+                tasks.lock().unwrap().spawn(Self::connect_to_nat_dst(
                     net_ns.clone(),
                     tcp_stream,
                     conn_map.clone(),
@@ -325,7 +277,7 @@ impl TcpProxy {
         };
         self.tasks
             .lock()
-            .await
+            .unwrap()
             .spawn(accept_task.instrument(tracing::info_span!("tcp_proxy_listener")));
 
         Ok(())
@@ -402,4 +354,65 @@ impl TcpProxy {
     pub fn get_local_port(&self) -> u16 {
         self.local_port.load(std::sync::atomic::Ordering::Relaxed)
     }
+
+    async fn try_handle_peer_packet(&self, packet: &mut ZCPacket) -> Option<()> {
+        if self.cidr_set.is_empty() && !self.global_ctx.enable_exit_node() {
+            return None;
+        }
+
+        let ipv4_addr = self.global_ctx.get_ipv4()?;
+        let hdr = packet.peer_manager_header().unwrap();
+        let is_exit_node = hdr.is_exit_node();
+
+        if hdr.packet_type != PacketType::Data as u8 {
+            return None;
+        };
+
+        let payload_bytes = packet.mut_payload();
+
+        let ipv4 = Ipv4Packet::new(payload_bytes)?;
+        if ipv4.get_version() != 4 || ipv4.get_next_level_protocol() != IpNextHeaderProtocols::Tcp {
+            return None;
+        }
+
+        if !self.cidr_set.contains_v4(ipv4.get_destination()) && !is_exit_node {
+            return None;
+        }
+
+        tracing::info!(ipv4 = ?ipv4, cidr_set = ?self.cidr_set, "proxy tcp packet received");
+
+        let ip_packet = Ipv4Packet::new(payload_bytes).unwrap();
+        let tcp_packet = TcpPacket::new(ip_packet.payload()).unwrap();
+
+        let is_tcp_syn = tcp_packet.get_flags() & pnet::packet::tcp::TcpFlags::SYN != 0;
+        if is_tcp_syn {
+            let source_ip = ip_packet.get_source();
+            let source_port = tcp_packet.get_source();
+            let src = SocketAddr::V4(SocketAddrV4::new(source_ip, source_port));
+
+            let dest_ip = ip_packet.get_destination();
+            let dest_port = tcp_packet.get_destination();
+            let dst = SocketAddr::V4(SocketAddrV4::new(dest_ip, dest_port));
+
+            let old_val = self
+                .syn_map
+                .insert(src, Arc::new(NatDstEntry::new(src, dst)));
+            tracing::trace!(src = ?src, dst = ?dst, old_entry = ?old_val, "tcp syn received");
+        }
+
+        let mut ip_packet = MutableIpv4Packet::new(payload_bytes).unwrap();
+        ip_packet.set_destination(ipv4_addr);
+        let source = ip_packet.get_source();
+
+        let mut tcp_packet = MutableTcpPacket::new(ip_packet.payload_mut()).unwrap();
+        tcp_packet.set_destination(self.get_local_port());
+
+        Self::update_tcp_packet_checksum(&mut tcp_packet, &source, &ipv4_addr);
+        drop(tcp_packet);
+        Self::update_ip_packet_checksum(&mut ip_packet);
+
+        tracing::info!(?source, ?ipv4_addr, ?packet, "tcp packet after modified");
+
+        Some(())
+    }
 }

easytier/src/gateway/udp_proxy.rs

@@ -21,13 +21,15 @@ use tokio::{
     time::timeout,
 };
 
-use tokio_util::bytes::Bytes;
 use tracing::Level;
 
 use crate::{
     common::{error::Error, global_ctx::ArcGlobalCtx, PeerId},
-    peers::{packet, peer_manager::PeerManager, PeerPacketFilter},
-    tunnels::common::setup_sokcet2,
+    peers::{peer_manager::PeerManager, PeerPacketFilter},
+    tunnel::{
+        common::setup_sokcet2,
+        packet_def::{PacketType, ZCPacket},
+    },
 };
 
 use super::CidrSet;
@@ -79,7 +81,7 @@ impl UdpNatEntry {
 
     async fn compose_ipv4_packet(
         self: &Arc<Self>,
-        packet_sender: &mut UnboundedSender<packet::Packet>,
+        packet_sender: &mut UnboundedSender<ZCPacket>,
         buf: &mut [u8],
         src_v4: &SocketAddrV4,
         payload_len: usize,
@@ -140,13 +142,10 @@ impl UdpNatEntry {
 
             tracing::trace!(?ipv4_packet, "udp nat packet response send");
 
-            let peer_packet = packet::Packet::new_data_packet(
-                self.my_peer_id,
-                self.src_peer_id,
-                &ipv4_packet.to_immutable().packet(),
-            );
+            let mut p = ZCPacket::new_with_payload(ipv4_packet.packet());
+            p.fill_peer_manager_hdr(self.my_peer_id, self.src_peer_id, PacketType::Data as u8);
 
-            if let Err(e) = packet_sender.send(peer_packet) {
+            if let Err(e) = packet_sender.send(p) {
                 tracing::error!("send icmp packet to peer failed: {:?}, may exiting..", e);
                 return Err(Error::AnyhowError(e.into()));
             }
@@ -158,7 +157,7 @@ impl UdpNatEntry {
         Ok(())
     }
 
-    async fn forward_task(self: Arc<Self>, mut packet_sender: UnboundedSender<packet::Packet>) {
+    async fn forward_task(self: Arc<Self>, mut packet_sender: UnboundedSender<ZCPacket>) {
         let mut buf = [0u8; 8192];
         let mut udp_body: &mut [u8] = unsafe { std::mem::transmute(&mut buf[20 + 8..]) };
         let mut ip_id = 1;
@@ -204,7 +203,7 @@ impl UdpNatEntry {
             else {
                 break;
             };
-            ip_id += 1;
+            ip_id = ip_id.wrapping_add(1);
         }
 
         self.stop();
@@ -220,36 +219,31 @@ pub struct UdpProxy {
 
     nat_table: Arc<DashMap<UdpNatKey, Arc<UdpNatEntry>>>,
 
-    sender: UnboundedSender<packet::Packet>,
-    receiver: Mutex<Option<UnboundedReceiver<packet::Packet>>>,
+    sender: UnboundedSender<ZCPacket>,
+    receiver: Mutex<Option<UnboundedReceiver<ZCPacket>>>,
 
     tasks: Mutex<JoinSet<()>>,
 }
 
-#[async_trait::async_trait]
-impl PeerPacketFilter for UdpProxy {
-    async fn try_process_packet_from_peer(
-        &self,
-        packet: &packet::ArchivedPacket,
-        _: &Bytes,
-    ) -> Option<()> {
-        if self.cidr_set.is_empty() {
+impl UdpProxy {
+    async fn try_handle_packet(&self, packet: &ZCPacket) -> Option<()> {
+        if self.cidr_set.is_empty() && !self.global_ctx.enable_exit_node() {
             return None;
         }
 
         let _ = self.global_ctx.get_ipv4()?;
-
-        if packet.packet_type != packet::PacketType::Data {
+        let hdr = packet.peer_manager_header().unwrap();
+        let is_exit_node = hdr.is_exit_node();
+        if hdr.packet_type != PacketType::Data as u8 {
             return None;
         };
 
-        let ipv4 = Ipv4Packet::new(packet.payload.as_bytes())?;
-
+        let ipv4 = Ipv4Packet::new(packet.payload())?;
         if ipv4.get_version() != 4 || ipv4.get_next_level_protocol() != IpNextHeaderProtocols::Udp {
             return None;
         }
 
-        if !self.cidr_set.contains_v4(ipv4.get_destination()) {
+        if !self.cidr_set.contains_v4(ipv4.get_destination()) && !is_exit_node {
             return None;
         }
 
@@ -272,8 +266,8 @@ impl PeerPacketFilter for UdpProxy {
                 tracing::info!(?packet, ?ipv4, ?udp_packet, "udp nat table entry created");
                 let _g = self.global_ctx.net_ns.guard();
                 Ok(Arc::new(UdpNatEntry::new(
-                    packet.from_peer.into(),
-                    packet.to_peer.into(),
+                    hdr.from_peer_id.get(),
+                    hdr.to_peer_id.get(),
                     nat_key.src_socket,
                 )?))
             })
@@ -316,6 +310,17 @@ impl PeerPacketFilter for UdpProxy {
     }
 }
 
+#[async_trait::async_trait]
+impl PeerPacketFilter for UdpProxy {
+    async fn try_process_packet_from_peer(&self, packet: ZCPacket) -> Option<ZCPacket> {
+        if let Some(_) = self.try_handle_packet(&packet).await {
+            return None;
+        } else {
+            return Some(packet);
+        }
+    }
+}
+
 impl UdpProxy {
     pub fn new(
         global_ctx: ArcGlobalCtx,
@@ -362,9 +367,9 @@ impl UdpProxy {
         let peer_manager = self.peer_manager.clone();
         self.tasks.lock().await.spawn(async move {
             while let Some(msg) = receiver.recv().await {
-                let to_peer_id: PeerId = msg.to_peer.into();
+                let to_peer_id: PeerId = msg.peer_manager_header().unwrap().to_peer_id.get();
                 tracing::trace!(?msg, ?to_peer_id, "udp nat packet response send");
-                let ret = peer_manager.send_msg(msg.into(), to_peer_id).await;
+                let ret = peer_manager.send_msg(msg, to_peer_id).await;
                 if ret.is_err() {
                     tracing::error!("send icmp packet to peer failed: {:?}", ret);
                 }

easytier/src/instance/instance.rs

@@ -0,0 +1,683 @@
+use std::collections::HashSet;
+use std::net::Ipv4Addr;
+use std::pin::Pin;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Weak};
+
+use anyhow::Context;
+use cidr::Ipv4Inet;
+use futures::{SinkExt, StreamExt};
+
+use pnet::packet::ipv4::Ipv4Packet;
+
+use tokio::{sync::Mutex, task::JoinSet};
+use tonic::transport::server::TcpIncoming;
+use tonic::transport::Server;
+
+use crate::common::config::ConfigLoader;
+use crate::common::error::Error;
+use crate::common::global_ctx::{ArcGlobalCtx, GlobalCtx, GlobalCtxEvent};
+use crate::common::PeerId;
+use crate::connector::direct::DirectConnectorManager;
+use crate::connector::manual::{ConnectorManagerRpcService, ManualConnectorManager};
+use crate::connector::udp_hole_punch::UdpHolePunchConnector;
+use crate::gateway::icmp_proxy::IcmpProxy;
+use crate::gateway::tcp_proxy::TcpProxy;
+use crate::gateway::udp_proxy::UdpProxy;
+use crate::peer_center::instance::PeerCenterInstance;
+use crate::peers::peer_conn::PeerConnId;
+use crate::peers::peer_manager::{PeerManager, RouteAlgoType};
+use crate::peers::rpc_service::PeerManagerRpcService;
+use crate::peers::PacketRecvChanReceiver;
+use crate::rpc::vpn_portal_rpc_server::VpnPortalRpc;
+use crate::rpc::{GetVpnPortalInfoRequest, GetVpnPortalInfoResponse, VpnPortalInfo};
+use crate::tunnel::packet_def::ZCPacket;
+
+use crate::tunnel::{ZCPacketSink, ZCPacketStream};
+use crate::vpn_portal::{self, VpnPortal};
+
+use super::listeners::ListenerManager;
+use super::virtual_nic;
+
+use crate::common::ifcfg::IfConfiguerTrait;
+
+#[derive(Clone)]
+struct IpProxy {
+    tcp_proxy: Arc<TcpProxy>,
+    icmp_proxy: Arc<IcmpProxy>,
+    udp_proxy: Arc<UdpProxy>,
+    global_ctx: ArcGlobalCtx,
+    started: Arc<AtomicBool>,
+}
+
+impl IpProxy {
+    fn new(global_ctx: ArcGlobalCtx, peer_manager: Arc<PeerManager>) -> Result<Self, Error> {
+        let tcp_proxy = TcpProxy::new(global_ctx.clone(), peer_manager.clone());
+        let icmp_proxy = IcmpProxy::new(global_ctx.clone(), peer_manager.clone())
+            .with_context(|| "create icmp proxy failed")?;
+        let udp_proxy = UdpProxy::new(global_ctx.clone(), peer_manager.clone())
+            .with_context(|| "create udp proxy failed")?;
+        Ok(IpProxy {
+            tcp_proxy,
+            icmp_proxy,
+            udp_proxy,
+            global_ctx,
+            started: Arc::new(AtomicBool::new(false)),
+        })
+    }
+
+    async fn start(&self) -> Result<(), Error> {
+        if (self.global_ctx.get_proxy_cidrs().is_empty() || self.started.load(Ordering::Relaxed))
+            && !self.global_ctx.config.get_flags().enable_exit_node
+        {
+            return Ok(());
+        }
+
+        self.started.store(true, Ordering::Relaxed);
+        self.tcp_proxy.start().await?;
+        self.icmp_proxy.start().await?;
+        self.udp_proxy.start().await?;
+        Ok(())
+    }
+}
+
+struct NicCtx {
+    global_ctx: ArcGlobalCtx,
+    peer_mgr: Weak<PeerManager>,
+    peer_packet_receiver: Arc<Mutex<PacketRecvChanReceiver>>,
+
+    nic: Arc<Mutex<virtual_nic::VirtualNic>>,
+    tasks: JoinSet<()>,
+}
+
+impl NicCtx {
+    fn new(
+        global_ctx: ArcGlobalCtx,
+        peer_manager: &Arc<PeerManager>,
+        peer_packet_receiver: Arc<Mutex<PacketRecvChanReceiver>>,
+    ) -> Self {
+        NicCtx {
+            global_ctx: global_ctx.clone(),
+            peer_mgr: Arc::downgrade(&peer_manager),
+            peer_packet_receiver,
+            nic: Arc::new(Mutex::new(virtual_nic::VirtualNic::new(global_ctx))),
+            tasks: JoinSet::new(),
+        }
+    }
+
+    async fn assign_ipv4_to_tun_device(&self, ipv4_addr: Ipv4Addr) -> Result<(), Error> {
+        let nic = self.nic.lock().await;
+        nic.link_up().await?;
+        nic.remove_ip(None).await?;
+        nic.add_ip(ipv4_addr, 24).await?;
+        if cfg!(target_os = "macos") {
+            nic.add_route(ipv4_addr, 24).await?;
+        }
+        Ok(())
+    }
+
+    async fn do_forward_nic_to_peers_ipv4(ret: ZCPacket, mgr: &PeerManager) {
+        if let Some(ipv4) = Ipv4Packet::new(ret.payload()) {
+            if ipv4.get_version() != 4 {
+                tracing::info!("[USER_PACKET] not ipv4 packet: {:?}", ipv4);
+                return;
+            }
+            let dst_ipv4 = ipv4.get_destination();
+            tracing::trace!(
+                ?ret,
+                "[USER_PACKET] recv new packet from tun device and forward to peers."
+            );
+
+            // TODO: use zero-copy
+            let send_ret = mgr.send_msg_ipv4(ret, dst_ipv4).await;
+            if send_ret.is_err() {
+                tracing::trace!(?send_ret, "[USER_PACKET] send_msg_ipv4 failed")
+            }
+        } else {
+            tracing::warn!(?ret, "[USER_PACKET] not ipv4 packet");
+        }
+    }
+
+    fn do_forward_nic_to_peers(
+        &mut self,
+        mut stream: Pin<Box<dyn ZCPacketStream>>,
+    ) -> Result<(), Error> {
+        // read from nic and write to corresponding tunnel
+        let Some(mgr) = self.peer_mgr.upgrade() else {
+            return Err(anyhow::anyhow!("peer manager not available").into());
+        };
+        self.tasks.spawn(async move {
+            while let Some(ret) = stream.next().await {
+                if ret.is_err() {
+                    log::error!("read from nic failed: {:?}", ret);
+                    break;
+                }
+                Self::do_forward_nic_to_peers_ipv4(ret.unwrap(), mgr.as_ref()).await;
+            }
+        });
+
+        Ok(())
+    }
+
+    fn do_forward_peers_to_nic(&mut self, mut sink: Pin<Box<dyn ZCPacketSink>>) {
+        let channel = self.peer_packet_receiver.clone();
+        self.tasks.spawn(async move {
+            // unlock until coroutine finished
+            let mut channel = channel.lock().await;
+            while let Some(packet) = channel.recv().await {
+                tracing::trace!(
+                    "[USER_PACKET] forward packet from peers to nic. packet: {:?}",
+                    packet
+                );
+                let ret = sink.send(packet).await;
+                if ret.is_err() {
+                    tracing::error!(?ret, "do_forward_tunnel_to_nic sink error");
+                }
+            }
+        });
+    }
+
+    async fn run_proxy_cidrs_route_updater(&mut self) -> Result<(), Error> {
+        let Some(peer_mgr) = self.peer_mgr.upgrade() else {
+            return Err(anyhow::anyhow!("peer manager not available").into());
+        };
+        let global_ctx = self.global_ctx.clone();
+        let net_ns = self.global_ctx.net_ns.clone();
+        let nic = self.nic.lock().await;
+        let ifcfg = nic.get_ifcfg();
+        let ifname = nic.ifname().to_owned();
+
+        self.tasks.spawn(async move {
+            let mut cur_proxy_cidrs = vec![];
+            loop {
+                let mut proxy_cidrs = vec![];
+                let routes = peer_mgr.list_routes().await;
+                for r in routes {
+                    for cidr in r.proxy_cidrs {
+                        let Ok(cidr) = cidr.parse::<cidr::Ipv4Cidr>() else {
+                            continue;
+                        };
+                        proxy_cidrs.push(cidr);
+                    }
+                }
+                // add vpn portal cidr to proxy_cidrs
+                if let Some(vpn_cfg) = global_ctx.config.get_vpn_portal_config() {
+                    proxy_cidrs.push(vpn_cfg.client_cidr);
+                }
+
+                // if route is in cur_proxy_cidrs but not in proxy_cidrs, delete it.
+                for cidr in cur_proxy_cidrs.iter() {
+                    if proxy_cidrs.contains(cidr) {
+                        continue;
+                    }
+
+                    let _g = net_ns.guard();
+                    let ret = ifcfg
+                        .remove_ipv4_route(
+                            ifname.as_str(),
+                            cidr.first_address(),
+                            cidr.network_length(),
+                        )
+                        .await;
+
+                    if ret.is_err() {
+                        tracing::trace!(
+                            cidr = ?cidr,
+                            err = ?ret,
+                            "remove route failed.",
+                        );
+                    }
+                }
+
+                for cidr in proxy_cidrs.iter() {
+                    if cur_proxy_cidrs.contains(cidr) {
+                        continue;
+                    }
+                    let _g = net_ns.guard();
+                    let ret = ifcfg
+                        .add_ipv4_route(
+                            ifname.as_str(),
+                            cidr.first_address(),
+                            cidr.network_length(),
+                        )
+                        .await;
+
+                    if ret.is_err() {
+                        tracing::trace!(
+                            cidr = ?cidr,
+                            err = ?ret,
+                            "add route failed.",
+                        );
+                    }
+                }
+
+                cur_proxy_cidrs = proxy_cidrs;
+                tokio::time::sleep(std::time::Duration::from_secs(1)).await;
+            }
+        });
+
+        Ok(())
+    }
+
+    async fn run(&mut self, ipv4_addr: Ipv4Addr) -> Result<(), Error> {
+        let tunnel = {
+            let mut nic = self.nic.lock().await;
+            let ret = nic.create_dev().await?;
+            self.global_ctx
+                .issue_event(GlobalCtxEvent::TunDeviceReady(nic.ifname().to_string()));
+            ret
+        };
+
+        let (stream, sink) = tunnel.split();
+
+        self.do_forward_nic_to_peers(stream)?;
+        self.do_forward_peers_to_nic(sink);
+
+        self.assign_ipv4_to_tun_device(ipv4_addr).await?;
+        self.run_proxy_cidrs_route_updater().await?;
+        Ok(())
+    }
+}
+
+type ArcNicCtx = Arc<Mutex<Option<NicCtx>>>;
+
+pub struct Instance {
+    inst_name: String,
+
+    id: uuid::Uuid,
+
+    nic_ctx: ArcNicCtx,
+
+    tasks: JoinSet<()>,
+
+    peer_packet_receiver: Arc<Mutex<PacketRecvChanReceiver>>,
+    peer_manager: Arc<PeerManager>,
+    listener_manager: Arc<Mutex<ListenerManager<PeerManager>>>,
+    conn_manager: Arc<ManualConnectorManager>,
+    direct_conn_manager: Arc<DirectConnectorManager>,
+    udp_hole_puncher: Arc<Mutex<UdpHolePunchConnector>>,
+
+    ip_proxy: Option<IpProxy>,
+
+    peer_center: Arc<PeerCenterInstance>,
+
+    vpn_portal: Arc<Mutex<Box<dyn VpnPortal>>>,
+
+    global_ctx: ArcGlobalCtx,
+}
+
+impl Instance {
+    pub fn new(config: impl ConfigLoader + Send + Sync + 'static) -> Self {
+        let global_ctx = Arc::new(GlobalCtx::new(config));
+
+        log::info!(
+            "[INIT] instance creating. config: {}",
+            global_ctx.config.dump()
+        );
+
+        let (peer_packet_sender, peer_packet_receiver) = tokio::sync::mpsc::channel(100);
+
+        let id = global_ctx.get_id();
+
+        let peer_manager = Arc::new(PeerManager::new(
+            RouteAlgoType::Ospf,
+            global_ctx.clone(),
+            peer_packet_sender.clone(),
+        ));
+
+        let listener_manager = Arc::new(Mutex::new(ListenerManager::new(
+            global_ctx.clone(),
+            peer_manager.clone(),
+        )));
+
+        let conn_manager = Arc::new(ManualConnectorManager::new(
+            global_ctx.clone(),
+            peer_manager.clone(),
+        ));
+
+        let mut direct_conn_manager =
+            DirectConnectorManager::new(global_ctx.clone(), peer_manager.clone());
+        direct_conn_manager.run();
+
+        let udp_hole_puncher = UdpHolePunchConnector::new(global_ctx.clone(), peer_manager.clone());
+
+        let peer_center = Arc::new(PeerCenterInstance::new(peer_manager.clone()));
+
+        #[cfg(feature = "wireguard")]
+        let vpn_portal_inst = vpn_portal::wireguard::WireGuard::default();
+        #[cfg(not(feature = "wireguard"))]
+        let vpn_portal_inst = vpn_portal::NullVpnPortal;
+
+        Instance {
+            inst_name: global_ctx.inst_name.clone(),
+            id,
+
+            peer_packet_receiver: Arc::new(Mutex::new(peer_packet_receiver)),
+            nic_ctx: Arc::new(Mutex::new(None)),
+
+            tasks: JoinSet::new(),
+            peer_manager,
+            listener_manager,
+            conn_manager,
+            direct_conn_manager: Arc::new(direct_conn_manager),
+            udp_hole_puncher: Arc::new(Mutex::new(udp_hole_puncher)),
+
+            ip_proxy: None,
+
+            peer_center,
+
+            vpn_portal: Arc::new(Mutex::new(Box::new(vpn_portal_inst))),
+
+            global_ctx,
+        }
+    }
+
+    pub fn get_conn_manager(&self) -> Arc<ManualConnectorManager> {
+        self.conn_manager.clone()
+    }
+
+    async fn add_initial_peers(&mut self) -> Result<(), Error> {
+        for peer in self.global_ctx.config.get_peers().iter() {
+            self.get_conn_manager()
+                .add_connector_by_url(peer.uri.as_str())
+                .await?;
+        }
+        Ok(())
+    }
+
+    async fn clear_nic_ctx(arc_nic_ctx: ArcNicCtx) {
+        let _ = arc_nic_ctx.lock().await.take();
+    }
+
+    async fn use_new_nic_ctx(arc_nic_ctx: ArcNicCtx, nic_ctx: NicCtx) {
+        let mut g = arc_nic_ctx.lock().await;
+        *g = Some(nic_ctx);
+    }
+
+    // Warning, if there is an IP conflict in the network when using DHCP, the IP will be automatically changed.
+    fn check_dhcp_ip_conflict(&self) {
+        use rand::Rng;
+        let peer_manager_c = self.peer_manager.clone();
+        let global_ctx_c = self.get_global_ctx();
+        let nic_ctx = self.nic_ctx.clone();
+        let peer_packet_receiver = self.peer_packet_receiver.clone();
+        tokio::spawn(async move {
+            let default_ipv4_addr = Ipv4Addr::new(10, 0, 0, 0);
+            let mut dhcp_ip: Option<Ipv4Inet> = None;
+            let mut tries = 6;
+            loop {
+                let mut ipv4_addr: Option<Ipv4Inet> = None;
+                let mut unique_ipv4 = HashSet::new();
+
+                for i in 0..tries {
+                    if dhcp_ip.is_none() {
+                        tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+                    }
+
+                    for route in peer_manager_c.list_routes().await {
+                        if !route.ipv4_addr.is_empty() {
+                            if let Ok(ip) = Ipv4Inet::new(
+                                if let Ok(ipv4) = route.ipv4_addr.parse::<Ipv4Addr>() {
+                                    ipv4
+                                } else {
+                                    default_ipv4_addr
+                                },
+                                24,
+                            ) {
+                                unique_ipv4.insert(ip);
+                            }
+                        }
+                    }
+
+                    if i == tries - 1 && unique_ipv4.is_empty() {
+                        unique_ipv4.insert(Ipv4Inet::new(default_ipv4_addr, 24).unwrap());
+                    }
+
+                    if let Some(ip) = dhcp_ip {
+                        if !unique_ipv4.contains(&ip) {
+                            ipv4_addr = dhcp_ip;
+                            break;
+                        }
+                    }
+
+                    for net in unique_ipv4.iter().map(|inet| inet.network()).take(1) {
+                        if let Some(ip) = net.iter().find(|ip| {
+                            ip.address() != net.first_address()
+                                && ip.address() != net.last_address()
+                                && !unique_ipv4.contains(ip)
+                        }) {
+                            ipv4_addr = Some(ip);
+                        }
+                    }
+                }
+
+                if dhcp_ip != ipv4_addr {
+                    let last_ip = dhcp_ip.map(|p| p.address());
+                    tracing::debug!("last_ip: {:?}", last_ip);
+
+                    Self::clear_nic_ctx(nic_ctx.clone()).await;
+
+                    if let Some(ip) = ipv4_addr {
+                        let mut new_nic_ctx = NicCtx::new(
+                            global_ctx_c.clone(),
+                            &peer_manager_c,
+                            peer_packet_receiver.clone(),
+                        );
+                        dhcp_ip = Some(ip);
+                        tries = 1;
+                        if let Err(e) = new_nic_ctx.run(ip.address()).await {
+                            tracing::error!("add ip failed: {:?}", e);
+                            global_ctx_c.set_ipv4(None);
+                            let sleep: u64 = rand::thread_rng().gen_range(200..500);
+                            tokio::time::sleep(std::time::Duration::from_millis(sleep)).await;
+                            continue;
+                        }
+                        global_ctx_c.set_ipv4(Some(ip.address()));
+                        global_ctx_c.issue_event(GlobalCtxEvent::DhcpIpv4Changed(
+                            last_ip,
+                            Some(ip.address()),
+                        ));
+                        Self::use_new_nic_ctx(nic_ctx.clone(), new_nic_ctx).await;
+                    } else {
+                        global_ctx_c.set_ipv4(None);
+                        global_ctx_c.issue_event(GlobalCtxEvent::DhcpIpv4Conflicted(last_ip));
+                        dhcp_ip = None;
+                        tries = 6;
+                    }
+                }
+
+                let sleep: u64 = rand::thread_rng().gen_range(5..10);
+
+                tokio::time::sleep(std::time::Duration::from_secs(sleep)).await;
+            }
+        });
+    }
+
+    pub async fn run(&mut self) -> Result<(), Error> {
+        self.listener_manager
+            .lock()
+            .await
+            .prepare_listeners()
+            .await?;
+        self.listener_manager.lock().await.run().await?;
+        self.peer_manager.run().await?;
+
+        if self.global_ctx.config.get_dhcp() {
+            self.check_dhcp_ip_conflict();
+        } else if let Some(ipv4_addr) = self.global_ctx.get_ipv4() {
+            let mut new_nic_ctx = NicCtx::new(
+                self.global_ctx.clone(),
+                &self.peer_manager,
+                self.peer_packet_receiver.clone(),
+            );
+            new_nic_ctx.run(ipv4_addr).await?;
+            Self::use_new_nic_ctx(self.nic_ctx.clone(), new_nic_ctx).await;
+        }
+
+        self.run_rpc_server()?;
+
+        // run after tun device created, so listener can bind to tun device, which may be required by win 10
+        self.ip_proxy = Some(IpProxy::new(
+            self.get_global_ctx(),
+            self.get_peer_manager(),
+        )?);
+        self.run_ip_proxy().await?;
+
+        self.udp_hole_puncher.lock().await.run().await?;
+
+        self.peer_center.init().await;
+        let route_calc = self.peer_center.get_cost_calculator();
+        self.peer_manager
+            .get_route()
+            .set_route_cost_fn(route_calc)
+            .await;
+
+        self.add_initial_peers().await?;
+
+        if self.global_ctx.get_vpn_portal_cidr().is_some() {
+            self.run_vpn_portal().await?;
+        }
+
+        Ok(())
+    }
+
+    pub async fn run_ip_proxy(&mut self) -> Result<(), Error> {
+        if self.ip_proxy.is_none() {
+            return Err(anyhow::anyhow!("ip proxy not enabled.").into());
+        }
+        self.ip_proxy.as_ref().unwrap().start().await?;
+        Ok(())
+    }
+
+    pub async fn run_vpn_portal(&mut self) -> Result<(), Error> {
+        if self.global_ctx.get_vpn_portal_cidr().is_none() {
+            return Err(anyhow::anyhow!("vpn portal cidr not set.").into());
+        }
+        self.vpn_portal
+            .lock()
+            .await
+            .start(self.get_global_ctx(), self.get_peer_manager())
+            .await?;
+        Ok(())
+    }
+
+    pub fn get_peer_manager(&self) -> Arc<PeerManager> {
+        self.peer_manager.clone()
+    }
+
+    pub async fn close_peer_conn(
+        &mut self,
+        peer_id: PeerId,
+        conn_id: &PeerConnId,
+    ) -> Result<(), Error> {
+        self.peer_manager
+            .get_peer_map()
+            .close_peer_conn(peer_id, conn_id)
+            .await?;
+        Ok(())
+    }
+
+    pub async fn wait(&mut self) {
+        while let Some(ret) = self.tasks.join_next().await {
+            log::info!("task finished: {:?}", ret);
+            ret.unwrap();
+        }
+    }
+
+    pub fn id(&self) -> uuid::Uuid {
+        self.id
+    }
+
+    pub fn peer_id(&self) -> PeerId {
+        self.peer_manager.my_peer_id()
+    }
+
+    fn get_vpn_portal_rpc_service(&self) -> impl VpnPortalRpc {
+        struct VpnPortalRpcService {
+            peer_mgr: Weak<PeerManager>,
+            vpn_portal: Weak<Mutex<Box<dyn VpnPortal>>>,
+        }
+
+        #[tonic::async_trait]
+        impl VpnPortalRpc for VpnPortalRpcService {
+            async fn get_vpn_portal_info(
+                &self,
+                _request: tonic::Request<GetVpnPortalInfoRequest>,
+            ) -> Result<tonic::Response<GetVpnPortalInfoResponse>, tonic::Status> {
+                let Some(vpn_portal) = self.vpn_portal.upgrade() else {
+                    return Err(tonic::Status::unavailable("vpn portal not available"));
+                };
+
+                let Some(peer_mgr) = self.peer_mgr.upgrade() else {
+                    return Err(tonic::Status::unavailable("peer manager not available"));
+                };
+
+                let vpn_portal = vpn_portal.lock().await;
+                let ret = GetVpnPortalInfoResponse {
+                    vpn_portal_info: Some(VpnPortalInfo {
+                        vpn_type: vpn_portal.name(),
+                        client_config: vpn_portal.dump_client_config(peer_mgr).await,
+                        connected_clients: vpn_portal.list_clients().await,
+                    }),
+                };
+
+                Ok(tonic::Response::new(ret))
+            }
+        }
+
+        VpnPortalRpcService {
+            peer_mgr: Arc::downgrade(&self.peer_manager),
+            vpn_portal: Arc::downgrade(&self.vpn_portal),
+        }
+    }
+
+    fn run_rpc_server(&mut self) -> Result<(), Error> {
+        let Some(addr) = self.global_ctx.config.get_rpc_portal() else {
+            tracing::info!("rpc server not enabled, because rpc_portal is not set.");
+            return Ok(());
+        };
+        let peer_mgr = self.peer_manager.clone();
+        let conn_manager = self.conn_manager.clone();
+        let net_ns = self.global_ctx.net_ns.clone();
+        let peer_center = self.peer_center.clone();
+        let vpn_portal_rpc = self.get_vpn_portal_rpc_service();
+
+        let incoming = TcpIncoming::new(addr, true, None)
+            .map_err(|e| anyhow::anyhow!("create rpc server failed. addr: {}, err: {}", addr, e))?;
+        self.tasks.spawn(async move {
+            let _g = net_ns.guard();
+            Server::builder()
+                .add_service(
+                    crate::rpc::peer_manage_rpc_server::PeerManageRpcServer::new(
+                        PeerManagerRpcService::new(peer_mgr),
+                    ),
+                )
+                .add_service(
+                    crate::rpc::connector_manage_rpc_server::ConnectorManageRpcServer::new(
+                        ConnectorManagerRpcService(conn_manager.clone()),
+                    ),
+                )
+                .add_service(
+                    crate::rpc::peer_center_rpc_server::PeerCenterRpcServer::new(
+                        peer_center.get_rpc_service(),
+                    ),
+                )
+                .add_service(crate::rpc::vpn_portal_rpc_server::VpnPortalRpcServer::new(
+                    vpn_portal_rpc,
+                ))
+                .serve_with_incoming(incoming)
+                .await
+                .with_context(|| format!("rpc server failed. addr: {}", addr))
+                .unwrap();
+        });
+        Ok(())
+    }
+
+    pub fn get_global_ctx(&self) -> ArcGlobalCtx {
+        self.global_ctx.clone()
+    }
+
+    pub fn get_vpn_portal_inst(&self) -> Arc<Mutex<Box<dyn VpnPortal>>> {
+        self.vpn_portal.clone()
+    }
+}

easytier/src/instance/listeners.rs

@@ -4,6 +4,10 @@ use anyhow::Context;
 use async_trait::async_trait;
 use tokio::{sync::Mutex, task::JoinSet};
 
+#[cfg(feature = "quic")]
+use crate::tunnel::quic::QUICTunnelListener;
+#[cfg(feature = "wireguard")]
+use crate::tunnel::wireguard::{WgConfig, WgTunnelListener};
 use crate::{
     common::{
         error::Error,
@@ -11,12 +15,41 @@ use crate::{
         netns::NetNS,
     },
     peers::peer_manager::PeerManager,
-    tunnels::{
-        ring_tunnel::RingTunnelListener, tcp_tunnel::TcpTunnelListener,
-        udp_tunnel::UdpTunnelListener, Tunnel, TunnelListener,
+    tunnel::{
+        ring::RingTunnelListener, tcp::TcpTunnelListener, udp::UdpTunnelListener, Tunnel,
+        TunnelListener,
     },
 };
 
+pub fn get_listener_by_url(
+    l: &url::Url,
+    _ctx: ArcGlobalCtx,
+) -> Result<Box<dyn TunnelListener>, Error> {
+    Ok(match l.scheme() {
+        "tcp" => Box::new(TcpTunnelListener::new(l.clone())),
+        "udp" => Box::new(UdpTunnelListener::new(l.clone())),
+        #[cfg(feature = "wireguard")]
+        "wg" => {
+            let nid = _ctx.get_network_identity();
+            let wg_config = WgConfig::new_from_network_identity(
+                &nid.network_name,
+                &nid.network_secret.unwrap_or_default(),
+            );
+            Box::new(WgTunnelListener::new(l.clone(), wg_config))
+        }
+        #[cfg(feature = "quic")]
+        "quic" => Box::new(QUICTunnelListener::new(l.clone())),
+        #[cfg(feature = "websocket")]
+        "ws" | "wss" => {
+            use crate::tunnel::websocket::WSTunnelListener;
+            Box::new(WSTunnelListener::new(l.clone()))
+        }
+        _ => {
+            return Err(Error::InvalidUrl(l.to_string()));
+        }
+    })
+}
+
 #[async_trait]
 pub trait TunnelHandlerForListener {
     async fn handle_tunnel(&self, tunnel: Box<dyn Tunnel>) -> Result<(), Error>;
@@ -30,10 +63,16 @@ impl TunnelHandlerForListener for PeerManager {
     }
 }
 
+#[derive(Debug, Clone)]
+struct Listener {
+    inner: Arc<Mutex<dyn TunnelListener>>,
+    must_succ: bool,
+}
+
 pub struct ListenerManager<H> {
     global_ctx: ArcGlobalCtx,
     net_ns: NetNS,
-    listeners: Vec<Arc<Mutex<dyn TunnelListener>>>,
+    listeners: Vec<Listener>,
     peer_manager: Arc<H>,
 
     tasks: JoinSet<()>,
@@ -51,36 +90,47 @@ impl<H: TunnelHandlerForListener + Send + Sync + 'static + Debug> ListenerManage
     }
 
     pub async fn prepare_listeners(&mut self) -> Result<(), Error> {
-        self.add_listener(RingTunnelListener::new(
-            format!("ring://{}", self.global_ctx.get_id())
-                .parse()
-                .unwrap(),
-        ))
+        self.add_listener(
+            RingTunnelListener::new(
+                format!("ring://{}", self.global_ctx.get_id())
+                    .parse()
+                    .unwrap(),
+            ),
+            true,
+        )
         .await?;
 
         for l in self.global_ctx.config.get_listener_uris().iter() {
-            match l.scheme() {
-                "tcp" => {
-                    self.add_listener(TcpTunnelListener::new(l.clone())).await?;
-                }
-                "udp" => {
-                    self.add_listener(UdpTunnelListener::new(l.clone())).await?;
-                }
-                _ => {
-                    log::warn!("unsupported listener uri: {}", l);
-                }
-            }
+            let Ok(lis) = get_listener_by_url(l, self.global_ctx.clone()) else {
+                let msg = format!("failed to get listener by url: {}, maybe not supported", l);
+                self.global_ctx
+                    .issue_event(GlobalCtxEvent::ListenerAddFailed(l.clone(), msg));
+                continue;
+            };
+            self.add_listener(lis, true).await?;
+        }
+
+        if self.global_ctx.config.get_flags().enable_ipv6 {
+            let _ = self
+                .add_listener(
+                    UdpTunnelListener::new("udp://[::]:0".parse().unwrap()),
+                    false,
+                )
+                .await?;
         }
 
         Ok(())
     }
 
-    pub async fn add_listener<Listener>(&mut self, listener: Listener) -> Result<(), Error>
+    pub async fn add_listener<L>(&mut self, listener: L, must_succ: bool) -> Result<(), Error>
     where
-        Listener: TunnelListener + 'static,
+        L: TunnelListener + 'static,
     {
         let listener = Arc::new(Mutex::new(listener));
-        self.listeners.push(listener);
+        self.listeners.push(Listener {
+            inner: listener,
+            must_succ,
+        });
         Ok(())
     }
 
@@ -100,31 +150,37 @@ impl<H: TunnelHandlerForListener + Send + Sync + 'static + Debug> ListenerManage
                 tunnel_info.remote_addr.clone(),
             ));
             tracing::info!(ret = ?ret, "conn accepted");
-            let server_ret = peer_manager.handle_tunnel(ret).await;
-            if let Err(e) = &server_ret {
-                global_ctx.issue_event(GlobalCtxEvent::ConnectionError(
-                    tunnel_info.local_addr,
-                    tunnel_info.remote_addr,
-                    e.to_string(),
-                ));
-                tracing::error!(error = ?e, "handle conn error");
-            }
+            let peer_manager = peer_manager.clone();
+            let global_ctx = global_ctx.clone();
+            tokio::spawn(async move {
+                let server_ret = peer_manager.handle_tunnel(ret).await;
+                if let Err(e) = &server_ret {
+                    global_ctx.issue_event(GlobalCtxEvent::ConnectionError(
+                        tunnel_info.local_addr,
+                        tunnel_info.remote_addr,
+                        e.to_string(),
+                    ));
+                    tracing::error!(error = ?e, "handle conn error");
+                }
+            });
         }
+        tracing::warn!("listener exit");
     }
 
     pub async fn run(&mut self) -> Result<(), Error> {
         for listener in &self.listeners {
             let _guard = self.net_ns.guard();
-            let addr = listener.lock().await.local_url();
+            let addr = listener.inner.lock().await.local_url();
             log::warn!("run listener: {:?}", listener);
             listener
+                .inner
                 .lock()
                 .await
                 .listen()
                 .await
                 .with_context(|| format!("failed to add listener {}", addr))?;
             self.tasks.spawn(Self::run_listener(
-                listener.clone(),
+                listener.inner.clone(),
                 self.peer_manager.clone(),
                 self.global_ctx.clone(),
             ));
@@ -141,7 +197,7 @@ mod tests {
 
     use crate::{
         common::global_ctx::tests::get_mock_global_ctx,
-        tunnels::{ring_tunnel::RingTunnelConnector, TunnelConnector},
+        tunnel::{packet_def::ZCPacket, ring::RingTunnelConnector, TunnelConnector},
     };
 
     use super::*;
@@ -151,9 +207,12 @@ mod tests {
 
     #[async_trait]
     impl TunnelHandlerForListener for MockListenerHandler {
-        async fn handle_tunnel(&self, _tunnel: Box<dyn Tunnel>) -> Result<(), Error> {
+        async fn handle_tunnel(&self, tunnel: Box<dyn Tunnel>) -> Result<(), Error> {
             let data = "abc";
-            _tunnel.pin_sink().send(data.into()).await.unwrap();
+            let (_recv, mut send) = tunnel.split();
+
+            let zc_packet = ZCPacket::new_with_payload(data.as_bytes());
+            send.send(zc_packet).await.unwrap();
             Err(Error::Unknown)
         }
     }
@@ -166,14 +225,18 @@ mod tests {
         let ring_id = format!("ring://{}", uuid::Uuid::new_v4());
 
         listener_mgr
-            .add_listener(RingTunnelListener::new(ring_id.parse().unwrap()))
+            .add_listener(RingTunnelListener::new(ring_id.parse().unwrap()), true)
             .await
             .unwrap();
         listener_mgr.run().await.unwrap();
 
         let connect_once = |ring_id| async move {
             let tunnel = RingTunnelConnector::new(ring_id).connect().await.unwrap();
-            assert_eq!(tunnel.pin_stream().next().await.unwrap().unwrap(), "abc");
+            let (mut recv, _send) = tunnel.split();
+            assert_eq!(
+                recv.next().await.unwrap().unwrap().payload(),
+                "abc".as_bytes()
+            );
             tunnel
         };
 

easytier/src/instance/virtual_nic.rs

@@ -0,0 +1,417 @@
+use std::{
+    io,
+    net::Ipv4Addr,
+    pin::Pin,
+    task::{Context, Poll},
+};
+
+use crate::{
+    common::{
+        error::Error,
+        global_ctx::ArcGlobalCtx,
+        ifcfg::{IfConfiger, IfConfiguerTrait},
+    },
+    tunnel::{
+        common::{reserve_buf, FramedWriter, TunnelWrapper, ZCPacketToBytes},
+        packet_def::{ZCPacket, ZCPacketType, TAIL_RESERVED_SIZE},
+        StreamItem, Tunnel, TunnelError,
+    },
+};
+
+use byteorder::WriteBytesExt as _;
+use bytes::{BufMut, BytesMut};
+use futures::{lock::BiLock, ready, Stream};
+use pin_project_lite::pin_project;
+use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
+use tokio_util::bytes::Bytes;
+use tun::{create_as_async, AsyncDevice, Configuration, Device as _, Layer};
+use zerocopy::{NativeEndian, NetworkEndian};
+
+pin_project! {
+    pub struct TunStream {
+        #[pin]
+        l: BiLock<AsyncDevice>,
+        cur_buf: BytesMut,
+        has_packet_info: bool,
+        payload_offset: usize,
+    }
+}
+
+impl TunStream {
+    pub fn new(l: BiLock<AsyncDevice>, has_packet_info: bool) -> Self {
+        let mut payload_offset = ZCPacketType::NIC.get_packet_offsets().payload_offset;
+        if has_packet_info {
+            payload_offset -= 4;
+        }
+        Self {
+            l,
+            cur_buf: BytesMut::new(),
+            has_packet_info,
+            payload_offset,
+        }
+    }
+}
+
+impl Stream for TunStream {
+    type Item = StreamItem;
+
+    fn poll_next(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<StreamItem>> {
+        let mut self_mut = self.project();
+        let mut g = ready!(self_mut.l.poll_lock(cx));
+        reserve_buf(&mut self_mut.cur_buf, 2500, 32 * 1024);
+        if self_mut.cur_buf.len() == 0 {
+            unsafe {
+                self_mut.cur_buf.set_len(*self_mut.payload_offset);
+            }
+        }
+        let buf = self_mut.cur_buf.chunk_mut().as_mut_ptr();
+        let buf = unsafe { std::slice::from_raw_parts_mut(buf, 2500) };
+        let mut buf = ReadBuf::new(buf);
+
+        let ret = ready!(g.as_pin_mut().poll_read(cx, &mut buf));
+        let len = buf.filled().len();
+        if len == 0 {
+            return Poll::Ready(None);
+        }
+        unsafe { self_mut.cur_buf.advance_mut(len + TAIL_RESERVED_SIZE) };
+
+        let mut ret_buf = self_mut.cur_buf.split();
+        let cur_len = ret_buf.len();
+        ret_buf.truncate(cur_len - TAIL_RESERVED_SIZE);
+
+        match ret {
+            Ok(_) => Poll::Ready(Some(Ok(ZCPacket::new_from_buf(ret_buf, ZCPacketType::NIC)))),
+            Err(err) => {
+                println!("tun stream error: {:?}", err);
+                Poll::Ready(None)
+            }
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default)]
+enum PacketProtocol {
+    #[default]
+    IPv4,
+    IPv6,
+    Other(u8),
+}
+
+// Note: the protocol in the packet information header is platform dependent.
+impl PacketProtocol {
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    fn into_pi_field(self) -> Result<u16, io::Error> {
+        use nix::libc;
+        match self {
+            PacketProtocol::IPv4 => Ok(libc::ETH_P_IP as u16),
+            PacketProtocol::IPv6 => Ok(libc::ETH_P_IPV6 as u16),
+            PacketProtocol::Other(_) => Err(io::Error::new(
+                io::ErrorKind::Other,
+                "neither an IPv4 nor IPv6 packet",
+            )),
+        }
+    }
+
+    #[cfg(any(target_os = "macos", target_os = "ios"))]
+    fn into_pi_field(self) -> Result<u16, io::Error> {
+        use nix::libc;
+        match self {
+            PacketProtocol::IPv4 => Ok(libc::PF_INET as u16),
+            PacketProtocol::IPv6 => Ok(libc::PF_INET6 as u16),
+            PacketProtocol::Other(_) => Err(io::Error::new(
+                io::ErrorKind::Other,
+                "neither an IPv4 nor IPv6 packet",
+            )),
+        }
+    }
+
+    #[cfg(target_os = "windows")]
+    fn into_pi_field(self) -> Result<u16, io::Error> {
+        unimplemented!()
+    }
+}
+
+/// Infer the protocol based on the first nibble in the packet buffer.
+fn infer_proto(buf: &[u8]) -> PacketProtocol {
+    match buf[0] >> 4 {
+        4 => PacketProtocol::IPv4,
+        6 => PacketProtocol::IPv6,
+        p => PacketProtocol::Other(p),
+    }
+}
+
+struct TunZCPacketToBytes {
+    has_packet_info: bool,
+}
+
+impl TunZCPacketToBytes {
+    pub fn new(has_packet_info: bool) -> Self {
+        Self { has_packet_info }
+    }
+
+    pub fn fill_packet_info(
+        &self,
+        mut buf: &mut [u8],
+        proto: PacketProtocol,
+    ) -> Result<(), io::Error> {
+        // flags is always 0
+        buf.write_u16::<NativeEndian>(0)?;
+        // write the protocol as network byte order
+        buf.write_u16::<NetworkEndian>(proto.into_pi_field()?)?;
+        Ok(())
+    }
+}
+
+impl ZCPacketToBytes for TunZCPacketToBytes {
+    fn into_bytes(&self, zc_packet: ZCPacket) -> Result<Bytes, TunnelError> {
+        let payload_offset = zc_packet.payload_offset();
+        let mut inner = zc_packet.inner();
+        // we have peer manager header, so payload offset must larger than 4
+        assert!(payload_offset >= 4);
+
+        let ret = if self.has_packet_info {
+            let mut inner = inner.split_off(payload_offset - 4);
+            let proto = infer_proto(&inner[4..]);
+            self.fill_packet_info(&mut inner[0..4], proto)?;
+            inner
+        } else {
+            inner.split_off(payload_offset)
+        };
+
+        tracing::debug!(?ret, ?payload_offset, "convert zc packet to tun packet");
+
+        Ok(ret.into())
+    }
+}
+
+pin_project! {
+    pub struct TunAsyncWrite {
+        #[pin]
+        l: BiLock<AsyncDevice>,
+    }
+}
+
+impl AsyncWrite for TunAsyncWrite {
+    fn poll_write(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &[u8],
+    ) -> Poll<Result<usize, io::Error>> {
+        let self_mut = self.project();
+        let mut g = ready!(self_mut.l.poll_lock(cx));
+        g.as_pin_mut().poll_write(cx, buf)
+    }
+
+    fn poll_flush(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Result<(), io::Error>> {
+        let self_mut = self.project();
+        let mut g = ready!(self_mut.l.poll_lock(cx));
+        g.as_pin_mut().poll_flush(cx)
+    }
+
+    fn poll_shutdown(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Result<(), io::Error>> {
+        let self_mut = self.project();
+        let mut g = ready!(self_mut.l.poll_lock(cx));
+        g.as_pin_mut().poll_shutdown(cx)
+    }
+
+    fn poll_write_vectored(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        bufs: &[io::IoSlice<'_>],
+    ) -> Poll<Result<usize, io::Error>> {
+        let self_mut = self.project();
+        let mut g = ready!(self_mut.l.poll_lock(cx));
+        g.as_pin_mut().poll_write_vectored(cx, bufs)
+    }
+
+    fn is_write_vectored(&self) -> bool {
+        true
+    }
+}
+
+pub struct VirtualNic {
+    dev_name: String,
+    queue_num: usize,
+
+    global_ctx: ArcGlobalCtx,
+
+    ifname: Option<String>,
+    ifcfg: Box<dyn IfConfiguerTrait + Send + Sync + 'static>,
+}
+
+impl VirtualNic {
+    pub fn new(global_ctx: ArcGlobalCtx) -> Self {
+        Self {
+            dev_name: "".to_owned(),
+            queue_num: 1,
+            global_ctx,
+            ifname: None,
+            ifcfg: Box::new(IfConfiger {}),
+        }
+    }
+
+    pub fn set_dev_name(mut self, dev_name: &str) -> Result<Self, Error> {
+        self.dev_name = dev_name.to_owned();
+        Ok(self)
+    }
+
+    pub fn set_queue_num(mut self, queue_num: usize) -> Result<Self, Error> {
+        self.queue_num = queue_num;
+        Ok(self)
+    }
+
+    async fn create_tun(&mut self) -> Result<AsyncDevice, Error> {
+        let mut config = Configuration::default();
+        config.layer(Layer::L3);
+
+        #[cfg(target_os = "linux")]
+        {
+            config.platform(|config| {
+                // detect protocol by ourselves for cross platform
+                config.packet_information(false);
+            });
+        }
+
+        #[cfg(target_os = "windows")]
+        {
+            use rand::distributions::Distribution as _;
+            use std::net::IpAddr;
+            let c = crate::arch::windows::interface_count()?;
+            let mut rng = rand::thread_rng();
+            let s: String = rand::distributions::Alphanumeric
+                .sample_iter(&mut rng)
+                .take(4)
+                .map(char::from)
+                .collect::<String>()
+                .to_lowercase();
+
+            config.name(format!("et{}_{}_{}", self.dev_name, c, s));
+            // set a temporary address
+            config.address(format!("172.0.{}.3", c).parse::<IpAddr>().unwrap());
+
+            config.platform(|config| {
+                config.skip_config(true);
+                config.guid(None);
+                config.ring_cap(Some(config.min_ring_cap() * 2));
+            });
+        }
+
+        if self.queue_num != 1 {
+            todo!("queue_num != 1")
+        }
+        config.queues(self.queue_num);
+        config.up();
+
+        let _g = self.global_ctx.net_ns.guard();
+        Ok(create_as_async(&config)?)
+    }
+
+    async fn create_dev_ret_err(&mut self) -> Result<Box<dyn Tunnel>, Error> {
+        let dev = self.create_tun().await?;
+        let ifname = dev.get_ref().name()?;
+        self.ifcfg.wait_interface_show(ifname.as_str()).await?;
+
+        let flags = self.global_ctx.config.get_flags();
+        let mut mtu_in_config = flags.mtu;
+        if flags.enable_encryption {
+            mtu_in_config -= 20;
+        }
+        {
+            // set mtu by ourselves, rust-tun does not handle it correctly on windows
+            let _g = self.global_ctx.net_ns.guard();
+            self.ifcfg
+                .set_mtu(ifname.as_str(), mtu_in_config as u32)
+                .await?;
+        }
+
+        let has_packet_info = cfg!(target_os = "macos");
+        let (a, b) = BiLock::new(dev);
+        let ft = TunnelWrapper::new(
+            TunStream::new(a, has_packet_info),
+            FramedWriter::new_with_converter(
+                TunAsyncWrite { l: b },
+                TunZCPacketToBytes::new(has_packet_info),
+            ),
+            None,
+        );
+
+        self.ifname = Some(ifname.to_owned());
+        Ok(Box::new(ft))
+    }
+
+    pub async fn create_dev(&mut self) -> Result<Box<dyn Tunnel>, Error> {
+        self.create_dev_ret_err().await
+    }
+
+    pub fn ifname(&self) -> &str {
+        self.ifname.as_ref().unwrap().as_str()
+    }
+
+    pub async fn link_up(&self) -> Result<(), Error> {
+        let _g = self.global_ctx.net_ns.guard();
+        self.ifcfg.set_link_status(self.ifname(), true).await?;
+        Ok(())
+    }
+
+    pub async fn add_route(&self, address: Ipv4Addr, cidr: u8) -> Result<(), Error> {
+        let _g = self.global_ctx.net_ns.guard();
+        self.ifcfg
+            .add_ipv4_route(self.ifname(), address, cidr)
+            .await?;
+        Ok(())
+    }
+
+    pub async fn remove_ip(&self, ip: Option<Ipv4Addr>) -> Result<(), Error> {
+        let _g = self.global_ctx.net_ns.guard();
+        self.ifcfg.remove_ip(self.ifname(), ip).await?;
+        Ok(())
+    }
+
+    pub async fn add_ip(&self, ip: Ipv4Addr, cidr: i32) -> Result<(), Error> {
+        let _g = self.global_ctx.net_ns.guard();
+        self.ifcfg
+            .add_ipv4_ip(self.ifname(), ip, cidr as u8)
+            .await?;
+        Ok(())
+    }
+
+    pub fn get_ifcfg(&self) -> impl IfConfiguerTrait {
+        IfConfiger {}
+    }
+}
+#[cfg(test)]
+mod tests {
+    use crate::common::{error::Error, global_ctx::tests::get_mock_global_ctx};
+
+    use super::VirtualNic;
+
+    async fn run_test_helper() -> Result<VirtualNic, Error> {
+        let mut dev = VirtualNic::new(get_mock_global_ctx());
+        let _tunnel = dev.create_dev().await?;
+
+        tokio::time::sleep(tokio::time::Duration::from_secs(1)).await;
+
+        dev.link_up().await?;
+        dev.remove_ip(None).await?;
+        dev.add_ip("10.144.111.1".parse().unwrap(), 24).await?;
+        Ok(dev)
+    }
+
+    #[tokio::test]
+    async fn tun_test() {
+        let _dev = run_test_helper().await.unwrap();
+
+        // let mut stream = nic.pin_recv_stream();
+        // while let Some(item) = stream.next().await {
+        //     println!("item: {:?}", item);
+        // }
+
+        // let framed = dev.into_framed();
+        // let (mut s, mut b) = framed.split();
+        // loop {
+        //     let tmp = b.next().await.unwrap().unwrap();
+        //     let tmp = EthernetPacket::new(tmp.get_bytes());
+        //     println!("ret: {:?}", tmp.unwrap());
+        // }
+    }
+}

easytier/src/launcher.rs

@@ -0,0 +1,280 @@
+use std::{
+    collections::VecDeque,
+    sync::{atomic::AtomicBool, Arc, RwLock},
+};
+
+use crate::{
+    common::{
+        config::{ConfigLoader, TomlConfigLoader},
+        global_ctx::GlobalCtxEvent,
+        stun::StunInfoCollectorTrait,
+    },
+    instance::instance::Instance,
+    peers::rpc_service::PeerManagerRpcService,
+    rpc::{
+        cli::{PeerInfo, Route, StunInfo},
+        peer::GetIpListResponse,
+    },
+    utils::{list_peer_route_pair, PeerRoutePair},
+};
+use chrono::{DateTime, Local};
+use serde::{Deserialize, Serialize};
+
+#[derive(Default, Clone, Debug, Serialize, Deserialize)]
+pub struct MyNodeInfo {
+    pub virtual_ipv4: String,
+    pub ips: GetIpListResponse,
+    pub stun_info: StunInfo,
+    pub listeners: Vec<String>,
+    pub vpn_portal_cfg: Option<String>,
+}
+
+#[derive(Default, Clone)]
+struct EasyTierData {
+    events: Arc<RwLock<VecDeque<(DateTime<Local>, GlobalCtxEvent)>>>,
+    node_info: Arc<RwLock<MyNodeInfo>>,
+    routes: Arc<RwLock<Vec<Route>>>,
+    peers: Arc<RwLock<Vec<PeerInfo>>>,
+}
+
+pub struct EasyTierLauncher {
+    instance_alive: Arc<AtomicBool>,
+    stop_flag: Arc<AtomicBool>,
+    thread_handle: Option<std::thread::JoinHandle<()>>,
+    running_cfg: String,
+
+    error_msg: Arc<RwLock<Option<String>>>,
+    data: EasyTierData,
+}
+
+impl EasyTierLauncher {
+    pub fn new() -> Self {
+        let instance_alive = Arc::new(AtomicBool::new(false));
+        Self {
+            instance_alive,
+            thread_handle: None,
+            error_msg: Arc::new(RwLock::new(None)),
+            running_cfg: String::new(),
+
+            stop_flag: Arc::new(AtomicBool::new(false)),
+            data: EasyTierData::default(),
+        }
+    }
+
+    async fn handle_easytier_event(event: GlobalCtxEvent, data: EasyTierData) {
+        let mut events = data.events.write().unwrap();
+        events.push_back((chrono::Local::now(), event));
+        if events.len() > 100 {
+            events.pop_front();
+        }
+    }
+
+    async fn easytier_routine(
+        cfg: TomlConfigLoader,
+        stop_signal: Arc<tokio::sync::Notify>,
+        data: EasyTierData,
+    ) -> Result<(), anyhow::Error> {
+        let mut instance = Instance::new(cfg);
+        let peer_mgr = instance.get_peer_manager();
+
+        // Subscribe to global context events
+        let global_ctx = instance.get_global_ctx();
+        let data_c = data.clone();
+        tokio::spawn(async move {
+            let mut receiver = global_ctx.subscribe();
+            while let Ok(event) = receiver.recv().await {
+                Self::handle_easytier_event(event, data_c.clone()).await;
+            }
+        });
+
+        // update my node info
+        let data_c = data.clone();
+        let global_ctx_c = instance.get_global_ctx();
+        let peer_mgr_c = peer_mgr.clone();
+        let vpn_portal = instance.get_vpn_portal_inst();
+        tokio::spawn(async move {
+            loop {
+                let node_info = MyNodeInfo {
+                    virtual_ipv4: global_ctx_c
+                        .get_ipv4()
+                        .map(|x| x.to_string())
+                        .unwrap_or_default(),
+                    ips: global_ctx_c.get_ip_collector().collect_ip_addrs().await,
+                    stun_info: global_ctx_c.get_stun_info_collector().get_stun_info(),
+                    listeners: global_ctx_c
+                        .get_running_listeners()
+                        .iter()
+                        .map(|x| x.to_string())
+                        .collect(),
+                    vpn_portal_cfg: Some(
+                        vpn_portal
+                            .lock()
+                            .await
+                            .dump_client_config(peer_mgr_c.clone())
+                            .await,
+                    ),
+                };
+                *data_c.node_info.write().unwrap() = node_info.clone();
+                *data_c.routes.write().unwrap() = peer_mgr_c.list_routes().await;
+                *data_c.peers.write().unwrap() = PeerManagerRpcService::new(peer_mgr_c.clone())
+                    .list_peers()
+                    .await;
+                tokio::time::sleep(std::time::Duration::from_secs(1)).await;
+            }
+        });
+
+        instance.run().await?;
+        stop_signal.notified().await;
+        Ok(())
+    }
+
+    pub fn start<F>(&mut self, cfg_generator: F)
+    where
+        F: FnOnce() -> Result<TomlConfigLoader, anyhow::Error> + Send + Sync,
+    {
+        let error_msg = self.error_msg.clone();
+        let cfg = cfg_generator();
+        if let Err(e) = cfg {
+            error_msg.write().unwrap().replace(e.to_string());
+            return;
+        }
+
+        self.running_cfg = cfg.as_ref().unwrap().dump();
+
+        let stop_flag = self.stop_flag.clone();
+
+        let instance_alive = self.instance_alive.clone();
+        instance_alive.store(true, std::sync::atomic::Ordering::Relaxed);
+
+        let data = self.data.clone();
+
+        self.thread_handle = Some(std::thread::spawn(move || {
+            let rt = tokio::runtime::Builder::new_multi_thread()
+                .enable_all()
+                .build()
+                .unwrap();
+            let stop_notifier = Arc::new(tokio::sync::Notify::new());
+
+            let stop_notifier_clone = stop_notifier.clone();
+            rt.spawn(async move {
+                while !stop_flag.load(std::sync::atomic::Ordering::Relaxed) {
+                    tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+                }
+                stop_notifier_clone.notify_one();
+            });
+
+            let ret = rt.block_on(Self::easytier_routine(
+                cfg.unwrap(),
+                stop_notifier.clone(),
+                data,
+            ));
+            if let Err(e) = ret {
+                error_msg.write().unwrap().replace(e.to_string());
+            }
+            instance_alive.store(false, std::sync::atomic::Ordering::Relaxed);
+        }));
+    }
+
+    pub fn error_msg(&self) -> Option<String> {
+        self.error_msg.read().unwrap().clone()
+    }
+
+    pub fn running(&self) -> bool {
+        self.instance_alive
+            .load(std::sync::atomic::Ordering::Relaxed)
+    }
+
+    pub fn get_events(&self) -> Vec<(DateTime<Local>, GlobalCtxEvent)> {
+        let events = self.data.events.read().unwrap();
+        events.iter().cloned().collect()
+    }
+
+    pub fn get_node_info(&self) -> MyNodeInfo {
+        self.data.node_info.read().unwrap().clone()
+    }
+
+    pub fn get_routes(&self) -> Vec<Route> {
+        self.data.routes.read().unwrap().clone()
+    }
+
+    pub fn get_peers(&self) -> Vec<PeerInfo> {
+        self.data.peers.read().unwrap().clone()
+    }
+}
+
+impl Drop for EasyTierLauncher {
+    fn drop(&mut self) {
+        self.stop_flag
+            .store(true, std::sync::atomic::Ordering::Relaxed);
+        if let Some(handle) = self.thread_handle.take() {
+            if let Err(e) = handle.join() {
+                println!("Error when joining thread: {:?}", e);
+            }
+        }
+    }
+}
+
+#[derive(Deserialize, Serialize, Debug)]
+pub struct NetworkInstanceRunningInfo {
+    pub my_node_info: MyNodeInfo,
+    pub events: Vec<(DateTime<Local>, GlobalCtxEvent)>,
+    pub node_info: MyNodeInfo,
+    pub routes: Vec<Route>,
+    pub peers: Vec<PeerInfo>,
+    pub peer_route_pairs: Vec<PeerRoutePair>,
+    pub running: bool,
+    pub error_msg: Option<String>,
+}
+
+pub struct NetworkInstance {
+    config: TomlConfigLoader,
+    launcher: Option<EasyTierLauncher>,
+}
+
+impl NetworkInstance {
+    pub fn new(config: TomlConfigLoader) -> Self {
+        Self {
+            config,
+            launcher: None,
+        }
+    }
+
+    pub fn is_easytier_running(&self) -> bool {
+        self.launcher.is_some() && self.launcher.as_ref().unwrap().running()
+    }
+
+    pub fn get_running_info(&self) -> Option<NetworkInstanceRunningInfo> {
+        if self.launcher.is_none() {
+            return None;
+        }
+
+        let launcher = self.launcher.as_ref().unwrap();
+
+        let peers = launcher.get_peers();
+        let routes = launcher.get_routes();
+        let peer_route_pairs = list_peer_route_pair(peers.clone(), routes.clone());
+
+        Some(NetworkInstanceRunningInfo {
+            my_node_info: launcher.get_node_info(),
+            events: launcher.get_events(),
+            node_info: launcher.get_node_info(),
+            routes,
+            peers,
+            peer_route_pairs,
+            running: launcher.running(),
+            error_msg: launcher.error_msg(),
+        })
+    }
+
+    pub fn start(&mut self) -> Result<(), anyhow::Error> {
+        if self.is_easytier_running() {
+            return Ok(());
+        }
+
+        let mut launcher = EasyTierLauncher::new();
+        launcher.start(|| Ok(self.config.clone()));
+
+        self.launcher = Some(launcher);
+        Ok(())
+    }
+}

easytier/src/lib.rs

@@ -0,0 +1,15 @@
+#![allow(dead_code)]
+
+mod arch;
+mod connector;
+mod gateway;
+mod instance;
+mod peer_center;
+mod peers;
+mod vpn_portal;
+
+pub mod common;
+pub mod launcher;
+pub mod rpc;
+pub mod tunnel;
+pub mod utils;

easytier/src/peer_center/instance.rs

@@ -1,23 +1,23 @@
 use std::{
-    collections::hash_map::DefaultHasher,
-    hash::{Hash, Hasher},
-    sync::{
-        atomic::{AtomicBool, Ordering},
-        Arc,
-    },
-    time::{Duration, SystemTime},
+    collections::BTreeSet,
+    sync::Arc,
+    time::{Duration, Instant, SystemTime},
 };
 
+use crossbeam::atomic::AtomicCell;
 use futures::Future;
-use tokio::{
-    sync::{Mutex, RwLock},
-    task::JoinSet,
-};
+use std::sync::RwLock;
+use tokio::sync::Mutex;
+use tokio::task::JoinSet;
 use tracing::Instrument;
 
 use crate::{
     common::PeerId,
-    peers::{peer_manager::PeerManager, rpc_service::PeerManagerRpcService},
+    peers::{
+        peer_manager::PeerManager,
+        route_trait::{RouteCostCalculator, RouteCostCalculatorInterface},
+        rpc_service::PeerManagerRpcService,
+    },
     rpc::{GetGlobalPeerMapRequest, GetGlobalPeerMapResponse},
 };
 
@@ -33,10 +33,12 @@ struct PeerCenterBase {
     lock: Arc<Mutex<()>>,
 }
 
-static SERVICE_ID: u32 = 5;
+// static SERVICE_ID: u32 = 5; for compatibility with the original code
+static SERVICE_ID: u32 = 50;
 
 struct PeridicJobCtx<T> {
     peer_mgr: Arc<PeerManager>,
+    center_peer: AtomicCell<PeerId>,
     job_ctx: T,
 }
 
@@ -81,6 +83,7 @@ impl PeerCenterBase {
             async move {
                 let ctx = Arc::new(PeridicJobCtx {
                     peer_mgr: peer_mgr.clone(),
+                    center_peer: AtomicCell::new(PeerId::default()),
                     job_ctx,
                 });
                 loop {
@@ -89,6 +92,7 @@ impl PeerCenterBase {
                         tokio::time::sleep(Duration::from_secs(1)).await;
                         continue;
                     };
+                    ctx.center_peer.store(center_peer.clone());
                     tracing::trace!(?center_peer, "run periodic job");
                     let rpc_mgr = peer_mgr.get_peer_rpc_mgr();
                     let _g = lock.lock().await;
@@ -128,7 +132,7 @@ impl PeerCenterBase {
 
 pub struct PeerCenterInstanceService {
     global_peer_map: Arc<RwLock<GlobalPeerMap>>,
-    global_peer_map_digest: Arc<RwLock<Digest>>,
+    global_peer_map_digest: Arc<AtomicCell<Digest>>,
 }
 
 #[tonic::async_trait]
@@ -137,7 +141,7 @@ impl crate::rpc::cli::peer_center_rpc_server::PeerCenterRpc for PeerCenterInstan
         &self,
         _request: tonic::Request<GetGlobalPeerMapRequest>,
     ) -> Result<tonic::Response<GetGlobalPeerMapResponse>, tonic::Status> {
-        let global_peer_map = self.global_peer_map.read().await.clone();
+        let global_peer_map = self.global_peer_map.read().unwrap().clone();
         Ok(tonic::Response::new(GetGlobalPeerMapResponse {
             global_peer_map: global_peer_map
                 .map
@@ -153,7 +157,8 @@ pub struct PeerCenterInstance {
 
     client: Arc<PeerCenterBase>,
     global_peer_map: Arc<RwLock<GlobalPeerMap>>,
-    global_peer_map_digest: Arc<RwLock<Digest>>,
+    global_peer_map_digest: Arc<AtomicCell<Digest>>,
+    global_peer_map_update_time: Arc<AtomicCell<Instant>>,
 }
 
 impl PeerCenterInstance {
@@ -162,7 +167,8 @@ impl PeerCenterInstance {
             peer_mgr: peer_mgr.clone(),
             client: Arc::new(PeerCenterBase::new(peer_mgr.clone())),
             global_peer_map: Arc::new(RwLock::new(GlobalPeerMap::new())),
-            global_peer_map_digest: Arc::new(RwLock::new(Digest::default())),
+            global_peer_map_digest: Arc::new(AtomicCell::new(Digest::default())),
+            global_peer_map_update_time: Arc::new(AtomicCell::new(Instant::now())),
         }
     }
 
@@ -175,12 +181,14 @@ impl PeerCenterInstance {
     async fn init_get_global_info_job(&self) {
         struct Ctx {
             global_peer_map: Arc<RwLock<GlobalPeerMap>>,
-            global_peer_map_digest: Arc<RwLock<Digest>>,
+            global_peer_map_digest: Arc<AtomicCell<Digest>>,
+            global_peer_map_update_time: Arc<AtomicCell<Instant>>,
         }
 
         let ctx = Arc::new(Ctx {
             global_peer_map: self.global_peer_map.clone(),
             global_peer_map_digest: self.global_peer_map_digest.clone(),
+            global_peer_map_update_time: self.global_peer_map_update_time.clone(),
         });
 
         self.client
@@ -188,11 +196,19 @@ impl PeerCenterInstance {
                 let mut rpc_ctx = tarpc::context::current();
                 rpc_ctx.deadline = SystemTime::now() + Duration::from_secs(3);
 
+                if ctx
+                    .job_ctx
+                    .global_peer_map_update_time
+                    .load()
+                    .elapsed()
+                    .as_secs()
+                    > 60
+                {
+                    ctx.job_ctx.global_peer_map_digest.store(Digest::default());
+                }
+
                 let ret = client
-                    .get_global_peer_map(
-                        rpc_ctx,
-                        ctx.job_ctx.global_peer_map_digest.read().await.clone(),
-                    )
+                    .get_global_peer_map(rpc_ctx, ctx.job_ctx.global_peer_map_digest.load())
                     .await?;
 
                 let Ok(resp) = ret else {
@@ -213,10 +229,13 @@ impl PeerCenterInstance {
                     resp.digest
                 );
 
-                *ctx.job_ctx.global_peer_map.write().await = resp.global_peer_map;
-                *ctx.job_ctx.global_peer_map_digest.write().await = resp.digest;
+                *ctx.job_ctx.global_peer_map.write().unwrap() = resp.global_peer_map;
+                ctx.job_ctx.global_peer_map_digest.store(resp.digest);
+                ctx.job_ctx
+                    .global_peer_map_update_time
+                    .store(Instant::now());
 
-                Ok(10000)
+                Ok(5000)
             })
             .await;
     }
@@ -224,60 +243,53 @@ impl PeerCenterInstance {
     async fn init_report_peers_job(&self) {
         struct Ctx {
             service: PeerManagerRpcService,
-            need_send_peers: AtomicBool,
-            last_report_peers: Mutex<PeerInfoForGlobalMap>,
+
+            last_report_peers: Mutex<BTreeSet<PeerId>>,
+
+            last_center_peer: AtomicCell<PeerId>,
+            last_report_time: AtomicCell<Instant>,
         }
         let ctx = Arc::new(Ctx {
             service: PeerManagerRpcService::new(self.peer_mgr.clone()),
-            need_send_peers: AtomicBool::new(true),
-            last_report_peers: Mutex::new(PeerInfoForGlobalMap::default()),
+            last_report_peers: Mutex::new(BTreeSet::new()),
+            last_center_peer: AtomicCell::new(PeerId::default()),
+            last_report_time: AtomicCell::new(Instant::now()),
         });
 
         self.client
             .init_periodic_job(ctx, |client, ctx| async move {
                 let my_node_id = ctx.peer_mgr.my_peer_id();
+                let peers: PeerInfoForGlobalMap = ctx.job_ctx.service.list_peers().await.into();
+                let peer_list = peers.direct_peers.keys().map(|k| *k).collect();
+                let job_ctx = &ctx.job_ctx;
 
-                // if peers are not same in next 10 seconds, report peers to center server
-                let mut peers = PeerInfoForGlobalMap::default();
-                for _ in 1..10 {
-                    peers = ctx.job_ctx.service.list_peers().await.into();
-                    if peers == *ctx.job_ctx.last_report_peers.lock().await {
-                        break;
-                    }
-                    tokio::time::sleep(Duration::from_secs(1)).await;
+                // only report when:
+                // 1. center peer changed
+                // 2. last report time is more than 60 seconds
+                // 3. peers changed
+                if ctx.center_peer.load() == ctx.job_ctx.last_center_peer.load()
+                    && job_ctx.last_report_time.load().elapsed().as_secs() < 60
+                    && *job_ctx.last_report_peers.lock().await == peer_list
+                {
+                    return Ok(5000);
                 }
 
-                *ctx.job_ctx.last_report_peers.lock().await = peers.clone();
-                let mut hasher = DefaultHasher::new();
-                peers.hash(&mut hasher);
-
-                let peers = if ctx.job_ctx.need_send_peers.load(Ordering::Relaxed) {
-                    Some(peers)
-                } else {
-                    None
-                };
                 let mut rpc_ctx = tarpc::context::current();
                 rpc_ctx.deadline = SystemTime::now() + Duration::from_secs(3);
 
                 let ret = client
-                    .report_peers(
-                        rpc_ctx,
-                        my_node_id.clone(),
-                        peers,
-                        hasher.finish() as Digest,
-                    )
+                    .report_peers(rpc_ctx, my_node_id.clone(), peers)
                     .await?;
 
-                if matches!(ret.as_ref().err(), Some(Error::DigestMismatch)) {
-                    ctx.job_ctx.need_send_peers.store(true, Ordering::Relaxed);
-                    return Ok(0);
-                } else if ret.is_err() {
+                if ret.is_ok() {
+                    ctx.job_ctx.last_center_peer.store(ctx.center_peer.load());
+                    *ctx.job_ctx.last_report_peers.lock().await = peer_list;
+                    ctx.job_ctx.last_report_time.store(Instant::now());
+                } else {
                     tracing::error!("report peers to center server got error result: {:?}", ret);
-                    return Ok(500);
                 }
 
-                ctx.job_ctx.need_send_peers.store(false, Ordering::Relaxed);
-                Ok(3000)
+                Ok(5000)
             })
             .await;
     }
@@ -288,15 +300,60 @@ impl PeerCenterInstance {
             global_peer_map_digest: self.global_peer_map_digest.clone(),
         }
     }
+
+    pub fn get_cost_calculator(&self) -> RouteCostCalculator {
+        struct RouteCostCalculatorImpl {
+            global_peer_map: Arc<RwLock<GlobalPeerMap>>,
+
+            global_peer_map_clone: GlobalPeerMap,
+
+            last_update_time: AtomicCell<Instant>,
+            global_peer_map_update_time: Arc<AtomicCell<Instant>>,
+        }
+
+        impl RouteCostCalculatorInterface for RouteCostCalculatorImpl {
+            fn calculate_cost(&self, src: PeerId, dst: PeerId) -> i32 {
+                let ret = self
+                    .global_peer_map_clone
+                    .map
+                    .get(&src)
+                    .and_then(|src_peer_info| src_peer_info.direct_peers.get(&dst))
+                    .and_then(|info| Some(info.latency_ms));
+                ret.unwrap_or(80)
+            }
+
+            fn begin_update(&mut self) {
+                let global_peer_map = self.global_peer_map.read().unwrap();
+                self.global_peer_map_clone = global_peer_map.clone();
+            }
+
+            fn end_update(&mut self) {
+                self.last_update_time
+                    .store(self.global_peer_map_update_time.load());
+            }
+
+            fn need_update(&self) -> bool {
+                self.last_update_time.load() < self.global_peer_map_update_time.load()
+            }
+        }
+
+        Box::new(RouteCostCalculatorImpl {
+            global_peer_map: self.global_peer_map.clone(),
+            global_peer_map_clone: GlobalPeerMap::new(),
+            last_update_time: AtomicCell::new(
+                self.global_peer_map_update_time.load() - Duration::from_secs(1),
+            ),
+            global_peer_map_update_time: self.global_peer_map_update_time.clone(),
+        })
+    }
 }
 
 #[cfg(test)]
 mod tests {
-    use std::ops::Deref;
-
     use crate::{
         peer_center::server::get_global_data,
         peers::tests::{connect_peer_manager, create_mock_peer_manager, wait_route_appear},
+        tunnel::common::tests::wait_for_condition,
     };
 
     use super::*;
@@ -329,43 +386,64 @@ mod tests {
         let center_data = get_global_data(center_peer);
 
         // wait center_data has 3 records for 10 seconds
-        let now = std::time::Instant::now();
-        loop {
-            if center_data.read().await.global_peer_map.map.len() == 3 {
-                println!(
-                    "center data ready, {:#?}",
-                    center_data.read().await.global_peer_map
-                );
-                break;
-            }
-            if now.elapsed().as_secs() > 60 {
-                panic!("center data not ready");
-            }
-            tokio::time::sleep(Duration::from_millis(100)).await;
-        }
+        wait_for_condition(
+            || async {
+                if center_data.global_peer_map.len() == 4 {
+                    println!("center data {:#?}", center_data.global_peer_map);
+                    true
+                } else {
+                    false
+                }
+            },
+            Duration::from_secs(10),
+        )
+        .await;
 
         let mut digest = None;
         for pc in peer_centers.iter() {
             let rpc_service = pc.get_rpc_service();
-            let now = std::time::Instant::now();
-            while now.elapsed().as_secs() < 10 {
-                if rpc_service.global_peer_map.read().await.map.len() == 3 {
-                    break;
-                }
-                tokio::time::sleep(Duration::from_millis(100)).await;
-            }
-            assert_eq!(rpc_service.global_peer_map.read().await.map.len(), 3);
+            wait_for_condition(
+                || async { rpc_service.global_peer_map.read().unwrap().map.len() == 3 },
+                Duration::from_secs(10),
+            )
+            .await;
+
             println!("rpc service ready, {:#?}", rpc_service.global_peer_map);
 
             if digest.is_none() {
-                digest = Some(rpc_service.global_peer_map_digest.read().await.clone());
+                digest = Some(rpc_service.global_peer_map_digest.load());
             } else {
-                let v = rpc_service.global_peer_map_digest.read().await;
-                assert_eq!(digest.as_ref().unwrap(), v.deref());
+                let v = rpc_service.global_peer_map_digest.load();
+                assert_eq!(digest.unwrap(), v);
             }
+
+            let mut route_cost = pc.get_cost_calculator();
+            assert!(route_cost.need_update());
+
+            route_cost.begin_update();
+            assert!(
+                route_cost.calculate_cost(peer_mgr_a.my_peer_id(), peer_mgr_b.my_peer_id()) < 30
+            );
+            assert!(
+                route_cost.calculate_cost(peer_mgr_b.my_peer_id(), peer_mgr_a.my_peer_id()) < 30
+            );
+            assert!(
+                route_cost.calculate_cost(peer_mgr_b.my_peer_id(), peer_mgr_c.my_peer_id()) < 30
+            );
+            assert!(
+                route_cost.calculate_cost(peer_mgr_c.my_peer_id(), peer_mgr_b.my_peer_id()) < 30
+            );
+            assert!(
+                route_cost.calculate_cost(peer_mgr_c.my_peer_id(), peer_mgr_a.my_peer_id()) > 50
+            );
+            assert!(
+                route_cost.calculate_cost(peer_mgr_a.my_peer_id(), peer_mgr_c.my_peer_id()) > 50
+            );
+            route_cost.end_update();
+            assert!(!route_cost.need_update());
         }
 
-        let global_digest = get_global_data(center_peer).read().await.digest.clone();
+        let global_digest = get_global_data(center_peer).digest.load();
         assert_eq!(digest.as_ref().unwrap(), &global_digest);
     }
 }

easytier/src/peer_center/server.rs

@@ -0,0 +1,159 @@
+use std::{
+    collections::BinaryHeap,
+    hash::{Hash, Hasher},
+    sync::Arc,
+};
+
+use crossbeam::atomic::AtomicCell;
+use dashmap::DashMap;
+use once_cell::sync::Lazy;
+use tokio::{task::JoinSet};
+
+use crate::{common::PeerId, rpc::DirectConnectedPeerInfo};
+
+use super::{
+    service::{GetGlobalPeerMapResponse, GlobalPeerMap, PeerCenterService, PeerInfoForGlobalMap},
+    Digest, Error,
+};
+
+#[derive(Debug, Clone, PartialEq, PartialOrd, Ord, Eq, Hash)]
+pub(crate) struct SrcDstPeerPair {
+    src: PeerId,
+    dst: PeerId,
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct PeerCenterInfoEntry {
+    info: DirectConnectedPeerInfo,
+    update_time: std::time::Instant,
+}
+
+#[derive(Default)]
+pub(crate) struct PeerCenterServerGlobalData {
+    pub(crate) global_peer_map: DashMap<SrcDstPeerPair, PeerCenterInfoEntry>,
+    pub(crate) peer_report_time: DashMap<PeerId, std::time::Instant>,
+    pub(crate) digest: AtomicCell<Digest>,
+}
+
+// a global unique instance for PeerCenterServer
+pub(crate) static GLOBAL_DATA: Lazy<DashMap<PeerId, Arc<PeerCenterServerGlobalData>>> =
+    Lazy::new(DashMap::new);
+
+pub(crate) fn get_global_data(node_id: PeerId) -> Arc<PeerCenterServerGlobalData> {
+    GLOBAL_DATA
+        .entry(node_id)
+        .or_insert_with(|| Arc::new(PeerCenterServerGlobalData::default()))
+        .value()
+        .clone()
+}
+
+#[derive(Clone, Debug)]
+pub struct PeerCenterServer {
+    // every peer has its own server, so use per-struct dash map is ok.
+    my_node_id: PeerId,
+    tasks: Arc<JoinSet<()>>,
+}
+
+impl PeerCenterServer {
+    pub fn new(my_node_id: PeerId) -> Self {
+        let mut tasks = JoinSet::new();
+        tasks.spawn(async move {
+            loop {
+                tokio::time::sleep(std::time::Duration::from_secs(10)).await;
+                PeerCenterServer::clean_outdated_peer(my_node_id).await;
+            }
+        });
+
+        PeerCenterServer {
+            my_node_id,
+            tasks: Arc::new(tasks),
+        }
+    }
+
+    async fn clean_outdated_peer(my_node_id: PeerId) {
+        let data = get_global_data(my_node_id);
+        data.peer_report_time.retain(|_, v| {
+            std::time::Instant::now().duration_since(*v) < std::time::Duration::from_secs(180)
+        });
+        data.global_peer_map.retain(|_, v| {
+            std::time::Instant::now().duration_since(v.update_time)
+                < std::time::Duration::from_secs(180)
+        });
+    }
+
+    fn calc_global_digest(my_node_id: PeerId) -> Digest {
+        let data = get_global_data(my_node_id);
+        let mut hasher = std::collections::hash_map::DefaultHasher::new();
+        data.global_peer_map
+            .iter()
+            .map(|v| v.key().clone())
+            .collect::<BinaryHeap<_>>()
+            .into_sorted_vec()
+            .into_iter()
+            .for_each(|v| v.hash(&mut hasher));
+        hasher.finish()
+    }
+}
+
+#[tarpc::server]
+impl PeerCenterService for PeerCenterServer {
+    #[tracing::instrument()]
+    async fn report_peers(
+        self,
+        _: tarpc::context::Context,
+        my_peer_id: PeerId,
+        peers: PeerInfoForGlobalMap,
+    ) -> Result<(), Error> {
+        tracing::debug!("receive report_peers");
+
+        let data = get_global_data(self.my_node_id);
+        data.peer_report_time
+            .insert(my_peer_id, std::time::Instant::now());
+
+        for (peer_id, peer_info) in peers.direct_peers {
+            let pair = SrcDstPeerPair {
+                src: my_peer_id,
+                dst: peer_id,
+            };
+            let entry = PeerCenterInfoEntry {
+                info: peer_info,
+                update_time: std::time::Instant::now(),
+            };
+            data.global_peer_map.insert(pair, entry);
+        }
+
+        data.digest
+            .store(PeerCenterServer::calc_global_digest(self.my_node_id));
+
+        Ok(())
+    }
+
+    async fn get_global_peer_map(
+        self,
+        _: tarpc::context::Context,
+        digest: Digest,
+    ) -> Result<Option<GetGlobalPeerMapResponse>, Error> {
+        let data = get_global_data(self.my_node_id);
+        if digest == data.digest.load() && digest != 0 {
+            return Ok(None);
+        }
+
+        let mut global_peer_map = GlobalPeerMap::new();
+        for item in data.global_peer_map.iter() {
+            let (pair, entry) = item.pair();
+            global_peer_map
+                .map
+                .entry(pair.src)
+                .or_insert_with(|| PeerInfoForGlobalMap {
+                    direct_peers: Default::default(),
+                })
+                .direct_peers
+                .insert(pair.dst, entry.info.clone());
+        }
+
+        Ok(Some(GetGlobalPeerMapResponse {
+            global_peer_map,
+            digest: data.digest.load(),
+        }))
+    }
+}

easytier/src/peer_center/service.rs

@@ -5,39 +5,23 @@ use crate::{common::PeerId, rpc::DirectConnectedPeerInfo};
 use super::{Digest, Error};
 use crate::rpc::PeerInfo;
 
-pub type LatencyLevel = crate::rpc::cli::LatencyLevel;
-
-impl LatencyLevel {
-    pub const fn from_latency_ms(lat_ms: u32) -> Self {
-        if lat_ms < 10 {
-            LatencyLevel::VeryLow
-        } else if lat_ms < 50 {
-            LatencyLevel::Low
-        } else if lat_ms < 100 {
-            LatencyLevel::Normal
-        } else if lat_ms < 200 {
-            LatencyLevel::High
-        } else {
-            LatencyLevel::VeryHigh
-        }
-    }
-}
-
 pub type PeerInfoForGlobalMap = crate::rpc::cli::PeerInfoForGlobalMap;
 
 impl From<Vec<PeerInfo>> for PeerInfoForGlobalMap {
     fn from(peers: Vec<PeerInfo>) -> Self {
         let mut peer_map = BTreeMap::new();
         for peer in peers {
-            let min_lat = peer
+            let Some(min_lat) = peer
                 .conns
                 .iter()
                 .map(|conn| conn.stats.as_ref().unwrap().latency_us)
                 .min()
-                .unwrap_or(0);
+            else {
+                continue;
+            };
 
             let dp_info = DirectConnectedPeerInfo {
-                latency_level: LatencyLevel::from_latency_ms(min_lat as u32 / 1000) as i32,
+                latency_ms: std::cmp::max(1, (min_lat as u32 / 1000) as i32),
             };
 
             // sort conn info so hash result is stable
@@ -73,11 +57,7 @@ pub struct GetGlobalPeerMapResponse {
 pub trait PeerCenterService {
     // report center server which peer is directly connected to me
     // digest is a hash of current peer map, if digest not match, we need to transfer the whole map
-    async fn report_peers(
-        my_peer_id: PeerId,
-        peers: Option<PeerInfoForGlobalMap>,
-        digest: Digest,
-    ) -> Result<(), Error>;
+    async fn report_peers(my_peer_id: PeerId, peers: PeerInfoForGlobalMap) -> Result<(), Error>;
 
     async fn get_global_peer_map(digest: Digest)
         -> Result<Option<GetGlobalPeerMapResponse>, Error>;