Add basic connectip client transport implementation

go.mod

@@ -6,6 +6,7 @@ toolchain go1.23.2
 
 require (
 github.com/ClickHouse/clickhouse-go/v2 v2.23.2
+github.com/alphadose/haxmap v1.4.1
 github.com/buraksezer/olric v0.5.6
 github.com/cncf/xds/go v0.0.0-20240905190251-b4127c9b8d78
 github.com/coder/websocket v1.8.12
@@ -15,6 +16,7 @@ require (
 github.com/docker/docker v27.2.0+incompatible
 github.com/dpeckett/contextio v0.5.1
 github.com/dpeckett/network v0.3.1
+github.com/dpeckett/triemap v0.3.1
 github.com/envoyproxy/gateway v0.5.0-rc.1.0.20240618131507-bdff5d56b59d
 github.com/envoyproxy/go-control-plane v0.13.0
 github.com/envoyproxy/ratelimit v1.4.1-0.20230427142404-e2a87f41d3a7
@@ -24,6 +26,7 @@ require (
 github.com/getsentry/sentry-go v0.26.0
 github.com/go-logr/logr v1.4.2
 github.com/goccy/go-json v0.9.11
+github.com/golang-jwt/jwt/v5 v5.2.2
 github.com/golang-migrate/migrate/v4 v4.17.1
 github.com/golang/protobuf v1.5.4
 github.com/google/go-cmp v0.6.0
@@ -39,6 +42,8 @@ require (
 github.com/opencontainers/image-spec v1.1.0
 github.com/opencontainers/runc v1.2.2
 github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8
+github.com/quic-go/connect-ip-go v0.0.0-20241112091351-321f13c3d203
+github.com/quic-go/quic-go v0.50.1
 github.com/shirou/gopsutil v3.21.11+incompatible
 github.com/sirupsen/logrus v1.9.3
 github.com/spf13/cobra v1.8.1
@@ -50,6 +55,7 @@ require (
 github.com/vishvananda/netlink v1.3.0
 github.com/vishvananda/netns v0.0.4
 github.com/vmihailenco/msgpack v4.0.4+incompatible
+github.com/yosida95/uritemplate/v3 v3.0.2
 go.opentelemetry.io/proto/otlp v1.2.0
 go.temporal.io/api v1.29.2
 go.temporal.io/sdk v1.26.0
@@ -105,7 +111,6 @@ require (
 github.com/NYTimes/gziphandler v1.1.1 // indirect
 github.com/Rican7/retry v0.1.0 // indirect
 github.com/RoaringBitmap/roaring v1.2.1 // indirect
-github.com/alphadose/haxmap v1.4.1 // indirect
 github.com/andybalholm/brotli v1.1.0 // indirect
 github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect
 github.com/apache/thrift v0.20.0 // indirect
@@ -173,7 +178,6 @@ require (
 github.com/gogo/protobuf v1.3.2 // indirect
 github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
 github.com/golang-jwt/jwt/v4 v4.5.1 // indirect
-github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 github.com/golang/mock v1.7.0-rc.1 // indirect
 github.com/golang/snappy v0.0.4 // indirect
@@ -277,9 +281,7 @@ require (
 github.com/prometheus/client_model v0.6.1 // indirect
 github.com/prometheus/common v0.60.1 // indirect
 github.com/prometheus/procfs v0.15.1 // indirect
-github.com/quic-go/connect-ip-go v0.0.0-20241112091351-321f13c3d203 // indirect
 github.com/quic-go/qpack v0.5.1 // indirect
-github.com/quic-go/quic-go v0.50.1 // indirect
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 github.com/redis/go-redis/v9 v9.6.1 // indirect
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
@@ -324,8 +326,6 @@ require (
 github.com/xdg-go/scram v1.1.2 // indirect
 github.com/xdg-go/stringprep v1.0.4 // indirect
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
-github.com/yosida95/uritemplate v2.0.0+incompatible // indirect
-github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 github.com/yusufpapurcu/wmi v1.2.4 // indirect
 go.etcd.io/bbolt v1.3.8 // indirect

go.sum

@@ -893,12 +893,12 @@ github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZ
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/dpeckett/contextio v0.5.1 h1:w19s6EThbZuRpa2z/Lu06v6+o3rrZhbBzmkol6en/hA=
 github.com/dpeckett/contextio v0.5.1/go.mod h1:IY/CQ1ee6y4C5j/mU0X0M/D84s2FxNisggbNClTPndc=
-github.com/dpeckett/triemap v0.2.1 h1:qn4azAsnYMXBPYIdqtA7m8eYbmBssVN0Bo3ygSfeorE=
-github.com/dpeckett/triemap v0.2.1/go.mod h1:pBxNH+K6m5I4lVo+W7u6JEanxP13adD4t2XYVMxfmTo=
-github.com/dunglas/httpsfv v1.0.2 h1:iERDp/YAfnojSDJ7PW3dj1AReJz4MrwbECSSE59JWL0=
-github.com/dunglas/httpsfv v1.0.2/go.mod h1:zID2mqw9mFsnt7YC3vYQ9/cjq30q41W+1AnDwH8TiMg=
 github.com/dpeckett/network v0.3.1 h1:rMDRLc85zc3v4mGcGfbOrNA9Kx69K2Xr8bD/Hc9MERY=
 github.com/dpeckett/network v0.3.1/go.mod h1:83quX+FE+BdOAKFEm5Om+QdI/1ZEQVNUBZSPl7V7erk=
+github.com/dpeckett/triemap v0.3.1 h1:jzxCyKs/ATw9uCdD2bd0xFTPLIP9uZwX0iZUOOOIDoc=
+github.com/dpeckett/triemap v0.3.1/go.mod h1:pBxNH+K6m5I4lVo+W7u6JEanxP13adD4t2XYVMxfmTo=
+github.com/dunglas/httpsfv v1.0.2 h1:iERDp/YAfnojSDJ7PW3dj1AReJz4MrwbECSSE59JWL0=
+github.com/dunglas/httpsfv v1.0.2/go.mod h1:zID2mqw9mFsnt7YC3vYQ9/cjq30q41W+1AnDwH8TiMg=
 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
@@ -1616,8 +1616,6 @@ github.com/quic-go/connect-ip-go v0.0.0-20241112091351-321f13c3d203 h1:/SLaObCHs
 github.com/quic-go/connect-ip-go v0.0.0-20241112091351-321f13c3d203/go.mod h1:eck9h1BsbP2ri3dIiBinxTfR6vMjsOqt3XgIsz6aKmo=
 github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
 github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
-github.com/quic-go/quic-go v0.48.1 h1:y/8xmfWI9qmGTc+lBr4jKRUWLGSlSigv847ULJ4hYXA=
-github.com/quic-go/quic-go v0.48.1/go.mod h1:yBgs3rWBOADpga7F+jJsb6Ybg1LSYiQvwWlLX+/6HMs=
 github.com/quic-go/quic-go v0.50.1 h1:unsgjFIUqW8a2oopkY7YNONpV1gYND6Nt9hnt1PN94Q=
 github.com/quic-go/quic-go v0.50.1/go.mod h1:Vim6OmUvlYdwBhXP9ZVrtGmCMWa3wEqhq3NgYrI8b4E=
 github.com/rcrowley/go-metrics v0.0.0-20141108142129-dee209f2455f/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
@@ -1816,8 +1814,6 @@ github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtX
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 h1:eY9dn8+vbi4tKz5Qo6v2eYzo7kUS51QINcR5jNpbZS8=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/yosida95/uritemplate v2.0.0+incompatible h1:j6LR/+4tiD14zc0Z0M8QilHLULqgZFD47XqgXQgCE1A=
-github.com/yosida95/uritemplate v2.0.0+incompatible/go.mod h1:mksJanHNnLsh6wYgt/AbBRZ4ogsHsO2uiZlm/UURY5c=
 github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
 github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
 github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
@@ -1918,8 +1914,6 @@ go.uber.org/fx v1.21.1/go.mod h1:HT2M7d7RHo+ebKGh9NRcrsrHHfpZ60nW3QRubMRfv48=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
-go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
 go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
 go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=

pkg/connip/client.go

@@ -0,0 +1,187 @@
+package connip
+
+import (
+"context"
+"crypto/tls"
+"crypto/x509"
+"errors"
+"fmt"
+"log/slog"
+"net"
+"net/http"
+"net/netip"
+"strings"
+"sync"
+"time"
+
+"github.com/dpeckett/network"
+connectip "github.com/quic-go/connect-ip-go"
+"github.com/quic-go/quic-go"
+"github.com/quic-go/quic-go/http3"
+"github.com/yosida95/uritemplate/v3"
+
+"github.com/apoxy-dev/apoxy-cli/pkg/netstack"
+)
+
+var _ TunnelTransport = (*ClientTransport)(nil)
+
+type ClientConfig struct {
+// The UUID identifying the client.
+UUID string
+// The authentication token for the client.
+AuthToken string
+// The optional path to a packet capture file.
+PcapPath string
+// Optional root CA certificates for TLS verification.
+RootCAs *x509.CertPool
+}
+
+type ClientTransport struct {
+*network.NetstackNetwork
+uuid string
+authToken string
+pcapPath string
+rootCAs *x509.CertPool
+
+conn *connectip.Conn
+tun *netstack.TunDevice
+closeOnce sync.Once
+}
+
+func NewClientTransport(conf *ClientConfig) *ClientTransport {
+return &ClientTransport{
+uuid: conf.UUID,
+authToken: conf.AuthToken,
+pcapPath: conf.PcapPath,
+rootCAs: conf.RootCAs,
+}
+}
+
+func (t *ClientTransport) Connect(ctx context.Context, serverAddr string) error {
+tlsConfig := &tls.Config{
+ServerName: "proxy",
+NextProtos: []string{http3.NextProtoH3},
+RootCAs: t.rootCAs,
+}
+
+// Use the proxy address as the server name if it is a domain.
+if addr, _, err := net.SplitHostPort(serverAddr); err == nil && net.ParseIP(addr) == nil {
+tlsConfig.ServerName = addr
+}
+
+qConn, err := quic.DialAddr(
+ctx,
+serverAddr,
+tlsConfig,
+&quic.Config{
+EnableDatagrams: true,
+InitialPacketSize: 1350,
+KeepAlivePeriod: 5 * time.Second,
+MaxIdleTimeout: 5 * time.Minute,
+},
+)
+if err != nil {
+return fmt.Errorf("failed to dial QUIC connection: %w", err)
+}
+
+tr := &http3.Transport{EnableDatagrams: true}
+hconn := tr.NewClientConn(qConn)
+
+template := uritemplate.MustNew(fmt.Sprintf("https://proxy/connect/%s?token=%s", t.uuid, t.authToken))
+
+var rsp *http.Response
+t.conn, rsp, err = connectip.Dial(ctx, hconn, template)
+if err != nil {
+return fmt.Errorf("failed to dial connect-ip connection: %w", err)
+}
+if rsp.StatusCode != http.StatusOK {
+return fmt.Errorf("unexpected status code: %d", rsp.StatusCode)
+}
+
+slog.Info("Connected to server", slog.String("addr", serverAddr))
+
+localPrefixes, err := t.conn.LocalPrefixes(ctx)
+if err != nil {
+return fmt.Errorf("failed to get local IP addresses: %w", err)
+}
+if len(localPrefixes) == 0 {
+return errors.New("no local IP addresses available")
+}
+
+// Filter out non-IPv6 addresses.
+filteredLocalPrefixes := make([]netip.Prefix, 0, len(localPrefixes))
+for _, prefix := range localPrefixes {
+if !prefix.Addr().Is6() {
+slog.Warn("Skipping non-IPv6 address", slog.String("address", prefix.Addr().String()))
+continue
+}
+
+slog.Info("Adding IPv6 address", slog.String("prefix", prefix.String()))
+filteredLocalPrefixes = append(filteredLocalPrefixes, prefix)
+}
+
+resolveConf := &network.ResolveConfig{
+Nameservers: rsp.Header.Values("X-Apoxy-Nameservers"),
+SearchDomains: rsp.Header.Values("X-Apoxy-DNS-SearchDomains"),
+}
+
+// Parse DNS options from response headers.
+if opts := rsp.Header.Values("X-Apoxy-DNS-Options"); len(opts) > 0 {
+for _, opt := range opts {
+if strings.HasPrefix(opt, "ndots:") {
+var ndots int
+if n, err := fmt.Sscanf(opt[6:], "%d", &ndots); err != nil || n != 1 {
+ndots = 1
+}
+resolveConf.NDots = &ndots
+}
+}
+}
+
+slog.Info("Using DNS configuration",
+slog.Any("nameservers", resolveConf.Nameservers),
+slog.Any("searchDomains", resolveConf.SearchDomains),
+slog.Any("nDots", resolveConf.NDots))
+
+t.tun, err = netstack.NewTunDevice(filteredLocalPrefixes, nil, t.pcapPath)
+if err != nil {
+return fmt.Errorf("failed to create virtual TUN device: %w", err)
+}
+
+t.NetstackNetwork = t.tun.Network(resolveConf)
+
+// TODO (dpeckett): how to bubble up errors from this?
+go splice(t.tun, t.conn)
+
+return nil
+}
+
+func (t *ClientTransport) Close() error {
+var closeErr error
+
+t.closeOnce.Do(func() {
+if t.conn != nil {
+if err := t.conn.Close(); err != nil {
+closeErr = fmt.Errorf("failed to close connect-ip connection: %w", err)
+}
+}
+
+if t.tun != nil {
+if err := t.tun.Close(); err != nil {
+// combine errors if both fail
+if closeErr != nil {
+closeErr = fmt.Errorf("%v; also failed to close TUN device: %w", closeErr, err)
+} else {
+closeErr = fmt.Errorf("failed to close TUN device: %w", err)
+}
+}
+}
+})
+
+return closeErr
+}
+
+// FowardToLoopback forwards all inbound traffic to the loopback interface.
+func (t *ClientTransport) FowardToLoopback(ctx context.Context) error {
+return t.tun.ForwardTo(ctx, network.Loopback())
+}