Files

T

feat(gateway): refresh remote MAC learning

The LAN switch has to keep learning that remote client MAC addresses live on
the gateway port. Once the gateway injects a remote client's traffic, that
learning can age out if the client is quiet, breaking the Layer 2 illusion.

Track valid remote-client source MACs observed in relay traffic and inject a
small padded CAM refresh frame for each known MAC every 60 seconds. The refresh
frame uses the remote MAC as the Ethernet source and the gateway NIC MAC as the
destination, with a local experimental EtherType so hosts should ignore it.

PacketSocket now reads the wired interface hardware address with SIOCGIFHWADDR
when opening the AF_PACKET socket. Non-Ethernet or invalid source interfaces
fail early instead of starting a gateway that cannot emit refresh traffic.

Test Plan:
- cargo fmt --check
- cargo test --workspace
- cargo clippy --workspace --all-targets -- -D warnings
- git diff --check

Refs: PLAN.md Linux gateway CAM-table refresh

2026-05-21 18:30:51 +02:00

3.9 KiB

Raw Blame History

softlan-vpn

Monorepo for a Layer 2 over QUIC LAN party bridge.

Workspace crates

lanparty-proto: shared frame format, MAC validation, MTU helpers.
lanparty-ctrl: control-plane messages (join/hello/role/version).
lanparty-obs: shared diagnostics/logging event models.
lanparty-client-core: platform-agnostic client session state.
lanparty-client-win: Windows TAP + route/metric handling binary.
lanparty-gateway: Linux AF_PACKET gateway binary.
lanparty-relay: public QUIC relay binary.

`lanparty-proto`

Transport-agnostic tunnel contract shared by all binaries:

overlay datagram header encoding and decoding
Ethernet frame header parsing
MAC address parsing and identity validation
QUIC datagram to TAP MTU budget helpers

`lanparty-ctrl`

Reliable control-plane schema shared by the QUIC stream handlers:

endpoint hello messages with role, room, MAC, and datagram budget
server welcome, reject, peer lifecycle, stats, and disconnect messages
room-code, role/MAC, peer-id, and effective-MTU validation
length-prefixed JSON control frames for reliable QUIC streams

`lanparty-obs`

Shared diagnostics and structured logging vocabulary:

gateway/relay frame logs with MACs, ethertype, length, peer, and action
tunnel counters shared by control messages and runtime diagnostics
client connectivity/TAP diagnostics and user-facing status messages

`lanparty-client-core`

Platform-neutral remote client relay session:

relay QUIC connection with pinned relay certificate trust
client hello with room, virtual MAC, and datagram budget
welcome/reject handling with assigned peer id and effective TAP MTU
Ethernet frame send/receive helpers over QUIC DATAGRAM

`lanparty-relay`

Public relay binary and relay-owned room state:

QUIC endpoint binding and first-stream hello/welcome admission
room admission for clients and gateways
one gateway per room, duplicate client MAC rejection, and room limits
stable effective room MTU chosen before Ethernet datagrams flow
live Ethernet datagram forwarding with no ingress reflection
L2 safety filters for jumbo, switch-control, DHCP-server, and IPv6-RA frames
peer leave cleanup for room membership and MAC indexes

Build

cargo check --workspace

Relay

cargo run -p lanparty-relay -- --listen 443/udp --dev-cert-der-out relay-cert.der

--listen accepts either a socket address or a UDP port shorthand such as 443/udp. The relay binds a QUIC endpoint, accepts a control-stream hello, replies with welcome or reject, and forwards live Ethernet QUIC datagrams between accepted peers in the same room. It currently uses a generated self-signed development certificate; --dev-cert-der-out writes that certificate so the gateway and client can pin it in development. Production certificate handling remains future work.

Gateway

cargo run -p lanparty-gateway -- \
  --relay 203.0.113.10:443 \
  --server-name lanparty-relay.local \
  --relay-ca-cert relay-cert.der \
  --room ROOM1 \
  --interface eth0

The gateway connects to the relay as role = gateway, completes the control-stream hello/welcome handshake, opens an AF_PACKET socket on the LAN interface, and bridges Ethernet frames between the relay and wired LAN until shutdown. It tracks remote-client source MACs seen from relay traffic and periodically emits small CAM refresh frames so the physical switch keeps those MACs associated with the gateway port.

Windows Client

cargo run -p lanparty-client-win -- \
  --relay 203.0.113.10:443 \
  --server-name lanparty-relay.local \
  --relay-ca-cert relay-cert.der \
  --room ROOM1 \
  --virtual-mac 02:00:00:00:00:51

The Windows client binary currently connects to the relay as role = client with the configured virtual MAC, completes the control-stream hello/welcome handshake, and then waits for shutdown. TAP adapter binding and route pinning are not wired yet.

3.9 KiB Raw Blame History