README
¶
Proxying Ethernet over HTTP
connect-eth-go is an implementation of the draft-ietf-masque-connect-ethernet, allowing the proxying of Ethernet frames via QUIC and HTTP/3. It is currently updated to version 15 of the draft.
The project is entirely based on quic-go, and provides both a client and a proxy implementation. Dockerized versions of client, proxy, and server are provided under the examples directory.
At this point, it supports the following use cases:
- Remote Access L2 VPN, see Section 8.1
- Site-to-Site L2 VPN, see Section 8.2
VLANs are supported as well: IEEE 802.1Q tagged frames are transparently forwarded through the tunnel, see Section 9.2. To avoid loops, it is also recommended to enable the Spanning Tree Protocol (STP) on the bridged Ethernet segments. Check captures under the pcaps directory to verify compliance with the draft.
Decrypting packet captures
pcaps/keys.txt contains the TLS secrets of the QUIC connection captured in pcaps, logged by the example client. To decrypt the captures in Wireshark, set it in Preferences → Protocols → TLS → (Pre)-Master-Secret log filename.
License
Distributed under the MIT License — see LICENSE.
Acknowledgements
This project is based in part on connect-ip-go and masque-go, both licensed under the MIT License by Marten Seemann. The original source code has been modified and adapted for this project.
Contributing
Bug reports and pull requests are welcome.
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CloseError ¶
type CloseError struct {
// Remote is true if the connection was closed by the peer, false if it was closed locally by calling Close.
Remote bool
}
CloseError is returned by ReadPacket and WritePacket once the connection is closed. It matches net.ErrClosed when checked with errors.Is.
func (*CloseError) Error ¶
func (e *CloseError) Error() string
func (*CloseError) Is ¶
func (e *CloseError) Is(target error) bool
type Conn ¶
type Conn struct {
// contains filtered or unexported fields
}
Conn is a connection structure used to proxy Ethernet frames over HTTP/3.
func Dial ¶
func Dial(ctx context.Context, conn *http3.ClientConn, template *uritemplate.Template) (*Conn, *http.Response, error)
Dial starts a connection to a target Ethernet proxy (Sec. 4.4, 8)
func (*Conn) ReadPacket ¶
ReadPacket reads an Ethernet frame over the HTTP/3 connection. Malformed datagrams and datagrams with an unknown Context ID are silently dropped. If b is too small to hold the frame, the frame is dropped and io.ErrShortBuffer is returned.
func (*Conn) WritePacket ¶
WritePacket encapsulates and sends an Ethernet frame over the HTTP/3 connection. Frames that can't be proxied (too short, or too large to fit in a datagram) are dropped (Sec. 7), and no error is returned. An error is returned only if the connection can't be used anymore.
type Proxy ¶
type Proxy struct{}
type Request ¶
type Request struct{}
Request is the parsed CONNECT-ETHERNET request returned from ParseRequest. It currently doesn't have any fields (it could have VLAN id or other ones)
func ParseRequest ¶
ParseRequest parses a CONNECT-ETHERNET request. The template is one of the URI template defined in Sec. 3
type RequestParseError ¶
RequestParseError is returned from ParseRequest if parsing the CONNECT-ETHERNET request fails. It is recommended that the request is rejected with the corresponding HTTP status code.
func (*RequestParseError) Error ¶
func (e *RequestParseError) Error() string
func (*RequestParseError) Unwrap ¶
func (e *RequestParseError) Unwrap() error
Source Files