Fast & reliable user space NAT64

Last update: Aug 4, 2023

Overview

protomask

A user space NAT64 implementation.

Protomask started as a challenge to create a NAT64 implementation in a weekend. The goal of protomask is to keep things simple.

There aren't many knobs to tweak, so stateful NAT or source address filtering will require protomask to be paired with a utility like iptables.

How it works

Protomask operates by listening on an IPv6 /96 prefix for incoming traffic.

When a new IPv6 host sends traffic through protomask, it is dynamically assigned an IPv4 address from a pool of addresses on a first-come-first-serve basis.

From then on, all subsequent packets coming from that same IPv6 host will be NATed through the assigned IPv4 address until the reservation period expires. Likewise, a similar process occurs for return traffic.

For hosts that necessitate a consistent IPv4 address, it is possible to configure a static mapping in the configuration file. This ensures it always communicates using the same IPv4 address no matter how long it is offline for. This is useful for single-stack hosts that need IPv4 DNS entries.

Configuration

Protomask uses a TOML configuration file. Here is a functional example:

# The NAT64 prefix to route to protomask
Nat64Prefix = "64:ff9b::/96"
# Setting this will enable prometheus metrics
Prometheus = "[::1]:8080" # Optional, defaults to disabled

[Pool]
# All prefixes in the pool
Prefixes = ["192.0.2.0/24"]
# The maximum duration an ipv4 address from the pool will be reserved for after becoming idle
MaxIdleDuration = 7200 # Optional, seconds. Defaults to 7200 (2 hours)
# Permanent address mappings
Static = [{ v4 = "192.0.2.2", v6 = "2001:db8:1::2" }]

Installation

Protomask can be installed using various methods:

Debian

Head over to the releases page and download the latest release for your architecture.

Then, install with:

apt install /path/to/protomask_<version>_<arch>.deb

# You can also edit the config file in /etc/protomask.toml
# And once ready, start protomask with
systemctl start protomask

Using Cargo

cargo install protomask

Usage

Usage: protomask [OPTIONS] <CONFIG_FILE>

Arguments:
  <CONFIG_FILE>  Path to the config file

Options:
  -v, --verbose  Enable verbose logging
  -h, --help     Print help
  -V, --version  Print version

Comments

Vulnerability in `tokio 0.1.22` from `tun-tap`

tun-tap depends on tokio 0.1.22 which is vulnerable to RUSTSEC-2021-0124.

Crate:     tokio
Version:   0.1.22
Title:     Data race when sending and receiving after closing a `oneshot` channel
Date:      2021-11-16
ID:        RUSTSEC-2021-0124
URL:       https://rustsec.org/advisories/RUSTSEC-2021-0124
Solution:  Upgrade to >=1.8.4, <1.9.0 OR >=1.13.1

Dependency tree:

tokio 0.1.22
└── tokio-core 0.1.18
    └── tun-tap 0.1.3
        ├── protomask-tun 0.1.0
        │   └── protomask 0.2.0
        └── protomask 0.2.0

More info: https://github.com/ewpratten/protomask/runs/15207757196

opened by ewpratten 2

Audit job failing due to bad permissions

The audit job fails with message Error: Resource not accessible by integration

> Run actions-rs/audit-check@v1
/home/runner/.cargo/bin/cargo generate-lockfile
    Updating crates.io index
> Calling cargo-audit (JSON output)
Warning: 1 vulnerabilities found!
Warning: 5 warnings found!
Found 1 advisory(ies), 1 unmaintained, 4 other
Error: Resource not accessible by integration

This can likely be fixed with the permissions outlined in https://github.com/actions-rs/audit-check/issues/220

Releases(v0.2.0)

v0.2.0(Jul 20, 2023)

Preliminary release for protomask
Source code(tar.gz)
Source code(zip)
protomask_0.2.0_amd64.deb(1.13 MB)
protomask_0.2.0_arm64.deb(996.51 KB)

Owner

Evan Pratten

I build software to assist people in building software

GitHub https://protomask.ewpratten.com/

Fast Hilbert space-filling curve transformation using a LUT

Fast Hilbert Fast Hilbert 2D curve computation using an efficient Lookup Table (LUT). Convert from discrete 2D space to 1D hilbert space and reverse V

20 Nov 3, 2022

Rapid, reliable and robust template management

14 Apr 16, 2022

Simple, reliable, open-source contract verification built for an L2 centric Ethereum ecosystem

Cove This repo contains the backend verification1 code for Cove, a simple, reliable, open-source contract verification built for an L2 centric Ethereu

12 Apr 1, 2023

A blazingly fast and memory safe password cracker with user interface.

HashVat A blazingly fast and memory safe password cracker with user interface. HashVat runs with user interface and is capable of cracking the 1.000.0

2 Dec 6, 2022

Unified directories for different use cases of an application, providing standard directories for local development, when run as service or when run by a user.

UniDirs Unified directories for different use cases of an application, providing standard directories for local development, when run as service or wh

3 Sep 30, 2022

LibreAuth is a collection of tools for user authentication.

LibreAuth is a collection of tools for user authentication. Features Password / passphrase authentication no character-set limitation reason

252 Dec 28, 2022

User-friendly secure computation engine based on secure multi-party computation

CipherCore If you have any questions, or, more generally, would like to discuss CipherCore, please join the Slack community. See a vastly extended ver

356 Jan 5, 2023

MevWallet is a smart contract wallet that allows the user to capture MEV from Searchers, or create MEV on purpose.

MevWallet MevWallet is a smart contract wallet that allows the user to capture MEV from Searchers, or create MEV on purpose. This repo contains the so

94 Jan 26, 2023

Cross-platform user interface framework for Rust.

Viewbuilder Examples Cross-platform user interface framework for Rust. This crate provides an HTML-like render API for the backend of a UI. It's built

18 Sep 26, 2023

Simple Multi-User Chat

4at Simple Multi-User Chat. The code has fallen to "Rewrite it in Rust" disease. You can find the legacy Go version in ./legacy-go-version if you stil

89 Nov 13, 2023

Web user interface for controlling a CATS Radio node

CATS Radio Node This project contains a web user interface for controlling a CATS Radio device, consisting of a Raspberry Pi with a RF4463 hat. Goals

4 Feb 25, 2024

The fast, light, and robust client for the Ethereum mainnet.

OpenEthereum Fast and feature-rich multi-network Ethereum client. » Download the latest release « Table of Contents Description Technical Overview Bui

1.6k Dec 28, 2022

Safe, fast, small crypto using Rust

THE SOFTWARE IS PROVIDED "AS IS" AND BRIAN SMITH AND THE AUTHORS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES

3k Jan 2, 2023

Fast and efficient ed25519 signing and verification in Rust.

ed25519-dalek Fast and efficient Rust implementation of ed25519 key generation, signing, and verification in Rust. Documentation Documentation is avai

563 Dec 26, 2022

Sodium Oxide: Fast cryptographic library for Rust (bindings to libsodium)

sodiumoxide |Crate|Documentation|Gitter| |:---:|:-----------:|:--------:|:-----:|:------:|:----:| |||| NaCl (pronounced "salt") is a new easy-to-use h

642 Dec 17, 2022

A fast tool to scan prototype pollution vulnerability written in Rust. 🦀

ppfuzz Prototype Pollution Fuzzer A fast tool to scan prototype pollution vulnerability written in Rust. ?? Installation Binary Source Dependencies Us

410 Dec 27, 2022

A fast and secure multi protocol honeypot.

Medusa A fast and secure multi protocol honeypot that can mimic realistic devices running ssh, telnet, http, https or any other tcp and udp servers. W

268 Dec 26, 2022

Web-Scale Blockchain for fast, secure, scalable, decentralized apps and marketplaces.

Building 1. Install rustc, cargo and rustfmt. $ curl https://sh.rustup.rs -sSf | sh $ source $HOME/.cargo/env $ rustup component add rustfmt When buil

9.8k Jan 3, 2023

A blazing fast, type-safe template engine for Rust.

markup.rs A blazing fast, type-safe template engine for Rust. markup.rs is a template engine for Rust powered by procedural macros which parses the te

209 Dec 24, 2022