srcport_rewrite N:1 flatten, bump to 0.0.7

Allow srcport_rewrite to be a single port regardless of srcport range
size. Sender squashes every matched src port onto that one; receiver
mirrors, squashing whatever random wire src port a symmetric NAT on
the path handed us back to a fixed app-side port. 1:1 same-size
mapping still works as before.

Author: root

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "transparent-udp-obfus"
-version = "0.0.6"
+version = "0.0.7"
 edition = "2021"
 
 [[bin]]

Cargo.toml

@@ -139,7 +139,7 @@ Each rule:
 | `srcport`         | u16 or `[lo, hi]`       | Optional. |
 | `dstport`         | u16                     | Optional. |
 | `dstport_rewrite` | u16                     | Optional. If set, overwrite dst port after encoding / before decoding. |
-| `srcport_rewrite` | u16 or `[lo, hi]`       | Optional. Requires `srcport`. Range size must match `srcport`. Sender maps app→wire (`srcport`→`srcport_rewrite`); receiver maps back (`srcport` matches wire, `srcport_rewrite` is the app range to restore). |
+| `srcport_rewrite` | u16 or `[lo, hi]`       | Optional. Requires `srcport`. Either a range of the same size as `srcport` (1:1 offset mapping) or a single port (N:1 flatten — every matched src port is squashed onto it). Sender maps app→wire; receiver maps back. Flatten mode is intended for symmetric NAT on the path: the NAT randomises the wire src port, so the receiver sets `srcport_rewrite` to a single port to pin everything back to a fixed app-side port. |
 
 ### Cipher mode
 

README.md

@@ -131,9 +131,18 @@ impl Config {
                 if a > b || c > d {
                     anyhow::bail!("{}: port range must have lo <= hi", name);
                 }
-                if (b - a) != (d - c) {
+                // Allow either an equal-size 1:1 range mapping, or an N:1
+                // flatten where srcport_rewrite is a single port and any
+                // srcport in the matched range is squashed onto it. The
+                // flatten form is there to cope with symmetric NAT on the
+                // path randomising the wire src port: the receiver can't
+                // recover the original, so we force everything to a fixed
+                // app-side port instead.
+                let flatten = c == d;
+                if !flatten && (b - a) != (d - c) {
                     anyhow::bail!(
-                        "{}: srcport_rewrite size ({}) must equal srcport size ({})",
+                        "{}: srcport_rewrite must be either a single port (flatten) \
+                         or a range the same size as srcport ({} vs {})",
                         name,
                         d - c + 1,
                         b - a + 1,

src/config.rs

@@ -120,9 +120,15 @@ fn handle(
     // Symmetric to sender's srcport rewrite. On this side `srcport` matches
     // the wire (rewritten) range and `srcport_rewrite` is the original app
     // range to restore. Validated equal-size at config load.
-    let new_sport = if let Some((orig_lo, _)) = rule.srcport_rewrite {
-        let (wire_lo, _) = rule.srcport.unwrap();
-        orig_lo + (peer.port() - wire_lo)
+    let new_sport = if let Some((orig_lo, orig_hi)) = rule.srcport_rewrite {
+        if orig_lo == orig_hi {
+            // N:1 flatten: squash whatever random wire src port a symmetric
+            // NAT handed us back to a fixed app-side port.
+            orig_lo
+        } else {
+            let (wire_lo, _) = rule.srcport.unwrap();
+            orig_lo + (peer.port() - wire_lo)
+        }
     } else {
         peer.port()
     };

src/receiver.rs

@@ -84,11 +84,15 @@ fn handle(buf: &mut [u8], ctx: &SenderCtx) {
     if let Some(new_dp) = rule.dstport_rewrite {
         packet::write_dport(buf, &parsed, new_dp);
     }
-    if let Some((rw_lo, _)) = rule.srcport_rewrite {
-        // Validated at config load: srcport is always set when srcport_rewrite is,
-        // and the ranges have identical size.
-        let (app_lo, _) = rule.srcport.unwrap();
-        let new_sp = rw_lo + (parsed.src_port - app_lo);
+    if let Some((rw_lo, rw_hi)) = rule.srcport_rewrite {
+        // Validated at config load: srcport is set, and srcport_rewrite is
+        // either the same size (1:1 offset) or a single port (N:1 flatten).
+        let new_sp = if rw_lo == rw_hi {
+            rw_lo
+        } else {
+            let (app_lo, _) = rule.srcport.unwrap();
+            rw_lo + (parsed.src_port - app_lo)
+        };
         packet::write_sport(buf, &parsed, new_sp);
     }
     packet::recompute_udp_checksum(buf, &parsed);