srcport rewrite, bump to 0.0.6

Symmetric to dstport_rewrite: map the UDP source port through an
equal-size range on the wire. Sender treats srcport as the app range
and srcport_rewrite as the wire range; receiver is mirrored
(srcport matches the wire, srcport_rewrite is the app range to
restore). Validated at config load: srcport must be set and the
two ranges must have identical size.

Author: root

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "transparent-udp-obfus"
-version = "0.0.5"
+version = "0.0.6"
 edition = "2021"
 
 [[bin]]

Cargo.toml

@@ -139,6 +139,7 @@ Each rule:
 | `srcport`         | u16 or `[lo, hi]`       | Optional. |
 | `dstport`         | u16                     | Optional. |
 | `dstport_rewrite` | u16                     | Optional. If set, overwrite dst port after encoding / before decoding. |
+| `srcport_rewrite` | u16 or `[lo, hi]`       | Optional. Requires `srcport`. Range size must match `srcport`. Sender maps app→wire (`srcport`→`srcport_rewrite`); receiver maps back (`srcport` matches wire, `srcport_rewrite` is the app range to restore). |
 
 ### Cipher mode
 

README.md

@@ -47,6 +47,8 @@ pub struct TrafficRule {
     pub dstport: Option<u16>,
     #[serde(default)]
     pub dstport_rewrite: Option<u16>,
+    #[serde(default)]
+    pub srcport_rewrite: Option<PortRange>,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
@@ -112,6 +114,33 @@ impl Config {
         if self.tun.len() >= 16 {
             anyhow::bail!("tun name too long");
         }
+        for (name, rules) in [
+            ("local_traffic", &self.local_traffic),
+            ("remote_traffic", &self.remote_traffic),
+        ] {
+            for r in rules {
+                let Some(rw) = &r.srcport_rewrite else { continue };
+                let Some(orig) = &r.srcport else {
+                    anyhow::bail!(
+                        "{}: srcport_rewrite requires srcport to be set",
+                        name
+                    );
+                };
+                let (a, b) = orig.as_pair();
+                let (c, d) = rw.as_pair();
+                if a > b || c > d {
+                    anyhow::bail!("{}: port range must have lo <= hi", name);
+                }
+                if (b - a) != (d - c) {
+                    anyhow::bail!(
+                        "{}: srcport_rewrite size ({}) must equal srcport size ({})",
+                        name,
+                        d - c + 1,
+                        b - a + 1,
+                    );
+                }
+            }
+        }
         if self.mark_emit & self.mark_reinject == 0 {
             tracing::warn!(
                 "mark_emit (0x{:x}) shares no bits with mark_reinject mask (0x{:x}); \

src/config.rs

@@ -14,6 +14,7 @@ pub struct CompiledRule {
     pub dstip: Option<IpNet>,
     pub dstport: Option<u16>,
     pub dstport_rewrite: Option<u16>,
+    pub srcport_rewrite: Option<(u16, u16)>,
 }
 
 impl CompiledRule {
@@ -25,6 +26,7 @@ impl CompiledRule {
             dstip: r.dstip.as_deref().map(parse_net).transpose()?,
             dstport: r.dstport,
             dstport_rewrite: r.dstport_rewrite,
+            srcport_rewrite: r.srcport_rewrite.as_ref().map(PortRange::as_pair),
         })
     }
 

src/matcher.rs

@@ -125,6 +125,11 @@ pub fn write_dport(buf: &mut [u8], p: &ParsedUdp, new_dport: u16) {
     buf[p.l4_offset + 2..p.l4_offset + 4].copy_from_slice(&new_dport.to_be_bytes());
 }
 
+/// Write `new_sport` into the UDP header (does NOT recompute checksum).
+pub fn write_sport(buf: &mut [u8], p: &ParsedUdp, new_sport: u16) {
+    buf[p.l4_offset..p.l4_offset + 2].copy_from_slice(&new_sport.to_be_bytes());
+}
+
 fn ones_complement_sum(mut sum: u32, data: &[u8]) -> u32 {
     let mut i = 0;
     while i + 1 < data.len() {

src/packet.rs

@@ -117,7 +117,16 @@ fn handle(
     }
 
     let new_dport = rule.dstport_rewrite.unwrap_or(orig.port());
-    packet::build(peer.ip(), orig.ip(), peer.port(), new_dport, data, out);
+    // Symmetric to sender's srcport rewrite. On this side `srcport` matches
+    // the wire (rewritten) range and `srcport_rewrite` is the original app
+    // range to restore. Validated equal-size at config load.
+    let new_sport = if let Some((orig_lo, _)) = rule.srcport_rewrite {
+        let (wire_lo, _) = rule.srcport.unwrap();
+        orig_lo + (peer.port() - wire_lo)
+    } else {
+        peer.port()
+    };
+    packet::build(peer.ip(), orig.ip(), new_sport, new_dport, data, out);
 
     let n = unsafe {
         libc::write(

src/receiver.rs

@@ -84,6 +84,13 @@ fn handle(buf: &mut [u8], ctx: &SenderCtx) {
     if let Some(new_dp) = rule.dstport_rewrite {
         packet::write_dport(buf, &parsed, new_dp);
     }
+    if let Some((rw_lo, _)) = rule.srcport_rewrite {
+        // Validated at config load: srcport is always set when srcport_rewrite is,
+        // and the ranges have identical size.
+        let (app_lo, _) = rule.srcport.unwrap();
+        let new_sp = rw_lo + (parsed.src_port - app_lo);
+        packet::write_sport(buf, &parsed, new_sp);
+    }
     packet::recompute_udp_checksum(buf, &parsed);
 
     let total = parsed.total_len;