Add support for UDP proxying

[VastBlast]

This PR adds support for a proxying a UDP server through Wireguard. It can listen on IPv4 while tunneling to an IPv6 address or vice versa.

When sending, it goes through BindAddress -> Wireguard -> Target and the opposite when receiving.

For example, if you wanted to proxy Cloudflare's DNS server, an example config would be:

[Interface]
...

[Peer]
...

[UDPProxyTunnel]
BindAddress = 127.0.0.1:53

#Target = [2606:4700:4700::1111]:53
Target = 1.1.1.1:53

# If its set to 0, it will never timeout
InactivityTimeout = 30

[cob-web-corner]

To comply with current architecture this also needs a landlock config rules section

wireproxy/cmd/wireproxy/main.go

Lines 133 to 153 in d710683

	func lockNetwork(sections []wireproxy.RoutineSpawner, infoAddr *string) {
	var rules []landlock.Rule
	if infoAddr != nil && *infoAddr != "" {
	rules = append(rules, landlock.BindTCP(extractPort(*infoAddr)))
	}
	for _, section := range sections {
	switch section := section.(type) {
	case *wireproxy.TCPServerTunnelConfig:
	rules = append(rules, landlock.ConnectTCP(extractPort(section.Target)))
	case *wireproxy.HTTPConfig:
	rules = append(rules, landlock.BindTCP(extractPort(section.BindAddress)))
	case *wireproxy.TCPClientTunnelConfig:
	rules = append(rules, landlock.ConnectTCP(uint16(section.BindAddress.Port)))
	case *wireproxy.Socks5Config:
	rules = append(rules, landlock.BindTCP(extractPort(section.BindAddress)))
	}
	}
	panicIfError(landlock.V4.BestEffort().RestrictNet(rules...))
	}

[VastBlast]

To comply with current architecture this also needs a landlock config rules section

wireproxy/cmd/wireproxy/main.go

Lines 133 to 153 in d710683

	func lockNetwork(sections []wireproxy.RoutineSpawner, infoAddr *string) {
	var rules []landlock.Rule
	if infoAddr != nil && *infoAddr != "" {
	rules = append(rules, landlock.BindTCP(extractPort(*infoAddr)))
	}
	for _, section := range sections {
	switch section := section.(type) {
	case *wireproxy.TCPServerTunnelConfig:
	rules = append(rules, landlock.ConnectTCP(extractPort(section.Target)))
	case *wireproxy.HTTPConfig:
	rules = append(rules, landlock.BindTCP(extractPort(section.BindAddress)))
	case *wireproxy.TCPClientTunnelConfig:
	rules = append(rules, landlock.ConnectTCP(uint16(section.BindAddress.Port)))
	case *wireproxy.Socks5Config:
	rules = append(rules, landlock.BindTCP(extractPort(section.BindAddress)))
	}
	}
	panicIfError(landlock.V4.BestEffort().RestrictNet(rules...))
	}

I looked into this but there seems to be no specific method for restricting UDP bindings/connects similar to TCP. As of right now go-landlock only has TCP.

[cob-web-corner]

Ah sorry I thought this already hit kernel, it appears it did not.

https://lore.kernel.org/all/[email protected]/
landlock-lsm/linux#10

Latest dec 24th
https://lwn.net/Articles/1002224/

There was plans to follow up in landlock with udp support.