add restricted nat retries

veilid-core/src/intf/native/network/public_dialinfo_discovery.rs

@@ -105,12 +105,20 @@ impl Network {
         None
     }
 
-    pub async fn update_udpv4_dialinfo_task_routine(self, l: u64, t: u64) -> Result<(), String> {
+    pub async fn update_udpv4_dialinfo_task_routine(self, _l: u64, _t: u64) -> Result<(), String> {
         trace!("looking for udpv4 public dial info");
         let routing_table = self.routing_table();
 
+        let mut retry_count = {
+            let c = self.config.get();
+            c.network.restricted_nat_retries
+        };
+
         // Get our local address
         let local1 = self.discover_local_address(ProtocolAddressType::UDPv4)?;
+
+        // Loop for restricted NAT retries
+        loop {
             // Get our external address from some fast node, call it node B
             let (external1, node_b) = self
                 .discover_external_address(ProtocolAddressType::UDPv4, None)
@@ -131,6 +139,9 @@ impl Network {
                         Some(NetworkClass::Server),
                         DialInfoOrigin::Discovered,
                     );
+
+                    // No more retries
+                    break;
                 } else {
                     // UDP firewall?
                     warn!("UDP static public dial info not reachable. UDP firewall may be blocking inbound to {:?} for {:?}",external1_dial_info, node_b);
@@ -149,12 +160,20 @@ impl Network {
                         Some(NetworkClass::Mapped),
                         DialInfoOrigin::Mapped,
                     );
+
+                    // No more retries
+                    break;
                 } else {
                     // Port mapping was not possible, let's see what kind of NAT we have
 
                     // Does a redirected dial info validation find us?
                     if self
-                    .validate_dial_info(node_b.clone(), external1_dial_info.clone(), true, false)
+                        .validate_dial_info(
+                            node_b.clone(),
+                            external1_dial_info.clone(),
+                            true,
+                            false,
+                        )
                         .await
                     {
                         // Yes, another machine can use the dial info directly, so Full Cone
@@ -164,6 +183,9 @@ impl Network {
                             Some(NetworkClass::FullNAT),
                             DialInfoOrigin::Discovered,
                         );
+
+                        // No more retries
+                        break;
                     } else {
                         // No, we are restricted, determine what kind of restriction
 
@@ -178,7 +200,13 @@ impl Network {
                         if external2 != external1 {
                             // Symmetric NAT is outbound only, no public dial info will work
                             self.inner.lock().network_class = Some(NetworkClass::OutboundOnly);
+
+                            // No more retries
+                            break;
                         } else {
+                            // If we're going to end up as a restricted NAT of some sort
+                            // we should go through our retries before we assign a dial info
+                            if retry_count == 0 {
                                 // Address is the same, so it's address or port restricted
                                 let external2_dial_info = DialInfo::udp_from_socketaddr(external2);
                                 // Do a validate_dial_info on the external address from a routed node
@@ -210,6 +238,13 @@ impl Network {
                     }
                 }
 
+                if retry_count == 0 {
+                    break;
+                }
+                retry_count -= 1;
+            }
+        }
+
         Ok(())
     }
 

veilid-core/src/tests/common/test_veilid_config.rs

@@ -183,6 +183,7 @@ pub fn config_callback(key: String) -> Result<Box<dyn core::any::Any>, String> {
         "network.upnp" => Ok(Box::new(false)),
         "network.natpmp" => Ok(Box::new(false)),
         "network.address_filter" => Ok(Box::new(true)),
+        "network.restricted_nat_retries" => Ok(Box::new(3u32)),
         "network.tls.certificate_path" => Ok(Box::new(get_certfile_path())),
         "network.tls.private_key_path" => Ok(Box::new(get_keyfile_path())),
         "network.tls.connection_initial_timeout" => Ok(Box::new(2_000_000u64)),
@@ -270,6 +271,7 @@ pub async fn test_config() {
     assert_eq!(inner.network.upnp, false);
     assert_eq!(inner.network.natpmp, false);
     assert_eq!(inner.network.address_filter, true);
+    assert_eq!(inner.network.restricted_nat_retries, 3u32);
     assert_eq!(inner.network.tls.certificate_path, get_certfile_path());
     assert_eq!(inner.network.tls.private_key_path, get_keyfile_path());
     assert_eq!(inner.network.tls.connection_initial_timeout, 2_000_000u64);

veilid-core/src/veilid_config.rs

@@ -128,6 +128,7 @@ pub struct VeilidConfigNetwork {
     pub upnp: bool,
     pub natpmp: bool,
     pub address_filter: bool,
+    pub restricted_nat_retries: u32,
     pub tls: VeilidConfigTLS,
     pub application: VeilidConfigApplication,
     pub protocol: VeilidConfigProtocol,
@@ -222,6 +223,7 @@ impl VeilidConfig {
             get_config!(inner.network.upnp);
             get_config!(inner.network.natpmp);
             get_config!(inner.network.address_filter);
+            get_config!(inner.network.restricted_nat_retries);
             get_config!(inner.network.tls.certificate_path);
             get_config!(inner.network.tls.private_key_path);
             get_config!(inner.network.tls.connection_initial_timeout);

veilid-server/src/settings.rs

@@ -63,6 +63,7 @@ core:
         upnp: false
         natpmp: false
         address_filter: true
+        restricted_nat_retries: 3
         tls:
             certificate_path: "/etc/veilid/server.crt"
             private_key_path: "/etc/veilid/private/server.key"
@@ -391,6 +392,7 @@ pub struct Network {
     pub upnp: bool,
     pub natpmp: bool,
     pub address_filter: bool,
+    pub restricted_nat_retries: u32,
     pub tls: TLS,
     pub application: Application,
     pub protocol: Protocol,
@@ -638,6 +640,9 @@ impl Settings {
                 "network.upnp" => Ok(Box::new(inner.core.network.upnp)),
                 "network.natpmp" => Ok(Box::new(inner.core.network.natpmp)),
                 "network.address_filter" => Ok(Box::new(inner.core.network.address_filter)),
+                "network.restricted_nat_retries" => {
+                    Ok(Box::new(inner.core.network.restricted_nat_retries))
+                }
                 "network.tls.certificate_path" => Ok(Box::new(
                     inner
                         .core
@@ -869,6 +874,7 @@ mod tests {
         assert_eq!(s.core.network.upnp, false);
         assert_eq!(s.core.network.natpmp, false);
         assert_eq!(s.core.network.address_filter, true);
+        assert_eq!(s.core.network.restricted_nat_retries, 3u32);
         //
         assert_eq!(
             s.core.network.tls.certificate_path,

veilid-wasm/src/js_veilid_core.rs

@@ -120,6 +120,7 @@ impl JsVeilidCore {
             "network.upnp" => Self::value_to_bool(val),
             "network.natpmp" => Self::value_to_bool(val),
             "network.address_filter" => Self::value_to_bool(val),
+            "network.restricted_nat_retries" => Self::value_to_u32(val),
             "network.tls.certificate_path" => Self::value_to_string(val),
             "network.tls.private_key_path" => Self::value_to_string(val),
             "network.application.path" => Self::value_to_string(val),

veilid-wasm/tests/web.rs

@@ -63,6 +63,7 @@ fn init_callbacks() {
             case "network.upnp": return false;
             case "network.natpmp": return false;
             case "network.address_filter": return true;
+            case "network.restricted_nat_retries": return 3;
             case "network.tls.certificate_path": return "";
             case "network.tls.private_key_path": return "";
             case "network.application.path": return "/app";