diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ad4b0c0..0989c397 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,11 +35,17 @@ jobs:
uses: Swatinem/rust-cache@v2
with:
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
- - name: Install protoc
- run: apt-get update && apt-get -y install protobuf-compiler
+ - name: Install dependencies
+ run: apt-get update && apt-get -y install protobuf-compiler libnftnl-dev libmnl-dev
- name: Check format
run: |
rustup component add rustfmt
cargo fmt -- --check
+ - name: Run clippy linter
+ run: |
+ rustup component add clippy
+ cargo clippy --all-targets --all-features -- -D warnings
+ - name: Run cargo deny
+ uses: EmbarkStudios/cargo-deny-action@v2
- name: Run tests
run: cargo test --locked --no-fail-fast
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 9035e420..6c8f9745 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -25,8 +25,8 @@ jobs:
- name: Install Rust toolchain
run: rustup update --no-self-update stable
- - name: Install protoc
- run: apt-get update && apt-get -y install protobuf-compiler
+ - name: Install dependencies
+ run: apt-get update && apt-get -y install protobuf-compiler libnftnl-dev libmnl-dev
- name: Build Docs
run: cargo doc --all --no-deps
diff --git a/Cargo.lock b/Cargo.lock
index 771103a1..f5684811 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -67,19 +67,20 @@ dependencies = [
[[package]]
name = "anstyle-wincon"
-version = "3.0.6"
+version = "3.0.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2109dbce0e72be3ec00bed26e6a7479ca384ad226efdd66db8fa2e3a38c83125"
+checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e"
dependencies = [
"anstyle",
+ "once_cell",
"windows-sys 0.59.0",
]
[[package]]
name = "anyhow"
-version = "1.0.95"
+version = "1.0.97"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04"
+checksum = "dcfed56ad506cb2c684a14971b8861fdc3baaaae314b9e5f9bb532cbe3ba7a4f"
[[package]]
name = "async-stream"
@@ -105,9 +106,9 @@ dependencies = [
[[package]]
name = "async-trait"
-version = "0.1.84"
+version = "0.1.88"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b1244b10dcd56c92219da4e14caa97e312079e185f04ba3eea25061561dc0a0"
+checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5"
dependencies = [
"proc-macro2",
"quote",
@@ -133,9 +134,36 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
dependencies = [
"async-trait",
- "axum-core",
+ "axum-core 0.4.5",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "itoa",
+ "matchit 0.7.3",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustversion",
+ "serde",
+ "sync_wrapper",
+ "tower 0.5.2",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de45108900e1f9b9242f7f2e254aa3e2c029c921c258fe9e6b4217eeebd54288"
+dependencies = [
+ "axum-core 0.5.2",
"axum-macros",
"bytes",
+ "form_urlencoded",
"futures-util",
"http",
"http-body",
@@ -143,7 +171,7 @@ dependencies = [
"hyper",
"hyper-util",
"itoa",
- "matchit",
+ "matchit 0.8.4",
"memchr",
"mime",
"percent-encoding",
@@ -179,14 +207,33 @@ dependencies = [
"sync_wrapper",
"tower-layer",
"tower-service",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68464cd0412f486726fb3373129ef5d2993f90c34bc2bc1c1e9943b2f4fc7ca6"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "rustversion",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
"tracing",
]
[[package]]
name = "axum-macros"
-version = "0.4.2"
+version = "0.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57d123550fa8d071b7255cb0cc04dc302baa6c8c4a79f55701552684d8399bce"
+checksum = "604fde5e028fea851ce1d8570bbdc034bec850d157f7569d10f347d06808c05c"
dependencies = [
"proc-macro2",
"quote",
@@ -216,9 +263,9 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
[[package]]
name = "bitflags"
-version = "2.6.0"
+version = "2.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
[[package]]
name = "byteorder"
@@ -228,15 +275,15 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
[[package]]
name = "bytes"
-version = "1.9.0"
+version = "1.10.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "325918d6fe32f23b19878fe4b34794ae41fc19ddbe53b10571a4874d44ffd39b"
+checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
[[package]]
name = "cc"
-version = "1.2.7"
+version = "1.2.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a012a0df96dd6d06ba9a1b29d6402d1a5d77c6befd2566afdc26e10603dc93d7"
+checksum = "525046617d8376e3db1deffb079e91cef90a89fc3ca5c185bbf8c9ecdd15cd5c"
dependencies = [
"jobserver",
"libc",
@@ -257,9 +304,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
[[package]]
name = "clap"
-version = "4.5.23"
+version = "4.5.35"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3135e7ec2ef7b10c6ed8950f0f792ed96ee093fa088608f1c76e569722700c84"
+checksum = "d8aa86934b44c19c50f87cc2790e19f54f7a67aedb64101c2e1a2e5ecfb73944"
dependencies = [
"clap_builder",
"clap_derive",
@@ -267,9 +314,9 @@ dependencies = [
[[package]]
name = "clap_builder"
-version = "4.5.23"
+version = "4.5.35"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30582fc632330df2bd26877bde0c1f4470d57c582bbc070376afcd04d8cb4838"
+checksum = "2414dbb2dd0695280da6ea9261e327479e9d37b0630f6b53ba2a11c60c679fd9"
dependencies = [
"anstream",
"anstyle",
@@ -279,9 +326,9 @@ dependencies = [
[[package]]
name = "clap_derive"
-version = "4.5.18"
+version = "4.5.32"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ac6a0c7b1a9e9a5186361f67dfa1b88213572f427fb9ab038efb2bd8c582dab"
+checksum = "09176aae279615badda0765c0c0b3f6ed53f4709118af73cf4655d85d1530cd7"
dependencies = [
"heck",
"proc-macro2",
@@ -319,9 +366,9 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
[[package]]
name = "cpufeatures"
-version = "0.2.16"
+version = "0.2.17"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16b80225097f2e5ae4e7179dd2266824648f3e2f49d9134d584b76389d31c4c3"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
dependencies = [
"libc",
]
@@ -363,9 +410,9 @@ dependencies = [
[[package]]
name = "darling"
-version = "0.20.10"
+version = "0.20.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f63b86c8a8826a49b8c21f08a2d07338eec8d900540f8630dc76284be802989"
+checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
dependencies = [
"darling_core",
"darling_macro",
@@ -373,9 +420,9 @@ dependencies = [
[[package]]
name = "darling_core"
-version = "0.20.10"
+version = "0.20.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95133861a8032aaea082871032f5815eb9e98cef03fa916ab4500513994df9e5"
+checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
dependencies = [
"fnv",
"ident_case",
@@ -387,9 +434,9 @@ dependencies = [
[[package]]
name = "darling_macro"
-version = "0.20.10"
+version = "0.20.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
+checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
dependencies = [
"darling_core",
"quote",
@@ -398,20 +445,23 @@ dependencies = [
[[package]]
name = "defguard-gateway"
-version = "1.2.1"
+version = "1.3.0"
dependencies = [
- "axum",
+ "axum 0.8.3",
"base64",
"clap",
"defguard_wireguard_rs",
"env_logger",
"gethostname",
+ "ipnetwork",
"log",
+ "mnl",
+ "nftnl",
"prost",
"prost-build",
"serde",
"syslog",
- "thiserror 2.0.9",
+ "thiserror 2.0.12",
"tokio",
"tokio-stream",
"toml",
@@ -423,8 +473,8 @@ dependencies = [
[[package]]
name = "defguard_wireguard_rs"
-version = "0.7.1"
-source = "git+https://github.com/DefGuard/wireguard-rs.git?rev=v0.7.1#c73ab15a5559ad2275d36469f8b7d00e942bba6c"
+version = "0.7.2"
+source = "git+https://github.com/DefGuard/wireguard-rs.git?rev=v0.7.2#6538ef726645604e7d466a4f7c5365a1b4629f86"
dependencies = [
"base64",
"libc",
@@ -437,15 +487,15 @@ dependencies = [
"netlink-sys",
"nix",
"serde",
- "thiserror 2.0.9",
+ "thiserror 2.0.12",
"x25519-dalek",
]
[[package]]
name = "deranged"
-version = "0.3.11"
+version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
dependencies = [
"powerfmt",
]
@@ -494,9 +544,9 @@ dependencies = [
[[package]]
name = "either"
-version = "1.13.0"
+version = "1.15.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
[[package]]
name = "env_filter"
@@ -510,28 +560,28 @@ dependencies = [
[[package]]
name = "env_logger"
-version = "0.11.6"
+version = "0.11.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcaee3d8e3cfc3fd92428d477bc97fc29ec8716d180c0d74c643bb26166660e0"
+checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
dependencies = [
"anstream",
"anstyle",
"env_filter",
- "humantime",
+ "jiff",
"log",
]
[[package]]
name = "equivalent"
-version = "1.0.1"
+version = "1.0.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
[[package]]
name = "errno"
-version = "0.3.10"
+version = "0.3.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33d852cb9b869c2a9b3df2f71a3074817f01e1844f839a144f5fcef059a4eb5d"
+checksum = "976dd42dc7e85965fe702eb8164f21f450704bdde31faefd6471dba214cb594e"
dependencies = [
"libc",
"windows-sys 0.59.0",
@@ -551,15 +601,15 @@ checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
[[package]]
name = "fixedbitset"
-version = "0.4.2"
+version = "0.5.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
[[package]]
name = "flate2"
-version = "1.0.35"
+version = "1.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c936bfdafb507ebbf50b8074c54fa31c5be9a1e7e5f467dd659697041407d07c"
+checksum = "7ced92e76e966ca2fd84c8f7aa01a4aea65b0eb6648d72f7c8f3e2764a67fece"
dependencies = [
"crc32fast",
"miniz_oxide",
@@ -621,9 +671,9 @@ dependencies = [
[[package]]
name = "gethostname"
-version = "0.5.0"
+version = "1.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc3655aa6818d65bc620d6911f05aa7b6aeb596291e1e9f79e52df85583d1e30"
+checksum = "ed7131e57abbde63513e0e6636f76668a1ca9798dcae2df4e283cae9ee83859e"
dependencies = [
"rustix",
"windows-targets",
@@ -637,7 +687,19 @@ checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
dependencies = [
"cfg-if",
"libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasi 0.14.2+wasi-0.2.4",
]
[[package]]
@@ -648,9 +710,9 @@ checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
[[package]]
name = "git2"
-version = "0.19.0"
+version = "0.20.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b903b73e45dc0c6c596f2d37eccece7c1c8bb6e4407b001096387c63d0d93724"
+checksum = "5220b8ba44c68a9a7f7a7659e864dd73692e417ef0211bea133c7b74e031eeb9"
dependencies = [
"bitflags",
"libc",
@@ -661,9 +723,9 @@ dependencies = [
[[package]]
name = "h2"
-version = "0.4.7"
+version = "0.4.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccae279728d634d083c00f6099cb58f01cc99c145b84b8be2f6c74618d79922e"
+checksum = "5017294ff4bb30944501348f6f8e42e6ad28f42c8bbef7a74029aff064a4e3c2"
dependencies = [
"atomic-waker",
"bytes",
@@ -671,7 +733,7 @@ dependencies = [
"futures-core",
"futures-sink",
"http",
- "indexmap 2.7.0",
+ "indexmap 2.9.0",
"slab",
"tokio",
"tokio-util",
@@ -698,20 +760,20 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
[[package]]
name = "hostname"
-version = "0.4.0"
+version = "0.4.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9c7c7c8ac16c798734b8a24560c1362120597c40d5e1459f09498f8f6c8f2ba"
+checksum = "a56f203cd1c76362b69e3863fd987520ac36cf70a8c92627449b2f64a8cf7d65"
dependencies = [
"cfg-if",
"libc",
- "windows",
+ "windows-link",
]
[[package]]
name = "http"
-version = "1.2.0"
+version = "1.3.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f16ca2af56261c99fba8bac40a10251ce8188205a4c448fbb745a2e4daa76fea"
+checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
dependencies = [
"bytes",
"fnv",
@@ -730,12 +792,12 @@ dependencies = [
[[package]]
name = "http-body-util"
-version = "0.1.2"
+version = "0.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
dependencies = [
"bytes",
- "futures-util",
+ "futures-core",
"http",
"http-body",
"pin-project-lite",
@@ -743,9 +805,9 @@ dependencies = [
[[package]]
name = "httparse"
-version = "1.9.5"
+version = "1.10.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d71d3574edd2771538b901e6549113b4006ece66150fb69c0fb6d9a2adae946"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
[[package]]
name = "httpdate"
@@ -753,17 +815,11 @@ version = "1.0.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-[[package]]
-name = "humantime"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
-
[[package]]
name = "hyper"
-version = "1.5.2"
+version = "1.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "256fb8d4bd6413123cc9d91832d78325c48ff41677595be797d90f42969beae0"
+checksum = "cc2b571658e38e0c01b1fdca3bbbe93c00d3d71693ff2770043f8c29bc7d6f80"
dependencies = [
"bytes",
"futures-channel",
@@ -795,9 +851,9 @@ dependencies = [
[[package]]
name = "hyper-util"
-version = "0.1.10"
+version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df2dcfbe0677734ab2f3ffa7fa7bfd4706bfdc1ef393f2ee30184aed67e631b4"
+checksum = "497bbc33a26fdd4af9ed9c70d63f61cf56a938375fbb32df34db9b1cd6d643f2"
dependencies = [
"bytes",
"futures-channel",
@@ -805,6 +861,7 @@ dependencies = [
"http",
"http-body",
"hyper",
+ "libc",
"pin-project-lite",
"socket2",
"tokio",
@@ -853,9 +910,9 @@ dependencies = [
[[package]]
name = "icu_locid_transform_data"
-version = "1.5.0"
+version = "1.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdc8ff3388f852bede6b579ad4e978ab004f139284d7b28715f773507b946f6e"
+checksum = "7515e6d781098bf9f7205ab3fc7e9709d34554ae0b21ddbcb5febfa4bc7df11d"
[[package]]
name = "icu_normalizer"
@@ -877,9 +934,9 @@ dependencies = [
[[package]]
name = "icu_normalizer_data"
-version = "1.5.0"
+version = "1.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8cafbf7aa791e9b22bec55a167906f9e1215fd475cd22adfcf660e03e989516"
+checksum = "c5e8338228bdc8ab83303f16b797e177953730f601a96c25d10cb3ab0daa0cb7"
[[package]]
name = "icu_properties"
@@ -898,9 +955,9 @@ dependencies = [
[[package]]
name = "icu_properties_data"
-version = "1.5.0"
+version = "1.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67a8effbc3dd3e4ba1afa8ad918d5684b8868b3b26500753effea8d2eed19569"
+checksum = "85fb8799753b75aee8d2a21d7c14d9f38921b54b3dbda10f5a3c7a7b82dba5e2"
[[package]]
name = "icu_provider"
@@ -969,14 +1026,20 @@ dependencies = [
[[package]]
name = "indexmap"
-version = "2.7.0"
+version = "2.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62f822373a4fe84d4bb149bf54e584a7f4abec90e072ed49cda0edea5b95471f"
+checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
dependencies = [
"equivalent",
"hashbrown 0.15.2",
]
+[[package]]
+name = "ipnetwork"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf370abdafd54d13e54a620e8c3e1145f28e46cc9d704bc6d94414559df41763"
+
[[package]]
name = "is_terminal_polyfill"
version = "1.70.1"
@@ -985,39 +1048,64 @@ checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
[[package]]
name = "itertools"
-version = "0.13.0"
+version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
dependencies = [
"either",
]
[[package]]
name = "itoa"
-version = "1.0.14"
+version = "1.0.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+
+[[package]]
+name = "jiff"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f33145a5cbea837164362c7bd596106eb7c5198f97d1ba6f6ebb3223952e488"
+dependencies = [
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43ce13c40ec6956157a3635d97a1ee2df323b263f09ea14165131289cb0f5c19"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
[[package]]
name = "jobserver"
-version = "0.1.32"
+version = "0.1.33"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48d1dbcbbeb6a7fec7e059840aa538bd62aaccf972c7346c4d9d2059312853d0"
+checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
dependencies = [
+ "getrandom 0.3.2",
"libc",
]
[[package]]
name = "libc"
-version = "0.2.169"
+version = "0.2.171"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
[[package]]
name = "libgit2-sys"
-version = "0.17.0+1.8.1"
+version = "0.18.1+1.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10472326a8a6477c3c20a64547b0059e4b0d086869eee31e6d7da728a8eb7224"
+checksum = "e1dcb20f84ffcdd825c7a311ae347cce604a6f084a767dec4a4929829645290e"
dependencies = [
"cc",
"libc",
@@ -1027,9 +1115,9 @@ dependencies = [
[[package]]
name = "libz-sys"
-version = "1.1.20"
+version = "1.1.22"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2d16453e800a8cf6dd2fc3eb4bc99b786a9b90c663b8559a5b1a041bf89e472"
+checksum = "8b70e7a7df205e92a1a4cd9aaae7898dac0aa555503cc0a649494d0d60e7651d"
dependencies = [
"cc",
"libc",
@@ -1039,21 +1127,21 @@ dependencies = [
[[package]]
name = "linux-raw-sys"
-version = "0.4.14"
+version = "0.9.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
+checksum = "fe7db12097d22ec582439daf8618b8fdd1a7bef6270e9af3b1ebcd30893cf413"
[[package]]
name = "litemap"
-version = "0.7.4"
+version = "0.7.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ee93343901ab17bd981295f2cf0026d4ad018c7c31ba84549a4ddbb47a45104"
+checksum = "23fb14cb19457329c82206317a5663005a4d404783dc74f4252769b0d5f42856"
[[package]]
name = "log"
-version = "0.4.22"
+version = "0.4.27"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
[[package]]
name = "matchit"
@@ -1061,6 +1149,12 @@ version = "0.7.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
[[package]]
name = "memchr"
version = "2.7.4"
@@ -1084,9 +1178,9 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
[[package]]
name = "miniz_oxide"
-version = "0.8.2"
+version = "0.8.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ffbe83022cedc1d264172192511ae958937694cd57ce297164951b8b3568394"
+checksum = "ff70ce3e48ae43fa075863cef62e8b43b71a4f2382229920e0df362592919430"
dependencies = [
"adler2",
]
@@ -1098,10 +1192,31 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
dependencies = [
"libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
"windows-sys 0.52.0",
]
+[[package]]
+name = "mnl"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1a5469630da93e1813bb257964c0ccee3b26b6879dd858039ddec35cc8681ed"
+dependencies = [
+ "libc",
+ "log",
+ "mnl-sys",
+]
+
+[[package]]
+name = "mnl-sys"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9750685b201e1ecfaaf7aa5d0387829170fa565989cc481b49080aa155f70457"
+dependencies = [
+ "libc",
+ "pkg-config",
+]
+
[[package]]
name = "multimap"
version = "0.10.0"
@@ -1133,9 +1248,9 @@ dependencies = [
[[package]]
name = "netlink-packet-route"
-version = "0.21.0"
+version = "0.22.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "483325d4bfef65699214858f097d504eb812c38ce7077d165f301ec406c3066e"
+checksum = "fc0e7987b28514adf555dc1f9a5c30dfc3e50750bbaffb1aec41ca7b23dcd8e4"
dependencies = [
"anyhow",
"bitflags",
@@ -1183,6 +1298,26 @@ dependencies = [
"log",
]
+[[package]]
+name = "nftnl"
+version = "0.7.0"
+source = "git+https://github.com/DefGuard/nftnl-rs.git?rev=1a1147271f43b9d7182a114bb056a5224c35d38f#1a1147271f43b9d7182a114bb056a5224c35d38f"
+dependencies = [
+ "bitflags",
+ "log",
+ "nftnl-sys",
+]
+
+[[package]]
+name = "nftnl-sys"
+version = "0.6.2"
+source = "git+https://github.com/DefGuard/nftnl-rs.git?rev=1a1147271f43b9d7182a114bb056a5224c35d38f#1a1147271f43b9d7182a114bb056a5224c35d38f"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "pkg-config",
+]
+
[[package]]
name = "nix"
version = "0.29.0"
@@ -1222,15 +1357,15 @@ dependencies = [
[[package]]
name = "once_cell"
-version = "1.20.2"
+version = "1.21.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
[[package]]
name = "openssl-probe"
-version = "0.1.5"
+version = "0.1.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
[[package]]
name = "paste"
@@ -1246,28 +1381,28 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
[[package]]
name = "petgraph"
-version = "0.6.5"
+version = "0.7.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
+checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772"
dependencies = [
"fixedbitset",
- "indexmap 2.7.0",
+ "indexmap 2.9.0",
]
[[package]]
name = "pin-project"
-version = "1.1.7"
+version = "1.1.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be57f64e946e500c8ee36ef6331845d40a93055567ec57e8fae13efd33759b95"
+checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
dependencies = [
"pin-project-internal",
]
[[package]]
name = "pin-project-internal"
-version = "1.1.7"
+version = "1.1.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c0f5fad0874fc7abcd4d750e76917eaebbecaa2c20bde22e1dbeeba8beb758c"
+checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
dependencies = [
"proc-macro2",
"quote",
@@ -1276,9 +1411,9 @@ dependencies = [
[[package]]
name = "pin-project-lite"
-version = "0.2.15"
+version = "0.2.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "915a1e146535de9163f3987b8944ed8cf49a18bb0056bcebcdcece385cece4ff"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
[[package]]
name = "pin-utils"
@@ -1288,9 +1423,24 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
[[package]]
name = "pkg-config"
-version = "0.3.31"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
+[[package]]
+name = "portable-atomic"
+version = "1.11.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
+checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8a2f0d8d040d7848a709caf78912debcc3f33ee4b3cac47d73d1e1069e83507"
+dependencies = [
+ "portable-atomic",
+]
[[package]]
name = "powerfmt"
@@ -1300,18 +1450,18 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
[[package]]
name = "ppv-lite86"
-version = "0.2.20"
+version = "0.2.21"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
dependencies = [
"zerocopy",
]
[[package]]
name = "prettyplease"
-version = "0.2.27"
+version = "0.2.32"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "483f8c21f64f3ea09fe0f30f5d48c3e8eefe5dac9129f0075f76593b4c1da705"
+checksum = "664ec5419c51e34154eec046ebcba56312d5a2fc3b09a06da188e1ad21afadf6"
dependencies = [
"proc-macro2",
"syn",
@@ -1319,18 +1469,18 @@ dependencies = [
[[package]]
name = "proc-macro2"
-version = "1.0.92"
+version = "1.0.94"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
+checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84"
dependencies = [
"unicode-ident",
]
[[package]]
name = "prost"
-version = "0.13.4"
+version = "0.13.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c0fef6c4230e4ccf618a35c59d7ede15dea37de8427500f50aff708806e42ec"
+checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
dependencies = [
"bytes",
"prost-derive",
@@ -1338,9 +1488,9 @@ dependencies = [
[[package]]
name = "prost-build"
-version = "0.13.4"
+version = "0.13.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0f3e5beed80eb580c68e2c600937ac2c4eedabdfd5ef1e5b7ea4f3fba84497b"
+checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
dependencies = [
"heck",
"itertools",
@@ -1358,9 +1508,9 @@ dependencies = [
[[package]]
name = "prost-derive"
-version = "0.13.4"
+version = "0.13.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "157c5a9d7ea5c2ed2d9fb8f495b64759f7816c7eaea54ba3978f0d63000162e3"
+checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
dependencies = [
"anyhow",
"itertools",
@@ -1371,22 +1521,28 @@ dependencies = [
[[package]]
name = "prost-types"
-version = "0.13.4"
+version = "0.13.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc2f1e56baa61e93533aebc21af4d2134b70f66275e0fcdf3cbe43d77ff7e8fc"
+checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
dependencies = [
"prost",
]
[[package]]
name = "quote"
-version = "1.0.38"
+version = "1.0.40"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
dependencies = [
"proc-macro2",
]
+[[package]]
+name = "r-efi"
+version = "5.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+
[[package]]
name = "rand"
version = "0.8.5"
@@ -1414,7 +1570,7 @@ version = "0.6.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
dependencies = [
- "getrandom",
+ "getrandom 0.2.15",
]
[[package]]
@@ -1448,15 +1604,14 @@ checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
[[package]]
name = "ring"
-version = "0.17.8"
+version = "0.17.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
dependencies = [
"cc",
"cfg-if",
- "getrandom",
+ "getrandom 0.2.15",
"libc",
- "spin",
"untrusted",
"windows-sys 0.52.0",
]
@@ -1478,9 +1633,9 @@ dependencies = [
[[package]]
name = "rustix"
-version = "0.38.42"
+version = "1.0.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f93dc38ecbab2eb790ff964bb77fa94faf256fd3e73285fd7ba0903b76bedb85"
+checksum = "d97817398dd4bb2e6da002002db259209759911da105da92bec29ccb12cf58bf"
dependencies = [
"bitflags",
"errno",
@@ -1491,9 +1646,9 @@ dependencies = [
[[package]]
name = "rustls"
-version = "0.23.20"
+version = "0.23.25"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5065c3f250cbd332cd894be57c40fa52387247659b14a2d6041d121547903b1b"
+checksum = "822ee9188ac4ec04a2f0531e55d035fb2de73f18b41a63c70c2712503b6fb13c"
dependencies = [
"log",
"once_cell",
@@ -1527,15 +1682,15 @@ dependencies = [
[[package]]
name = "rustls-pki-types"
-version = "1.10.1"
+version = "1.11.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2bf47e6ff922db3825eb750c4e2ff784c6ff8fb9e13046ef6a1d1c5401b0b37"
+checksum = "917ce264624a4b4db1c364dcc35bfca9ded014d0a958cd47ad3e960e988ea51c"
[[package]]
name = "rustls-webpki"
-version = "0.102.8"
+version = "0.103.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
+checksum = "fef8b8769aaccf73098557a87cd1816b4f9c7c16811c9c77142aa695c16f2c03"
dependencies = [
"ring",
"rustls-pki-types",
@@ -1544,15 +1699,15 @@ dependencies = [
[[package]]
name = "rustversion"
-version = "1.0.19"
+version = "1.0.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
+checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"
[[package]]
name = "ryu"
-version = "1.0.18"
+version = "1.0.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
[[package]]
name = "schannel"
@@ -1565,9 +1720,9 @@ dependencies = [
[[package]]
name = "security-framework"
-version = "3.1.0"
+version = "3.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81d3f8c9bfcc3cbb6b0179eb57042d75b1582bdc65c3cb95f3fa999509c03cbc"
+checksum = "271720403f46ca04f7ba6f55d438f8bd878d6b8ca0a1046e8228c4145bcbb316"
dependencies = [
"bitflags",
"core-foundation",
@@ -1578,9 +1733,9 @@ dependencies = [
[[package]]
name = "security-framework-sys"
-version = "2.13.0"
+version = "2.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1863fd3768cd83c56a7f60faa4dc0d403f1b6df0a38c3c25f44b7894e45370d5"
+checksum = "49db231d56a190491cb4aeda9527f1ad45345af50b0851622a7adb8c03b01c32"
dependencies = [
"core-foundation-sys",
"libc",
@@ -1588,24 +1743,24 @@ dependencies = [
[[package]]
name = "semver"
-version = "1.0.24"
+version = "1.0.26"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cb6eb87a131f756572d7fb904f6e7b68633f09cca868c5df1c4b8d1a694bbba"
+checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
[[package]]
name = "serde"
-version = "1.0.217"
+version = "1.0.219"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
dependencies = [
"serde_derive",
]
[[package]]
name = "serde_derive"
-version = "1.0.217"
+version = "1.0.219"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
dependencies = [
"proc-macro2",
"quote",
@@ -1614,9 +1769,9 @@ dependencies = [
[[package]]
name = "serde_json"
-version = "1.0.134"
+version = "1.0.140"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d00f4175c42ee48b15416f6193a959ba3a0d67fc699a0db9ad12df9f83991c7d"
+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
dependencies = [
"itoa",
"memchr",
@@ -1626,9 +1781,9 @@ dependencies = [
[[package]]
name = "serde_path_to_error"
-version = "0.1.16"
+version = "0.1.17"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af99884400da37c88f5e9146b7f1fd0fbcae8f6eec4e9da38b67d05486f814a6"
+checksum = "59fab13f937fa393d08645bf3a84bdfe86e296747b506ada67bb15f10f218b2a"
dependencies = [
"itoa",
"serde",
@@ -1672,26 +1827,20 @@ dependencies = [
[[package]]
name = "smallvec"
-version = "1.13.2"
+version = "1.15.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9"
[[package]]
name = "socket2"
-version = "0.5.8"
+version = "0.5.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c970269d99b64e60ec3bd6ad27270092a5394c4e309314b18ae3fe575695fbe8"
+checksum = "4f5fd57c80058a56cf5c777ab8a126398ece8e442983605d280a44ce79d0edef"
dependencies = [
"libc",
"windows-sys 0.52.0",
]
-[[package]]
-name = "spin"
-version = "0.9.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
-
[[package]]
name = "stable_deref_trait"
version = "1.2.0"
@@ -1712,9 +1861,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
[[package]]
name = "syn"
-version = "2.0.95"
+version = "2.0.100"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46f71c0377baf4ef1cc3e3402ded576dccc315800fbc62dfc7fe04b009773b4a"
+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
dependencies = [
"proc-macro2",
"quote",
@@ -1752,13 +1901,12 @@ dependencies = [
[[package]]
name = "tempfile"
-version = "3.15.0"
+version = "3.19.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8a559c81686f576e8cd0290cd2a24a2a9ad80c98b3478856500fcbd7acd704"
+checksum = "7437ac7763b9b123ccf33c338a5cc1bac6f69b45a136c19bdd8a65e3916435bf"
dependencies = [
- "cfg-if",
"fastrand",
- "getrandom",
+ "getrandom 0.3.2",
"once_cell",
"rustix",
"windows-sys 0.59.0",
@@ -1775,11 +1923,11 @@ dependencies = [
[[package]]
name = "thiserror"
-version = "2.0.9"
+version = "2.0.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f072643fd0190df67a8bab670c20ef5d8737177d6ac6b2e9a236cb096206b2cc"
+checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
dependencies = [
- "thiserror-impl 2.0.9",
+ "thiserror-impl 2.0.12",
]
[[package]]
@@ -1795,9 +1943,9 @@ dependencies = [
[[package]]
name = "thiserror-impl"
-version = "2.0.9"
+version = "2.0.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b50fa271071aae2e6ee85f842e2e28ba8cd2c5fb67f11fcb1fd70b276f9e7d4"
+checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
dependencies = [
"proc-macro2",
"quote",
@@ -1806,9 +1954,9 @@ dependencies = [
[[package]]
name = "time"
-version = "0.3.37"
+version = "0.3.41"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
+checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
dependencies = [
"deranged",
"itoa",
@@ -1823,15 +1971,15 @@ dependencies = [
[[package]]
name = "time-core"
-version = "0.1.2"
+version = "0.1.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
[[package]]
name = "time-macros"
-version = "0.2.19"
+version = "0.2.22"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de"
+checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
dependencies = [
"num-conv",
"time-core",
@@ -1849,9 +1997,9 @@ dependencies = [
[[package]]
name = "tokio"
-version = "1.42.0"
+version = "1.44.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cec9b21b0450273377fc97bd4c33a8acffc8c996c987a7c5b319a0083707551"
+checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48"
dependencies = [
"backtrace",
"bytes",
@@ -1865,9 +2013,9 @@ dependencies = [
[[package]]
name = "tokio-macros"
-version = "2.4.0"
+version = "2.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
+checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
dependencies = [
"proc-macro2",
"quote",
@@ -1876,9 +2024,9 @@ dependencies = [
[[package]]
name = "tokio-rustls"
-version = "0.26.1"
+version = "0.26.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f6d0975eaace0cf0fcadee4e4aaa5da15b5c079146f2cffb67c113be122bf37"
+checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
dependencies = [
"rustls",
"tokio",
@@ -1897,9 +2045,9 @@ dependencies = [
[[package]]
name = "tokio-util"
-version = "0.7.13"
+version = "0.7.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7fcaa8d55a2bdd6b83ace262b016eca0d79ee02818c5c1bcdf0305114081078"
+checksum = "6b9590b93e6fcc1739458317cccd391ad3955e2bde8913edf6f95f9e65a8f034"
dependencies = [
"bytes",
"futures-core",
@@ -1910,9 +2058,9 @@ dependencies = [
[[package]]
name = "toml"
-version = "0.8.19"
+version = "0.8.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1ed1f98e3fdc28d6d910e6737ae6ab1a93bf1985935a1193e68f93eeb68d24e"
+checksum = "cd87a5cdd6ffab733b2f74bc4fd7ee5fff6634124999ac278c35fc78c6120148"
dependencies = [
"serde",
"serde_spanned",
@@ -1931,11 +2079,11 @@ dependencies = [
[[package]]
name = "toml_edit"
-version = "0.22.22"
+version = "0.22.24"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ae48d6208a266e853d946088ed816055e556cc6028c5e8e2b84d9fa5dd7c7f5"
+checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474"
dependencies = [
- "indexmap 2.7.0",
+ "indexmap 2.9.0",
"serde",
"serde_spanned",
"toml_datetime",
@@ -1950,7 +2098,7 @@ checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
dependencies = [
"async-stream",
"async-trait",
- "axum",
+ "axum 0.7.9",
"base64",
"bytes",
"flate2",
@@ -2078,9 +2226,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
[[package]]
name = "unicode-ident"
-version = "1.0.14"
+version = "1.0.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
[[package]]
name = "untrusted"
@@ -2125,9 +2273,9 @@ checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
[[package]]
name = "vergen"
-version = "9.0.2"
+version = "9.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31f25fc8f8f05df455c7941e87f093ad22522a9ff33d7a027774815acf6f0639"
+checksum = "e0d2f179f8075b805a43a2a21728a46f0cc2921b3c58695b28fa8817e103cd9a"
dependencies = [
"anyhow",
"derive_builder",
@@ -2138,9 +2286,9 @@ dependencies = [
[[package]]
name = "vergen-git2"
-version = "1.0.2"
+version = "1.0.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e63e069d8749fead1e3bab7a9d79e8fb90516b2ec66fc2243a798ecdc1a31d7"
+checksum = "d86bae87104cb2790cdee615c2bb54729804d307191732ab27b1c5357ea6ddc5"
dependencies = [
"anyhow",
"derive_builder",
@@ -2153,9 +2301,9 @@ dependencies = [
[[package]]
name = "vergen-lib"
-version = "0.1.5"
+version = "0.1.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c767e6751c09fc85cde58722cf2f1007e80e4c8d5a4321fc90d83dc54ca147"
+checksum = "9b07e6010c0f3e59fcb164e0163834597da68d1f864e2b8ca49f74de01e9c166"
dependencies = [
"anyhow",
"derive_builder",
@@ -2178,23 +2326,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
[[package]]
-name = "windows"
-version = "0.52.0"
+name = "wasi"
+version = "0.14.2+wasi-0.2.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be"
+checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
dependencies = [
- "windows-core",
- "windows-targets",
+ "wit-bindgen-rt",
]
[[package]]
-name = "windows-core"
-version = "0.52.0"
+name = "windows-link"
+version = "0.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
-dependencies = [
- "windows-targets",
-]
+checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
[[package]]
name = "windows-sys"
@@ -2280,13 +2424,22 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
[[package]]
name = "winnow"
-version = "0.6.22"
+version = "0.7.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39281189af81c07ec09db316b302a3e67bf9bd7cbf6c820b50e35fee9c2fa980"
+checksum = "63d3fcd9bba44b03821e7d699eeee959f3126dcc4aa8e4ae18ec617c2a5cea10"
dependencies = [
"memchr",
]
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
+dependencies = [
+ "bitflags",
+]
+
[[package]]
name = "write16"
version = "1.0.0"
@@ -2337,19 +2490,18 @@ dependencies = [
[[package]]
name = "zerocopy"
-version = "0.7.35"
+version = "0.8.24"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+checksum = "2586fea28e186957ef732a5f8b3be2da217d65c5969d4b1e17f973ebbe876879"
dependencies = [
- "byteorder",
"zerocopy-derive",
]
[[package]]
name = "zerocopy-derive"
-version = "0.7.35"
+version = "0.8.24"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+checksum = "a996a8f63c5c4448cd959ac1bab0aaa3306ccfd060472f85943ee0750f0169be"
dependencies = [
"proc-macro2",
"quote",
@@ -2358,18 +2510,18 @@ dependencies = [
[[package]]
name = "zerofrom"
-version = "0.1.5"
+version = "0.1.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cff3ee08c995dee1859d998dea82f7374f2826091dd9cd47def953cae446cd2e"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
dependencies = [
"zerofrom-derive",
]
[[package]]
name = "zerofrom-derive"
-version = "0.1.5"
+version = "0.1.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "595eed982f7d355beb85837f651fa22e90b3c044842dc7f2c2842c086f295808"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
dependencies = [
"proc-macro2",
"quote",
diff --git a/Cargo.toml b/Cargo.toml
index af0c4cfc..9a74686d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,15 +1,16 @@
[package]
name = "defguard-gateway"
-version = "1.2.1"
+version = "1.3.0"
edition = "2021"
[dependencies]
-axum = { version = "0.7", features = ["macros"] }
+axum = { version = "0.8", features = ["macros"] }
base64 = "0.22"
clap = { version = "4.5", features = ["derive", "env"] }
-defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.7.1" }
+defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.7.2" }
env_logger = "0.11"
-gethostname = "0.5"
+gethostname = "1.0"
+ipnetwork = "0.21"
log = "0.4"
prost = "0.13"
serde = { version = "1.0", features = ["derive"] }
@@ -20,6 +21,10 @@ tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
tokio-stream = { version = "0.1", features = [] }
toml = { version = "0.8", default-features = false, features = ["parse"] }
+[target.'cfg(target_os = "linux")'.dependencies]
+nftnl = { git = "https://github.com/DefGuard/nftnl-rs.git", rev = "1a1147271f43b9d7182a114bb056a5224c35d38f" }
+mnl = "0.2"
+
[dev-dependencies]
tokio = { version = "1", features = ["io-std", "io-util"] }
x25519-dalek = { version = "2.0", features = ["getrandom", "static_secrets"] }
diff --git a/Cross.toml b/Cross.toml
index 6484d442..3b193b35 100644
--- a/Cross.toml
+++ b/Cross.toml
@@ -1,23 +1,39 @@
[target.x86_64-unknown-linux-gnu]
-pre-build = ["apt-get update && apt-get install --assume-yes unzip ",
-"PB_REL='https://github.com/protocolbuffers/protobuf/releases'",
-"PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip",
-"unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr"]
+image = "ghcr.io/defguard/cross:x86_64-unknown-linux-gnu"
+pre-build = [
+ "dpkg --add-architecture $CROSS_DEB_ARCH",
+ "apt-get update && apt-get install --assume-yes unzip libnftnl-dev:$CROSS_DEB_ARCH libmnl-dev:$CROSS_DEB_ARCH",
+ "PB_REL='https://github.com/protocolbuffers/protobuf/releases'",
+ "PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip",
+ "unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr",
+]
[target.armv7-unknown-linux-gnueabihf]
-pre-build = ["apt-get update && apt-get install --assume-yes unzip ",
-"PB_REL='https://github.com/protocolbuffers/protobuf/releases'",
-"PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip",
-"unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr"]
+image = "ghcr.io/defguard/cross:armv7-unknown-linux-gnueabihf"
+pre-build = [
+ "dpkg --add-architecture $CROSS_DEB_ARCH",
+ "apt-get update && apt-get install --assume-yes unzip libnftnl-dev:$CROSS_DEB_ARCH libmnl-dev:$CROSS_DEB_ARCH",
+ "PB_REL='https://github.com/protocolbuffers/protobuf/releases'",
+ "PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip",
+ "unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr",
+]
+
[target.aarch64-unknown-linux-gnu]
-pre-build = ["apt-get update && apt-get install --assume-yes unzip ",
-"PB_REL='https://github.com/protocolbuffers/protobuf/releases'",
-"PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip",
-"unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr"]
+image = "ghcr.io/defguard/cross:aarch64-unknown-linux-gnu"
+pre-build = [
+ "dpkg --add-architecture $CROSS_DEB_ARCH",
+ "apt-get update && apt-get install --assume-yes unzip libnftnl-dev libnftnl-dev:$CROSS_DEB_ARCH libmnl-dev libmnl-dev:$CROSS_DEB_ARCH",
+ "PB_REL='https://github.com/protocolbuffers/protobuf/releases'",
+ "PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip",
+ "unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr",
+]
[target.x86_64-unknown-freebsd]
-pre-build = ["apt-get update && apt-get install --assume-yes unzip ",
-"PB_REL='https://github.com/protocolbuffers/protobuf/releases'",
-"PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip",
-"unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr"]
+image = "ghcr.io/defguard/cross:x86_64-unknown-freebsd"
+pre-build = [
+ "apt-get update && apt-get install --assume-yes unzip",
+ "PB_REL='https://github.com/protocolbuffers/protobuf/releases'",
+ "PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip",
+ "unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr",
+]
diff --git a/Dockerfile b/Dockerfile
index 42cf61cb..16ba3ccb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,13 @@
FROM rust:1-slim as builder
-RUN apt-get update && apt-get -y install protobuf-compiler
+RUN apt-get update && apt-get -y install protobuf-compiler libnftnl-dev libmnl-dev
WORKDIR /app
COPY . .
RUN cargo build --release
FROM debian:bookworm-slim
RUN apt-get update && apt-get -y --no-install-recommends install \
- iproute2 wireguard-tools sudo ca-certificates iptables ebtables && \
+ iproute2 wireguard-tools sudo ca-certificates iptables ebtables nftables && \
apt-get clean && rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY --from=builder /app/target/release/defguard-gateway /usr/local/bin
diff --git a/LICENSE b/LICENSE
deleted file mode 100644
index 8ddd1409..00000000
--- a/LICENSE
+++ /dev/null
@@ -1,13 +0,0 @@
-Copyright 2023 teonite ventures sp. z o.o. (teonite)
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
diff --git a/LICENSE.md b/LICENSE.md
new file mode 100644
index 00000000..65be7750
--- /dev/null
+++ b/LICENSE.md
@@ -0,0 +1,666 @@
+# Dual license info
+The code in this repository is available under a dual licensing model:
+
+1. Open Source License: The code, except for the contents of the "src/enterprise" directory, is licensed under the AGPL license (this license). This applies to the open core components of the software.
+2. Enterprise License: All code in this repository (including within the "src/enterprise" directory) is licensed under a separate Enterprise License (see file src/enterprise/LICENSE.md).
+
+# GNU AFFERO GENERAL PUBLIC LICENSE
+
+Version 3, 19 November 2007
+
+Copyright (C) 2007 Free Software Foundation, Inc.
+
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+## Preamble
+
+The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works. By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains
+free software for all its users.
+
+When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate. Many developers of free software are heartened and
+encouraged by the resulting cooperation. However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community. It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server. Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals. This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing
+under this license.
+
+The precise terms and conditions for copying, distribution and
+modification follow.
+
+## TERMS AND CONDITIONS
+
+### 0. Definitions.
+
+"This License" refers to version 3 of the GNU Affero General Public
+License.
+
+"Copyright" also means copyright-like laws that apply to other kinds
+of works, such as semiconductor masks.
+
+"The Program" refers to any copyrightable work licensed under this
+License. Each licensee is addressed as "you". "Licensees" and
+"recipients" may be individuals or organizations.
+
+To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of
+an exact copy. The resulting work is called a "modified version" of
+the earlier work or a work "based on" the earlier work.
+
+A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user
+through a computer network, with no transfer of a copy, is not
+conveying.
+
+An interactive user interface displays "Appropriate Legal Notices" to
+the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License. If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+### 1. Source Code.
+
+The "source code" for a work means the preferred form of the work for
+making modifications to it. "Object code" means any non-source form of
+a work.
+
+A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form. A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities. However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users can
+regenerate automatically from other parts of the Corresponding Source.
+
+The Corresponding Source for a work in source code form is that same
+work.
+
+### 2. Basic Permissions.
+
+All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met. This License explicitly affirms your unlimited
+permission to run the unmodified Program. The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work. This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not convey,
+without conditions so long as your license otherwise remains in force.
+You may convey covered works to others for the sole purpose of having
+them make modifications exclusively for you, or provide you with
+facilities for running those works, provided that you comply with the
+terms of this License in conveying all material for which you do not
+control copyright. Those thus making or running the covered works for
+you must do so exclusively on your behalf, under your direction and
+control, on terms that prohibit them from making any copies of your
+copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under the
+conditions stated below. Sublicensing is not allowed; section 10 makes
+it unnecessary.
+
+### 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such
+circumvention is effected by exercising rights under this License with
+respect to the covered work, and you disclaim any intention to limit
+operation or modification of the work as a means of enforcing, against
+the work's users, your or third parties' legal rights to forbid
+circumvention of technological measures.
+
+### 4. Conveying Verbatim Copies.
+
+You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+### 5. Conveying Modified Source Versions.
+
+You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these
+conditions:
+
+- a) The work must carry prominent notices stating that you modified
+ it, and giving a relevant date.
+- b) The work must carry prominent notices stating that it is
+ released under this License and any conditions added under
+ section 7. This requirement modifies the requirement in section 4
+ to "keep intact all notices".
+- c) You must license the entire work, as a whole, under this
+ License to anyone who comes into possession of a copy. This
+ License will therefore apply, along with any applicable section 7
+ additional terms, to the whole of the work, and all its parts,
+ regardless of how they are packaged. This License gives no
+ permission to license the work in any other way, but it does not
+ invalidate such permission if you have separately received it.
+- d) If the work has interactive user interfaces, each must display
+ Appropriate Legal Notices; however, if the Program has interactive
+ interfaces that do not display Appropriate Legal Notices, your
+ work need not make them do so.
+
+A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+### 6. Conveying Non-Source Forms.
+
+You may convey a covered work in object code form under the terms of
+sections 4 and 5, provided that you also convey the machine-readable
+Corresponding Source under the terms of this License, in one of these
+ways:
+
+- a) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by the
+ Corresponding Source fixed on a durable physical medium
+ customarily used for software interchange.
+- b) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by a
+ written offer, valid for at least three years and valid for as
+ long as you offer spare parts or customer support for that product
+ model, to give anyone who possesses the object code either (1) a
+ copy of the Corresponding Source for all the software in the
+ product that is covered by this License, on a durable physical
+ medium customarily used for software interchange, for a price no
+ more than your reasonable cost of physically performing this
+ conveying of source, or (2) access to copy the Corresponding
+ Source from a network server at no charge.
+- c) Convey individual copies of the object code with a copy of the
+ written offer to provide the Corresponding Source. This
+ alternative is allowed only occasionally and noncommercially, and
+ only if you received the object code with such an offer, in accord
+ with subsection 6b.
+- d) Convey the object code by offering access from a designated
+ place (gratis or for a charge), and offer equivalent access to the
+ Corresponding Source in the same way through the same place at no
+ further charge. You need not require recipients to copy the
+ Corresponding Source along with the object code. If the place to
+ copy the object code is a network server, the Corresponding Source
+ may be on a different server (operated by you or a third party)
+ that supports equivalent copying facilities, provided you maintain
+ clear directions next to the object code saying where to find the
+ Corresponding Source. Regardless of what server hosts the
+ Corresponding Source, you remain obligated to ensure that it is
+ available for as long as needed to satisfy these requirements.
+- e) Convey the object code using peer-to-peer transmission,
+ provided you inform other peers where the object code and
+ Corresponding Source of the work are being offered to the general
+ public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal,
+family, or household purposes, or (2) anything designed or sold for
+incorporation into a dwelling. In determining whether a product is a
+consumer product, doubtful cases shall be resolved in favor of
+coverage. For a particular product received by a particular user,
+"normally used" refers to a typical or common use of that class of
+product, regardless of the status of the particular user or of the way
+in which the particular user actually uses, or expects or is expected
+to use, the product. A product is a consumer product regardless of
+whether the product has substantial commercial, industrial or
+non-consumer uses, unless such uses represent the only significant
+mode of use of the product.
+
+"Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to
+install and execute modified versions of a covered work in that User
+Product from a modified version of its Corresponding Source. The
+information must suffice to ensure that the continued functioning of
+the modified object code is in no case prevented or interfered with
+solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information. But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or
+updates for a work that has been modified or installed by the
+recipient, or for the User Product in which it has been modified or
+installed. Access to a network may be denied when the modification
+itself materially and adversely affects the operation of the network
+or violates the rules and protocols for communication across the
+network.
+
+Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+### 7. Additional Terms.
+
+"Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law. If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it. (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.) You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders
+of that material) supplement the terms of this License with terms:
+
+- a) Disclaiming warranty or limiting liability differently from the
+ terms of sections 15 and 16 of this License; or
+- b) Requiring preservation of specified reasonable legal notices or
+ author attributions in that material or in the Appropriate Legal
+ Notices displayed by works containing it; or
+- c) Prohibiting misrepresentation of the origin of that material,
+ or requiring that modified versions of such material be marked in
+ reasonable ways as different from the original version; or
+- d) Limiting the use for publicity purposes of names of licensors
+ or authors of the material; or
+- e) Declining to grant rights under trademark law for use of some
+ trade names, trademarks, or service marks; or
+- f) Requiring indemnification of licensors and authors of that
+ material by anyone who conveys the material (or modified versions
+ of it) with contractual assumptions of liability to the recipient,
+ for any liability that these contractual assumptions directly
+ impose on those licensors and authors.
+
+All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10. If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term. If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions; the
+above requirements apply either way.
+
+### 8. Termination.
+
+You may not propagate or modify a covered work except as expressly
+provided under this License. Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+However, if you cease all violation of this License, then your license
+from a particular copyright holder is reinstated (a) provisionally,
+unless and until the copyright holder explicitly and finally
+terminates your license, and (b) permanently, if the copyright holder
+fails to notify you of the violation by some reasonable means prior to
+60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License. If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+### 9. Acceptance Not Required for Having Copies.
+
+You are not required to accept this License in order to receive or run
+a copy of the Program. Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance. However,
+nothing other than this License grants you permission to propagate or
+modify any covered work. These actions infringe copyright if you do
+not accept this License. Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+### 10. Automatic Licensing of Downstream Recipients.
+
+Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License. You are not responsible
+for enforcing compliance by third parties with this License.
+
+An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations. If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License. For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+### 11. Patents.
+
+A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The
+work thus licensed is called the contributor's "contributor version".
+
+A contributor's "essential patent claims" are all patent claims owned
+or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version. For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement). To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+A patent license is "discriminatory" if it does not include within the
+scope of its coverage, prohibits the exercise of, or is conditioned on
+the non-exercise of one or more of the rights that are specifically
+granted under this License. You may not convey a covered work if you
+are a party to an arrangement with a third party that is in the
+business of distributing software, under which you make payment to the
+third party based on the extent of your activity of conveying the
+work, and under which the third party grants, to any of the parties
+who would receive the covered work from you, a discriminatory patent
+license (a) in connection with copies of the covered work conveyed by
+you (or copies made from those copies), or (b) primarily for and in
+connection with specific products or compilations that contain the
+covered work, unless you entered into that arrangement, or that patent
+license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+### 12. No Surrender of Others' Freedom.
+
+If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under
+this License and any other pertinent obligations, then as a
+consequence you may not convey it at all. For example, if you agree to
+terms that obligate you to collect a royalty for further conveying
+from those to whom you convey the Program, the only way you could
+satisfy both those terms and this License would be to refrain entirely
+from conveying the Program.
+
+### 13. Remote Network Interaction; Use with the GNU General Public License.
+
+Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your
+version supports such interaction) an opportunity to receive the
+Corresponding Source of your version by providing access to the
+Corresponding Source from a network server at no charge, through some
+standard or customary means of facilitating copying of software. This
+Corresponding Source shall include the Corresponding Source for any
+work covered by version 3 of the GNU General Public License that is
+incorporated pursuant to the following paragraph.
+
+Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work. The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+### 14. Revised Versions of this License.
+
+The Free Software Foundation may publish revised and/or new versions
+of the GNU Affero General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program
+specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation. If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever
+published by the Free Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions
+of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+Later license versions may give you additional or different
+permissions. However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+### 15. Disclaimer of Warranty.
+
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT
+WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND
+PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE
+DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR
+CORRECTION.
+
+### 16. Limitation of Liability.
+
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR
+CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES
+ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT
+NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR
+LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM
+TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER
+PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+### 17. Interpretation of Sections 15 and 16.
+
+If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+END OF TERMS AND CONDITIONS
+
+## How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these
+terms.
+
+To do so, attach the following notices to the program. It is safest to
+attach them to the start of each source file to most effectively state
+the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+
+ Copyright (C)
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as
+ published by the Free Software Foundation, either version 3 of the
+ License, or (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program. If not, see .
+
+Also add information on how to contact you by electronic and paper
+mail.
+
+If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source. For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code. There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for
+the specific requirements.
+
+You should also get your employer (if you work as a programmer) or
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary. For more information on this, and how to apply and follow
+the GNU AGPL, see .
diff --git a/build.rs b/build.rs
index 2c920323..744ed848 100644
--- a/build.rs
+++ b/build.rs
@@ -11,8 +11,12 @@ fn main() -> Result<(), Box> {
config.protoc_arg("--experimental_allow_proto3_optional");
tonic_build::configure().compile_protos_with_config(
config,
- &["proto/wireguard/gateway.proto"],
- &["proto/wireguard"],
+ &[
+ "proto/wireguard/gateway.proto",
+ "proto/enterprise/firewall/firewall.proto",
+ ],
+ &["proto/wireguard", "proto/enterprise/firewall"],
)?;
+ println!("cargo:rerun-if-changed=proto");
Ok(())
}
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 00000000..9305cfe7
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,238 @@
+# This template contains all of the possible sections and their default values
+
+# Note that all fields that take a lint level have these possible values:
+# * deny - An error will be produced and the check will fail
+# * warn - A warning will be produced, but the check will not fail
+# * allow - No warning or error will be produced, though in some cases a note
+# will be
+
+# The values provided in this template are the default values that will be used
+# when any section or field is not specified in your own configuration
+
+# Root options
+
+# The graph table configures how the dependency graph is constructed and thus
+# which crates the checks are performed against
+[graph]
+# If 1 or more target triples (and optionally, target_features) are specified,
+# only the specified targets will be checked when running `cargo deny check`.
+# This means, if a particular package is only ever used as a target specific
+# dependency, such as, for example, the `nix` crate only being used via the
+# `target_family = "unix"` configuration, that only having windows targets in
+# this list would mean the nix crate, as well as any of its exclusive
+# dependencies not shared by any other crates, would be ignored, as the target
+# list here is effectively saying which targets you are building for.
+targets = [
+ # The triple can be any string, but only the target triples built in to
+ # rustc (as of 1.40) can be checked against actual config expressions
+ #"x86_64-unknown-linux-musl",
+ # You can also specify which target_features you promise are enabled for a
+ # particular target. target_features are currently not validated against
+ # the actual valid features supported by the target architecture.
+ #{ triple = "wasm32-unknown-unknown", features = ["atomics"] },
+]
+# When creating the dependency graph used as the source of truth when checks are
+# executed, this field can be used to prune crates from the graph, removing them
+# from the view of cargo-deny. This is an extremely heavy hammer, as if a crate
+# is pruned from the graph, all of its dependencies will also be pruned unless
+# they are connected to another crate in the graph that hasn't been pruned,
+# so it should be used with care. The identifiers are [Package ID Specifications]
+# (https://doc.rust-lang.org/cargo/reference/pkgid-spec.html)
+#exclude = []
+# If true, metadata will be collected with `--all-features`. Note that this can't
+# be toggled off if true, if you want to conditionally enable `--all-features` it
+# is recommended to pass `--all-features` on the cmd line instead
+all-features = false
+# If true, metadata will be collected with `--no-default-features`. The same
+# caveat with `all-features` applies
+no-default-features = false
+# If set, these feature will be enabled when collecting metadata. If `--features`
+# is specified on the cmd line they will take precedence over this option.
+#features = []
+
+# The output table provides options for how/if diagnostics are outputted
+[output]
+# When outputting inclusion graphs in diagnostics that include features, this
+# option can be used to specify the depth at which feature edges will be added.
+# This option is included since the graphs can be quite large and the addition
+# of features from the crate(s) to all of the graph roots can be far too verbose.
+# This option can be overridden via `--feature-depth` on the cmd line
+feature-depth = 1
+
+# This section is considered when running `cargo deny check advisories`
+# More documentation for the advisories section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
+[advisories]
+# The path where the advisory databases are cloned/fetched into
+#db-path = "$CARGO_HOME/advisory-dbs"
+# The url(s) of the advisory databases to use
+#db-urls = ["https://github.com/rustsec/advisory-db"]
+# A list of advisory IDs to ignore. Note that ignored advisories will still
+# output a note when they are encountered.
+ignore = [
+ { id = "RUSTSEC-2024-0436", reason = "Unmaintained" },
+]
+# If this is true, then cargo deny will use the git executable to fetch advisory database.
+# If this is false, then it uses a built-in git library.
+# Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support.
+# See Git Authentication for more information about setting up git authentication.
+#git-fetch-with-cli = true
+
+# This section is considered when running `cargo deny check licenses`
+# More documentation for the licenses section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
+[licenses]
+# List of explicitly allowed licenses
+# See https://spdx.org/licenses/ for list of possible licenses
+# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
+allow = [
+ "MIT",
+ "Apache-2.0",
+ "BSD-3-Clause",
+ "Unicode-3.0",
+ "Zlib",
+ "ISC",
+ "BSL-1.0",
+ "0BSD",
+ "AGPL-3.0",
+]
+# The confidence threshold for detecting a license from license text.
+# The higher the value, the more closely the license text must be to the
+# canonical license text of a valid SPDX license file.
+# [possible values: any between 0.0 and 1.0].
+confidence-threshold = 0.8
+# Allow 1 or more licenses on a per-crate basis, so that particular licenses
+# aren't accepted for every possible crate as with the normal allow list
+exceptions = [
+ # Each entry is the crate and version constraint, and its specific allow
+ # list
+ #{ allow = ["Zlib"], crate = "adler32" },
+]
+
+# Some crates don't have (easily) machine readable licensing information,
+# adding a clarification entry for it allows you to manually specify the
+# licensing information
+#[[licenses.clarify]]
+# The package spec the clarification applies to
+#crate = "ring"
+# The SPDX expression for the license requirements of the crate
+#expression = "MIT AND ISC AND OpenSSL"
+# One or more files in the crate's source used as the "source of truth" for
+# the license expression. If the contents match, the clarification will be used
+# when running the license check, otherwise the clarification will be ignored
+# and the crate will be checked normally, which may produce warnings or errors
+# depending on the rest of your configuration
+#license-files = [
+# Each entry is a crate relative path, and the (opaque) hash of its contents
+#{ path = "LICENSE", hash = 0xbd0eed23 }
+#]
+
+[licenses.private]
+# If true, ignores workspace crates that aren't published, or are only
+# published to private registries.
+# To see how to mark a crate as unpublished (to the official registry),
+# visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field.
+ignore = false
+# One or more private registries that you might publish crates to, if a crate
+# is only published to private registries, and ignore is true, the crate will
+# not have its license(s) checked
+registries = [
+ #"https://sekretz.com/registry
+]
+
+# This section is considered when running `cargo deny check bans`.
+# More documentation about the 'bans' section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
+[bans]
+# Lint level for when multiple versions of the same crate are detected
+multiple-versions = "warn"
+# Lint level for when a crate version requirement is `*`
+wildcards = "allow"
+# The graph highlighting used when creating dotgraphs for crates
+# with multiple versions
+# * lowest-version - The path to the lowest versioned duplicate is highlighted
+# * simplest-path - The path to the version with the fewest edges is highlighted
+# * all - Both lowest-version and simplest-path are used
+highlight = "all"
+# The default lint level for `default` features for crates that are members of
+# the workspace that is being checked. This can be overridden by allowing/denying
+# `default` on a crate-by-crate basis if desired.
+workspace-default-features = "allow"
+# The default lint level for `default` features for external crates that are not
+# members of the workspace. This can be overridden by allowing/denying `default`
+# on a crate-by-crate basis if desired.
+external-default-features = "allow"
+# List of crates that are allowed. Use with care!
+allow = [
+ #"ansi_term@0.11.0",
+ #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is allowed" },
+]
+# List of crates to deny
+deny = [
+ #"ansi_term@0.11.0",
+ #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is banned" },
+ # Wrapper crates can optionally be specified to allow the crate when it
+ # is a direct dependency of the otherwise banned crate
+ #{ crate = "ansi_term@0.11.0", wrappers = ["this-crate-directly-depends-on-ansi_term"] },
+]
+
+# List of features to allow/deny
+# Each entry the name of a crate and a version range. If version is
+# not specified, all versions will be matched.
+#[[bans.features]]
+#crate = "reqwest"
+# Features to not allow
+#deny = ["json"]
+# Features to allow
+#allow = [
+# "rustls",
+# "__rustls",
+# "__tls",
+# "hyper-rustls",
+# "rustls",
+# "rustls-pemfile",
+# "rustls-tls-webpki-roots",
+# "tokio-rustls",
+# "webpki-roots",
+#]
+# If true, the allowed features must exactly match the enabled feature set. If
+# this is set there is no point setting `deny`
+#exact = true
+
+# Certain crates/versions that will be skipped when doing duplicate detection.
+skip = [
+ #"ansi_term@0.11.0",
+ #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason why it can't be updated/removed" },
+]
+# Similarly to `skip` allows you to skip certain crates during duplicate
+# detection. Unlike skip, it also includes the entire tree of transitive
+# dependencies starting at the specified crate, up to a certain depth, which is
+# by default infinite.
+skip-tree = [
+ #"ansi_term@0.11.0", # will be skipped along with _all_ of its direct and transitive dependencies
+ #{ crate = "ansi_term@0.11.0", depth = 20 },
+]
+
+# This section is considered when running `cargo deny check sources`.
+# More documentation about the 'sources' section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
+[sources]
+# Lint level for what to happen when a crate from a crate registry that is not
+# in the allow list is encountered
+unknown-registry = "warn"
+# Lint level for what to happen when a crate from a git repository that is not
+# in the allow list is encountered
+unknown-git = "warn"
+# List of URLs for allowed crate registries. Defaults to the crates.io index
+# if not specified. If it is specified but empty, no registries are allowed.
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+# List of URLs for allowed Git repositories
+allow-git = []
+
+[sources.allow-org]
+# github.com organizations to allow git sources for
+github = []
+# gitlab.com organizations to allow git sources for
+gitlab = []
+# bitbucket.org organizations to allow git sources for
+bitbucket = []
diff --git a/example-config.toml b/example-config.toml
index 8653c271..052bbe85 100644
--- a/example-config.toml
+++ b/example-config.toml
@@ -50,3 +50,9 @@ syslog_socket = "/var/run/log"
# 200 - Gateway is working and is connected to CORE
# 503 - gateway works but is not connected to CORE
#health_port = 55003
+
+# Optional: Enable automatic masquerading of traffic by the firewall
+#masquerade = true
+
+# Optional: Set the priority of the Defguard forward chain
+#fw_priority = 0
diff --git a/examples/server.rs b/examples/server.rs
index fb057ab7..c7250581 100644
--- a/examples/server.rs
+++ b/examples/server.rs
@@ -27,7 +27,7 @@ pub struct HostConfig {
host: Host,
}
-type ClientMap = HashMap>>;
+type ClientMap = HashMap>>;
struct GatewayServer {
config_rx: Receiver,
@@ -42,12 +42,12 @@ impl GatewayServer {
tokio::spawn(async move {
while task_config_rx.changed().await.is_ok() {
let config = (&*task_config_rx.borrow()).into();
- let update = proto::Update {
- update_type: proto::UpdateType::Modify as i32,
- update: Some(proto::update::Update::Network(config)),
+ let update = proto::gateway::Update {
+ update_type: proto::gateway::UpdateType::Modify as i32,
+ update: Some(proto::gateway::update::Update::Network(config)),
};
task_clients.lock().unwrap().retain(
- move |_addr, tx: &mut UnboundedSender>| {
+ move |_addr, tx: &mut UnboundedSender>| {
tx.send(Ok(update.clone())).is_ok()
},
);
@@ -58,7 +58,7 @@ impl GatewayServer {
}
}
-impl From<&HostConfig> for proto::Configuration {
+impl From<&HostConfig> for proto::gateway::Configuration {
fn from(host_config: &HostConfig) -> Self {
Self {
name: host_config.name.clone(),
@@ -80,18 +80,19 @@ impl From<&HostConfig> for proto::Configuration {
.values()
.map(|peer| peer.into())
.collect(),
+ firewall_config: None,
}
}
}
#[tonic::async_trait]
-impl proto::gateway_service_server::GatewayService for GatewayServer {
- type UpdatesStream = UnboundedReceiverStream>;
+impl proto::gateway::gateway_service_server::GatewayService for GatewayServer {
+ type UpdatesStream = UnboundedReceiverStream>;
async fn config(
&self,
- request: Request,
- ) -> Result, Status> {
+ request: Request,
+ ) -> Result, Status> {
let address = request.remote_addr().unwrap();
eprintln!("CONFIG connected from: {address}");
Ok(Response::new((&*self.config_rx.borrow()).into()))
@@ -99,7 +100,7 @@ impl proto::gateway_service_server::GatewayService for GatewayServer {
async fn stats(
&self,
- request: Request>,
+ request: Request>,
) -> Result, Status> {
let address = request.remote_addr().unwrap();
eprintln!("STATS connected from: {address}");
@@ -143,7 +144,7 @@ pub async fn cli(tx: Sender, clients: Arc>) {
match keyword {
"a" | "addr" => {
let mut addresses = Vec::new();
- while let Some(address) = token_iter.next() {
+ for address in token_iter.by_ref() {
match address.parse() {
Ok(ipaddr) => addresses.push(ipaddr),
Err(err) => eprintln!("Skipping {address}: {err}"),
@@ -158,12 +159,15 @@ pub async fn cli(tx: Sender, clients: Arc>) {
if let Ok(key) = Key::try_from(key) {
let peer = Peer::new(key.clone());
- let update = proto::Update {
- update_type: proto::UpdateType::Create as i32,
- update: Some(proto::update::Update::Peer((&peer).into())),
+ let update = proto::gateway::Update {
+ update_type: proto::gateway::UpdateType::Create as i32,
+ update: Some(proto::gateway::update::Update::Peer((&peer).into())),
};
clients.lock().unwrap().retain(
- move |addr, tx: &mut UnboundedSender>| {
+ move |addr,
+ tx: &mut UnboundedSender<
+ Result,
+ >| {
eprintln!("Sending peer update to {addr}");
tx.send(Ok(update.clone())).is_ok()
},
@@ -184,12 +188,15 @@ pub async fn cli(tx: Sender, clients: Arc>) {
if let Ok(key) = Key::try_from(key) {
let peer = Peer::new(key);
- let update = proto::Update {
- update_type: proto::UpdateType::Delete as i32,
- update: Some(proto::update::Update::Peer((&peer).into())),
+ let update = proto::gateway::Update {
+ update_type: proto::gateway::UpdateType::Delete as i32,
+ update: Some(proto::gateway::update::Update::Peer((&peer).into())),
};
clients.lock().unwrap().retain(
- move |addr, tx: &mut UnboundedSender>| {
+ move |addr,
+ tx: &mut UnboundedSender<
+ Result,
+ >| {
eprintln!("Sending peer update to {addr}");
tx.send(Ok(update.clone())).is_ok()
},
@@ -234,7 +241,7 @@ pub async fn grpc(
config_rx: Receiver,
clients: Arc>,
) -> Result<(), tonic::transport::Error> {
- let gateway_service = proto::gateway_service_server::GatewayServiceServer::new(
+ let gateway_service = proto::gateway::gateway_service_server::GatewayServiceServer::new(
GatewayServer::new(config_rx, clients),
);
let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), 50055); // TODO: port as an option
diff --git a/flake.lock b/flake.lock
index 3e3538f3..abd9d138 100644
--- a/flake.lock
+++ b/flake.lock
@@ -5,11 +5,11 @@
"systems": "systems"
},
"locked": {
- "lastModified": 1726560853,
- "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+ "lastModified": 1731533236,
+ "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
- "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+ "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
@@ -20,11 +20,11 @@
},
"nixpkgs": {
"locked": {
- "lastModified": 1731139594,
- "narHash": "sha256-IigrKK3vYRpUu+HEjPL/phrfh7Ox881er1UEsZvw9Q4=",
+ "lastModified": 1743315132,
+ "narHash": "sha256-6hl6L/tRnwubHcA4pfUUtk542wn2Om+D4UnDhlDW9BE=",
"owner": "NixOS",
"repo": "nixpkgs",
- "rev": "76612b17c0ce71689921ca12d9ffdc9c23ce40b2",
+ "rev": "52faf482a3889b7619003c0daec593a1912fddc1",
"type": "github"
},
"original": {
@@ -48,11 +48,11 @@
]
},
"locked": {
- "lastModified": 1731464916,
- "narHash": "sha256-WZ5rpjr/wCt7yBOUsvDE2i22hYz9g8W921jlwVktRQ4=",
+ "lastModified": 1743475035,
+ "narHash": "sha256-uLjVsb4Rxnp1zmFdPCDmdODd4RY6ETOeRj0IkC0ij/4=",
"owner": "oxalica",
"repo": "rust-overlay",
- "rev": "2c19bad6e881b5a154cafb7f9106879b5b356d1f",
+ "rev": "bee11c51c2cda3ac57c9e0149d94b86cc1b00d13",
"type": "github"
},
"original": {
diff --git a/flake.nix b/flake.nix
index 22fad37d..08e0ab97 100644
--- a/flake.nix
+++ b/flake.nix
@@ -34,6 +34,8 @@
protobuf
sqlx-cli
rustToolchain
+ libnftnl
+ libmnl
];
};
});
diff --git a/proto b/proto
index 6197e062..289f58ef 160000
--- a/proto
+++ b/proto
@@ -1 +1 @@
-Subproject commit 6197e0622fe6118bb680810d5dc75ecb289d2d72
+Subproject commit 289f58ef42617bfbdd75d98a62ac9aec2ab8d1d6
diff --git a/src/config.rs b/src/config.rs
index 16037880..619a58e1 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -90,6 +90,15 @@ pub struct Config {
/// 503 - gateway works but is not connected to CORE
#[arg(long, env = "HEALTH_PORT")]
pub health_port: Option,
+
+ /// Whether the firewall should automatically apply masquerading
+ #[arg(long, env = "DEFGUARD_MASQUERADE")]
+ #[serde(default)]
+ pub masquerade: bool,
+
+ #[arg(long, env = "DEFGUARD_FW_PRIORITY")]
+ #[serde(default)]
+ pub fw_priority: Option,
}
impl Default for Config {
@@ -112,6 +121,8 @@ impl Default for Config {
pre_down: None,
post_down: None,
health_port: None,
+ masquerade: false,
+ fw_priority: None,
}
}
}
diff --git a/src/enterprise/LICENSE.md b/src/enterprise/LICENSE.md
new file mode 100644
index 00000000..7a386fef
--- /dev/null
+++ b/src/enterprise/LICENSE.md
@@ -0,0 +1,16 @@
+Copyright 2024 teonite ventures sp. z o. o.
+
+defguard enterprise license / defguard.net
+
+Use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Use is permitted for the purposes of the Licensee that paid for the relevant license only (no redistributions or products based on that).
+
+2. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote the Licensee when using the product without specific prior written permission.
+
+3. The Licensee may use the software in accordance with the terms and conditions of this license after paying the license fee to the Licensor, in accordance with the currently available price list on the defguard.net website, for the time period defined in the license. The Licensee is not permitted to resell, sublicense, or create derivative products based on the software. The Licensor may secure the ability to use the software with a license key or other technical protection.
+
+5. You may not move, change, disable, or circumvent the license key functionality in the software, and you may not remove or obscure any functionality in the software that is protected by the license key.
+
+6. The licensor can provide support for the use of the software. The current terms in this respect are on the website defguard.net
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/src/enterprise/firewall/api.rs b/src/enterprise/firewall/api.rs
new file mode 100644
index 00000000..1950ea7e
--- /dev/null
+++ b/src/enterprise/firewall/api.rs
@@ -0,0 +1,39 @@
+#[cfg(target_os = "linux")]
+use nftnl::Batch;
+
+use super::{FirewallError, FirewallRule, Policy};
+
+pub struct FirewallApi {
+ pub ifname: String,
+ #[cfg(target_os = "linux")]
+ #[allow(dead_code)]
+ pub(crate) batch: Option,
+}
+
+impl FirewallApi {
+ #[must_use]
+ pub fn new(ifname: &str) -> Self {
+ Self {
+ ifname: ifname.into(),
+ #[cfg(target_os = "linux")]
+ batch: None,
+ }
+ }
+}
+
+pub trait FirewallManagementApi {
+ /// Sets up the firewall with the default policy and cleans up any existing rules
+ fn setup(
+ &mut self,
+ default_policy: Option,
+ priority: Option,
+ ) -> Result<(), FirewallError>;
+ fn cleanup(&mut self) -> Result<(), FirewallError>;
+ fn add_rule(&mut self, rule: FirewallRule) -> Result<(), FirewallError>;
+ fn add_rules(&mut self, rules: Vec) -> Result<(), FirewallError>;
+ fn set_firewall_default_policy(&mut self, policy: Policy) -> Result<(), FirewallError>;
+ fn set_masquerade_status(&mut self, enabled: bool) -> Result<(), FirewallError>;
+ fn begin(&mut self) -> Result<(), FirewallError>;
+ fn commit(&mut self) -> Result<(), FirewallError>;
+ fn rollback(&mut self);
+}
diff --git a/src/enterprise/firewall/dummy/mod.rs b/src/enterprise/firewall/dummy/mod.rs
new file mode 100644
index 00000000..e09b3919
--- /dev/null
+++ b/src/enterprise/firewall/dummy/mod.rs
@@ -0,0 +1,53 @@
+use super::{
+ api::{FirewallApi, FirewallManagementApi},
+ FirewallError, FirewallRule, Policy, Protocol,
+};
+use crate::proto;
+
+impl FirewallManagementApi for FirewallApi {
+ fn setup(
+ &mut self,
+ _default_policy: Option,
+ _priority: Option,
+ ) -> Result<(), FirewallError> {
+ Ok(())
+ }
+
+ fn cleanup(&mut self) -> Result<(), FirewallError> {
+ Ok(())
+ }
+
+ fn set_firewall_default_policy(&mut self, _policy: Policy) -> Result<(), FirewallError> {
+ Ok(())
+ }
+
+ fn set_masquerade_status(&mut self, _enabled: bool) -> Result<(), FirewallError> {
+ Ok(())
+ }
+
+ fn add_rules(&mut self, _rules: Vec) -> Result<(), FirewallError> {
+ Ok(())
+ }
+
+ fn add_rule(&mut self, _rule: FirewallRule) -> Result<(), FirewallError> {
+ Ok(())
+ }
+
+ fn begin(&mut self) -> Result<(), FirewallError> {
+ Ok(())
+ }
+
+ fn rollback(&mut self) {}
+
+ fn commit(&mut self) -> Result<(), FirewallError> {
+ Ok(())
+ }
+}
+
+impl Protocol {
+ pub const fn from_proto(
+ proto: proto::enterprise::firewall::Protocol,
+ ) -> Result {
+ Ok(Self(proto as u8))
+ }
+}
diff --git a/src/enterprise/firewall/linux/mod.rs b/src/enterprise/firewall/linux/mod.rs
new file mode 100644
index 00000000..12f7e142
--- /dev/null
+++ b/src/enterprise/firewall/linux/mod.rs
@@ -0,0 +1,262 @@
+pub mod netfilter;
+
+use std::sync::atomic::{AtomicU32, Ordering};
+
+use mnl::mnl_sys::libc;
+use netfilter::{
+ allow_established_traffic, apply_filter_rules, drop_table, ignore_unrelated_traffic,
+ init_firewall, send_batch, set_default_policy, set_masq,
+};
+use nftnl::Batch;
+
+use super::{
+ api::{FirewallApi, FirewallManagementApi},
+ Address, FirewallError, FirewallRule, Policy, Port, Protocol, PORT_PROTOCOLS,
+};
+use crate::proto;
+
+static SET_ID_COUNTER: AtomicU32 = AtomicU32::new(0);
+
+pub fn get_set_id() -> u32 {
+ SET_ID_COUNTER.fetch_add(1, Ordering::Relaxed)
+}
+
+impl Protocol {
+ pub const fn from_proto(
+ proto: proto::enterprise::firewall::Protocol,
+ ) -> Result {
+ match proto {
+ proto::enterprise::firewall::Protocol::Tcp => Ok(Self(libc::IPPROTO_TCP as u8)),
+ proto::enterprise::firewall::Protocol::Udp => Ok(Self(libc::IPPROTO_UDP as u8)),
+ proto::enterprise::firewall::Protocol::Icmp => Ok(Self(libc::IPPROTO_ICMP as u8)),
+ proto::enterprise::firewall::Protocol::Invalid => {
+ Err(FirewallError::UnsupportedProtocol(proto as u8))
+ }
+ }
+ }
+}
+
+#[derive(Debug, Default)]
+pub enum State {
+ #[default]
+ Established,
+ Invalid,
+ New,
+ Related,
+}
+
+#[derive(Debug, Default)]
+pub struct FilterRule<'a> {
+ pub src_ips: &'a [Address],
+ pub dest_ips: &'a [Address],
+ pub src_ports: &'a [Port],
+ pub dest_ports: &'a [Port],
+ pub protocols: Vec,
+ pub oifname: Option,
+ pub iifname: Option,
+ pub action: Policy,
+ pub states: Vec,
+ pub counter: bool,
+ // The ID of the associated Defguard rule.
+ // The filter rules may not always be a 1:1 representation of the Defguard rules, so
+ // this value helps to keep track of them.
+ pub defguard_rule_id: i64,
+ pub v4: bool,
+ pub comment: Option,
+ pub negated_oifname: bool,
+ pub negated_iifname: bool,
+}
+
+impl FirewallManagementApi for FirewallApi {
+ /// Sets up the firewall with the given default policy and priority. Drops the previous table.
+ ///
+ /// This function also begins a batch of operations which can be applied later using the [`apply`] method.
+ /// This allows for making atomic changes to the firewall rules.
+ fn setup(
+ &mut self,
+ default_policy: Option,
+ priority: Option,
+ ) -> Result<(), FirewallError> {
+ debug!("Initializing firewall, VPN interface: {}", self.ifname);
+ if let Some(batch) = &mut self.batch {
+ drop_table(batch)?;
+ init_firewall(default_policy, priority, batch).expect("Failed to setup chains");
+ debug!("Allowing all established traffic");
+ ignore_unrelated_traffic(batch, &self.ifname)?;
+ allow_established_traffic(batch)?;
+ debug!("Allowed all established traffic");
+ debug!("Initialized firewall");
+ Ok(())
+ } else {
+ Err(FirewallError::TransactionNotStarted)
+ }
+ }
+
+ /// Cleans up the whole Defguard table.
+ fn cleanup(&mut self) -> Result<(), FirewallError> {
+ debug!("Cleaning up all previous firewall rules, if any");
+ if let Some(batch) = &mut self.batch {
+ drop_table(batch)?;
+ } else {
+ return Err(FirewallError::TransactionNotStarted);
+ }
+ debug!("Cleaned up all previous firewall rules");
+ Ok(())
+ }
+
+ /// Allows for changing the default policy of the firewall.
+ fn set_firewall_default_policy(&mut self, policy: Policy) -> Result<(), FirewallError> {
+ debug!("Setting default firewall policy to: {policy:?}");
+ if let Some(batch) = &mut self.batch {
+ set_default_policy(policy, batch)?;
+ } else {
+ return Err(FirewallError::TransactionNotStarted);
+ }
+ debug!("Set firewall default policy to {policy:?}");
+ Ok(())
+ }
+
+ /// Allows for changing the masquerade status of the firewall.
+ fn set_masquerade_status(&mut self, enabled: bool) -> Result<(), FirewallError> {
+ debug!("Setting masquerade status to: {enabled:?}");
+ if let Some(batch) = &mut self.batch {
+ set_masq(&self.ifname, enabled, batch)?;
+ } else {
+ return Err(FirewallError::TransactionNotStarted);
+ }
+ debug!("Set masquerade status to: {enabled:?}");
+ Ok(())
+ }
+
+ fn add_rules(&mut self, rules: Vec) -> Result<(), FirewallError> {
+ debug!("Applying the following Defguard ACL rules: {:?}", rules);
+ for rule in rules {
+ self.add_rule(rule)?;
+ }
+ debug!("Applied all Defguard ACL rules");
+ Ok(())
+ }
+
+ fn add_rule(&mut self, rule: FirewallRule) -> Result<(), FirewallError> {
+ debug!("Applying the following Defguard ACL rule: {:?}", rule);
+ let mut rules = Vec::new();
+ let batch = if let Some(ref mut batch) = self.batch {
+ batch
+ } else {
+ return Err(FirewallError::TransactionNotStarted);
+ };
+
+ debug!("The rule will be split into multiple nftables rules based on the specified destination ports and protocols.");
+ if rule.destination_ports.is_empty() {
+ debug!("No destination ports specified, applying single aggregate nftables rule for every protocol.");
+ let rule = FilterRule {
+ src_ips: &rule.source_addrs,
+ dest_ips: &rule.destination_addrs,
+ protocols: rule.protocols,
+ action: rule.verdict,
+ counter: true,
+ defguard_rule_id: rule.id,
+ v4: rule.ipv4,
+ comment: rule.comment.clone(),
+ ..Default::default()
+ };
+ rules.push(rule);
+ } else if !rule.protocols.is_empty() {
+ debug!("Destination ports and protocols specified, applying individual nftables rules for each protocol.");
+ for protocol in rule.protocols {
+ debug!("Applying rule for protocol: {:?}", protocol);
+ if protocol.supports_ports() {
+ debug!("Protocol supports ports, rule.");
+ let rule = FilterRule {
+ src_ips: &rule.source_addrs,
+ dest_ips: &rule.destination_addrs,
+ dest_ports: &rule.destination_ports,
+ protocols: vec![protocol],
+ action: rule.verdict,
+ counter: true,
+ defguard_rule_id: rule.id,
+ v4: rule.ipv4,
+ comment: rule.comment.clone(),
+ ..Default::default()
+ };
+ rules.push(rule);
+ } else {
+ debug!("Protocol does not support ports, applying nftables rule and ignoring destination ports.");
+ let rule = FilterRule {
+ src_ips: &rule.source_addrs,
+ dest_ips: &rule.destination_addrs,
+ protocols: vec![protocol],
+ action: rule.verdict,
+ counter: true,
+ defguard_rule_id: rule.id,
+ v4: rule.ipv4,
+ comment: rule.comment.clone(),
+ ..Default::default()
+ };
+ rules.push(rule);
+ }
+ }
+ } else {
+ debug!(
+ "Destination ports specified, but no protocols specified, applying nftables rules for each protocol that support ports."
+ );
+ for protocol in PORT_PROTOCOLS {
+ debug!("Applying nftables rule for protocol: {:?}", protocol);
+ let rule = FilterRule {
+ src_ips: &rule.source_addrs,
+ dest_ips: &rule.destination_addrs,
+ dest_ports: &rule.destination_ports,
+ protocols: vec![protocol],
+ action: rule.verdict,
+ counter: true,
+ defguard_rule_id: rule.id,
+ v4: rule.ipv4,
+ comment: rule.comment.clone(),
+ ..Default::default()
+ };
+ rules.push(rule);
+ }
+ }
+
+ apply_filter_rules(rules, batch)?;
+
+ debug!(
+ "Applied firewall rules for Defguard ACL rule ID: {}",
+ rule.id
+ );
+ Ok(())
+ }
+
+ fn begin(&mut self) -> Result<(), FirewallError> {
+ if self.batch.is_none() {
+ debug!("Starting new firewall transaction");
+ let batch = Batch::new();
+ self.batch = Some(batch);
+ debug!("Firewall transaction successfully started");
+ Ok(())
+ } else {
+ Err(FirewallError::TransactionFailed(
+ "There is another firewall transaction already in progress. Commit or rollback it before starting a new one.".to_string()
+ ))
+ }
+ }
+
+ fn rollback(&mut self) {
+ self.batch = None;
+ debug!("Firewall transaction has been rolled back.")
+ }
+
+ /// Apply whole firewall configuration and send it in one go to the kernel.
+ fn commit(&mut self) -> Result<(), FirewallError> {
+ if let Some(batch) = self.batch.take() {
+ debug!("Committing firewall transaction");
+ let finalized = batch.finalize();
+ debug!("Firewall batch finalized, sending to kernel");
+ send_batch(&finalized)?;
+ debug!("Firewall transaction successfully committed to kernel");
+ Ok(())
+ } else {
+ Err(FirewallError::TransactionNotStarted)
+ }
+ }
+}
diff --git a/src/enterprise/firewall/linux/netfilter.rs b/src/enterprise/firewall/linux/netfilter.rs
new file mode 100644
index 00000000..840c0879
--- /dev/null
+++ b/src/enterprise/firewall/linux/netfilter.rs
@@ -0,0 +1,1054 @@
+#[cfg(test)]
+use std::str::FromStr;
+use std::{
+ ffi::CString,
+ net::{IpAddr, Ipv4Addr, Ipv6Addr},
+};
+
+use ipnetwork::IpNetwork;
+#[cfg(test)]
+use ipnetwork::{Ipv4Network, Ipv6Network};
+use mnl::mnl_sys::libc::{self};
+use nftnl::{
+ expr::{Expression, InterfaceName},
+ nft_expr, nftnl_sys,
+ set::{Set, SetKey},
+ Batch, Chain, FinalizedBatch, ProtoFamily, Rule, Table,
+};
+
+use super::{get_set_id, Address, FilterRule, Policy, Port, Protocol, State};
+use crate::enterprise::firewall::FirewallError;
+
+const FILTER_TABLE: &str = "filter";
+const NAT_TABLE: &str = "nat";
+const DEFGUARD_TABLE: &str = "DEFGUARD";
+const POSTROUTING_CHAIN: &str = "POSTROUTING";
+const FORWARD_CHAIN: &str = "FORWARD";
+const ANON_SET_NAME: &str = "__set%d";
+const LOOPBACK_IFACE: &str = "lo";
+
+const POSTROUTING_PRIORITY: i32 = 100;
+const FORWARD_PRIORITY: i32 = 0;
+
+struct InetService(u16);
+
+impl SetKey for InetService {
+ const LEN: u32 = 2;
+ const TYPE: u32 = 13;
+
+ fn data(&self) -> Box<[u8]> {
+ Box::new(self.0.to_be_bytes())
+ }
+}
+
+impl State {
+ const fn to_expr_state(&self) -> nftnl::expr::ct::States {
+ match self {
+ Self::Established => nftnl::expr::ct::States::ESTABLISHED,
+ Self::Invalid => nftnl::expr::ct::States::INVALID,
+ Self::New => nftnl::expr::ct::States::NEW,
+ Self::Related => nftnl::expr::ct::States::RELATED,
+ }
+ }
+}
+
+impl Protocol {
+ pub(crate) fn as_port_payload_expr(&self) -> Result<&impl Expression, FirewallError> {
+ match self.0.into() {
+ libc::IPPROTO_TCP => Ok(&nft_expr!(payload tcp dport)),
+ libc::IPPROTO_UDP => Ok(&nft_expr!(payload udp dport)),
+ _ => Err(FirewallError::UnsupportedProtocol(self.0)),
+ }
+ }
+}
+
+impl From for nftnl::Policy {
+ fn from(policy: Policy) -> Self {
+ match policy {
+ Policy::Allow => Self::Accept,
+ Policy::Deny => Self::Drop,
+ }
+ }
+}
+
+impl SetKey for Protocol {
+ const LEN: u32 = 1;
+ const TYPE: u32 = 12;
+
+ fn data(&self) -> Box<[u8]> {
+ Box::new([self.0])
+ }
+}
+
+pub trait FirewallRule {
+ fn to_chain_rule<'a>(
+ &self,
+ chain: &'a Chain,
+ batch: &mut Batch,
+ ) -> Result, FirewallError>;
+}
+
+fn add_address_to_set(set: *mut nftnl_sys::nftnl_set, ip: &Address) -> Result<(), FirewallError> {
+ match ip {
+ Address::Ip(ip) => match ip {
+ IpAddr::V4(ip) => {
+ add_to_set(set, ip, Some(ip))?;
+ }
+ IpAddr::V6(ip) => {
+ add_to_set(set, ip, Some(ip))?;
+ }
+ },
+ Address::Range(start, end) => match (start, end) {
+ (IpAddr::V4(start), IpAddr::V4(end)) => {
+ add_to_set(set, start, Some(end))?;
+ }
+ (IpAddr::V6(start), IpAddr::V6(end)) => {
+ add_to_set(set, start, Some(end))?;
+ }
+ _ => {
+ return Err(FirewallError::InvalidConfiguration(format!(
+ "Expected both addresses to be of the same type, got {:?} and {:?}",
+ start, end
+ )))
+ }
+ },
+ Address::Network(network) => {
+ let upper_bound = max_address(network);
+ let net = network.network();
+ match (net, upper_bound) {
+ (IpAddr::V4(network), IpAddr::V4(upper_bound)) => {
+ add_to_set(set, &network, Some(&upper_bound))?;
+ }
+ (IpAddr::V6(network), IpAddr::V6(upper_bound)) => {
+ add_to_set(set, &network, Some(&upper_bound))?;
+ }
+ _ => {
+ return Err(FirewallError::InvalidConfiguration(format!(
+ "Expected both addresses to be of the same type, got {:?} and {:?}",
+ net, upper_bound
+ )))
+ }
+ }
+ }
+ }
+
+ Ok(())
+}
+
+fn add_port_to_set(set: *mut nftnl_sys::nftnl_set, port: &Port) -> Result<(), FirewallError> {
+ match port {
+ Port::Single(port) => {
+ let inet_service = InetService(*port);
+ add_to_set(set, &inet_service, Some(&inet_service))?;
+ }
+ Port::Range(start, end) => {
+ let start = InetService(*start);
+ let end = InetService(*end);
+
+ add_to_set(set, &start, Some(&end))?;
+ }
+ }
+
+ Ok(())
+}
+
+fn add_protocol_to_set(
+ set: *mut nftnl_sys::nftnl_set,
+ proto: &Protocol,
+) -> Result<(), FirewallError> {
+ add_to_set(set, proto, None)?;
+ Ok(())
+}
+
+impl FirewallRule for FilterRule<'_> {
+ fn to_chain_rule<'a>(
+ &self,
+ chain: &'a Chain,
+ batch: &mut Batch,
+ ) -> Result, FirewallError> {
+ let mut rule = Rule::new(chain);
+ debug!("Converting {:?} to nftables expression", self);
+ // Debug purposes only
+ let mut matches = Vec::new();
+
+ if !self.dest_ports.is_empty() && self.protocols.len() > 1 {
+ return Err(FirewallError::InvalidConfiguration(
+ format!("Cannot specify multiple protocols with destination ports, specified protocols: {:?}, destination ports: {:?}, Defguard Rule ID: {}",
+ self.protocols, self.dest_ports, self.defguard_rule_id)
+ ));
+ }
+
+ // TODO: Reduce code duplication here
+ if !self.src_ips.is_empty() {
+ if self.v4 {
+ let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?;
+ batch.add(&set, nftnl::MsgType::Add);
+
+ for ip in self.src_ips {
+ add_address_to_set(set.as_ptr(), ip)?;
+ }
+
+ // ip saddr {x.x.x.x, x.x.x.x}
+ set.elems_iter().for_each(|elem| {
+ batch.add(&elem, nftnl::MsgType::Add);
+ });
+
+ rule.add_expr(&nft_expr!(meta nfproto));
+ rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV4 as u8));
+ rule.add_expr(&nft_expr!(payload ipv4 saddr));
+
+ rule.add_expr(&nft_expr!(lookup & set));
+ } else {
+ let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?;
+ batch.add(&set, nftnl::MsgType::Add);
+
+ for ip in self.src_ips {
+ add_address_to_set(set.as_ptr(), ip)?;
+ }
+
+ // ip6 saddr {x.x.x.x, x.x.x.x}
+ set.elems_iter().for_each(|elem| {
+ batch.add(&elem, nftnl::MsgType::Add);
+ });
+
+ rule.add_expr(&nft_expr!(meta nfproto));
+ rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV6 as u8));
+ rule.add_expr(&nft_expr!(payload ipv6 saddr));
+
+ rule.add_expr(&nft_expr!(lookup & set));
+ }
+ debug!(
+ "Added source IP addresses match to nftables expression: {:?}",
+ self.src_ips
+ );
+ matches.push(format!("ANY SOURCE IPs: {:?}", self.src_ips));
+ }
+
+ // TODO: Reduce code duplication here
+ if !self.dest_ips.is_empty() {
+ if self.v4 {
+ let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?;
+ batch.add(&set, nftnl::MsgType::Add);
+
+ for ip in self.dest_ips {
+ add_address_to_set(set.as_ptr(), ip)?;
+ }
+
+ set.elems_iter().for_each(|elem| {
+ batch.add(&elem, nftnl::MsgType::Add);
+ });
+
+ // ip daddr {x.x.x.x, x.x.x.x}
+ rule.add_expr(&nft_expr!(meta nfproto));
+ rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV4 as u8));
+ rule.add_expr(&nft_expr!(payload ipv4 daddr));
+
+ rule.add_expr(&nft_expr!(lookup & set));
+ } else {
+ let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, true)?;
+ batch.add(&set, nftnl::MsgType::Add);
+
+ for ip in self.dest_ips {
+ add_address_to_set(set.as_ptr(), ip)?;
+ }
+
+ // ip6 daddr {x.x.x.x, x.x.x.x}
+ set.elems_iter().for_each(|elem| {
+ batch.add(&elem, nftnl::MsgType::Add);
+ });
+
+ rule.add_expr(&nft_expr!(meta nfproto));
+ rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV6 as u8));
+ rule.add_expr(&nft_expr!(payload ipv6 daddr));
+
+ rule.add_expr(&nft_expr!(lookup & set));
+ }
+ debug!(
+ "Added destination IP addresses match to nftables expression: {:?}",
+ self.dest_ips
+ );
+ matches.push(format!("ANY DEST IPs: {:?}", self.dest_ips));
+ }
+
+ if !self.protocols.is_empty() {
+ // > 0 Protocols
+ // 0 Ports
+ if self.protocols.len() > 1 {
+ let set = new_anon_set::(chain.get_table(), ProtoFamily::Inet, false)?;
+ batch.add(&set, nftnl::MsgType::Add);
+
+ for proto in &self.protocols {
+ add_protocol_to_set(set.as_ptr(), proto)?;
+ }
+
+ // dport {x, x-x}
+ set.elems_iter().for_each(|elem| {
+ batch.add(&elem, nftnl::MsgType::Add);
+ });
+
+ rule.add_expr(&nft_expr!(meta nfproto));
+
+ if self.v4 {
+ rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV4 as u8));
+ rule.add_expr(&nft_expr!(payload ipv4 protocol));
+ } else {
+ rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV6 as u8));
+ rule.add_expr(&nft_expr!(payload ipv6 nextheader));
+ }
+
+ rule.add_expr(&nft_expr!(lookup & set));
+
+ debug!("Added protocol match to rule: {:?}", self.protocols);
+ matches.push(format!("ANY PROTOCOLS: {:?}", self.protocols));
+ }
+ // 1 Protocol
+ // > 0 Ports
+ else if !self.dest_ports.is_empty() {
+ if let Some(protocol) = self.protocols.first() {
+ if protocol.supports_ports() {
+ let set = new_anon_set::(
+ chain.get_table(),
+ ProtoFamily::Inet,
+ true,
+ )?;
+ batch.add(&set, nftnl::MsgType::Add);
+
+ for port in self.dest_ports {
+ add_port_to_set(set.as_ptr(), port)?;
+ }
+
+ // dport {x, x-x}
+ set.elems_iter().for_each(|elem| {
+ batch.add(&elem, nftnl::MsgType::Add);
+ });
+
+ rule.add_expr(&nft_expr!(meta l4proto));
+ rule.add_expr(&nft_expr!(cmp == protocol.0));
+ rule.add_expr(protocol.as_port_payload_expr()?);
+ rule.add_expr(&nft_expr!(lookup & set));
+ }
+ }
+
+ debug!(
+ "Added single protocol ({:?}) match and destination ports match to nftables expression: {:?}",
+ self.protocols, self.dest_ports
+ );
+ matches.push(format!(
+ "PROTOCOL: {:?} AND ANY DEST PORTS: {:?}",
+ self.protocols, self.dest_ports
+ ));
+ }
+ // 1 Protocol
+ // 0 Ports
+ else if let Some(protocol) = self.protocols.first() {
+ // ip protocol
+ rule.add_expr(&nft_expr!(meta nfproto));
+
+ if self.v4 {
+ rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV4 as u8));
+ rule.add_expr(&nft_expr!(payload ipv4 protocol));
+ } else {
+ rule.add_expr(&nft_expr!(cmp == libc::NFPROTO_IPV6 as u8));
+ rule.add_expr(&nft_expr!(payload ipv6 nextheader));
+ }
+
+ rule.add_expr(&nft_expr!(cmp == protocol.0));
+ debug!("Added protocol match to rule: {:?}", protocol);
+ matches.push(format!("SINGLE PROTOCOL: {:?}", protocol));
+ }
+ }
+
+ if let Some(iifname) = &self.iifname {
+ // iifname
+ rule.add_expr(&nft_expr!(meta iifname));
+ let exact = InterfaceName::Exact(CString::new(iifname.as_str()).unwrap());
+ if self.negated_iifname {
+ rule.add_expr(&nft_expr!(cmp != exact));
+ } else {
+ rule.add_expr(&nft_expr!(cmp == exact));
+ }
+ debug!("Added input interface match to rule: {:?}", iifname);
+ matches.push(format!("INPUT INTERFACE: {:?}", iifname));
+ }
+
+ if let Some(oifname) = &self.oifname {
+ // oifname
+ rule.add_expr(&nft_expr!(meta oifname));
+ let exact = InterfaceName::Exact(CString::new(oifname.as_str()).unwrap());
+ if self.negated_oifname {
+ rule.add_expr(&nft_expr!(cmp != exact));
+ } else {
+ rule.add_expr(&nft_expr!(cmp == exact));
+ }
+ debug!("Added output interface match to rule: {:?}", oifname);
+ matches.push(format!("OUTPUT INTERFACE: {:?}", oifname));
+ }
+
+ if !self.states.is_empty() {
+ // ct state ,
+ let combined_states = self
+ .states
+ .iter()
+ .fold(0u32, |acc, state| acc | state.to_expr_state().bits());
+ rule.add_expr(&nft_expr!(ct state));
+ rule.add_expr(&nft_expr!(bitwise mask combined_states, xor 0u32));
+ rule.add_expr(&nft_expr!(cmp != 0u32));
+ debug!(
+ "Added connection tracking states match to nftables expression: {:?}",
+ self.states
+ );
+ matches.push(format!("ANY CT STATES: {:?}", self.states));
+ }
+
+ if self.counter {
+ // counter
+ rule.add_expr(&nft_expr!(counter));
+ debug!("Added counter expression to rule");
+ }
+
+ // accept/drop
+ match self.action {
+ Policy::Allow => {
+ rule.add_expr(&nft_expr!(verdict accept));
+ }
+ Policy::Deny => {
+ rule.add_expr(&nft_expr!(verdict drop));
+ }
+ }
+
+ // comment
+ if let Some(comment_string) = &self.comment {
+ debug!(
+ "Adding comment to nftables expression: {:?}",
+ comment_string
+ );
+ // Since we are interoping with C, truncate the string to 255 *bytes* (not UTF-8 characters)
+ // 256 is the maximum length of a comment string in nftables, leave 1 byte for the null terminator
+ let maybe_truncated_str = if comment_string.len() > 255 {
+ warn!("Comment string {comment_string} is too long, truncating to 255 bytes");
+ &comment_string[..=255]
+ } else {
+ comment_string.as_str()
+ };
+ let comment = &CString::new(maybe_truncated_str).map_err(|e| {
+ FirewallError::NetlinkError(format!(
+ "Failed to create CString from string {comment_string}. Error: {e:?}"
+ ))
+ })?;
+ rule.set_comment(comment);
+ debug!("Added comment to nftables expression: {:?}", comment_string);
+ } else {
+ debug!("No comment provided for nftables expression");
+ }
+
+ let matches = matches.join(" AND ");
+ debug!("Created nftables rule with matches: {:?}", matches);
+
+ Ok(rule)
+ }
+}
+
+#[derive(Debug, Default)]
+struct NatRule {
+ src_ip: Option,
+ dest_ip: Option,
+ oifname: Option,
+ iifname: Option,
+ negated_oifname: bool,
+ negated_iifname: bool,
+ counter: bool,
+}
+
+impl FirewallRule for NatRule {
+ fn to_chain_rule<'a>(
+ &self,
+ chain: &'a Chain,
+ _batch: &mut Batch,
+ ) -> Result, FirewallError> {
+ let mut rule = Rule::new(chain);
+
+ if let Some(src_ip) = self.src_ip {
+ if src_ip.is_ipv4() {
+ rule.add_expr(&nft_expr!(payload ipv4 saddr));
+ } else {
+ rule.add_expr(&nft_expr!(payload ipv6 saddr));
+ }
+ rule.add_expr(&nft_expr!(cmp == src_ip));
+ }
+
+ if let Some(dest_ip) = self.dest_ip {
+ if dest_ip.is_ipv4() {
+ rule.add_expr(&nft_expr!(payload ipv4 daddr));
+ } else {
+ rule.add_expr(&nft_expr!(payload ipv6 daddr));
+ }
+ rule.add_expr(&nft_expr!(cmp == dest_ip));
+ }
+
+ if let Some(iifname) = &self.iifname {
+ rule.add_expr(&nft_expr!(meta iifname));
+ let exact = InterfaceName::Exact(CString::new(iifname.as_str()).unwrap());
+ if self.negated_iifname {
+ rule.add_expr(&nft_expr!(cmp != exact));
+ } else {
+ rule.add_expr(&nft_expr!(cmp == exact));
+ }
+ }
+
+ if let Some(oifname) = &self.oifname {
+ rule.add_expr(&nft_expr!(meta oifname));
+ let exact = InterfaceName::Exact(CString::new(oifname.as_str()).unwrap());
+ if self.negated_oifname {
+ rule.add_expr(&nft_expr!(cmp != exact));
+ } else {
+ rule.add_expr(&nft_expr!(cmp == exact));
+ }
+ }
+
+ if self.counter {
+ rule.add_expr(&nft_expr!(counter));
+ }
+
+ rule.add_expr(&nft_expr!(masquerade));
+
+ Ok(rule)
+ }
+}
+
+// Left in case if this is ever needed
+// struct JumpRule<'a> {
+// src_chain: &'a Chain<'a>,
+// dest_chain: &'a Chain<'a>,
+// oifname: Option,
+// iifname: Option,
+// negated_oifname: bool,
+// negated_iifname: bool,
+// }
+
+// impl<'a> JumpRule<'a> {
+// fn to_chain_rule(&self) -> Result, FirewallError> {
+// let mut rule = Rule::new(self.src_chain);
+
+// if let Some(iifname) = &self.iifname {
+// rule.add_expr(&nft_expr!(meta iifname));
+// let exact = InterfaceName::Exact(CString::new(iifname.as_str()).unwrap());
+// if self.negated_iifname {
+// rule.add_expr(&nft_expr!(cmp != exact));
+// } else {
+// rule.add_expr(&nft_expr!(cmp == exact));
+// }
+// }
+
+// if let Some(oifname) = &self.oifname {
+// rule.add_expr(&nft_expr!(meta oifname));
+// let exact = InterfaceName::Exact(CString::new(oifname.as_str()).unwrap());
+// if self.negated_oifname {
+// rule.add_expr(&nft_expr!(cmp != exact));
+// } else {
+// rule.add_expr(&nft_expr!(cmp == exact));
+// }
+// }
+
+// // first, match
+
+// rule.add_expr(&nft_expr!(counter));
+// rule.add_expr(&nft_expr!(verdict jump self.dest_chain.get_name().into()));
+
+// Ok(rule)
+// }
+// }
+
+/// Sets up the default chains for the firewall
+pub(crate) fn init_firewall(
+ initial_policy: Option,
+ defguard_fwd_chain_priority: Option,
+ batch: &mut Batch,
+) -> Result<(), FirewallError> {
+ let table = Tables::Defguard(ProtoFamily::Inet).to_table();
+
+ batch.add(&table, nftnl::MsgType::Add);
+ batch.add(&table, nftnl::MsgType::Del);
+ batch.add(&table, nftnl::MsgType::Add);
+
+ let mut fw_chain = Chains::Forward.to_chain(&table);
+ fw_chain.set_hook(
+ nftnl::Hook::Forward,
+ defguard_fwd_chain_priority.unwrap_or(FORWARD_PRIORITY),
+ );
+ fw_chain.set_policy(initial_policy.unwrap_or(Policy::Allow).into());
+ fw_chain.set_type(nftnl::ChainType::Filter);
+ batch.add(&fw_chain, nftnl::MsgType::Add);
+
+ Ok(())
+}
+
+pub(crate) fn drop_table(batch: &mut Batch) -> Result<(), FirewallError> {
+ let table = Tables::Defguard(ProtoFamily::Inet).to_table();
+ batch.add(&table, nftnl::MsgType::Add);
+ batch.add(&table, nftnl::MsgType::Del);
+
+ Ok(())
+}
+
+pub(crate) fn drop_chain(chain: &Chains, batch: &mut Batch) -> Result<(), FirewallError> {
+ let table = Tables::Defguard(ProtoFamily::Inet).to_table();
+ let chain = chain.to_chain(&table);
+ batch.add(&chain, nftnl::MsgType::Add);
+ batch.add(&chain, nftnl::MsgType::Del);
+
+ Ok(())
+}
+
+/// Applies masquerade on the specified interface for the outgoing packets
+pub(crate) fn set_masq(
+ _ifname: &str,
+ enabled: bool,
+ batch: &mut Batch,
+) -> Result<(), FirewallError> {
+ let table = Tables::Defguard(ProtoFamily::Inet).to_table();
+ batch.add(&table, nftnl::MsgType::Add);
+
+ drop_chain(&Chains::Postrouting, batch)?;
+
+ let mut nat_chain = Chains::Postrouting.to_chain(&table);
+ nat_chain.set_hook(nftnl::Hook::PostRouting, POSTROUTING_PRIORITY);
+ nat_chain.set_policy(nftnl::Policy::Accept);
+ nat_chain.set_type(nftnl::ChainType::Nat);
+ batch.add(&nat_chain, nftnl::MsgType::Add);
+
+ let nat_rule = NatRule {
+ oifname: Some(LOOPBACK_IFACE.to_string()),
+ negated_oifname: true,
+ counter: true,
+ ..Default::default()
+ }
+ .to_chain_rule(&nat_chain, batch)?;
+
+ if enabled {
+ batch.add(&nat_rule, nftnl::MsgType::Add);
+ } else {
+ batch.add(&nat_rule, nftnl::MsgType::Del);
+ }
+
+ Ok(())
+}
+
+pub(crate) fn set_default_policy(policy: Policy, batch: &mut Batch) -> Result<(), FirewallError> {
+ let table = Tables::Defguard(ProtoFamily::Inet).to_table();
+ batch.add(&table, nftnl::MsgType::Add);
+
+ let mut forward_chain = Chains::Forward.to_chain(&table);
+ forward_chain.set_policy(if policy == Policy::Allow {
+ nftnl::Policy::Accept
+ } else {
+ nftnl::Policy::Drop
+ });
+ batch.add(&forward_chain, nftnl::MsgType::Add);
+
+ Ok(())
+}
+
+pub(crate) fn allow_established_traffic(batch: &mut Batch) -> Result<(), FirewallError> {
+ let table = Tables::Defguard(ProtoFamily::Inet).to_table();
+ batch.add(&table, nftnl::MsgType::Add);
+
+ let forward_chain = Chains::Forward.to_chain(&table);
+ batch.add(&forward_chain, nftnl::MsgType::Add);
+
+ let established_rule = FilterRule {
+ states: vec![State::Established, State::Related],
+ counter: true,
+ action: Policy::Allow,
+ comment: Some("Allow established and related traffic".to_string()),
+ ..Default::default()
+ }
+ .to_chain_rule(&forward_chain, batch)?;
+ batch.add(&established_rule, nftnl::MsgType::Add);
+
+ Ok(())
+}
+
+pub(crate) fn ignore_unrelated_traffic(
+ batch: &mut Batch,
+ ifname: &str,
+) -> Result<(), FirewallError> {
+ let table = Tables::Defguard(ProtoFamily::Inet).to_table();
+ batch.add(&table, nftnl::MsgType::Add);
+
+ let forward_chain = Chains::Forward.to_chain(&table);
+ batch.add(&forward_chain, nftnl::MsgType::Add);
+
+ let ignore_rule = FilterRule {
+ iifname: Some(ifname.to_string()),
+ negated_iifname: true,
+ action: Policy::Allow,
+ counter: true,
+ comment: Some("Ignore traffic not related to the VPN".to_string()),
+ ..Default::default()
+ }
+ .to_chain_rule(&forward_chain, batch)?;
+ batch.add(&ignore_rule, nftnl::MsgType::Add);
+
+ Ok(())
+}
+
+pub enum Tables {
+ Filter(ProtoFamily),
+ Nat(ProtoFamily),
+ Defguard(ProtoFamily),
+}
+
+impl Tables {
+ fn to_table(&self) -> Table {
+ match self {
+ Self::Filter(family) => Table::new(
+ &CString::new(FILTER_TABLE)
+ .expect("Failed to create CString from FILTER_TABLE constant."),
+ *family,
+ ),
+ Self::Nat(family) => Table::new(
+ &CString::new(NAT_TABLE)
+ .expect("Failed to create CString from NAT_TABLE constant."),
+ *family,
+ ),
+ Self::Defguard(family) => Table::new(
+ &CString::new(DEFGUARD_TABLE)
+ .expect("Failed to create CString from DEFGUARD_TABLE constant."),
+ *family,
+ ),
+ }
+ }
+}
+
+pub enum Chains {
+ Forward,
+ Postrouting,
+}
+
+impl Chains {
+ fn to_chain<'a>(&self, table: &'a Table) -> Chain<'a> {
+ match self {
+ Self::Forward => Chain::new(
+ &CString::new(FORWARD_CHAIN)
+ .expect("Failed to create CString from FORWARD_CHAIN constant."),
+ table,
+ ),
+ Self::Postrouting => Chain::new(
+ &CString::new(POSTROUTING_CHAIN)
+ .expect("Failed to create CString from POSTROUTING_CHAIN constant."),
+ table,
+ ),
+ }
+ }
+}
+
+pub(crate) fn apply_filter_rules(
+ rules: Vec,
+ batch: &mut Batch,
+) -> Result<(), FirewallError> {
+ let table = Tables::Defguard(ProtoFamily::Inet).to_table();
+ batch.add(&table, nftnl::MsgType::Add);
+
+ let forward_chain = Chains::Forward.to_chain(&table);
+ batch.add(&forward_chain, nftnl::MsgType::Add);
+
+ for rule in rules.iter() {
+ let chain_rule = rule.to_chain_rule(&forward_chain, batch)?;
+ batch.add(&chain_rule, nftnl::MsgType::Add);
+ }
+
+ Ok(())
+}
+
+pub(crate) fn send_batch(batch: &FinalizedBatch) -> Result<(), FirewallError> {
+ let socket = mnl::Socket::new(mnl::Bus::Netfilter)
+ .map_err(|e| FirewallError::NetlinkError(format!("Failed to create socket: {e:?}")))?;
+ socket.send_all(batch).map_err(|e| {
+ FirewallError::NetlinkError(format!("Failed to send batch through socket: {e:?}"))
+ })?;
+
+ let portid = socket.portid();
+ let mut buffer = vec![0; nftnl::nft_nlmsg_maxsize() as usize];
+
+ // TODO: Why is it supposed to be 2?
+ let seq = 2;
+ while let Some(message) = socket_recv(&socket, &mut buffer[..])? {
+ match mnl::cb_run(message, seq, portid) {
+ Ok(mnl::CbResult::Stop) => {
+ debug!("Received stop signal from netlink callback");
+ break;
+ }
+ Ok(mnl::CbResult::Ok) => {
+ debug!("Received OK signal from netlink callback");
+ }
+ Err(err) => {
+ return Err(FirewallError::NetlinkError(format!(
+ "There was an error while sending netlink messages: {err:?}"
+ )))
+ }
+ };
+ }
+
+ Ok(())
+}
+
+fn socket_recv<'a>(
+ socket: &mnl::Socket,
+ buf: &'a mut [u8],
+) -> Result, FirewallError> {
+ let ret = socket.recv(buf).map_err(|err| {
+ FirewallError::NetlinkError(format!(
+ "Failed while reading a message from socket: {err:?}"
+ ))
+ })?;
+ if ret > 0 {
+ Ok(Some(&buf[..ret]))
+ } else {
+ Ok(None)
+ }
+}
+
+/// Get the max address in a network.
+///
+/// - In IPv4 this is the broadcast address.
+/// - In IPv6 this is just the last address in the network.
+fn max_address(network: &IpNetwork) -> IpAddr {
+ match network {
+ IpNetwork::V4(network) => {
+ let ip_u32 = u32::from(network.ip());
+ let mask_u32 = u32::from(network.mask());
+
+ IpAddr::V4(Ipv4Addr::from(ip_u32 | !mask_u32))
+ }
+ IpNetwork::V6(network) => {
+ let ip_u128 = u128::from(network.ip());
+ let mask_u128 = u128::from(network.mask());
+
+ IpAddr::V6(Ipv6Addr::from(ip_u128 | !mask_u128))
+ }
+ }
+}
+
+fn new_anon_set(
+ table: &Table,
+ family: ProtoFamily,
+ interval_set: bool,
+) -> Result, FirewallError>
+where
+ T: SetKey,
+{
+ let set = Set::::new(
+ &CString::new(ANON_SET_NAME)
+ .expect("Failed to create CString from ANON_SET_NAME constant."),
+ get_set_id(),
+ table,
+ family,
+ );
+
+ if interval_set {
+ unsafe {
+ nftnl_sys::nftnl_set_set_u32(
+ set.as_ptr(),
+ nftnl_sys::NFTNL_SET_FLAGS as u16,
+ (libc::NFT_SET_ANONYMOUS | libc::NFT_SET_CONSTANT | libc::NFT_SET_INTERVAL) as u32,
+ );
+ }
+ }
+
+ Ok(set)
+}
+
+/// Adds key to a set. If the range_end option is specified, it will assume the lower and upper
+/// bounds of a range need to be added.
+fn add_to_set(
+ set: *mut nftnl_sys::nftnl_set,
+ key: &K,
+ range_end: Option<&K>,
+) -> Result<(), FirewallError>
+where
+ K: SetKey,
+{
+ let key_data = key.data();
+ let key_data_len = key_data.len() as u32;
+ unsafe {
+ let elem = nftnl_sys::nftnl_set_elem_alloc();
+ if elem.is_null() {
+ return Err(FirewallError::OutOfMemory(
+ "Failed to allocate memory for set element".to_string(),
+ ));
+ }
+ nftnl_sys::nftnl_set_elem_set(
+ elem,
+ nftnl_sys::NFTNL_SET_ELEM_KEY as u16,
+ key_data.as_ptr().cast(),
+ key_data_len,
+ );
+ nftnl_sys::nftnl_set_elem_add(set, elem);
+
+ if let Some(end) = range_end {
+ let mut end_data = end.data();
+
+ // This is a workaround to make the upper bound inclusive.
+ // Perhaps there is a better way to do this.
+ increment_bytes(&mut end_data);
+ let end_data_len = (end_data.len()) as u32;
+
+ let elem = nftnl_sys::nftnl_set_elem_alloc();
+ if elem.is_null() {
+ return Err(FirewallError::OutOfMemory(
+ "Failed to allocate memory for set element".to_string(),
+ ));
+ }
+ nftnl_sys::nftnl_set_elem_set(
+ elem,
+ nftnl_sys::NFTNL_SET_ELEM_KEY as u16,
+ end_data.as_ptr().cast(),
+ end_data_len,
+ );
+ nftnl_sys::nftnl_set_elem_set_u32(
+ elem,
+ nftnl_sys::NFTNL_SET_ELEM_FLAGS as u16,
+ libc::NFT_SET_ELEM_INTERVAL_END as u32,
+ );
+ nftnl_sys::nftnl_set_elem_add(set, elem);
+ }
+ }
+
+ Ok(())
+}
+
+fn increment_bytes(bytes: &mut [u8]) {
+ for i in (0..bytes.len()).rev() {
+ if bytes[i] < 255 {
+ bytes[i] += 1;
+ return;
+ } else {
+ bytes[i] = 0;
+ }
+ }
+
+ // the bytes have overflown, but that's okay for our purposes
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn test_increment_ipv4_basic() {
+ let mut ip = [192, 168, 1, 1];
+ increment_bytes(&mut ip);
+ assert_eq!(ip, [192, 168, 1, 2]);
+ }
+
+ #[test]
+ fn test_increment_ipv4_overflow_last_octet() {
+ let mut ip = [192, 168, 1, 255];
+ increment_bytes(&mut ip);
+ assert_eq!(ip, [192, 168, 2, 0]);
+ }
+
+ #[test]
+ fn test_increment_ipv4_overflow_multiple_octets() {
+ let mut ip = [192, 168, 255, 255];
+ increment_bytes(&mut ip);
+ assert_eq!(ip, [192, 169, 0, 0]);
+ }
+
+ #[test]
+ fn test_increment_ipv4_max_address() {
+ let mut ip = [255, 255, 255, 255];
+ increment_bytes(&mut ip);
+ assert_eq!(ip, [0, 0, 0, 0]);
+ }
+
+ #[test]
+ fn test_increment_ipv4_zero_address() {
+ let mut ip = [0, 0, 0, 0];
+ increment_bytes(&mut ip);
+ assert_eq!(ip, [0, 0, 0, 1]);
+ }
+
+ #[test]
+ fn test_increment_ipv6_basic() {
+ let mut ip = [0, 0, 0, 0, 0, 0, 0, 0];
+ increment_bytes(&mut ip);
+ assert_eq!(ip, [0, 0, 0, 0, 0, 0, 0, 1]);
+ }
+
+ #[test]
+ fn test_increment_ipv6_overflow_last_octet() {
+ let mut ip = [0, 0, 0, 0, 0, 0, 0, 255];
+ increment_bytes(&mut ip);
+ assert_eq!(ip, [0, 0, 0, 0, 0, 0, 1, 0]);
+ }
+
+ #[test]
+ fn test_increment_ipv6_overflow_multiple_octets() {
+ let mut ip = [0, 0, 0, 0, 0, 0, 255, 255];
+ increment_bytes(&mut ip);
+ assert_eq!(ip, [0, 0, 0, 0, 0, 1, 0, 0]);
+ }
+
+ #[test]
+ fn test_increment_ipv6_max_address() {
+ let mut ip = [255, 255, 255, 255, 255, 255, 255, 255];
+ increment_bytes(&mut ip);
+ assert_eq!(ip, [0, 0, 0, 0, 0, 0, 0, 0]);
+ }
+
+ #[test]
+ fn test_max_address_ipv4_24() {
+ let network = IpNetwork::V4(Ipv4Network::from_str("192.168.1.0/24").unwrap());
+ let max = max_address(&network);
+ assert_eq!(max, IpAddr::V4(Ipv4Addr::new(192, 168, 1, 255)));
+ }
+
+ #[test]
+ fn test_max_address_ipv4_16() {
+ let network = IpNetwork::V4(Ipv4Network::from_str("10.1.0.0/16").unwrap());
+ let max = max_address(&network);
+ assert_eq!(max, IpAddr::V4(Ipv4Addr::new(10, 1, 255, 255)));
+ }
+
+ #[test]
+ fn test_max_address_ipv4_8() {
+ let network = IpNetwork::V4(Ipv4Network::from_str("172.16.0.0/8").unwrap());
+ let max = max_address(&network);
+ assert_eq!(max, IpAddr::V4(Ipv4Addr::new(172, 255, 255, 255)));
+ }
+
+ #[test]
+ fn test_max_address_ipv4_32() {
+ let network = IpNetwork::V4(Ipv4Network::from_str("192.168.1.1/32").unwrap());
+ let max = max_address(&network);
+ assert_eq!(max, IpAddr::V4(Ipv4Addr::new(192, 168, 1, 1)));
+ }
+
+ #[test]
+ fn test_max_address_ipv6_64() {
+ let network = IpNetwork::V6(Ipv6Network::from_str("2001:db8::/64").unwrap());
+ let max = max_address(&network);
+ assert_eq!(
+ max,
+ IpAddr::V6(Ipv6Addr::from_str("2001:db8::ffff:ffff:ffff:ffff").unwrap())
+ );
+ }
+
+ #[test]
+ fn test_max_address_ipv6_128() {
+ let network = IpNetwork::V6(Ipv6Network::from_str("2001:db8::1/128").unwrap());
+ let max = max_address(&network);
+ assert_eq!(max, IpAddr::V6(Ipv6Addr::from_str("2001:db8::1").unwrap()));
+ }
+
+ #[test]
+ fn test_max_address_ipv6_48() {
+ let network = IpNetwork::V6(Ipv6Network::from_str("2001:db8:1234::/48").unwrap());
+ let max = max_address(&network);
+ assert_eq!(
+ max,
+ IpAddr::V6(Ipv6Addr::from_str("2001:db8:1234:ffff:ffff:ffff:ffff:ffff").unwrap())
+ );
+ }
+}
diff --git a/src/enterprise/firewall/mod.rs b/src/enterprise/firewall/mod.rs
new file mode 100644
index 00000000..f68c6b85
--- /dev/null
+++ b/src/enterprise/firewall/mod.rs
@@ -0,0 +1,255 @@
+use std::{net::IpAddr, str::FromStr};
+
+use ipnetwork::IpNetwork;
+use thiserror::Error;
+
+use crate::proto;
+
+pub mod api;
+#[cfg(all(not(test), target_os = "linux"))]
+pub mod linux;
+
+#[cfg(any(test, not(target_os = "linux")))]
+pub mod dummy;
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
+pub enum Address {
+ Ip(IpAddr),
+ Network(IpNetwork),
+ Range(IpAddr, IpAddr),
+}
+
+impl Address {
+ pub fn from_proto(ip: &proto::enterprise::firewall::IpAddress) -> Result {
+ match &ip.address {
+ Some(proto::enterprise::firewall::ip_address::Address::Ip(ip)) => {
+ Ok(Self::Ip(IpAddr::from_str(ip).map_err(|err| {
+ FirewallError::TypeConversionError(format!("Invalid IP format: {err}"))
+ })?))
+ }
+ Some(proto::enterprise::firewall::ip_address::Address::IpSubnet(network)) => Ok(
+ Self::Network(IpNetwork::from_str(network).map_err(|err| {
+ FirewallError::TypeConversionError(format!("Invalid subnet format: {err}"))
+ })?),
+ ),
+ Some(proto::enterprise::firewall::ip_address::Address::IpRange(range)) => {
+ let start = IpAddr::from_str(&range.start).map_err(|err| {
+ FirewallError::TypeConversionError(format!("Invalid IP format: {err}"))
+ })?;
+ let end = IpAddr::from_str(&range.end).map_err(|err| {
+ FirewallError::TypeConversionError(format!("Invalid IP format: {err}"))
+ })?;
+ if start > end {
+ return Err(FirewallError::TypeConversionError(format!(
+ "Invalid IP range: start IP ({start}) is greater than end IP ({end})",
+ )));
+ }
+ Ok(Self::Range(start, end))
+ }
+ _ => Err(FirewallError::TypeConversionError(format!(
+ "Invalid IP address type. Must be one of Ip, IpSubnet, IpRange. Instead got {:?}",
+ ip.address
+ ))),
+ }
+ }
+}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
+pub enum Port {
+ Single(u16),
+ Range(u16, u16),
+}
+
+impl Port {
+ pub fn from_proto(port: &proto::enterprise::firewall::Port) -> Result {
+ match &port.port {
+ Some(proto::enterprise::firewall::port::Port::SinglePort(port)) => {
+ let port_u16 = u16::try_from(*port).map_err(|err| {
+ FirewallError::TypeConversionError(format!(
+ "Invalid port number ({port}): {err}"
+ ))
+ })?;
+ Ok(Self::Single(port_u16))
+ }
+ Some(proto::enterprise::firewall::port::Port::PortRange(range)) => {
+ let start_u16 = u16::try_from(range.start).map_err(|err| {
+ FirewallError::TypeConversionError(format!(
+ "Invalid range start port number ({}): {err}",
+ range.start
+ ))
+ })?;
+ let end_u16 = u16::try_from(range.end).map_err(|err| {
+ FirewallError::TypeConversionError(format!(
+ "Invalid range end port number ({}): {err}",
+ range.end
+ ))
+ })?;
+ if start_u16 > end_u16 {
+ return Err(FirewallError::TypeConversionError(format!(
+ "Invalid port range: start port ({start_u16}) is greater than end port ({end_u16})"
+ )));
+ }
+ Ok(Self::Range(start_u16, end_u16))
+ }
+ _ => Err(FirewallError::TypeConversionError(format!(
+ "Invalid port type. Must be one of SinglePort, PortRange. Instead got: {:?}",
+ port.port
+ ))),
+ }
+ }
+}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
+pub struct Protocol(pub u8);
+
+// Protocols that have the concept of ports
+pub const PORT_PROTOCOLS: [Protocol; 2] = [
+ // TCP
+ Protocol(6),
+ // UDP
+ Protocol(17),
+];
+
+impl Protocol {
+ #[must_use]
+ pub fn supports_ports(&self) -> bool {
+ PORT_PROTOCOLS.contains(self)
+ }
+}
+
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub enum Policy {
+ #[default]
+ Allow,
+ Deny,
+}
+
+impl From for Policy {
+ fn from(allow: bool) -> Self {
+ if allow {
+ Self::Allow
+ } else {
+ Self::Deny
+ }
+ }
+}
+
+impl Policy {
+ #[must_use]
+ pub const fn from_proto(verdict: proto::enterprise::firewall::FirewallPolicy) -> Self {
+ match verdict {
+ proto::enterprise::firewall::FirewallPolicy::Allow => Self::Allow,
+ proto::enterprise::firewall::FirewallPolicy::Deny => Self::Deny,
+ }
+ }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct FirewallRule {
+ pub comment: Option,
+ pub destination_addrs: Vec,
+ pub destination_ports: Vec,
+ pub id: i64,
+ pub verdict: Policy,
+ pub protocols: Vec,
+ pub source_addrs: Vec,
+ /// Whether a rule uses IPv4 (true) or IPv6 (false)
+ pub ipv4: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct FirewallConfig {
+ pub rules: Vec,
+ pub default_policy: Policy,
+ /// Whether the rules use IPv4 (true) or IPv6 (false)
+ pub ipv4: bool,
+}
+
+impl FirewallConfig {
+ pub fn from_proto(
+ config: proto::enterprise::firewall::FirewallConfig,
+ ) -> Result {
+ debug!("Parsing following received firewall proto configuration: {config:?}");
+ let mut rules = Vec::new();
+ let v4 = config.ip_version == proto::enterprise::firewall::IpVersion::Ipv4 as i32;
+ let default_policy =
+ Policy::from_proto(config.default_policy.try_into().map_err(|err| {
+ FirewallError::TypeConversionError(format!("Invalid default policy: {err:?}"))
+ })?);
+ debug!("Using IPv4: {v4:?}, default firewall policy defined: {default_policy:?}. Proceeding to parsing rules...");
+
+ for rule in config.rules {
+ debug!("Parsing the following received Defguard ACL proto rule: {rule:?}");
+ let mut source_addrs = Vec::new();
+ let mut destination_addrs = Vec::new();
+ let mut destination_ports = Vec::new();
+ let mut protocols = Vec::new();
+
+ for addr in rule.source_addrs {
+ source_addrs.push(Address::from_proto(&addr)?);
+ }
+
+ for addr in rule.destination_addrs {
+ destination_addrs.push(Address::from_proto(&addr)?);
+ }
+
+ for port in rule.destination_ports {
+ destination_ports.push(Port::from_proto(&port)?);
+ }
+
+ for protocol in rule.protocols {
+ protocols.push(Protocol::from_proto(
+ // Since the protocol is an i32, convert it to the proto enum variant first
+ proto::enterprise::firewall::Protocol::try_from(protocol).map_err(|err| {
+ FirewallError::TypeConversionError(format!(
+ "Invalid protocol: {protocol:?}. Details: {err:?}",
+ ))
+ })?,
+ )?);
+ }
+
+ let verdict = Policy::from_proto(rule.verdict.try_into().map_err(|err| {
+ FirewallError::TypeConversionError(format!("Invalid rule verdict: {err:?}"))
+ })?);
+
+ let firewall_rule = FirewallRule {
+ id: rule.id,
+ source_addrs,
+ destination_addrs,
+ destination_ports,
+ protocols,
+ verdict,
+ ipv4: v4,
+ comment: rule.comment,
+ };
+
+ debug!("Parsed received proto rule as: {firewall_rule:?}");
+
+ rules.push(firewall_rule);
+ }
+
+ Ok(Self {
+ rules,
+ default_policy,
+ ipv4: v4,
+ })
+ }
+}
+
+#[derive(Debug, Error)]
+pub enum FirewallError {
+ #[error("Type conversion error: {0}")]
+ TypeConversionError(String),
+ #[error("Out of memory: {0}")]
+ OutOfMemory(String),
+ #[error("Unsupported protocol: {0}")]
+ UnsupportedProtocol(u8),
+ #[error("Netlink error: {0}")]
+ NetlinkError(String),
+ #[error("Invalid configuration: {0}")]
+ InvalidConfiguration(String),
+ #[error("Firewall transaction not started. Start the firewall transaction first in order to interact with the firewall API.")]
+ TransactionNotStarted,
+ #[error("Firewall transaction failed: {0}")]
+ TransactionFailed(String),
+}
diff --git a/src/enterprise/mod.rs b/src/enterprise/mod.rs
new file mode 100644
index 00000000..a0734b85
--- /dev/null
+++ b/src/enterprise/mod.rs
@@ -0,0 +1 @@
+pub mod firewall;
diff --git a/src/error.rs b/src/error.rs
index e03cfa88..d05e5d45 100644
--- a/src/error.rs
+++ b/src/error.rs
@@ -1,6 +1,8 @@
use defguard_wireguard_rs::error::WireguardInterfaceError;
use thiserror::Error;
+use crate::enterprise::firewall::FirewallError;
+
#[derive(Debug, Error)]
pub enum GatewayError {
#[error("Command {command} execution failed. Error: {error}")]
@@ -38,4 +40,7 @@ pub enum GatewayError {
#[error(transparent)]
IoError(#[from] std::io::Error),
+
+ #[error("Firewall error: {0}")]
+ FirewallError(#[from] FirewallError),
}
diff --git a/src/gateway.rs b/src/gateway.rs
index dd1dda8b..e4fc7fda 100644
--- a/src/gateway.rs
+++ b/src/gateway.rs
@@ -9,6 +9,7 @@ use std::{
time::{Duration, SystemTime},
};
+use defguard_wireguard_rs::{net::IpAddrMask, WireguardInterfaceApi};
use gethostname::gethostname;
use tokio::{
select,
@@ -25,17 +26,21 @@ use tonic::{
Request, Status, Streaming,
};
+#[cfg(target_os = "linux")]
+use crate::enterprise::firewall::api::FirewallManagementApi;
+#[cfg(any(target_os = "linux", test))]
+use crate::enterprise::firewall::FirewallRule;
use crate::{
config::Config,
+ enterprise::firewall::{api::FirewallApi, FirewallConfig},
error::GatewayError,
execute_command, mask,
- proto::{
+ proto::gateway::{
gateway_service_client::GatewayServiceClient, stats_update::Payload, update, Configuration,
ConfigurationRequest, Peer, StatsUpdate, Update,
},
VERSION,
};
-use defguard_wireguard_rs::{net::IpAddrMask, WireguardInterfaceApi};
const TEN_SECS: Duration = Duration::from_secs(10);
@@ -101,6 +106,10 @@ pub struct Gateway {
interface_configuration: Option,
peers: HashMap,
wgapi: Arc>,
+ #[cfg_attr(not(target_os = "linux"), allow(unused))]
+ firewall_api: FirewallApi,
+ #[cfg_attr(not(target_os = "linux"), allow(unused))]
+ firewall_config: Option,
pub connected: Arc,
client: GatewayServiceClient>,
stats_thread: Option>,
@@ -110,6 +119,7 @@ impl Gateway {
pub fn new(
config: Config,
wgapi: impl WireguardInterfaceApi + Send + Sync + 'static,
+ firewall_api: FirewallApi,
) -> Result {
let client = Self::setup_client(&config)?;
Ok(Self {
@@ -120,6 +130,8 @@ impl Gateway {
connected: Arc::new(AtomicBool::new(false)),
client,
stats_thread: None,
+ firewall_api,
+ firewall_config: None,
})
}
@@ -134,7 +146,7 @@ impl Gateway {
}
// check if new received configuration is different than current one
- fn is_config_changed(
+ fn is_interface_config_changed(
&self,
new_interface_configuration: &InterfaceConfiguration,
new_peers: &[Peer],
@@ -166,7 +178,7 @@ impl Gateway {
!new_peers.iter().all(|peer| {
self.peers
.get(&peer.pubkey)
- .map_or(false, |p| peer.allowed_ips == p.allowed_ips)
+ .is_some_and(|p| peer.allowed_ips == p.allowed_ips)
})
}
@@ -201,11 +213,11 @@ impl Gateway {
);
for peer in peers.into_values().filter(|p| {
p.last_handshake
- .map_or(false, |lhs| lhs != SystemTime::UNIX_EPOCH)
+ .is_some_and(|lhs| lhs != SystemTime::UNIX_EPOCH)
}) {
let has_changed = peer_map
.get(&peer.public_key)
- .map_or(true, |last_peer| *last_peer != peer);
+ .is_none_or(|last_peer| *last_peer != peer);
if has_changed {
peer_map.insert(peer.public_key.clone(), peer.clone());
id += 1;
@@ -247,6 +259,91 @@ impl Gateway {
}
}
+ /// Checks whether the firewall config changed
+ #[cfg(any(target_os = "linux", test))]
+ fn has_firewall_config_changed(&self, new_fw_config: &FirewallConfig) -> bool {
+ if let Some(current_config) = &self.firewall_config {
+ return current_config.default_policy != new_fw_config.default_policy
+ || current_config.ipv4 != new_fw_config.ipv4
+ || self.has_firewall_rules_changed(&new_fw_config.rules);
+ }
+
+ true
+ }
+
+ /// Checks whether the firewall rules have changed.
+ #[cfg(any(target_os = "linux", test))]
+ fn has_firewall_rules_changed(&self, new_rules: &[FirewallRule]) -> bool {
+ debug!("Checking if Defguard ACL rules have changed");
+ if let Some(current_config) = &self.firewall_config {
+ let current_rules = ¤t_config.rules;
+ if current_rules.len() != new_rules.len() {
+ debug!("Number of Defguard ACL rules is different, so the rules have changed");
+ return true;
+ }
+
+ for rule in new_rules {
+ if !current_rules.contains(rule) {
+ debug!("Found a new Defguard ACL rule: {rule:?}. Rules have changed.");
+ return true;
+ }
+ }
+
+ for rule in current_rules {
+ if !new_rules.contains(rule) {
+ debug!("Found a removed Defguard ACL rule: {rule:?}. Rules have changed.");
+ return true;
+ }
+ }
+
+ debug!("Defguard ACL rules are the same. Rules have not changed. My rules: {current_rules:?}, new rules: {new_rules:?}");
+ false
+ } else {
+ debug!("There are new Defguard ACL rules in the new configuration, but we don't have any in the current one. Rules have changed.");
+ true
+ }
+ }
+
+ /// Process and apply firewall configuration changes.
+ /// - If the main config changed (default policy), reconfigure the whole firewall.
+ /// - If only the rules changed, apply the new rules. Currently also reconfigures the whole firewall but that
+ /// should be temporary.
+ ///
+ /// TODO: Reduce cloning here
+ #[cfg(target_os = "linux")]
+ fn process_firewall_changes(
+ &mut self,
+ fw_config: Option<&FirewallConfig>,
+ ) -> Result<(), GatewayError> {
+ if let Some(fw_config) = fw_config {
+ debug!("Received firewall configuration: {fw_config:?}");
+ if self.has_firewall_config_changed(fw_config) {
+ debug!("Received firewall configuration is different than current one. Reconfiguring firewall...");
+ self.firewall_api.begin()?;
+ self.firewall_api
+ .setup(Some(fw_config.default_policy), self.config.fw_priority)?;
+ if self.config.masquerade {
+ self.firewall_api.set_masquerade_status(true)?;
+ }
+ self.firewall_api.add_rules(fw_config.rules.clone())?;
+ self.firewall_api.commit()?;
+ self.firewall_config = Some(fw_config.clone());
+ info!("Reconfigured firewall with new configuration");
+ } else {
+ debug!("Received firewall configuration is the same as current one. Skipping reconfiguration.");
+ }
+ } else {
+ debug!("Received firewall configuration is empty, cleaning up firewall rules...");
+ self.firewall_api.begin()?;
+ self.firewall_api.cleanup()?;
+ self.firewall_api.commit()?;
+ self.firewall_config = None;
+ debug!("Cleaned up firewall rules");
+ }
+
+ Ok(())
+ }
+
/// Performs complete interface reconfiguration based on `configuration` object.
/// Called when gateway (re)connects to gRPC endpoint and retrieves complete
/// network and peers data.
@@ -262,27 +359,42 @@ impl Gateway {
// check if new configuration is different than current one
let new_interface_configuration = new_configuration.clone().into();
- if !self.is_config_changed(&new_interface_configuration, &new_configuration.peers) {
- debug!("Received configuration is identical to current one. Skipping interface reconfiguration");
- return Ok(());
- };
- self.wgapi
- .lock()
- .unwrap()
- .configure_interface(&new_configuration.clone().into())?;
- info!(
- "Reconfigured WireGuard interface {} (addresses: {:?})",
- new_configuration.name, new_configuration.addresses
- );
- trace!(
- "Reconfigured WireGuard interface. Configuration: {:?}",
- mask!(new_configuration, prvkey)
- );
+ if self.is_interface_config_changed(&new_interface_configuration, &new_configuration.peers)
+ {
+ debug!(
+ "Received configuration is different than the current one. Reconfiguring interface..."
+ );
+ self.wgapi
+ .lock()
+ .unwrap()
+ .configure_interface(&new_configuration.clone().into())?;
+ info!(
+ "Reconfigured WireGuard interface {} (addresses: {:?})",
+ new_configuration.name, new_configuration.addresses
+ );
+ trace!(
+ "Reconfigured WireGuard interface. Configuration: {:?}",
+ mask!(new_configuration, prvkey)
+ );
+ // store new configuration and peers
+ self.interface_configuration = Some(new_interface_configuration);
+ self.replace_peers(new_configuration.peers);
+ } else {
+ debug!("Received configuration is identical to the current one. Skipping interface reconfiguration.");
+ }
- // store new configuration and peers
- self.interface_configuration = Some(new_interface_configuration);
- self.replace_peers(new_configuration.peers);
+ #[cfg(target_os = "linux")]
+ {
+ let new_firewall_configuration =
+ if let Some(firewall_config) = new_configuration.firewall_config {
+ Some(FirewallConfig::from_proto(firewall_config)?)
+ } else {
+ None
+ };
+
+ self.process_firewall_changes(new_firewall_configuration.as_ref())?;
+ }
Ok(())
}
@@ -403,6 +515,33 @@ impl Gateway {
}
};
}
+ #[cfg(target_os = "linux")]
+ Some(update::Update::FirewallConfig(config)) => {
+ debug!("Applying received firewall configuration: {config:?}");
+ let config_str = format!("{:?}", config);
+ match FirewallConfig::from_proto(config) {
+ Ok(new_firewall_config) => {
+ debug!("Parsed the received firewall configuration: {new_firewall_config:?}, processing it and applying changes");
+ if let Err(err) =
+ self.process_firewall_changes(Some(&new_firewall_config))
+ {
+ error!("Failed to process received firewall configuration: {err}");
+ }
+ }
+ Err(err) => {
+ error!(
+ "Failed to parse received firewall configuration: {err}. Configuration: {config_str}"
+ );
+ }
+ }
+ }
+ #[cfg(target_os = "linux")]
+ Some(update::Update::DisableFirewall(_)) => {
+ debug!("Disabling firewall configuration");
+ if let Err(err) = self.process_firewall_changes(None) {
+ error!("Failed to disable firewall configuration: {err}");
+ }
+ }
_ => warn!("Unsupported kind of update: {update:?}"),
}
}
@@ -437,6 +576,13 @@ impl Gateway {
"Couldn't create network interface {}: {err}. Proceeding anyway.",
self.config.ifname
);
+ } else {
+ #[cfg(target_os = "linux")]
+ if self.config.masquerade {
+ self.firewall_api.begin()?;
+ self.firewall_api.set_masquerade_status(true)?;
+ self.firewall_api.commit()?;
+ }
}
info!(
@@ -471,8 +617,10 @@ mod tests {
#[cfg(target_os = "macos")]
use defguard_wireguard_rs::Userspace;
use defguard_wireguard_rs::WGApi;
+ use ipnetwork::IpNetwork;
use super::*;
+ use crate::enterprise::firewall::{Address, FirewallRule, Policy, Port, Protocol};
#[tokio::test]
async fn test_configuration_comparison() {
@@ -509,6 +657,7 @@ mod tests {
let wgapi = WGApi::::new("wg0".into()).unwrap();
let config = Config::default();
let client = Gateway::setup_client(&config).unwrap();
+ let firewall_api = FirewallApi::new("wg0");
let gateway = Gateway {
config,
interface_configuration: Some(old_config.clone()),
@@ -517,12 +666,14 @@ mod tests {
connected: Arc::new(AtomicBool::new(false)),
client,
stats_thread: None,
+ firewall_api,
+ firewall_config: None,
};
// new config is the same
let new_config = old_config.clone();
let new_peers = old_peers.clone();
- assert!(!gateway.is_config_changed(&new_config, &new_peers));
+ assert!(!gateway.is_interface_config_changed(&new_config, &new_peers));
// only interface config is different
let new_config = InterfaceConfiguration {
@@ -532,14 +683,14 @@ mod tests {
port: 50051,
};
let new_peers = old_peers.clone();
- assert!(gateway.is_config_changed(&new_config, &new_peers));
+ assert!(gateway.is_interface_config_changed(&new_config, &new_peers));
// peer was removed
let new_config = old_config.clone();
let mut new_peers = old_peers.clone();
new_peers.pop();
- assert!(gateway.is_config_changed(&new_config, &new_peers));
+ assert!(gateway.is_interface_config_changed(&new_config, &new_peers));
// peer was added
let new_config = old_config.clone();
@@ -551,7 +702,7 @@ mod tests {
keepalive_interval: None,
});
- assert!(gateway.is_config_changed(&new_config, &new_peers));
+ assert!(gateway.is_interface_config_changed(&new_config, &new_peers));
// peer pubkey changed
let new_config = old_config.clone();
@@ -570,7 +721,7 @@ mod tests {
},
];
- assert!(gateway.is_config_changed(&new_config, &new_peers));
+ assert!(gateway.is_interface_config_changed(&new_config, &new_peers));
// peer IP changed
let new_config = old_config.clone();
@@ -589,7 +740,7 @@ mod tests {
},
];
- assert!(gateway.is_config_changed(&new_config, &new_peers));
+ assert!(gateway.is_interface_config_changed(&new_config, &new_peers));
// peer preshared key changed
let new_config = old_config.clone();
@@ -608,7 +759,7 @@ mod tests {
},
];
- assert!(gateway.is_config_changed(&new_config, &new_peers));
+ assert!(gateway.is_interface_config_changed(&new_config, &new_peers));
// peer keepalive interval changed
let new_config = old_config.clone();
@@ -627,6 +778,190 @@ mod tests {
},
];
- assert!(gateway.is_config_changed(&new_config, &new_peers));
+ assert!(gateway.is_interface_config_changed(&new_config, &new_peers));
+ }
+
+ #[tokio::test]
+ async fn test_firewall_rules_comparison() {
+ use std::net::IpAddr;
+
+ let rule1 = FirewallRule {
+ comment: Some("Rule 1".to_string()),
+ destination_addrs: vec![Address::Ip(IpAddr::from_str("10.0.0.1").unwrap())],
+ destination_ports: vec![Port::Single(80)],
+ id: 1,
+ verdict: Policy::Allow,
+ protocols: vec![Protocol(6)], // TCP
+ source_addrs: vec![Address::Ip(IpAddr::from_str("192.168.1.1").unwrap())],
+ ipv4: true,
+ };
+
+ let rule2 = FirewallRule {
+ comment: Some("Rule 2".to_string()),
+ destination_addrs: vec![Address::Ip(IpAddr::from_str("10.0.0.2").unwrap())],
+ destination_ports: vec![Port::Single(443)],
+ id: 2,
+ verdict: Policy::Allow,
+ protocols: vec![Protocol(6)], // TCP
+ source_addrs: vec![Address::Ip(IpAddr::from_str("192.168.1.2").unwrap())],
+ ipv4: true,
+ };
+
+ let rule3 = FirewallRule {
+ comment: Some("Rule 3".to_string()),
+ destination_addrs: vec![Address::Network(
+ IpNetwork::from_str("10.0.1.0/24").unwrap(),
+ )],
+ destination_ports: vec![Port::Range(1000, 2000)],
+ id: 3,
+ verdict: Policy::Deny,
+ protocols: vec![Protocol(17)], // UDP
+ source_addrs: vec![Address::Network(
+ IpNetwork::from_str("192.168.0.0/16").unwrap(),
+ )],
+ ipv4: true,
+ };
+
+ let config1 = FirewallConfig {
+ rules: vec![rule1.clone(), rule2.clone()],
+ default_policy: Policy::Allow,
+ ipv4: true,
+ };
+
+ let config_empty = FirewallConfig {
+ rules: vec![],
+ default_policy: Policy::Allow,
+ ipv4: true,
+ };
+
+ #[cfg(target_os = "macos")]
+ let wgapi = WGApi::::new("wg0".into()).unwrap();
+ #[cfg(not(target_os = "macos"))]
+ let wgapi = WGApi::::new("wg0".into()).unwrap();
+
+ let config = Config::default();
+ let client = Gateway::setup_client(&config).unwrap();
+ let mut gateway = Gateway {
+ config,
+ interface_configuration: None,
+ peers: HashMap::new(),
+ wgapi: Arc::new(Mutex::new(wgapi)),
+ connected: Arc::new(AtomicBool::new(false)),
+ client,
+ stats_thread: None,
+ firewall_api: FirewallApi::new("test_interface"),
+ firewall_config: None,
+ };
+
+ // Gateway has no firewall config, new rules are empty
+ gateway.firewall_config = None;
+ assert!(gateway.has_firewall_rules_changed(&[]));
+
+ // Gateway has no firewall config, but new rules exist
+ gateway.firewall_config = None;
+ assert!(gateway.has_firewall_rules_changed(&[rule1.clone()]));
+
+ // Gateway has firewall config, with empty rules list
+ gateway.firewall_config = Some(config1.clone());
+ assert!(gateway.has_firewall_rules_changed(&[]));
+
+ // Gateway has firewall config, new rules have different length
+ gateway.firewall_config = Some(config1.clone());
+ assert!(gateway.has_firewall_rules_changed(&[rule1.clone()]));
+
+ // Gateway has firewall config, new rules have different content
+ gateway.firewall_config = Some(config1.clone());
+ assert!(gateway.has_firewall_rules_changed(&[rule1.clone(), rule3.clone()]));
+
+ // Gateway has firewall config, new rules are identical
+ gateway.firewall_config = Some(config1.clone());
+ assert!(!gateway.has_firewall_rules_changed(&[rule1.clone(), rule2.clone()]));
+
+ // Gateway has empty firewall config, new rules exist
+ gateway.firewall_config = Some(config_empty.clone());
+ assert!(gateway.has_firewall_rules_changed(&[rule1.clone()]));
+
+ // Both configs are empty
+ gateway.firewall_config = Some(config_empty);
+ assert!(!gateway.has_firewall_rules_changed(&[]));
+ }
+
+ #[tokio::test]
+ async fn test_firewall_config_comparison() {
+ let config1 = FirewallConfig {
+ rules: vec![],
+ default_policy: Policy::Allow,
+ ipv4: true,
+ };
+
+ let config2 = FirewallConfig {
+ rules: vec![],
+ default_policy: Policy::Deny,
+ ipv4: true,
+ };
+
+ let config3 = FirewallConfig {
+ rules: vec![],
+ default_policy: Policy::Allow,
+ ipv4: false,
+ };
+
+ let config4 = FirewallConfig {
+ rules: vec![],
+ default_policy: Policy::Allow,
+ ipv4: true,
+ };
+
+ #[cfg(target_os = "macos")]
+ let wgapi = WGApi::::new("wg0".into()).unwrap();
+ #[cfg(not(target_os = "macos"))]
+ let wgapi = WGApi::::new("wg0".into()).unwrap();
+
+ let config = Config::default();
+ let client = Gateway::setup_client(&config).unwrap();
+ let mut gateway = Gateway {
+ config,
+ interface_configuration: None,
+ peers: HashMap::new(),
+ wgapi: Arc::new(Mutex::new(wgapi)),
+ connected: Arc::new(AtomicBool::new(false)),
+ client,
+ stats_thread: None,
+ firewall_api: FirewallApi::new("test_interface"),
+ firewall_config: None,
+ };
+ // Gateway has no config
+ gateway.firewall_config = None;
+ assert!(gateway.has_firewall_config_changed(&config1));
+
+ // Gateway has config, new config has different default_policy
+ gateway.firewall_config = Some(config1.clone());
+ assert!(gateway.has_firewall_config_changed(&config2));
+
+ // Gateway has config, new config has different v4 value
+ gateway.firewall_config = Some(config1.clone());
+ assert!(gateway.has_firewall_config_changed(&config3));
+
+ // Gateway has config, new config is identical
+ gateway.firewall_config = Some(config1.clone());
+ assert!(!gateway.has_firewall_config_changed(&config4));
+
+ // Rules are not being ignored
+ let config5 = FirewallConfig {
+ rules: vec![FirewallRule {
+ comment: None,
+ destination_addrs: vec![],
+ destination_ports: vec![],
+ id: 0,
+ verdict: Policy::Allow,
+ protocols: vec![],
+ source_addrs: vec![],
+ ipv4: true,
+ }],
+ default_policy: Policy::Allow,
+ ipv4: true,
+ };
+ gateway.firewall_config = Some(config1);
+ assert!(gateway.has_firewall_config_changed(&config5));
}
}
diff --git a/src/lib.rs b/src/lib.rs
index 8fef5c67..251696cf 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -4,7 +4,14 @@ pub mod gateway;
pub mod server;
pub mod proto {
- tonic::include_proto!("gateway");
+ pub mod gateway {
+ tonic::include_proto!("gateway");
+ }
+ pub mod enterprise {
+ pub mod firewall {
+ tonic::include_proto!("enterprise.firewall");
+ }
+ }
}
#[macro_use]
@@ -17,6 +24,8 @@ use defguard_wireguard_rs::{host::Peer, net::IpAddrMask, InterfaceConfiguration}
use error::GatewayError;
use syslog::{BasicLogger, Facility, Formatter3164};
+pub mod enterprise;
+
pub const VERSION: &str = concat!(env!("CARGO_PKG_VERSION"), "-", env!("VERGEN_GIT_SHA"));
/// Masks object's field with "***" string.
@@ -64,10 +73,7 @@ pub fn execute_command(command: &str) -> Result<(), GatewayError> {
let stdout = String::from_utf8_lossy(&output.stdout);
let stderr = String::from_utf8_lossy(&output.stderr);
- info!(
- "Command {} executed successfully. Stdout: {}",
- command, stdout
- );
+ info!("Command {command} executed successfully. Stdout: {stdout}",);
if !stderr.is_empty() {
error!("Stderr:\n{stderr}");
}
@@ -79,8 +85,8 @@ pub fn execute_command(command: &str) -> Result<(), GatewayError> {
Ok(())
}
-impl From for InterfaceConfiguration {
- fn from(config: proto::Configuration) -> Self {
+impl From for InterfaceConfiguration {
+ fn from(config: proto::gateway::Configuration) -> Self {
let peers = config.peers.into_iter().map(Peer::from).collect();
// Try to convert an array of `String`s to `IpAddrMask`, leaving out the failed ones.
let addresses = config
@@ -99,8 +105,8 @@ impl From for InterfaceConfiguration {
}
}
-impl From for Peer {
- fn from(proto_peer: proto::Peer) -> Self {
+impl From for Peer {
+ fn from(proto_peer: proto::gateway::Peer) -> Self {
let mut peer = Self::new(proto_peer.pubkey.as_str().try_into().unwrap_or_default());
peer.persistent_keepalive_interval = proto_peer
.keepalive_interval
@@ -117,7 +123,7 @@ impl From for Peer {
}
}
-impl From<&Peer> for proto::Peer {
+impl From<&Peer> for proto::gateway::Peer {
fn from(peer: &Peer) -> Self {
let preshared_key = peer.preshared_key.as_ref().map(ToString::to_string);
Self {
@@ -129,7 +135,7 @@ impl From<&Peer> for proto::Peer {
}
}
-impl From<&Peer> for proto::PeerStats {
+impl From<&Peer> for proto::gateway::PeerStats {
fn from(peer: &Peer) -> Self {
Self {
public_key: peer.public_key.to_string(),
diff --git a/src/main.rs b/src/main.rs
index f83194a4..3a129cce 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,16 +1,15 @@
use std::{fs::File, io::Write, process, sync::Arc};
+use defguard_gateway::{
+ config::get_config, enterprise::firewall::api::FirewallApi, error::GatewayError,
+ execute_command, gateway::Gateway, init_syslog, server::run_server,
+};
#[cfg(not(target_os = "macos"))]
use defguard_wireguard_rs::Kernel;
use defguard_wireguard_rs::{Userspace, WGApi};
use env_logger::{init_from_env, Env, DEFAULT_FILTER_ENV};
use tokio::task::JoinSet;
-use defguard_gateway::{
- config::get_config, error::GatewayError, execute_command, gateway::Gateway, init_syslog,
- server::run_server,
-};
-
#[tokio::main]
async fn main() -> Result<(), GatewayError> {
// parse config
@@ -40,14 +39,16 @@ async fn main() -> Result<(), GatewayError> {
}
let ifname = config.ifname.clone();
+ let firewall_api = FirewallApi::new(&ifname);
+
let mut gateway = if config.userspace {
let wgapi = WGApi::::new(ifname)?;
- Gateway::new(config.clone(), wgapi)?
+ Gateway::new(config.clone(), wgapi, firewall_api)?
} else {
#[cfg(not(target_os = "macos"))]
{
let wgapi = WGApi::::new(ifname)?;
- Gateway::new(config.clone(), wgapi)?
+ Gateway::new(config.clone(), wgapi, firewall_api)?
}
#[cfg(target_os = "macos")]
{
@@ -55,6 +56,7 @@ async fn main() -> Result<(), GatewayError> {
return Ok(());
}
};
+
let mut tasks = JoinSet::new();
if let Some(health_port) = config.health_port {
tasks.spawn(run_server(health_port, Arc::clone(&gateway.connected)));