This PR allows the TURN allocation binding to be optionally configured
by `TURN_LOWEST_PORT` and `TURN_HIGHEST_PORT` environment variables.
This will allow client app developers to test their apps against a
fully-working local development cluster in Docker Desktop for
Linux/macOS/Windows, allowing us to remove the PortalMock, Connlib Mock,
and SwiftMock codepaths entirely.
cc @roop @pratikvelani
Previously, we required the user to specify a `LISTEN_IP4_ADDR` and/or a
`LISTEN_IP6_ADDR` parameter. This is cumbersome because dynamically
fetching the address of the local interface is not trivial in all
environments.
We remove this parameter in exchange for listening on all interfaces.
This is a trade-off. The relay will now listen on all interfaces, even
the ones not exposed to the public internet. This is true for the main
socket on port 3478 and for all created allocations. Actually relaying
data relies on the 4-tuple of a "connection", i.e. the source and
destination address and port. Technically, I think it is possible with
this change to send traffic to a relay via an interface that was not
intended to be used for that. I think this will still require spoofing
the source address which is a known and accepted problem.
It is still recommended that operators put appropriate firewall rules in
place to not allow ingress traffic on any interface other than the one
intended for relaying.
I've tested locally that we are correctly using the `IPV6_ONLY` flag. In
other words, a relay listening on the `0.0.0.0` wildcard interface will
not accept IPv6 traffic and vice versa.
Resolves#1886.
This PR should fix the way we handle the `length` field in the
`DataChannel` messages, previous to this fix relaying data (using the
`webrtc-rs` crate) was impossible)
The new way to handle this is if the actual message is bigger than what
this data field says we ignore the extra bytes (which I think is the
correct way to do it according to spec)
Also, I added an integration test to verify relay messages using
`iptables`, not the cleanest way to do it but the easiest, in this vein
I tried to fix the caching for rust containers since 2 integration test
in our current state would take ~20 minutes each.
Bumps [clap](https://github.com/clap-rs/clap) from 4.3.19 to 4.3.21.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/clap-rs/clap/releases">clap's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.21</h2>
<h2>[4.3.21] - 2023-08-08</h2>
<h3>Features</h3>
<ul>
<li>Expose <code>TryMapValueParser</code> so the type can be named</li>
</ul>
<h2>v4.3.20</h2>
<h2>[4.3.20] - 2023-08-08</h2>
<h3>Features</h3>
<ul>
<li>Expose <code>TryMapValueParser</code> so the type can be named</li>
<li><code>Command::mut_args</code> for modifying all arguments en
masse</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/clap-rs/clap/blob/master/CHANGELOG.md">clap's
changelog</a>.</em></p>
<blockquote>
<h2>[4.3.21] - 2023-08-08</h2>
<h3>Features</h3>
<ul>
<li>Expose <code>TryMapValueParser</code> so the type can be named</li>
</ul>
<h2>[4.3.20] - 2023-08-08</h2>
<h3>Features</h3>
<ul>
<li><code>Command::mut_args</code> for modifying all arguments en
masse</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ee1388c0a3"><code>ee1388c</code></a>
chore: Release</li>
<li><a
href="390436681a"><code>3904366</code></a>
docs: Update changelog</li>
<li><a
href="3156e1a35c"><code>3156e1a</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/5066">#5066</a>
from 9999years/export-trymapvalueparser</li>
<li><a
href="da19141560"><code>da19141</code></a>
chore: Release</li>
<li><a
href="b96cbafcbe"><code>b96cbaf</code></a>
chore: Release</li>
<li><a
href="174f12c7f8"><code>174f12c</code></a>
docs: Update changelog</li>
<li><a
href="fe04b3cc4e"><code>fe04b3c</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/5056">#5056</a>
from ModProg/dynamic-completions-help</li>
<li><a
href="aa3f47c239"><code>aa3f47c</code></a>
test(complete): Help for possible value</li>
<li><a
href="65b9c2b37d"><code>65b9c2b</code></a>
test(complete): Helper for asserting dynamic completions</li>
<li><a
href="c86172e891"><code>c86172e</code></a>
feat: Export <code>builder::TryMapValueParser</code></li>
<li>Additional commits viewable in <a
href="https://github.com/clap-rs/clap/compare/v4.3.19...v4.3.21">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [serde](https://github.com/serde-rs/serde) from 1.0.179 to
1.0.183.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/serde-rs/serde/releases">serde's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.183</h2>
<ul>
<li>Support deserializing <code>Box<OsStr></code> with an
equivalent representation as <code>OsString</code> (<a
href="https://redirect.github.com/serde-rs/serde/issues/2556">#2556</a>,
thanks <a
href="https://github.com/DBLouis"><code>@DBLouis</code></a>)</li>
</ul>
<h2>v1.0.182</h2>
<ul>
<li>Render field aliases in sorted order in error messages (<a
href="https://redirect.github.com/serde-rs/serde/issues/2458">#2458</a>,
thanks <a
href="https://github.com/Mingun"><code>@Mingun</code></a>)</li>
<li>Support <code>serde(default)</code> on tuple structs (<a
href="https://redirect.github.com/serde-rs/serde/issues/2553">#2553</a>,
thanks <a
href="https://github.com/Mingun"><code>@Mingun</code></a>)</li>
</ul>
<h2>v1.0.181</h2>
<ul>
<li>Make <code>serde(alias)</code> work in combination with
<code>flatten</code> when using in-place deserialization (<a
href="https://redirect.github.com/serde-rs/serde/issues/2443">#2443</a>,
thanks <a
href="https://github.com/Mingun"><code>@Mingun</code></a>)</li>
<li>Improve the representation of adjacently tagged enums in formats
where enum tags are serialized by index, as opposed to by string name
(<a
href="https://redirect.github.com/serde-rs/serde/issues/2505">#2505</a>,
<a
href="https://redirect.github.com/serde-rs/serde/issues/2496">#2496</a>,
thanks <a
href="https://github.com/Baptistemontan"><code>@Baptistemontan</code></a>)</li>
</ul>
<h2>v1.0.180</h2>
<ul>
<li>Update to 2018 edition</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="05a5b7e3c6"><code>05a5b7e</code></a>
Release 1.0.183</li>
<li><a
href="3bff326fb3"><code>3bff326</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/serde/issues/2555">#2555</a>
from Mingun/field</li>
<li><a
href="aaadd93878"><code>aaadd93</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/serde/issues/2556">#2556</a>
from DBLouis/master</li>
<li><a
href="9c864f0b02"><code>9c864f0</code></a>
Add forward impl for OsStr</li>
<li><a
href="070cce0d9c"><code>070cce0</code></a>
Get rid of temporary variable</li>
<li><a
href="b58e8bac12"><code>b58e8ba</code></a>
Replace <code>if let Some(...) = ...</code> to Option::map</li>
<li><a
href="ada50b077e"><code>ada50b0</code></a>
ignore_variant variable is always None, let's take this into
account</li>
<li><a
href="5e313a7330"><code>5e313a7</code></a>
Move generiс code out-of-function, create more specialized and simple
code</li>
<li><a
href="2a36d11238"><code>2a36d11</code></a>
Introduce a dedicated function for generating Field enum</li>
<li><a
href="b6685cf9dd"><code>b6685cf</code></a>
Release 1.0.182</li>
<li>Additional commits viewable in <a
href="https://github.com/serde-rs/serde/compare/v1.0.179...v1.0.183">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Previously, I thought it might be helpful to refuse a insecure
connections to the portal unless the user explicitly opts-in to this. In
our CI and testing environment, this however proved to cause more
headaches than it helps.
This PR removes this flag and assumes that users are smart enough that
they should protect self-hosted portals with transport-level encryption.
`webrtc-rs` has a race condition where `send_to` does not actually await
the channel binding, thus attempting to send something through the
channel from the other end my fail because we receive the bytes from the
relay before the library registers that there is an active channel.
This should hopefully fix the flakiness of the smoke test script.
This patch series adds support for IPv6 allocations. If not specified
otherwise in the ALLOCATE request, clients will get an IP4 allocation.
They can also request an IPv6 address or an additional IPv6 address in
addition to their IPv4 address.
Either of those is only possible if the relay actually has a listening
socket for the requested address family. The CLI is designed such that
the user can either specify IP4, IP6 or both of them.
The `Server` component handles all of this logic and responds with
either a successful allocation response or an Address Family Not
Supported error (see
https://www.rfc-editor.org/rfc/rfc8656#name-stun-error-response-codes).
Multiple refactorings were necessary to achieve this design, they are
all extracted into separate PRs:
Depends-On: #1831.
Depends-On: #1832.
Depends-On: #1833.
---------
Co-authored-by: Jamil <jamilbk@users.noreply.github.com>
This patch series refactors how we handle allocations in the relay to
make it easier to forward a failure to the `Server`. Each allocation
runs in a separate task (to allow for parallelization). If the
allocation fails, this channel is automatically closed.
Previously, this would erroneously trigger a `debug_assert!`. Now, we
invoke a callback on `Server` to allow it to clean up its internal
resources for the allocation.
At the same time, we simplify the buffering around data that is destined
for a certain allocation. Instead of having an additional buffer in the
event-loop, we increase the channel size to 10. Any exceeding items will
be dropped to avoid memory growth. This means that the `Server` is never
blocked on a slow allocation.
Given that we are running on top of an unreliable protocol anyway, I'd
say this is fine.
Currently, the primary UDP socket is polled within the `Eventloop`. In
order to not block the `Server` on the readiness of the socket, we
buffer all outgoing packets in a `VecDeque`.
This isn't particularly ergonomic.
In addition, whilst implementing the IPv6 support, I ran into a
limitation with this model. In case we operate in dual-stack mode, I
need to poll two UDP sockets but it is not clear in which order they
should be polled. The solution I am going for now is to have two
separate tasks, one per IP family and have them both write into the same
channel.
In order to keep #1814 smaller, I this PR represents a pure refactoring
towards that solution.
While developing IPv6 support, I ran into a limitations with how I
designed the prometheus metrics integration. Currently, we just use the
IPv4 listen socket to server the metrics. That however no longer works
with IPv6 support because the relay may now operate in IPv6 only mode
for example.
To circumvent this, we introduce a dedicated configuration option where
the user needs to pass the socket addr for the metrics endpoint. If
omitted, the metrics won't be served at all.
I finally figured out why the smoke test script was being funny. It
turns out that the TURN client I still had lying around in the `gateway`
binary was reading from the UDP socket in the background and thus
sometimes grabbed the relayed data and wanted to interpret it as a STUN
packet.
However, for this test, the `gateway` doesn't actually need a TURN
client at all. It communicates with the relay as if it were the `client`
itself.
By modifying the script to only work on localhost, we can avoid use of a
TURN client altogether in the relay and make this script deterministic
which is a big win for our CI confidence!
Bumps [clap](https://github.com/clap-rs/clap) from 4.3.10 to 4.3.19.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/clap-rs/clap/releases">clap's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.19</h2>
<h2>[4.3.19] - 2023-07-21</h2>
<h3>Fixes</h3>
<ul>
<li><em>(parse)</em> Respect <code>value_terminator</code> even in the
presence of later multiple-value positional arguments</li>
</ul>
<h2>v4.3.18</h2>
<h2>[4.3.18] - 2023-07-21</h2>
<h3>Fixes</h3>
<ul>
<li><em>(parse)</em> Suggest <code>--</code> in fewer places where it
won't work</li>
</ul>
<h2>v4.3.17</h2>
<h2>[4.3.17] - 2023-07-19</h2>
<h3>Fixes</h3>
<ul>
<li><em>(help)</em> Address a regression in wrapping
<code>PossibleValue</code> descriptions in <code>--help</code></li>
</ul>
<h2>v4.3.16</h2>
<h2>[4.3.16] - 2023-07-18</h2>
<h3>Fixes</h3>
<ul>
<li>Don't assert when stateful value parsers fail on defaults (e.g.
checking if a path exists)</li>
</ul>
<h2>v4.3.15</h2>
<h2>[4.3.15] - 2023-07-18</h2>
<h3>Features</h3>
<ul>
<li><em>(unstable-styles)</em> Re-export <code>anstyle</code></li>
</ul>
<h3>Documentation</h3>
<ul>
<li><em>(unstable-styles)</em> Provide more examples</li>
</ul>
<h2>v4.3.14</h2>
<h2>[4.3.14] - 2023-07-17</h2>
<h3>Features</h3>
<ul>
<li><code>ArgAction::HelpShort</code> and
<code>ArgAction::HelpLong</code> for explicitly specifying which style
of help to display</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Skip <code>[OPTIONS]</code> in usage if a help or version
<code>ArgAction</code> is used</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/clap-rs/clap/blob/master/CHANGELOG.md">clap's
changelog</a>.</em></p>
<blockquote>
<h2>[4.3.19] - 2023-07-21</h2>
<h3>Fixes</h3>
<ul>
<li><em>(parse)</em> Respect <code>value_terminator</code> even in the
presence of later multiple-value positional arguments</li>
</ul>
<h2>[4.3.18] - 2023-07-21</h2>
<h3>Fixes</h3>
<ul>
<li><em>(parse)</em> Suggest <code>--</code> in fewer places where it
won't work</li>
</ul>
<h2>[4.3.17] - 2023-07-19</h2>
<h3>Fixes</h3>
<ul>
<li><em>(help)</em> Address a regression in wrapping
<code>PossibleValue</code> descriptions in <code>--help</code></li>
</ul>
<h2>[4.3.16] - 2023-07-18</h2>
<h3>Fixes</h3>
<ul>
<li>Don't assert when stateful value parsers fail on defaults (e.g.
checking if a path exists)</li>
</ul>
<h2>[4.3.15] - 2023-07-18</h2>
<h3>Features</h3>
<ul>
<li><em>(unstable-styles)</em> Re-export <code>anstyle</code></li>
</ul>
<h3>Documentation</h3>
<ul>
<li><em>(unstable-styles)</em> Provide more examples</li>
</ul>
<h2>[4.3.14] - 2023-07-17</h2>
<h3>Features</h3>
<ul>
<li><code>ArgAction::HelpShort</code> and
<code>ArgAction::HelpLong</code> for explicitly specifying which style
of help to display</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Skip <code>[OPTIONS]</code> in usage if a help or version
<code>ArgAction</code> is used</li>
</ul>
<h2>[4.3.13] - 2023-07-17</h2>
<h2>[4.3.12] - 2023-07-14</h2>
<h3>Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ae5549d61f"><code>ae5549d</code></a>
chore: Release</li>
<li><a
href="4b30a2cfe1"><code>4b30a2c</code></a>
docs: Update changelog</li>
<li><a
href="5540d20286"><code>5540d20</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/5037">#5037</a>
from epage/term</li>
<li><a
href="8bee728034"><code>8bee728</code></a>
fix(parser): Value terminator has higher precedence than later multiple
values</li>
<li><a
href="bdf205bff2"><code>bdf205b</code></a>
test(parser): Show one value terminator bug</li>
<li><a
href="727ca29674"><code>727ca29</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/5034">#5034</a>
from epage/update</li>
<li><a
href="9856d67541"><code>9856d67</code></a>
chore: Release</li>
<li><a
href="a6267b77a7"><code>a6267b7</code></a>
docs: Update changelog</li>
<li><a
href="e82234162c"><code>e822341</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/5033">#5033</a>
from epage/escape</li>
<li><a
href="0137a8be65"><code>0137a8b</code></a>
chore(complete): Update completest</li>
<li>Additional commits viewable in <a
href="https://github.com/clap-rs/clap/compare/v4.3.10...v4.3.19">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [serde](https://github.com/serde-rs/serde) from 1.0.171 to
1.0.179.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/serde-rs/serde/releases">serde's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.179</h2>
<ul>
<li>Support serialization of tuple variants inside a flattened field (<a
href="https://redirect.github.com/serde-rs/serde/issues/2448">#2448</a>,
thanks <a
href="https://github.com/Mingun"><code>@Mingun</code></a>)</li>
</ul>
<h2>v1.0.178</h2>
<ul>
<li>Fix build error when using serde with "std" feature turned
off and "unstable" feature turned on (<a
href="https://redirect.github.com/serde-rs/serde/issues/2541">#2541</a>)</li>
</ul>
<h2>v1.0.177</h2>
<ul>
<li>Add <code>serde(rename_all_fields = "...")</code>
attribute to apply a <code>rename_all</code> on every struct variant of
an enum (<a
href="https://redirect.github.com/serde-rs/serde/issues/1695">#1695</a>,
thanks <a
href="https://github.com/jplatte"><code>@jplatte</code></a>)</li>
<li>Improve diagnostics for attribute parse errors (<a
href="https://redirect.github.com/serde-rs/serde/issues/2536">#2536</a>,
thanks <a
href="https://github.com/jplatte"><code>@jplatte</code></a>)</li>
</ul>
<h2>v1.0.176</h2>
<ul>
<li>Allow tag field of an internally tagged enum to have same name as a
field inside a skipped struct variant (<a
href="https://redirect.github.com/serde-rs/serde/issues/2266">#2266</a>,
thanks <a
href="https://github.com/flisky"><code>@flisky</code></a>)</li>
</ul>
<h2>v1.0.175</h2>
<ul>
<li>Restore missing LICENSE files in serde_derive crate (<a
href="https://redirect.github.com/serde-rs/serde/issues/2527">#2527</a>,
thanks <a
href="https://github.com/ankane"><code>@ankane</code></a>)</li>
</ul>
<h2>v1.0.174</h2>
<ul>
<li>Documentation improvements</li>
</ul>
<h2>v1.0.173</h2>
<ul>
<li>Fix missing trait implementations when using serde derive macro on a
macro-generated data structure, such as via the <code>bitflags</code>
crate (<a
href="https://redirect.github.com/serde-rs/serde/issues/2516">#2516</a>)</li>
</ul>
<h2>v1.0.172</h2>
<ul>
<li>Experiment with precompiling the serde_derive macros to reduce build
time (<a
href="https://redirect.github.com/serde-rs/serde/issues/2514">#2514</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c2b16bfbb0"><code>c2b16bf</code></a>
Release 1.0.179</li>
<li><a
href="e7df53701c"><code>e7df537</code></a>
Resolve doc_markdown clippy lint from PR 2448</li>
<li><a
href="02c34e490b"><code>02c34e4</code></a>
Resolve redundant_field_names clippy lint from PR 2448</li>
<li><a
href="427c839b3d"><code>427c839</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/serde/issues/2448">#2448</a>
from Mingun/ser-flatten-enums</li>
<li><a
href="48aa054f53"><code>48aa054</code></a>
Release 1.0.178</li>
<li><a
href="3616860203"><code>3616860</code></a>
Delete broken symlink from precompiled derive sources</li>
<li><a
href="861b0dfea2"><code>861b0df</code></a>
Consistently list StdError under 'Re-exports' heading of rustdoc</li>
<li><a
href="8b3d71ae2d"><code>8b3d71a</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/serde/issues/2541">#2541</a>
from dtolnay/de-core-error</li>
<li><a
href="ff5442cd9e"><code>ff5442c</code></a>
Add no-std unstable build in CI</li>
<li><a
href="92d686f9a5"><code>92d686f</code></a>
Fix serde::de::StdError in no-std unstable build</li>
<li>Additional commits viewable in <a
href="https://github.com/serde-rs/serde/compare/v1.0.171...v1.0.179">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [test-strategy](https://github.com/frozenlib/test-strategy) from
0.3.0 to 0.3.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="19797fdf2b"><code>19797fd</code></a>
Version 0.3.1.</li>
<li><a
href="7a2705c71d"><code>7a2705c</code></a>
Made it possible to use <code>#[proptest(dump)]</code> instead of
<code>#[proptest_dump]</code>.</li>
<li><a
href="c492d62a51"><code>c492d62</code></a>
Add docuemnt for <code>#[proptest(async = ...)]</code>.</li>
<li><a
href="839fe30cc6"><code>839fe30</code></a>
Use <code>#[cfg(test)]</code>.</li>
<li><a
href="2b57ca7262"><code>2b57ca7</code></a>
Merge pull request <a
href="https://redirect.github.com/frozenlib/test-strategy/issues/10">#10</a>
from niklaslong/clippy</li>
<li><a
href="5208cb2bfa"><code>5208cb2</code></a>
Add test for using <code>#[proptest]</code> in areas not enclosed by
<code>#[cfg(test)]</code>.</li>
<li><a
href="e258b67f9f"><code>e258b67</code></a>
Fix clippy unused field warning in proptest <code>Args</code>
structs.</li>
<li><a
href="885013160c"><code>8850131</code></a>
Update expected compile error message.</li>
<li><a
href="5198884aa1"><code>5198884</code></a>
Clippy.</li>
<li><a
href="fd49486cb2"><code>fd49486</code></a>
Support async fn test.</li>
<li>Additional commits viewable in <a
href="https://github.com/frozenlib/test-strategy/compare/v0.3.0...v0.3.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [anyhow](https://github.com/dtolnay/anyhow) from 1.0.71 to 1.0.72.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dtolnay/anyhow/releases">anyhow's
releases</a>.</em></p>
<blockquote>
<h2>1.0.72</h2>
<ul>
<li>Documentation improvements</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e458996b0a"><code>e458996</code></a>
Release 1.0.72</li>
<li><a
href="660fb0f068"><code>660fb0f</code></a>
Opt in to generate-link-to-definition when building on docs.rs</li>
<li><a
href="24d9166581"><code>24d9166</code></a>
Add CI job using minimal-versions</li>
<li><a
href="2c913b3078"><code>2c913b3</code></a>
Remove .clippy.toml in favor of respecting rust-version from
Cargo.toml</li>
<li><a
href="1f17666ef1"><code>1f17666</code></a>
Ignore needless_else clippy lint in test suite</li>
<li><a
href="6046674814"><code>6046674</code></a>
Show error details during miri setup in CI</li>
<li><a
href="dffcb4bf6c"><code>dffcb4b</code></a>
Revert "Temporarily disable miri CI"</li>
<li><a
href="438fec6036"><code>438fec6</code></a>
Temporarily disable miri CI</li>
<li>See full diff in <a
href="https://github.com/dtolnay/anyhow/compare/1.0.71...1.0.72">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The metrics are available at `http://{listen_addr}:8080/metrics`.
Currently, we collect the following:
- Number of active allocations: We can have an alert once the number of
allocations passes through a certain threshold.
- Outcome (success / error) and message kind (allocation / channel_bind
/ ...) of all responses: Summing all of these up would give you the
total number of requests handled. We might want to have a grafana alert
for an increased number of error responses.
- Total number of bytes relayed: Dividing this by time gives us an
average "internal" bandwidth.
This is just a start, we can explore what else is useful as we have it
operate.
Depends-On: https://github.com/firezone/firezone/pull/1743
Bumps [serde](https://github.com/serde-rs/serde) from 1.0.165 to
1.0.171.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/serde-rs/serde/releases">serde's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.171</h2>
<ul>
<li>Support <code>derive(Deserialize)</code> on unit structs that have
const generics (<a
href="https://redirect.github.com/serde-rs/serde/issues/2500">#2500</a>,
thanks <a
href="https://github.com/Baptistemontan"><code>@Baptistemontan</code></a>)</li>
</ul>
<h2>v1.0.170</h2>
<ul>
<li>Produce error message on suffixed string literals inside serde
attributes (<a
href="https://redirect.github.com/serde-rs/serde/issues/2242">#2242</a>)</li>
<li>Support single identifier as unbraced default value for const
generic parameter (<a
href="https://redirect.github.com/serde-rs/serde/issues/2449">#2449</a>)</li>
</ul>
<h2>v1.0.169</h2>
<ul>
<li>Add Deserializer::deserialize_identifier support for adjacently
tagged enums (<a
href="https://redirect.github.com/serde-rs/serde/issues/2475">#2475</a>,
thanks <a
href="https://github.com/Baptistemontan"><code>@Baptistemontan</code></a>)</li>
<li>Fix unused_braces lint in generated Deserialize impl that uses
braced const generic expressions (<a
href="https://redirect.github.com/serde-rs/serde/issues/2414">#2414</a>)</li>
</ul>
<h2>v1.0.168</h2>
<ul>
<li>Allow <code>serde::de::IgnoredAny</code> to be the type for a
<code>serde(flatten)</code> field (<a
href="https://redirect.github.com/serde-rs/serde/issues/2436">#2436</a>,
thanks <a
href="https://github.com/Mingun"><code>@Mingun</code></a>)</li>
<li>Allow larger preallocated capacity for smaller elements (<a
href="https://redirect.github.com/serde-rs/serde/issues/2494">#2494</a>)</li>
</ul>
<h2>v1.0.167</h2>
<ul>
<li>Add serialize and deserialize impls for <code>RangeFrom</code> and
<code>RangeTo</code> (<a
href="https://redirect.github.com/serde-rs/serde/issues/2471">#2471</a>,
thanks <a href="https://github.com/tbu"><code>@tbu</code></a>-)</li>
</ul>
<h2>v1.0.166</h2>
<ul>
<li>Add <code>no-alloc</code> category to crates.io metadata</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="03da66c805"><code>03da66c</code></a>
Release 1.0.171</li>
<li><a
href="f75426f47e"><code>f75426f</code></a>
Inline visitor_expr of unit struct deserialize impl</li>
<li><a
href="662fc3861c"><code>662fc38</code></a>
Add test of const-generic unit struct where-clause edge case</li>
<li><a
href="28c10020b9"><code>28c1002</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/serde/issues/2500">#2500</a>
from Baptistemontan/derive_generic_unit_struct</li>
<li><a
href="89c8d85de9"><code>89c8d85</code></a>
allow Deserialize derive to handle generic unit structs</li>
<li><a
href="6502838f27"><code>6502838</code></a>
Release 1.0.170</li>
<li><a
href="c93a0f335a"><code>c93a0f3</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/serde/issues/2499">#2499</a>
from dtolnay/strsuffix</li>
<li><a
href="8264e002a7"><code>8264e00</code></a>
Reject suffixed string literals inside serde attrs</li>
<li><a
href="117ef22142"><code>117ef22</code></a>
Add ui test with suffixed string literals in attribute</li>
<li><a
href="3fb5e71c33"><code>3fb5e71</code></a>
Release 1.0.169</li>
<li>Additional commits viewable in <a
href="https://github.com/serde-rs/serde/compare/v1.0.165...v1.0.171">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jamil <jamilbk@users.noreply.github.com>
Previously, we would access the state around allocations from different
places. This actually led to a minor memory leak where we wouldn't clean
up the `allocations_by_port` table. We refactor the code slightly to
avoid this.
---------
Co-authored-by: Jamil <jamilbk@users.noreply.github.com>
With this patch, the relay exposes a `--json` and `JSON_LOG` env
variable that will activate logs in JSON format the way it is expected
by google cloud:
https://cloud.google.com/logging/docs/structured-logging
In addition, we make use of spans to record contextual information as
first-class variables that are available in the context of every
message. An example output here is:
```
{"time":"2023-07-06T19:54:42.643694430Z","target":"relay","logging.googleapis.com/sourceLocation":{"file":"relay/src/main.rs","line":"156"},"severity":"INFO","message":"Seeding RNG from '0'"}
{"time":"2023-07-06T19:54:42.644408014Z","target":"relay","logging.googleapis.com/sourceLocation":{"file":"relay/src/main.rs","line":"130"},"severity":"INFO","message":"Listening for incoming traffic on UDP port 3478"}
{"time":"2023-07-06T19:54:42.843247996Z","target":"relay","logging.googleapis.com/sourceLocation":{"file":"relay/src/server.rs","line":"417"},"span":{"lifetime":"600","name":"allocate"},"spans":[{"sender":"127.0.0.1:46406","transaction_id":"0531a911a24d1e5297b94cb2","name":"client"},{"lifetime":"600","name":"allocate"}],"severity":"INFO","ip4RelayAddress":"127.0.0.1:65460","message":"Created new allocation"}
{"time":"2023-07-06T19:54:42.851623041Z","target":"relay","logging.googleapis.com/sourceLocation":{"file":"relay/src/server.rs","line":"569"},"span":{"allocation":"AID-1","peer_address":"127.0.0.1:42314","requested_channel":"16384","name":"channel_bind"},"spans":[{"sender":"127.0.0.1:46406","transaction_id":"e99e07e482789cdc30bd2b50","name":"client"},{"allocation":"AID-1","peer_address":"127.0.0.1:42314","requested_channel":"16384","name":"channel_bind"}],"severity":"INFO","message":"Successfully bound channel"}
{"time":"2023-07-06T19:54:42.852889208Z","target":"relay","logging.googleapis.com/sourceLocation":{"file":"relay/src/server.rs","line":"288"},"span":{"allocation_id":"AID-1","channel":16384,"recipient":"127.0.0.1:46406","sender":"127.0.0.1:42314","name":"peer"},"spans":[{"allocation_id":"AID-1","channel":16384,"recipient":"127.0.0.1:46406","sender":"127.0.0.1:42314","name":"peer"}],"severity":"DEBUG","message":"Relaying 32 bytes"}
{"time":"2023-07-06T19:54:42.854625857Z","target":"relay","logging.googleapis.com/sourceLocation":{"file":"relay/src/server.rs","line":"619"},"span":{"channel":"16384","recipient":"127.0.0.1:42314","name":"channel_data"},"spans":[{"sender":"127.0.0.1:46406","name":"client"},{"channel":"16384","recipient":"127.0.0.1:42314","name":"channel_data"}],"severity":"DEBUG","message":"Relaying 32 bytes"}
```
For some reason, the current `span` is always duplicated but I don't
think that is a big issue. When run using the regular log formatter, it
looks like this:
```
2023-07-06T20:02:33.939273Z INFO relay: Seeding RNG from '0'
2023-07-06T20:02:33.940153Z INFO relay: Listening for incoming traffic on UDP port 3478
2023-07-06T20:02:34.135801Z INFO client{sender=127.0.0.1:33919 transaction_id="7092a2363377709cd18b9d98"}:allocate{lifetime=600}: relay: Created new allocation ip4_relay_address=127.0.0.1:65460
2023-07-06T20:02:34.144833Z INFO client{sender=127.0.0.1:33919 transaction_id="4e1a18e58953242c92a075a3"}:channel_bind{requested_channel=16384 peer_address=127.0.0.1:47859 allocation="AID-1"}: relay: Successfully bound channel
2023-07-06T20:02:34.145501Z DEBUG peer{sender=127.0.0.1:47859 allocation_id=AID-1 recipient=127.0.0.1:33919 channel=16384}: relay: Relaying 32 bytes
2023-07-06T20:02:34.146863Z DEBUG client{sender=127.0.0.1:33919}:channel_data{channel=16384 recipient=127.0.0.1:47859}: relay: Relaying 32 bytes
```
This provides lots of contextual information in a DRY and easily
parse-able way.
---------
Co-authored-by: Jamil <jamilbk@users.noreply.github.com>
Instead of having portal URL and token optional, we default the portal
URL and decide based on the presence of the token, whether we should
connect to the portal on startup. This allows the relay to be
used/tested standalone and keeps the number of config options and error
cases small.
We require the user to config the full path of the websocket and thus
avoid the need for duplicating the connlib function. Given that most
users will never need to override this option, this seems like a good
trade-off.
Resolves https://github.com/firezone/product/issues/614.
With this PR the full control-plane message flow is working.
Meaning that if you do:
```
docker compose up -d
docker compose exec -it client "ping 172.20.0.2" # will fix this IP later
```
Messages start flowing to gateway. The gateway still not correctly
forwards the messages to the resource since masquerading is still not
working, although I suspect there might be an additional problem. Will
fix this in my next PR along with a README on how to test this whole
flow.
This PR also fixes how we sent the stamp secret to the gateway from the
relay, but I still see some warnings in the webrtc that I'm sure that
are due to a mismatch between how webrtc-rs and the relay handle
messages (The most important being `bind() failed: unexpected response
type`), I will take a look at that and a way to test that the flow works
when:
1. hole-punching is available
2. through relay when it's not
Since the flow right now works without hole-punching or relay since the
gateway is in the same network in the docker compose.
Due to a silly bash mistake (I hate bash), the error from the gateway
binary wasn't actually propagated to the script. Thus, we did not notice
that it was been broken for a while.
Attempting to fix it turned up that we were double-hexing the relay
secret and using invalid passwords for the clients.
This brindgs connlib from its own separated repo to firezone's monorepo.
On top of bringing connlib we also add and unify the Dockerfile for all
rust binaries and add a docker-compose that can run a headless client, a
relay and a gateway which eventually will test the whole flow between a
client and a resource. For this to work we also incorporated some elixir
scripts to generate portal tokens for those components.
With this PR, the relay can be configured with a WebSocket URL on startup. If given, it will attempt to connect to it and join the `relay` room with its `stamp_secret`. Once the `init` message is received, regular relay operation will begin.
Previously, the relay would treat the `stamp_secret` internally as bytes and share it with the outside world as hex-string. The portal however treats it as an opaque string and uses the UTF-8 bytes to create username and password.
This patch aligns the relay's functionality with the portal and stores the `stamp_secret` internally as a string.
This saves us several lines of code and allows usage of the relay via
commandline arguments in addition to env variables. Note that because of
`#[arg(env)]`, all of these can still be configured via environment
variables too.
To complete the authentication scheme for the relay, we need to prompt
the client with a nonce when they send an unauthenticated request. The
semantic meaning of a nonce is opaque to the client. As a starting
point, we implement a count-based scheme. Each nonce is valid for 10
requests. After that, a request will be rejected with a 401 and the
client has to authenticate with a new nonce.
This scheme provides a basic form of replay-protection.
We introduce dedicated types for each message that the `Server` can
handle. This allows us to make the functions public because the
type-system now guarantees that those are either parsed from bytes or
constructed with the correct data.
The latter will be useful to write tests against a richer API.
With this patch, the relay can parse and respond to allocation requests. I
ran some basics tests against https://icetest.info/ and implemented a
regression test as a result of the logged data.
In writing this, I also had to slightly change the design of `Server`
(as expected). Event handlers for incoming data now do not return a
message directly. Instead, the caller is responsible to drain `Command`s
from it.
When creating an allocation, we need to start listening on a new port.
This needs to happen outside the `Server` as I am going for a sans-IO
style. We emit a `Command` that instructs the main event loop to listen
on a new port. Any incoming data on that port will be forwarded to the
`Server`.
At the moment, this incoming data is just dropped. This is actually
standards-compliant because we cannot handle binding requests yet which
would allow this data to be forwarded to the client.
In some areas, the code is still a bit rough but I expect to iron those
things out as we go along.
This is an alternative to https://github.com/firezone/firezone/pull/1602
that implements the server using a library I've found called
`stun_codec`.
It already has support for parsing a variety of attributes.
The following is a nice website to test some of the functionality:
https://icetest.info/
The server is still listening on:
`ec2-3-89-112-240.compute-1.amazonaws.com:3478`.
