mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-27 18:18:55 +00:00
026feefc2cdc3a9d0ae2d35f04c193cede57face
1296 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
dependabot[bot]
|
026feefc2c |
build(deps): Bump log from 0.4.21 to 0.4.22 in /rust (#6081)
Bumps [log](https://github.com/rust-lang/log) from 0.4.21 to 0.4.22. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rust-lang/log/blob/master/CHANGELOG.md">log's changelog</a>.</em></p> <blockquote> <h2>[0.4.22] - 2024-06-27</h2> <h2>What's Changed</h2> <ul> <li>Add some clarifications to the library docs by <a href="https://github.com/KodrAus"><code>@KodrAus</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/620">rust-lang/log#620</a></li> <li>Add links to <code>colog</code> crate by <a href="https://github.com/chrivers"><code>@chrivers</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/621">rust-lang/log#621</a></li> <li>adding line_number test + updating some testing infrastructure by <a href="https://github.com/DIvkov575"><code>@DIvkov575</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/619">rust-lang/log#619</a></li> <li>Clarify the actual set of functions that can race in _racy variants by <a href="https://github.com/KodrAus"><code>@KodrAus</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/623">rust-lang/log#623</a></li> <li>Replace deprecated std::sync::atomic::spin_loop_hint() by <a href="https://github.com/Catamantaloedis"><code>@Catamantaloedis</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/625">rust-lang/log#625</a></li> <li>Check usage of max_level features by <a href="https://github.com/Thomasdezeeuw"><code>@Thomasdezeeuw</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/627">rust-lang/log#627</a></li> <li>Remove unneeded import by <a href="https://github.com/Thomasdezeeuw"><code>@Thomasdezeeuw</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/628">rust-lang/log#628</a></li> <li>Loosen orderings for logger initialization in <a href="https://redirect.github.com/rust-lang/log/pull/632">rust-lang/log#632</a>. Originally by <a href="https://github.com/pwoolcoc"><code>@pwoolcoc</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/599">rust-lang/log#599</a></li> <li>Use Location::caller() for file and line info in <a href="https://redirect.github.com/rust-lang/log/pull/633">rust-lang/log#633</a>. Originally by <a href="https://github.com/Cassy343"><code>@Cassy343</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/520">rust-lang/log#520</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/chrivers"><code>@chrivers</code></a> made their first contribution in <a href="https://redirect.github.com/rust-lang/log/pull/621">rust-lang/log#621</a></li> <li><a href="https://github.com/DIvkov575"><code>@DIvkov575</code></a> made their first contribution in <a href="https://redirect.github.com/rust-lang/log/pull/619">rust-lang/log#619</a></li> <li><a href="https://github.com/Catamantaloedis"><code>@Catamantaloedis</code></a> made their first contribution in <a href="https://redirect.github.com/rust-lang/log/pull/625">rust-lang/log#625</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rust-lang/log/compare/0.4.21...0.4.22">https://github.com/rust-lang/log/compare/0.4.21...0.4.22</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Thomas Eizinger
|
14a93e0d4d |
refactor(connlib): use const ctors for IpNetwork (#6085)
|
||
|
dependabot[bot]
|
509f7ab6c4 |
build(deps): Bump zip from 2.1.3 to 2.1.5 in /rust (#6079)
Bumps [zip](https://github.com/zip-rs/zip2) from 2.1.3 to 2.1.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/zip-rs/zip2/releases">zip's releases</a>.</em></p> <blockquote> <h2>v2.1.5</h2> <h3><!-- raw HTML omitted -->🚜 Refactor</h3> <ul> <li>change invalid_state() return type to io::Result<!-- raw HTML omitted --></li> </ul> <h2>v2.1.4</h2> <h3><!-- raw HTML omitted -->🐛 Bug Fixes</h3> <ul> <li>fix(<a href="https://redirect.github.com/zip-rs/zip2/pull/215">#215</a>): Upgrade to deflate64 0.1.9</li> <li>Panic when reading a file truncated in the middle of an XZ block header</li> <li>Some archives with over u16::MAX files were handled incorrectly or slowly (<a href="https://redirect.github.com/zip-rs/zip2/pull/189">#189</a>)</li> <li>Check number of files when deciding whether a CDE is the real one</li> <li>Could still select a fake CDE over a real one in some cases</li> <li>May have to consider multiple CDEs before filtering for validity</li> <li>We now keep searching for a real CDE header after read an invalid one from the file comment</li> <li>Always search for data start when opening an archive for append, and reject the header if data appears to start after central directory</li> <li><code>deep_copy_file</code> no longer allows overwriting an existing file, to match the behavior of <code>shallow_copy_file</code></li> <li>File start position was wrong when extra data was present</li> <li>Abort file if central extra data is too large</li> <li>Overflow panic when central directory extra data is too large</li> <li>ZIP64 header was being written twice when copying a file</li> <li>ZIP64 header was being written to central header twice</li> <li>Start position was incorrect when file had no extra data</li> <li>Allow all reserved headers we can create</li> <li>Fix a bug where alignment padding interacts with other extra-data fields</li> <li>Fix bugs involving alignment padding and Unicode extra fields</li> <li>Incorrect header when adding AES-encrypted files</li> <li>Parse the extra field and reject it if invalid</li> <li>Incorrect behavior following a rare combination of <code>merge_archive</code>, <code>abort_file</code> and <code>deep_copy_file</code>. As well, we now return an error when a file is being copied to itself.</li> <li>path_to_string now properly handles the case of an empty path</li> <li>Implement <code>Debug</code> for <code>ZipWriter</code> even when it's not implemented for the inner writer's type</li> <li>Fix an issue where the central directory could be incorrectly detected</li> <li><code>finish_into_readable()</code> would corrupt the archive if the central directory had moved</li> </ul> <h3><!-- raw HTML omitted -->🚜 Refactor</h3> <ul> <li>Verify with debug assertions that no FixedSizeBlock expects a multi-byte alignment (<a href="https://redirect.github.com/zip-rs/zip2/pull/198">#198</a>)</li> <li>Use new do_or_abort_file method</li> </ul> <h3><!-- raw HTML omitted -->⚡ Performance</h3> <ul> <li>Speed up CRC when encrypting small files</li> <li>Limit the number of extra fields</li> <li>Refactor extra-data validation</li> <li>Store extra data in plain vectors until after validation</li> <li>Only build one IndexMap after choosing among the possible valid headers</li> <li>Simplify validation of empty extra-data fields</li> <li>Validate automatic extra-data fields only once, even if several are present</li> <li>Remove redundant <code>validate_extra_data()</code> call</li> <li>Skip searching for the ZIP32 header if a valid ZIP64 header is present (<a href="https://redirect.github.com/zip-rs/zip2/pull/189">#189</a>)</li> </ul> <h3><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h3> <ul> <li>Fix a bug introduced by c934c824</li> <li>Fix a failing unit test</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md">zip's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/zip-rs/zip2/compare/v2.1.4...v2.1.5">2.1.5</a> - 2024-07-20</h2> <h3><!-- raw HTML omitted -->🚜 Refactor</h3> <ul> <li>change invalid_state() return type to io::Result<!-- raw HTML omitted --></li> </ul> <h2><a href="https://github.com/zip-rs/zip2/compare/v2.1.3...v2.1.4">2.1.4</a> - 2024-07-18</h2> <h3><!-- raw HTML omitted -->🐛 Bug Fixes</h3> <ul> <li>fix(<a href="https://redirect.github.com/zip-rs/zip2/pull/215">#215</a>): Upgrade to deflate64 0.1.9</li> <li>Panic when reading a file truncated in the middle of an XZ block header</li> <li>Some archives with over u16::MAX files were handled incorrectly or slowly (<a href="https://redirect.github.com/zip-rs/zip2/pull/189">#189</a>)</li> <li>Check number of files when deciding whether a CDE is the real one</li> <li>Could still select a fake CDE over a real one in some cases</li> <li>May have to consider multiple CDEs before filtering for validity</li> <li>We now keep searching for a real CDE header after read an invalid one from the file comment</li> <li>Always search for data start when opening an archive for append, and reject the header if data appears to start after central directory</li> <li><code>deep_copy_file</code> no longer allows overwriting an existing file, to match the behavior of <code>shallow_copy_file</code></li> <li>File start position was wrong when extra data was present</li> <li>Abort file if central extra data is too large</li> <li>Overflow panic when central directory extra data is too large</li> <li>ZIP64 header was being written twice when copying a file</li> <li>ZIP64 header was being written to central header twice</li> <li>Start position was incorrect when file had no extra data</li> <li>Allow all reserved headers we can create</li> <li>Fix a bug where alignment padding interacts with other extra-data fields</li> <li>Fix bugs involving alignment padding and Unicode extra fields</li> <li>Incorrect header when adding AES-encrypted files</li> <li>Parse the extra field and reject it if invalid</li> <li>Incorrect behavior following a rare combination of <code>merge_archive</code>, <code>abort_file</code> and <code>deep_copy_file</code>. As well, we now return an error when a file is being copied to itself.</li> <li>path_to_string now properly handles the case of an empty path</li> <li>Implement <code>Debug</code> for <code>ZipWriter</code> even when it's not implemented for the inner writer's type</li> <li>Fix an issue where the central directory could be incorrectly detected</li> <li><code>finish_into_readable()</code> would corrupt the archive if the central directory had moved</li> </ul> <h3><!-- raw HTML omitted -->🚜 Refactor</h3> <ul> <li>Verify with debug assertions that no FixedSizeBlock expects a multi-byte alignment (<a href="https://redirect.github.com/zip-rs/zip2/pull/198">#198</a>)</li> <li>Use new do_or_abort_file method</li> </ul> <h3><!-- raw HTML omitted -->⚡ Performance</h3> <ul> <li>Speed up CRC when encrypting small files</li> <li>Limit the number of extra fields</li> <li>Refactor extra-data validation</li> <li>Store extra data in plain vectors until after validation</li> <li>Only build one IndexMap after choosing among the possible valid headers</li> <li>Simplify validation of empty extra-data fields</li> <li>Validate automatic extra-data fields only once, even if several are present</li> <li>Remove redundant <code>validate_extra_data()</code> call</li> <li>Skip searching for the ZIP32 header if a valid ZIP64 header is present (<a href="https://redirect.github.com/zip-rs/zip2/pull/189">#189</a>)</li> </ul> <h3><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Gabi
|
c3a45f53df |
fix(connlib): prevent routing loops on windows (#6032)
In `connlib`, traffic is sent through sockets via one of three ways: 1. Direct p2p traffic between clients and gateways: For these, we always explicitly set the source IP (and thus interface). 2. UDP traffic to the relays: For these, we let the OS pick an appropriate source interface. 3. WebSocket traffic over TCP to the portal: For this too, we let the OS pick the source interface. For (2) and (3), it is possible to run into routing loops, depending on the routes that we have configured on the TUN device. In Linux, we can prevent routing loops by marking a socket [0] and repeating the mark when we add routes [1]. Packets sent via a marked socket won't be routed by a rule that contains this mark. On Android, we can do something similar by "protecting" a socket via a syscall on the Java side [2]. On Windows, routing works slightly different. There, the source interface is determined based on a computed metric [3] [4]. To prevent routing loops on Windows, we thus need to find the "next best" interface after our TUN interface. We can achieve this with a combination of several syscalls: 1. List all interfaces on the machine 2. Ask Windows for the best route on each interface, except our TUN interface. 3. Sort by Windows' routing metric and pick the lowest one (lower is better). Thanks to the abstraction of `SocketFactory` that we already previously introduced, Integrating this into `connlib` isn't too difficult: 1. For TCP sockets, we simply resolve the best route after creating the socket and then bind it to that local interface. That way, all packets will always going via that interface, regardless of which routes are present on our TUN interface. 2. UDP is connection-less so we need to decide per-packet, which interface to use. "Pick the best interface for me" is modelled in `connlib` via the `DatagramOut::src` field being `None`. - To ensure those packets don't cause a routing loop, we introduce a "source IP resolver" for our `UdpSocket`. This function gets called every time we need to send a packet without a source IP. - For improved performance, we cache these results. The Windows client uses this source IP resolver to use the above devised strategy to find a suitable source IP. - In case the source IP resolution fails, we don't send the packet. This is important, otherwise, the kernel might choose our TUN interface again and trigger a routing loop. The last remark to make here is that this also works for connection roaming. The TCP socket gets thrown away when we reconnect to the portal. Thus, the new socket will pick the new best interface as it is re-created. The UDP sockets also get thrown away as part of roaming. That clears the above cache which is what we want: Upon roaming, the best interface for a given destination IP will likely have changed. [0]: |
||
|
Thomas Eizinger
|
194eebd164 |
fix(connlib): de-prioritise timeout handling (#6077)
`connlib`'s event loop performs work in a very particular order: 1. Local buffers like IP, UDP and DNS packets are emptied. 2. Time-sensitive tasks, if any, are performed. 3. New UDP packets are processed. 4. New IP packets (from the TUN device) are processed. This priority ensures we don't accept more work (i.e. new packets) until we have finished processing existing work. As a result, we can keep local buffers small and processing latencies low. I am not completely confident on the issue of #6067 but if the busy-loop originates from a bad timer, then the above priority means we never get to the part where we read new UDP or IP packets and components such a `PhoenixChannel` - which operate outside of `connlib'`s event loop - don't get any CPU time. A naive fix for this problem is to just de-prioritise the polling of the timer within `Io::poll`. I say naive because without additional changes, this could delay the processing of time-sensitive tasks on a very busy client / gateway where packets are constantly arriving and thus we never[^1] reach the part where the timer gets polled. To fix this, we make two distinct changes: 1. We pro-actively break from `connlib'`s event loop every 5000 iterations. This ensures that even on a very busy system, other components like the `PhoenixChannel` get a chance to do _some_ work once in a while. 2. In case we force-yield from the event loop, we call `handle_timeout` and immediately schedule a new wake-up. This ensures time does advance in regular intervals as well and we don't get wrongly suspended by the runtime. These changes don't prevent any timer-loops by themselves. With a timer-loop, we still busy-loop for 5000 iterations and thus unnecessarily burn through some CPU cycles. The important bit however is that we stay operational and can accept packets and portal messages. Any of them might change the state such that the timer value changes, thus allowing `connlib` to self-heal from this loop. Fixes: #6067. [^1]: This is an assumption based on the possible control flow. In practise, I believe that reading from the sockets or the TUN device is a much slower operation than processing the packets. Thus, we should eventually hit the the timer path too. |
||
|
Reactor Scram
|
6e24e0201e |
chore(rust): bump Rust to 1.80 (#6065)
Co-authored-by: Thomas Eizinger <thomas@eizinger.io> |
||
|
Thomas Eizinger
|
b29341be62 |
fix(connlib): clear timeout after it fired (#6076)
We don't want the timer to fire multiple times at the same `Instant` unless it has been specifically set to that `Instant` again. Thus, clear the timer after it fired. I don't think this fixed #6067 but it can't hurt. |
||
|
Thomas Eizinger
|
fc4b8c7b46 |
refactor: rename reconnect to reset (#6057)
Connection roaming within `connlib` has changed a fair-bit since we introduced the `reconnect` function. The new implementation is basically a hard-reset of all state within `connlib`. Renaming this function across all layers makes this more obvious. Resolves: #6038. |
||
|
Thomas Eizinger
|
356dd12e7f |
chore(connlib): remove duplicate Device::poll_read function (#6072)
The `Device` implementation is no longer platform-specific so we can delete the duplicated `poll_read` function. |
||
|
Reactor Scram
|
05e3a38701 |
refactor(bin-shared): remove CommonArgs (#6068)
Closes #6025 It was only used in the Gateway, so we inline it there and remove `clap` as a dep for ~~that crate~~ `bin-shared` |
||
|
Thomas Eizinger
|
90f74aa35e |
test(snownet): minor tidy-up (#6056)
Came across this while looking into #6014. |
||
|
Reactor Scram
|
6862213cc2 |
fix(headless-client/linux): only notify systemd that we're up after Resources are available (#6026)
Closes #5912 Before this, I had the `--exit` CLI flag and the `sd_notify` call hanging off the wrong callback. |
||
|
Gabi
|
a39b853bc1 |
fix(windows,linux): ensure set_routes is idempotent (#6051)
Windows may delete the default route during roaming. To prevent this from causing problems, we make `set_routes` add all routes regardless of the previously stored ones. The known routes are only used to compute, what routes are to be removed. For Linux we do the same to make it consistent across platforms. This also give us the chance to not clear the cache when ips are set, since now all routes are always added, meaning they will be always re-added when roaming. Overall, this more closely aligns Linux and Windows with how Firezone works on Apple and Android. There, we always remove all routes and set new ones. Removing routes happens very rarely (only when CIDR resources are deactivated), thus, not removing all and re-adding the routes is still deemed to be worth it. With the new implementation, this is guaranteed to always make the new routes take effect and at the same time be idempotent. --------- Signed-off-by: Gabi <gabrielalejandro7@gmail.com> Co-authored-by: Thomas Eizinger <thomas@eizinger.io> |
||
|
Thomas Eizinger
|
f800875aff |
fix(relay): don't hang when connecting to OTLP exporter (#6034)
The dependency update in #6003 introduced a regression: Connecting to the OTLP exporter was hanging forever and thus the relay failed to start up. The hang seems to be related to _dropping_ the `meter_provider`. Looking at the changelog update, this change was actually called out: https://github.com/open-telemetry/opentelemetry-rust/blob/main/opentelemetry-otlp/CHANGELOG.md#v0170. By setting these providers globally, the relay starts up just fine. To ensure this doesn't regress again, we add an OTEL collector to our `docker-compose.yml` and configure the `relay-1` to connect to it. |
||
|
Reactor Scram
|
cc1478adc2 |
feat(headless-client/windows): add DNS change / network change listening to the Headless Client (#6022)
Note that for GUI Clients, listening is still done by the GUI process, not the IPC service. Yak shave towards #5846. This allows for faster dev cycles since I won't have to compile all the GUI stuff. Some changes in here were extracted from other draft PRs. Changes: - Remove `thiserror` that was never matched on - Don't return the DNS resolvers from the notifier directly, just send a notification and allow the caller to check the resolvers itself if needed - Rename `DnsListener` to `DnsNotifier` - Rename `Worker` to `NetworkNotifier` - remove `unwrap_or_default` when getting resolvers. I don't know why it's there, if there's a good reason then it should be handled inside the function, not in the caller ```[tasklist] ### Tasks - [x] Rename `*Listener` to `*Notifier` - [x] (not needed) ~~Support `/etc/resolv.conf` DNS control method too?~~ ``` |
||
|
Reactor Scram
|
82b8de4c9c |
refactor(client/windows): de-dupe wintun.dll (#6020)
Closes #5977 Refactored some other stuff to make this work Also removed a redundant impl of `ensure_dll` in a benchmark |
||
|
Thomas Eizinger
|
59014a9622 |
refactor(connlib): encapsulate UDP and TCP sockets (#6028)
As part of debugging full-route tunneling on Windows, we discovered that we need to always explicitly choose the interface through which we want to send packets, otherwise Windows may cause a routing loop by routing our packets back into the TUN device. We already have a `SocketFactory` abstraction in `connlib` that is used by each platform to customise the setup of each socket to prevent routing loops. So far, this abstraction directly returns tokio sockets which don't allow us to intercept the actual sending of packets. For some of our traffic, i.e. the UDP packets exchanged with relays, we don't specify a source address. To make full-route work on Windows, we need to intercept these packets and explicitly set the source address. To achieve that, we introduce dedicated `TcpSocket` and `UdpSocket` structs within `socket-factory`. With this in place, we will be able to add Windows-conditional code to looks up and sets the source address of outgoing UDP packets. For TCP sockets, the lookup will happen prior to connecting to the address and used to bind to the correct interface. Related: #2667. Related: #5955. |
||
|
Thomas Eizinger
|
782b171cc1 |
chore(relay): always log setup on trace (#6031)
In staging and production, setting up the logger for the relay is a fairly complicated setup. To make debugging easier, we always log these initial steps on `TRACE` level until the real logger is initialised. |
||
|
Reactor Scram
|
e36dc1c9d7 |
ux(gui-client): remove keyboard accelerators (#6017)
Closes #5953 In all my testing on Windows I've never seen these work. I tried them a couple days ago on Linux and I haven't seen them work there either. No clue why. Tauri bug? Windows bug? |
||
|
Reactor Scram
|
05b1bce9da |
chore(gui-client): bump keyring-rs (#6016)
Removes a few lines on our side that don't need to be platform-specific. Thanks Daniel! <https://github.com/hwchen/keyring-rs/pull/198> |
||
|
Thomas Eizinger
|
b2a374a78b |
test(connlib): add comment explaining position of handle_timeout (#6012)
Feedback from #5948. |
||
|
dependabot[bot]
|
dae90d81e1 |
build(deps): bump opentelemetry dependencies (#6003)
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Thomas Eizinger <thomas@eizinger.io> |
||
|
Thomas Eizinger
|
5068425017 |
chore(connlib): use Relaxed ordering (#6011)
Feedback from #5948. |
||
|
dependabot[bot]
|
3b5d136575 |
build(deps-dev): Bump tailwindcss from 3.4.4 to 3.4.6 in /rust/gui-client (#5993)
Bumps [tailwindcss](https://github.com/tailwindlabs/tailwindcss) from 3.4.4 to 3.4.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/releases">tailwindcss's releases</a>.</em></p> <blockquote> <h2>v3.4.6</h2> <h3>Fixed</h3> <ul> <li>Fix detection of some utilities in Slim/Pug templates (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/14006">#14006</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Loosen <code>:is()</code> wrapping rules when using an important selector (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13900">#13900</a>)</li> </ul> <h2>v3.4.5</h2> <h3>Fixed</h3> <ul> <li>Disable automatic <code>var()</code> injection for anchor properties (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13826">#13826</a>)</li> <li>Use no value instead of <code>blur(0px)</code> for <code>backdrop-blur-none</code> and <code>blur-none</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13830">#13830</a>)</li> <li>Add <code>.mts</code> and <code>.cts</code> config file detection (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13940">#13940</a>)</li> <li>Don't generate utilities like <code>px-1</code> unnecessarily when using utilities like <code>px-1.5</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13959">#13959</a>)</li> <li>Always generate <code>-webkit-backdrop-filter</code> for <code>backdrop-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13997">#13997</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/blob/v3.4.6/CHANGELOG.md">tailwindcss's changelog</a>.</em></p> <blockquote> <h2>[3.4.6] - 2024-07-16</h2> <h3>Fixed</h3> <ul> <li>Fix detection of some utilities in Slim/Pug templates (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/14006">#14006</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Loosen <code>:is()</code> wrapping rules when using an important selector (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13900">#13900</a>)</li> </ul> <h2>[3.4.5] - 2024-07-15</h2> <h3>Fixed</h3> <ul> <li>Disable automatic <code>var()</code> injection for anchor properties (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13826">#13826</a>)</li> <li>Use no value instead of <code>blur(0px)</code> for <code>backdrop-blur-none</code> and <code>blur-none</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13830">#13830</a>)</li> <li>Add <code>.mts</code> and <code>.cts</code> config file detection (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13940">#13940</a>)</li> <li>Don't generate utilities like <code>px-1</code> unnecessarily when using utilities like <code>px-1.5</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13959">#13959</a>)</li> <li>Always generate <code>-webkit-backdrop-filter</code> for <code>backdrop-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13997">#13997</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Reactor Scram
|
a04d2166fb |
docs(gui-client): remove outdated comment block (#5908)
This explanation of the processes is no longer accurate after the IPC service split. --------- Signed-off-by: Reactor Scram <ReactorScram@users.noreply.github.com> |
||
|
dependabot[bot]
|
d9670f867f |
build(deps): Bump @tauri-apps/api from 1.5.6 to 1.6.0 in /rust/gui-client (#6001)
Bumps [@tauri-apps/api](https://github.com/tauri-apps/tauri) from 1.5.6 to 1.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tauri-apps/tauri/releases"><code>@tauri-apps/api</code>'s releases</a>.</em></p> <blockquote> <h2><code>@tauri-apps/api</code> v1.6.0</h2> <!-- raw HTML omitted --> <pre><code>yarn audit v1.22.22 info No lockfile found. 0 vulnerabilities found - Packages audited: 146 Done in 2.09s. </code></pre> <!-- raw HTML omitted --> <h2>[1.6.0]</h2> <h3>Enhancements</h3> <ul> <li><a href=" |
||
|
dependabot[bot]
|
50de878736 |
build(deps-dev): Bump @types/node from 20.14.9 to 20.14.12 in /rust/gui-client (#5999)
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 20.14.9 to 20.14.12. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
7d3815b50a |
build(deps): Bump @tauri-apps/cli from 1.5.14 to 1.6.0 in /rust/gui-client (#5996)
Bumps [@tauri-apps/cli](https://github.com/tauri-apps/tauri) from 1.5.14 to 1.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tauri-apps/tauri/releases"><code>@tauri-apps/cli</code>'s releases</a>.</em></p> <blockquote> <h2><code>@tauri-apps/cli</code> v1.6.0</h2> <h2>[1.6.0]</h2> <h3>New Features</h3> <ul> <li><a href=" |
||
|
dependabot[bot]
|
e7b1e2b1d6 |
build(deps-dev): Bump typescript from 5.5.2 to 5.5.4 in /rust/gui-client (#5997)
Bumps [typescript](https://github.com/Microsoft/TypeScript) from 5.5.2 to 5.5.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Microsoft/TypeScript/releases">typescript's releases</a>.</em></p> <blockquote> <h2>TypeScript 5.5.4</h2> <p>For release notes, check out the <a href="https://devblogs.microsoft.com/typescript/announcing-typescript-5-5/">release announcement</a>.</p> <p>For the complete list of fixed issues, check out the</p> <ul> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=is%3Aissue+milestone%3A%22TypeScript+5.5.4%22+is%3Aclosed+">fixed issues query for TypeScript v5.5.4 (Stable)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=is%3Aissue+milestone%3A%22TypeScript+5.5.3%22+is%3Aclosed+">fixed issues query for TypeScript v5.5.3 (Stable)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=is%3Aissue+milestone%3A%22TypeScript+5.5.2%22+is%3Aclosed+">fixed issues query for TypeScript v5.5.2 (Stable)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=is%3Aissue+milestone%3A%22TypeScript+5.5.1%22+is%3Aclosed+">fixed issues query for TypeScript v5.5.1 (RC)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=is%3Aissue+milestone%3A%22TypeScript+5.5.0%22+is%3Aclosed+">fixed issues query for TypeScript v5.5.0 (Beta)</a>.</li> </ul> <p>Downloads are available on:</p> <ul> <li><a href="https://www.npmjs.com/package/typescript">npm</a></li> <li><a href="https://www.nuget.org/packages/Microsoft.TypeScript.MSBuild">NuGet package</a> (soon!)</li> </ul> <h2>TypeScript 5.5.3</h2> <p>For release notes, check out the <a href="https://devblogs.microsoft.com/typescript/announcing-typescript-5-5/">release announcement</a>.</p> <p>For the complete list of fixed issues, check out the</p> <ul> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=is%3Aissue+milestone%3A%22TypeScript+5.5.3%22+is%3Aclosed+">fixed issues query for TypeScript v5.5.3 (Stable)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=is%3Aissue+milestone%3A%22TypeScript+5.5.2%22+is%3Aclosed+">fixed issues query for TypeScript v5.5.2 (Stable)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=is%3Aissue+milestone%3A%22TypeScript+5.5.1%22+is%3Aclosed+">fixed issues query for TypeScript v5.5.1 (RC)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=is%3Aissue+milestone%3A%22TypeScript+5.5.0%22+is%3Aclosed+">fixed issues query for TypeScript v5.5.0 (Beta)</a>.</li> </ul> <p>Downloads are available on:</p> <ul> <li><a href="https://www.npmjs.com/package/typescript">npm</a></li> <li><a href="https://www.nuget.org/packages/Microsoft.TypeScript.MSBuild">NuGet package</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
7be47f2c6e |
build(deps): Bump url from 2.5.0 to 2.5.2 in /rust (#6002)
Bumps [url](https://github.com/servo/rust-url) from 2.5.0 to 2.5.2. <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Thomas Eizinger
|
3aeb9d506e |
test(connlib): add Idle transition (#6006)
In #5948, we start testing network latency within `tunnel_test` to make sure _some_ time-related things are triggered. Building on top of that, we now add an `Idle` transition that does nothing for 5 minutes. After 5 minutes of idling, we auto-close a connection. Using this new state transition, we can replace another test within `snownet`, further reducing that (duplicated) test suite. In addition, this gives us some more coverage of code by testing whether allocations and channel bindings can be refreshed accordingly. |
||
|
dependabot[bot]
|
e44710c6c1 |
build(deps): Bump sd-notify from 0.4.1 to 0.4.2 in /rust (#6004)
Bumps [sd-notify](https://github.com/lnicola/sd-notify) from 0.4.1 to 0.4.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lnicola/sd-notify/blob/master/CHANGELOG.md">sd-notify's changelog</a>.</em></p> <blockquote> <h2>[0.4.2] - 2024-07-03</h2> <h3>Fixed</h3> <ul> <li>fixed <code>listen_fds</code> to use the right value of <code>FD_CLOEXEC</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Thomas Eizinger
|
7c8bbd550b |
test(connlib): introduce network latency to tunnel_test (#5948)
Currently, `tunnel_test` executes all actions within the same `Instant`, i.e. time is never advanced by itself. The difficulty with advancing time compared to other actions like sending packets is that all time-related actions "overlap". In other words, all timers within connlib advance at the same time. This makes it difficult to model the expected behaviour after a certain amount of time has passed as we'd effectively need to model all timers and their relation to particular actions (like resending of connection intents or STUN requests). Instead of only advancing time by itself, we can model some aspect of it by introducing latency on network messages. This allows us to define a range of an "acceptable" network latency within everything is expected to work. Whilst this doesn't cover all failure cases, it gives us a solid foundation of parameters within which we should not expect any operational problems. |
||
|
dependabot[bot]
|
6d09344521 |
build(deps): Bump uuid from 1.8.0 to 1.10.0 in /rust (#6005)
Bumps [uuid](https://github.com/uuid-rs/uuid) from 1.8.0 to 1.10.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/uuid-rs/uuid/releases">uuid's releases</a>.</em></p> <blockquote> <h2>1.10.0</h2> <h2>Deprecations</h2> <p>This release deprecates and renames the following functions:</p> <ul> <li><code>Builder::from_rfc4122_timestamp</code> -> <code>Builder::from_gregorian_timestamp</code></li> <li><code>Builder::from_sorted_rfc4122_timestamp</code> -> <code>Builder::from_sorted_gregorian_timestamp</code></li> <li><code>Timestamp::from_rfc4122</code> -> <code>Timestamp::from_gregorian</code></li> <li><code>Timestamp::to_rfc4122</code> -> <code>Timestamp::to_gregorian</code></li> </ul> <h2>What's Changed</h2> <ul> <li>Use const identifier in uuid macro by <a href="https://github.com/Vrajs16"><code>@Vrajs16</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/764">uuid-rs/uuid#764</a></li> <li>Rename most methods referring to RFC4122 by <a href="https://github.com/Mikopet"><code>@Mikopet</code></a> / <a href="https://github.com/KodrAus"><code>@KodrAus</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/765">uuid-rs/uuid#765</a></li> <li>prepare for 1.10.0 release by <a href="https://github.com/KodrAus"><code>@KodrAus</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/766">uuid-rs/uuid#766</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Vrajs16"><code>@Vrajs16</code></a> made their first contribution in <a href="https://redirect.github.com/uuid-rs/uuid/pull/764">uuid-rs/uuid#764</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/uuid-rs/uuid/compare/1.9.1...1.10.0">https://github.com/uuid-rs/uuid/compare/1.9.1...1.10.0</a></p> <h2>1.9.1</h2> <h2>What's Changed</h2> <ul> <li>Add an example of generating bulk v7 UUIDs by <a href="https://github.com/KodrAus"><code>@KodrAus</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/761">uuid-rs/uuid#761</a></li> <li>Avoid taking the shared lock when getting usable bits in Uuid::now_v7 by <a href="https://github.com/KodrAus"><code>@KodrAus</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/762">uuid-rs/uuid#762</a></li> <li>Prepare for 1.9.1 release by <a href="https://github.com/KodrAus"><code>@KodrAus</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/763">uuid-rs/uuid#763</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/uuid-rs/uuid/compare/1.9.0...1.9.1">https://github.com/uuid-rs/uuid/compare/1.9.0...1.9.1</a></p> <h2>1.9.0</h2> <h2><code>Uuid::now_v7()</code> is guaranteed to be monotonic</h2> <p>Before this release, <code>Uuid::now_v7()</code> would only use the millisecond-precision timestamp for ordering. It now also uses a global 42-bit counter that's re-initialized each millisecond so that the following will always pass:</p> <pre lang="rust"><code>let a = Uuid::now_v7(); let b = Uuid::now_v7(); <p>assert!(a < b);<br /> </code></pre></p> <h2>What's Changed</h2> <ul> <li>Add a get_node_id method for v1 and v6 UUIDs by <a href="https://github.com/KodrAus"><code>@KodrAus</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/748">uuid-rs/uuid#748</a></li> <li>Update atomic and zerocopy to latest by <a href="https://github.com/KodrAus"><code>@KodrAus</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/750">uuid-rs/uuid#750</a></li> <li>Add repository field to uuid-macro-internal crate by <a href="https://github.com/paolobarbolini"><code>@paolobarbolini</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/752">uuid-rs/uuid#752</a></li> <li>update docs to updated RFC (from 4122 to 9562) by <a href="https://github.com/Mikopet"><code>@Mikopet</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/753">uuid-rs/uuid#753</a></li> <li>Support counters in v7 UUIDs by <a href="https://github.com/KodrAus"><code>@KodrAus</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/755">uuid-rs/uuid#755</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/paolobarbolini"><code>@paolobarbolini</code></a> made their first contribution in <a href="https://redirect.github.com/uuid-rs/uuid/pull/752">uuid-rs/uuid#752</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Thomas Eizinger
|
50d6b865a1 |
refactor(connlib): move Tun implementations out of firezone-tunnel (#5903)
The different implementations of `Tun` are the last platform-specific code within `firezone-tunnel`. By introducing a dedicated crate and a `Tun` trait, we can move this code into (platform-specific) leaf crates: - `connlib-client-android` - `connlib-client-apple` - `firezone-bin-shared` Related: #4473. --------- Co-authored-by: Not Applicable <ReactorScram@users.noreply.github.com> |
||
|
Thomas Eizinger
|
23ef0e36b4 |
chore(connlib): make fields in TunnelTest private (#5967)
These aren't actually accessed outside the test itself and can be private. |
||
|
Reactor Scram
|
710fb2fd7e |
chore(gui-client): bump deps so we can get to zbus 4.x (#5957)
Yak shave for #5846 |
||
|
Jamil
|
423032cb5b |
fix(apple): stringify errors from WrappedSession::connect (#5970)
Errors returned from `WrappedSession.connect` are always a `RustString` but those are only pointers to the actual data. See https://chinedufn.github.io/swift-bridge/built-in/string/index.html#ruststring for details. To see the actual string on the Swift side (and in the logs), we need to call `.toString()` on it. Fixes: #5965. --------- Signed-off-by: Jamil <jamilbk@users.noreply.github.com> Co-authored-by: Thomas Eizinger <thomas@eizinger.io> Co-authored-by: Reactor Scram <ReactorScram@users.noreply.github.com> |
||
|
Jamil
|
6ae494904e |
docs: Update 'user guides' -> 'client apps' (#5940)
- This terminology / naming makes things more clear for most admins/users. - Fixes layout of /kb/client-apps to align better --------- Signed-off-by: Jamil <jamilbk@users.noreply.github.com> Co-authored-by: Not Applicable <ReactorScram@users.noreply.github.com> |
||
|
Thomas Eizinger
|
ac79ba0f97 |
refactor(connlib): better ctor for SimRelay (#5947)
|
||
|
Thomas Eizinger
|
45879ba481 |
chore(connlib): shorter formatting for Debug impls of IDs (#5946)
We almost never `Debug`-print our IDs. Except in the proptests where the test runner prints them. To allow for better use of full-text search, apply the same formatting that we have for the `Display` output to the `Debug` output as well. |
||
|
Thomas Eizinger
|
03c3bb7f15 |
fix(connlib): drop direct traffic from gateway (#5945)
In #5917, we introduced a sampled boolean that controls whether direct traffic from clients to gateways is dropped. To correctly, simulate such a network scenario, we also need to drop traffic from gateways back to clients. |
||
|
Thomas Eizinger
|
67ffa7017e |
fix(connlib): make iteration of maps and sets deterministic (#5943)
For `tunnel_test`, it is very important that each execution of a set of state transitions is completely deterministic, otherwise the shrinking behaviour does not work. Iterating over `HashMap` and `HashSet` is non-deterministic. To fix this, we convert several maps and sets to `BTreeMap`s and `BTreeSet`s. |
||
|
Reactor Scram
|
079546cfbf |
refactor(gui-client): remove abstraction layer over keyring dep (#5961)
This abstraction existed early in the days of the Linux GUI, before the auth module was fully set up. It's not needed now, both Linux and Windows just sit atop `keyring-rs` ```[tasklist] - [x] Smoke test in Linux VM - [x] Smoke test in Windows VM ``` |
||
|
dependabot[bot]
|
8bd94750a6 |
build(deps): Bump tauri-utils from 1.5.4 to 1.6.0 in /rust (#5949)
Bumps [tauri-utils](https://github.com/tauri-apps/tauri) from 1.5.4 to 1.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tauri-apps/tauri/releases">tauri-utils's releases</a>.</em></p> <blockquote> <h2>tauri-utils v1.6.0</h2> <!-- raw HTML omitted --> <pre><code>Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 630 security advisories (from /home/runner/.cargo/advisory-db) Updating crates.io index Scanning Cargo.lock for vulnerabilities (590 crate dependencies) Crate: atty Version: 0.2.14 Warning: unsound Title: Potential unaligned read Date: 2021-07-04 ID: RUSTSEC-2021-0145 URL: https://rustsec.org/advisories/RUSTSEC-2021-0145 Dependency tree: atty 0.2.14 └── clap 3.2.25 └── tauri 1.7.0 ├── tauri 1.7.0 ├── restart 0.1.0 └── app-updater 0.1.0 <p>warning: 1 allowed warning found </code></pre></p> <!-- raw HTML omitted --> <h2>[1.6.0]</h2> <h3>New Features</h3> <ul> <li><a href=" |
||
|
Thomas Eizinger
|
fa58e27883 |
refactor(connlib): reduce indentation when looping over gateways (#5944)
By leveraging `let-else`, we can perform the main action - pushing to the buffered transmits - on first indentation level of the loop. |
||
|
Thomas Eizinger
|
ab8d6dca1e |
fix(connlib): only send DNS through tunnel if upstream DNS is configured (#5819)
Extracted out of #5797. This is a problem that becomes evident as https://github.com/firezone/firezone/issues/2667 is implemented: Whenever connlib sees a DNS packet where the sentinel DNS is a resource, it's forwarded to the resource instead of requests being resolved locally. This doesn't work well with system's DNS servers since many times those are provided by the DHCP to be a local resolver which can't be reached from a gateway. Meaning that with full route this request will be just dropped. Preventing all internet connections outside of Firezone. Most of the times when an administrator actually wants to forward all DNS request they will add explicitly an upstream DNS server which makes sense since depending on what the local DHCP configures isn't a good idea if you want to tunnel DNS requests. This makes this behavior explicit and docs and UI should be updated accordingly. Co-authored-by: Gabi <gabrielalejandro7@gmail.com> --------- Co-authored-by: Gabi <gabrielalejandro7@gmail.com> |
||
|
dependabot[bot]
|
6fa6c08bf9 |
build(deps): Bump pnet_packet from 0.34.0 to 0.35.0 in /rust (#5396)
Bumps [pnet_packet](https://github.com/libpnet/libpnet) from 0.34.0 to 0.35.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/libpnet/libpnet/releases">pnet_packet's releases</a>.</em></p> <blockquote> <h2>v0.35.0</h2> <h2>What's Changed</h2> <ul> <li>Update license field following SPDX 2.1 license expression standard by <a href="https://github.com/frisoft"><code>@frisoft</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/633">libpnet/libpnet#633</a></li> <li>transport: Add option to set ECN on the TransportSender socket. by <a href="https://github.com/hawkinsw"><code>@hawkinsw</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/685">libpnet/libpnet#685</a></li> <li>Fix failing tests by <a href="https://github.com/Paul-weqe"><code>@Paul-weqe</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/676">libpnet/libpnet#676</a></li> <li>remove the repetitive word by <a href="https://github.com/cuishuang"><code>@cuishuang</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/672">libpnet/libpnet#672</a></li> <li>Add apple tvos support by <a href="https://github.com/lcruz99"><code>@lcruz99</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/652">libpnet/libpnet#652</a></li> <li>Adding vxlan to pnet_packet by <a href="https://github.com/stevedoyle"><code>@stevedoyle</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/654">libpnet/libpnet#654</a></li> <li>Add ICMP Destination unreachable Next-hop MTU by <a href="https://github.com/fabi321"><code>@fabi321</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/662">libpnet/libpnet#662</a></li> <li>Update ARP example to also support IPv6 via NDP by <a href="https://github.com/tgross35"><code>@tgross35</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/642">libpnet/libpnet#642</a></li> <li>Ensure BPF read is 4-byte aligned by <a href="https://github.com/frankplow"><code>@frankplow</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/655">libpnet/libpnet#655</a></li> <li>Expose the various values in the TcpOption structure for external program access by <a href="https://github.com/rikonaka"><code>@rikonaka</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/640">libpnet/libpnet#640</a></li> <li>Definition for ethernet flow control packets. by <a href="https://github.com/AJMansfield"><code>@AJMansfield</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/649">libpnet/libpnet#649</a></li> <li>Expose set_ecn on unix only by <a href="https://github.com/mrmonday"><code>@mrmonday</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/689">libpnet/libpnet#689</a></li> <li>datalink(linux): add feature to pass the fd (socket) to ::channel() by <a href="https://github.com/Martichou"><code>@Martichou</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/584">libpnet/libpnet#584</a></li> <li>Added DNS protocol support by <a href="https://github.com/tomDev5"><code>@tomDev5</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/678">libpnet/libpnet#678</a></li> <li>linux: use poll api instead of select inorder to support fd > 1024. Fixes <a href="https://redirect.github.com/libpnet/libpnet/issues/612">#612</a> and <a href="https://redirect.github.com/libpnet/libpnet/issues/639">#639</a> by <a href="https://github.com/nemosupremo"><code>@nemosupremo</code></a> in <a href="https://redirect.github.com/libpnet/libpnet/pull/681">libpnet/libpnet#681</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/frisoft"><code>@frisoft</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/633">libpnet/libpnet#633</a></li> <li><a href="https://github.com/hawkinsw"><code>@hawkinsw</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/685">libpnet/libpnet#685</a></li> <li><a href="https://github.com/Paul-weqe"><code>@Paul-weqe</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/676">libpnet/libpnet#676</a></li> <li><a href="https://github.com/cuishuang"><code>@cuishuang</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/672">libpnet/libpnet#672</a></li> <li><a href="https://github.com/lcruz99"><code>@lcruz99</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/652">libpnet/libpnet#652</a></li> <li><a href="https://github.com/stevedoyle"><code>@stevedoyle</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/654">libpnet/libpnet#654</a></li> <li><a href="https://github.com/fabi321"><code>@fabi321</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/662">libpnet/libpnet#662</a></li> <li><a href="https://github.com/tgross35"><code>@tgross35</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/642">libpnet/libpnet#642</a></li> <li><a href="https://github.com/frankplow"><code>@frankplow</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/655">libpnet/libpnet#655</a></li> <li><a href="https://github.com/AJMansfield"><code>@AJMansfield</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/649">libpnet/libpnet#649</a></li> <li><a href="https://github.com/tomDev5"><code>@tomDev5</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/678">libpnet/libpnet#678</a></li> <li><a href="https://github.com/nemosupremo"><code>@nemosupremo</code></a> made their first contribution in <a href="https://redirect.github.com/libpnet/libpnet/pull/681">libpnet/libpnet#681</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/libpnet/libpnet/compare/v0.34.0...v0.35.0">https://github.com/libpnet/libpnet/compare/v0.34.0...v0.35.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Thomas Eizinger
|
5e021a235c |
test(connlib): proactively force connections through relay (#5917)
Currently, the relay path in `tunnel_test` is only hit accidentally because we don't run the gateways in dual-stack mode and thus, some testcases have a client and gateways that can't talk to each other (and thus fall back to the relay). This requires us to filter out certain resources because we can't route to an IPv6 CIDR resource from an IPv4-only gateway. This causes quite a lot of rejections which creates problems when one attempts up the number of test cases (i.e. 10_000). To fix this, we run the gateways always in dual-stack mode and introduce a dedicated flag that sometimes drop all direct traffic between the client and the gateways. |
||
|
Gabi
|
18394e3dcb |
fix(connlib): send dns proxy ips even with overlapping internet resource (#5902)
To determine whether we send proxy IPs we depend on the `allowed_ips`, since that's where we track what resources we have sent to a given gateway. However, the way we were matching if a given resource destination was sent was using `longest_match` and with overlapping DNS this no longer works, since this will match for internet resources even if the proxy IP wasn't sent. So we check that it's a DNS resource and if it's we exactly match on the allowed ip table. Alternatively, we could keep track of `sent_ips` for a gateway, though this is a bit of a redundant state that we need to keep in sync but has the benefit of being more explicit, so I'm open to do that in a follow up PR. But I'd like to merge this to get ready for internet resources. |