When developing the macOS app, we always build the exact same version
and build code for each build. ~~This _may_ be one reason why we
constantly have to deactivate the extension before the new one will
launch.~~ Edit: Just tested, and I can verify that this does fix the
issue on dev builds, so no more having to uninstall the sysex between
builds.
Even if that's not the reason, this is a cleaner approach than building
it in our prod-only scripts.
---------
Signed-off-by: Jamil <jamilbk@users.noreply.github.com>
When updating the provisioning profiles (i.e. when changing anything the
Apple Developer Portal), we needed to manually update these build
scripts to point to the new UUIDs.
This can be made simpler to automatically pull it out of the profiles in
CI.
Before a Client can send packets to a DNS resource, the Gateway must
first setup a NAT table between the IPs assigned by the Client and the
IPs the domain actually resolves to. This is what we call the DNS
resource NAT.
The communication for this process happens over IP through the tunnel
which is an unreliable transport. To ensure that this works reliably
even in the presence of packet loss on the wire, the Client uses an
idempotent algorithm where it tracks the state of the NAT for each
domain that is has ever assigned IPs for (i.e. received an A or AAAA
query from an application). This algorithm ensures that if we don't hear
anything back from the Gateway within 2s, another packet for setting up
the NAT is sent as soon as we receive _any_ DNS query.
This design balances efficiency (we don't try forever) with reliability
(we always check all of them).
In case a domain does not resolve at all or there are resolution errors,
the Gateway replies with `NatStatus::Inactive`. At present, the Client
doesn't handle this in any particular way other than logging that it was
not able to successfully setup the NAT.
The combination of the above results in an undesirable behaviour: If an
application queries a domain without A and AAAA records once, we will
keep retrying forever to resolve it upon every other DNS query issued to
the system. To fix this, we introduce `dns_resource_nat::State::Failed`.
Entries in this state are ignored as part of the above algorithm and
only recreated when explicitly told to do so which we only do when we
receive another DNS query for this domain.
To handle the increased complexity around this system, we extract it
into its own component and add a fleet of unit tests for its behaviour.
Currently, the Tauri build is broken on `main` because #9045
accidentally merged a bit too soon. In that PR, the two binaries that
the `gui-client` crate is composed of are now both defined in `src/bin`.
For some reason, this breaks Tauri's bundler and now on aarch64, it
stops including the `firezone-client-ipc` binary in the bundle. I don't
fully understand why and how that even works for x64 in the first place.
Nowhere in our repository can I find a configuration for the bundler as
to why it should even include that binary in the first place.
To fix this, we now explicitly copy this binary into the correct path
and also rebuild the `data` archive in addition to the `control`
archive.
When we implemented #8350, we chose an error handling strategy that
would shutdown the Gateway in case we didn't have a nameserver selected
for handling those SRV and TXT queries. At the time, this was deemed to
be sufficiently rare to be an adequate strategy. We have since learned
that this can indeed happen when the Gateway starts without network
connectivity which is quite common when using tools such as terraform to
provision infrastructure.
In #9060, we fix this by re-evaluating the fastest nameserver on a
timer. This however doesn't change the error handling strategy when we
don't have a working nameserver at all. It is practically impossible to
have a working Gateway yet us being unable to select a nameserver. We
read them from `/etc/resolv.conf` which is what `libc` uses to also
resolve the domain we connect to for the WebSocket. A working WebSocket
connection is required for us to establish connections to Clients, which
in turn is a precursor to us receiving DNS queries from a Client.
It causes unnecessary complexity to have a code path that can
potentially terminate the Gateway, yet is practically unreachable. To
fix this situation, we remove this code path and instead reply with a
DNS SERVFAIL error.
---------
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Why:
* It was pointed out that the way Postgresql does compound indexes there
is no need to have an individual index on the first column of the
compound index. This commit removes the redundant index on the
`actor_id` for the `actor_group_membership` table.
Opentelemetry logs a DEBUG log every time it creates a new meter. That
happens fairly often now in our codebase which spams the logs on the
DEBUG level.
```
2025-05-09T02:31:51.147Z DEBUG opentelemetry_sdk: name="MeterProvider.ExistingMeterReturned" meter_name="connlib"
```
We fix that be setting `opentelemetry_sdk` to default to `INFO` if it is
not specified explicitly.
Currently, the Gateway reads all nameservers from `/etc/resolv.conf` on
startup and evaluates the fastest one to use for SRV and TXT DNS queries
that are forwarded by the Client. If the machine just booted and we do
not have Internet connectivity just yet, this fails which leaves the
Gateway in state where it cannot fulfill those queries.
In order to ensure we always use the fastest one and to self-heal from
such situations, we add a 60s timer that refreshes this state.
Currently, this will **not** re-read the nameservers from
`/etc/resolv.conf` but still use the same IPs read on startup.
Why:
* As we move towards hard deleting data one issue we've run into is with
cascading deletes on the actor_group_memberships table. In order to
solve this problem indexes have been created on the `actor_id` and
`group_id` columns of the actor_group_memberships.
When the Gateway is handed an IP packet for a DNS resource that it
cannot route, it sends back an ICMP unreachable error. According to RFC
792 [0] (for ICMPv4) and RFC 4443 [1] (for ICMPv6), parts of the
original packet should be included in the ICMP error payload to allow
the sending party to correlate, what could not be sent.
For ICMPv4, the RFC says:
```
Internet Header + 64 bits of Data Datagram
The internet header plus the first 64 bits of the original
datagram's data. This data is used by the host to match the
message to the appropriate process. If a higher level protocol
uses port numbers, they are assumed to be in the first 64 data
bits of the original datagram's data.
```
For ICMPv6, the RFC says:
```
As much of invoking packet as possible without the ICMPv6 packet exceeding the minimum IPv6 MTU
```
[0]: https://datatracker.ietf.org/doc/html/rfc792
[1]: https://datatracker.ietf.org/doc/html/rfc4443#section-3.1
The module and crate structure around the GUI client and its background
service are currently a mess of circular dependencies. Most of the
service implementation actually sits in `firezone-headless-client`
because the headless-client and the service share certain modules. We
have recently moved most of these to `firezone-bin-shared` which is the
correct place for these modules.
In order to move the background service to `firezone-gui-client`, we
need to untangle a few more things in the GUI client. Those are done
commit-by-commit in this PR. With that out the way, we can finally move
the service module to the GUI client; where is should actually live
given that it has nothing to do with the headless client.
As a result, the headless-client is - as one would expect - really just
a thin wrapper around connlib itself and is reduced down to 4 files with
this PR.
To make things more consistent in the GUI client, we move the `main.rs`
file also into `bin/`. By convention `bin/` is where you define binaries
if a crate has more than one. cargo will then build all of them.
Eventually, we can optimise the compile-times for `firezone-gui-client`
by splitting it into multiple crates:
- Shared structs like IPC messages
- Background service
- GUI client
This will be useful because it allows only re-compiling of the GUI
client alone if nothing in `connlib` changes and vice versa.
Resolves: #6913Resolves: #5754
Both `device_id` and `device_info` are used by the headless-client and
the GUI client / IPC service. They should therefore be defined in the
`bin-shared` crate.
Somewhere between Xcode 16.0 and Xcode 16.3, the API for the libresolv
functions we call changed slightly, and we can now pass the return value
of `__res_9_state()` directly to the `res_9_ninit`, `res_9_ndestroy` and
`res_9_getservers` functions.
In order to experiment with alternative GUI libraries, we extracted a
`gui-client-common` crate that would hold GUI-library agnostic code.
We've since upgraded to Tauri v2 and settled on that as the GUI
framework for the Windows and Linux Firezone Clients. Therefore this
abstraction is unnecessary and can be removed again.
This makes it easier to work on the GUI client and also allows the
compiler to flag unused code more easily.
Currently, the platform-specific code for controlling DNS resolution on
a system sits in `firezone-headless-client`. This code is also used by
the GUI client. This creates a weird compile-time dependency from the
GUI client to the headless client.
For other components that have platform-specific implementations, we use
the `firezone-bin-shared` crate. As a first step of resolving the
compile-time dependency, we move the `dns_control` module to
`firezone-bin-shared`.
By default, we send all WARN and ERROR logs to Sentry. This also
includes logs emitted via the `log` crate via a facade that `tracing`
installs. The wintun-rs bindings install such a logger in the native
WinTUN code. The WinTUN code has a bug where it doesn't handle adapter
removal idempotently. That is, if the adapter has already been removed
it logs an error instead of succeeding.
Typically, such logs can easily be suppressed in Sentry. In this case
however, Sentry fails to group these different logs together because
WinTUN's error message contains a path to a temporary directory which is
different every time it gets executed. As such, these logs spam our
Sentry instance with no way for us to disable them with existing tools.
The WireGuard mailing list for WinTUN also appears to be dead. We
attempted to contact the list in February and have not received a reply
yet. The last archive goes back to November 2024 [0]. We use WinTUN as a
prebuild and signed DLL so we also cannot meaningfully patch this on our
end without upstreaming it.
Thus, as a last resort, we add some infrastructure to our logging setup
that allows us to client-side filter events based on certain patterns of
the message and a log level.
[0]: https://lists.zx2c4.com/pipermail/wireguard/
---------
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Presently, the network change detection on Windows is very naive and
simply emits a change event everytime _anything_ changes. We can
optimise this and therefore improve the start-up time of Firezone by:
- Filtering out duplicate events
- Filtering out network change events for our own network adapter
This reduces the number of network change events to 1 during startup. As
far as I can tell from the code comments in this area, we explicitly
send this one to ensure we don't run into a race condition whilst we are
starting up.
Resolves: #8905
The `signals` module isn't something headless-client specific and should
live in our `bin-shared` crate. Once the `ipc_service` module is
decoupled from the headless-client crate, it will be used by both the
headless client and IPC service (which then will be defined in the GUI
client crate).
The `known_dirs` module is used across the headless-client and the GUI
client. It should live in `bin-shared` where all the other
cross-platform modules are.
---------
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Bumps [anyhow](https://github.com/dtolnay/anyhow) from 1.0.97 to 1.0.98.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dtolnay/anyhow/releases">anyhow's
releases</a>.</em></p>
<blockquote>
<h2>1.0.98</h2>
<ul>
<li>Add <a
href="https://docs.rs/anyhow/1/anyhow/struct.Error.html#method.into_boxed_dyn_error"><code>self.into_boxed_dyn_error()</code></a>
and <a
href="https://docs.rs/anyhow/1/anyhow/struct.Error.html#method.reallocate_into_boxed_dyn_error_without_backtrace"><code>self.reallocate_into_boxed_dyn_error_without_backtrace()</code></a>
methods for anyhow::Error (<a
href="https://redirect.github.com/dtolnay/anyhow/issues/415">#415</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="709fe86f04"><code>709fe86</code></a>
Release 1.0.98</li>
<li><a
href="cbc1ad2b16"><code>cbc1ad2</code></a>
Merge pull request <a
href="https://redirect.github.com/dtolnay/anyhow/issues/415">#415</a>
from dtolnay/intodyn</li>
<li><a
href="e1a2017668"><code>e1a2017</code></a>
Add 2 different conversions to Box<dyn Error + Send + Sync +
'static></li>
<li><a
href="29f2eddd15"><code>29f2edd</code></a>
Merge pull request <a
href="https://redirect.github.com/dtolnay/anyhow/issues/416">#416</a>
from dtolnay/oldnostd</li>
<li><a
href="2244db872f"><code>2244db8</code></a>
Omit unused object_boxed from vtable in old no-std rustc</li>
<li><a
href="213a9c2e6c"><code>213a9c2</code></a>
Merge pull request <a
href="https://redirect.github.com/dtolnay/anyhow/issues/414">#414</a>
from dtolnay/nightly</li>
<li><a
href="02aa6b6faa"><code>02aa6b6</code></a>
Make all nightly go through the module that was probed</li>
<li>See full diff in <a
href="https://github.com/dtolnay/anyhow/compare/1.0.97...1.0.98">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [clap](https://github.com/clap-rs/clap) from 4.5.34 to 4.5.37.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/clap-rs/clap/releases">clap's
releases</a>.</em></p>
<blockquote>
<h2>v4.5.37</h2>
<h2>[4.5.37] - 2025-04-18</h2>
<h3>Features</h3>
<ul>
<li>Added <code>ArgMatches::try_clear_id()</code></li>
</ul>
<h2>v4.5.36</h2>
<h2>[4.5.36] - 2025-04-11</h2>
<h3>Fixes</h3>
<ul>
<li><em>(help)</em> Revert 4.5.35's "Don't leave space for shorts
if there are none" for now</li>
</ul>
<h2>v4.5.35</h2>
<h2>[4.5.35] - 2025-04-01</h2>
<h3>Fixes</h3>
<ul>
<li><em>(help)</em> Align positionals and flags when put in the same
<code>help_heading</code></li>
<li><em>(help)</em> Don't leave space for shorts if there are none</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/clap-rs/clap/blob/master/CHANGELOG.md">clap's
changelog</a>.</em></p>
<blockquote>
<h2>[4.5.37] - 2025-04-18</h2>
<h3>Features</h3>
<ul>
<li>Added <code>ArgMatches::try_clear_id()</code></li>
</ul>
<h2>[4.5.36] - 2025-04-11</h2>
<h3>Fixes</h3>
<ul>
<li><em>(help)</em> Revert 4.5.35's "Don't leave space for shorts
if there are none" for now</li>
</ul>
<h2>[4.5.35] - 2025-04-01</h2>
<h3>Fixes</h3>
<ul>
<li><em>(help)</em> Align positionals and flags when put in the same
<code>help_heading</code></li>
<li><em>(help)</em> Don't leave space for shorts if there are none</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c54ffa17f5"><code>c54ffa1</code></a>
chore: Release</li>
<li><a
href="26eab7b4e5"><code>26eab7b</code></a>
docs: Update changelog</li>
<li><a
href="f275804c23"><code>f275804</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/5805">#5805</a>
from epage/style</li>
<li><a
href="7c7742cae8"><code>7c7742c</code></a>
fix(complete): Adjust dynamic for MSRV</li>
<li><a
href="f1ae3c0e49"><code>f1ae3c0</code></a>
style: Make clippy happy</li>
<li><a
href="5c932b7079"><code>5c932b7</code></a>
chore(deps): Update Rust crate divan to v0.1.15 (<a
href="https://redirect.github.com/clap-rs/clap/issues/5798">#5798</a>)</li>
<li><a
href="bc0537f589"><code>bc0537f</code></a>
chore(deps): Update compatible (dev) (<a
href="https://redirect.github.com/clap-rs/clap/issues/5797">#5797</a>)</li>
<li><a
href="7a6475e3c1"><code>7a6475e</code></a>
chore: Release</li>
<li><a
href="0266c4197f"><code>0266c41</code></a>
docs: Update changelog</li>
<li><a
href="6ec0b43448"><code>6ec0b43</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/5791">#5791</a>
from okapia/zsh-default-fallback</li>
<li>Additional commits viewable in <a
href="https://github.com/clap-rs/clap/compare/clap_complete-v4.5.34...clap_complete-v4.5.37">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Running `clippy` first is more useful because it provides better
feedback around compile-errors. When working with cross-platform code,
it is often the case that one needs to push to CI to ensure everything
builds. Therefore, getting fast feedback is important.
The `uptime` module from `firezone-headless-client` is also used in the
GUI client. In order to decouple this dependency, we move the module to
`bin-shared`, next to the other cross-plaform modules.
At the moment, Firezone already attempts to prefer the same IP stack
across relayed connections all the way through to the Gateway. This is
achieved with a feature in str0m implemented in
https://github.com/algesten/str0m/pull/640 where the `IceAgent` computes
the local preference of an added candidate such that an IPv4 candidate
allocated over an IPv4 network has a higher preference than an IPv6
candidate allocated over an IPv4 network.
If a candidate gets accepted by the local agent, it is signaled to the
remote via our control protocol. The remote peer then adds the candidate
as a remote candidate and the ICE process starts by pairing them with
local ones and testing connectivity.
Currently, str0m's API consumes the candidate and only returns a `bool`
whether it should be sent signaled to the remote. This means the local
preference computed as part of `add_local_candidate` **is not**
reflected in the priority of the candidate sent to the remote. As a
result, if the controlled agent (i.e. the Gateway) is behind symmetric
NAT and therefore only has relay candidates available, the preference of
IPv4 over IPv6 candidates on an IPv4 network is lost. This is what we
are seeing in #8998.
This changes with https://github.com/algesten/str0m/pull/650 being
merged to `main` which we are updating to with this PR. Now,
`add_local_candidate` returns an `Option<&Candidate>` which has been
modified with the local preference of the `IceAgent` around the
preferred IP stack of relay candidates. As such, the priority calculated
and signaled to the remote embeds this information and will be taken
into account by the controlling agent (i.e. the Client) when nominating
a pair.
Resolves: #8998
When there is no traffic going through the tunnel, Firezone switches
into a low-power mode where it only sends STUN bindings every 60s. As
soon as we see traffic, we move out of this low-power mode to detect
connectivity problems early.
Applying this new timing config however does not clear some internal
caches in `str0m` and therefore, it can take up to the previously set
timeout value until str0m actually picks up on the new timers.
This is being fixed in https://github.com/algesten/str0m/pull/649. Until
that is merged, we depend on our fork that has these changes merged
already.
Resolves: #8999
Bumps the aya group in /rust with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [aya](https://github.com/aya-rs/aya) | ``c65a200`` | ``583709f`` |
| [aya-build](https://github.com/aya-rs/aya) | ``c65a200`` | ``583709f``
|
| [aya-ebpf](https://github.com/aya-rs/aya) | ``c65a200`` | ``583709f``
|
| [aya-log](https://github.com/aya-rs/aya) | ``c65a200`` | ``583709f`` |
| [aya-log-ebpf](https://github.com/aya-rs/aya) | ``c65a200`` |
``583709f`` |
Updates `aya` from `c65a200` to `583709f`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="583709f6a0"><code>583709f</code></a>
appease <code>clippy::uninlined-format-args</code></li>
<li>See full diff in <a
href="c65a200e9a...583709f6a0">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-build` from `c65a200` to `583709f`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="583709f6a0"><code>583709f</code></a>
appease <code>clippy::uninlined-format-args</code></li>
<li>See full diff in <a
href="c65a200e9a...583709f6a0">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-ebpf` from `c65a200` to `583709f`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="583709f6a0"><code>583709f</code></a>
appease <code>clippy::uninlined-format-args</code></li>
<li>See full diff in <a
href="c65a200e9a...583709f6a0">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-log` from `c65a200` to `583709f`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="583709f6a0"><code>583709f</code></a>
appease <code>clippy::uninlined-format-args</code></li>
<li>See full diff in <a
href="c65a200e9a...583709f6a0">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-log-ebpf` from `c65a200` to `583709f`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="583709f6a0"><code>583709f</code></a>
appease <code>clippy::uninlined-format-args</code></li>
<li>See full diff in <a
href="c65a200e9a...583709f6a0">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
GitHub's Windows runners are very slow. In order to not prolong CI runs
too much, we set the number of _additional_ proptest cases for Windows
to 0. This means we still run all the regression seeds that we've
accumulated in `proptest-regressions/tests.txt` and simply don't
generate any new ones on top of it.
This is also a good benchmark to ensure that our regression seeds cover
all cases that we are testing further down below using the coverage
grepping.
Related: #8948
ECN information is helpful to allow the congestion controllers to more
easily fine-tune their send and receive windows. When a Firezone Client
receives an IP packet where the ECN bits signal an ECN capable
transport, we mirror this bit on the UDP datagram that carries the
encrypted IP packet.
When receiving a datagram with ECN bits set, the Gateway will then apply
these bits to the decrypted IP packet and pass it along towards its
destination.
This implementation is unfortunately a bit too naive. Not all devices on
the Internet support ECN and therefore, we may receive a datagram that
has its ECN bits cleared when the ECN bits on the inner IP packet still
signal an ECN capable transport. In this case, we should _not_ override
the ECN bits and instead pass the IP packet along as is. Network devices
along the path between Gateway and Resource may still use these ECN bits
to signal congestion.
We fix this by making the `with_ecn` function on `IpPacket` private. It
is not meant to be used outside of the module. We supersede it with a
`with_ecn_from_transport` function that implements the above logic.
---------
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Co-authored-by: Jamil <jamilbk@users.noreply.github.com>
Validating checksums can be expensive so this is off-by-default. The
intent is to turn it on in our staging environment so we can detects
bugs in our packet handling code during testing.
When setting ECN information on an IP packet, the header changes and
therefore, we need to update the IP checksum. MacOS attempts to open TCP
connections with ECN information but will fallback to non-ECT if it
detects packet loss. Failing to update the checksums caused the packet
to get dropped at the remote TCP stack and therefore triggered a
retransmission on the MacOS side.
Related: #8899
When establishing connections that take longer than the TCP RTO, we may
see duplicate TCP SYNs. Those have different timestamps from each other
but are otherwise equal. To provide more accurate timing information to
the TCP stack, we now keep the latest TCP SYN around instead of the very
first one.
Bumps [resolv-conf](https://github.com/hickory-dns/resolv-conf) from
0.7.1 to 0.7.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hickory-dns/resolv-conf/releases">resolv-conf's
releases</a>.</em></p>
<blockquote>
<h2>0.7.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump version and add dummy / compat "system" feature by <a
href="https://github.com/decathorpe"><code>@decathorpe</code></a> in <a
href="https://redirect.github.com/hickory-dns/resolv-conf/pull/48">hickory-dns/resolv-conf#48</a></li>
</ul>
<h2>0.7.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Replace external crate with inline code by <a
href="https://github.com/Jake-Shadle"><code>@Jake-Shadle</code></a> in
<a
href="https://redirect.github.com/hickory-dns/resolv-conf/pull/44">hickory-dns/resolv-conf#44</a></li>
<li>Hostname tweaks by <a
href="https://github.com/djc"><code>@djc</code></a> in <a
href="https://redirect.github.com/hickory-dns/resolv-conf/pull/45">hickory-dns/resolv-conf#45</a></li>
<li>Style updates by <a
href="https://github.com/djc"><code>@djc</code></a> in <a
href="https://redirect.github.com/hickory-dns/resolv-conf/pull/46">hickory-dns/resolv-conf#46</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5d8efe95fe"><code>5d8efe9</code></a>
Bump version to 0.7.3</li>
<li><a
href="846de1b7eb"><code>846de1b</code></a>
Add back dummy "system" feature for compatibility with
0.7.1</li>
<li><a
href="47effe2e2f"><code>47effe2</code></a>
Use match ergonomics</li>
<li><a
href="1fc695df24"><code>1fc695d</code></a>
Use inline format arguments</li>
<li><a
href="7f202b8c8d"><code>7f202b8</code></a>
Bump version to 0.7.2</li>
<li><a
href="b1f9e69538"><code>b1f9e69</code></a>
Move version up</li>
<li><a
href="523747af6e"><code>523747a</code></a>
Reduce MSRV to 1.61</li>
<li><a
href="ef960824d6"><code>ef96082</code></a>
Postpone String allocation</li>
<li><a
href="07c06becbd"><code>07c06be</code></a>
Simplify domain_from_host()</li>
<li><a
href="a2b71ca625"><code>a2b71ca</code></a>
Extend domain_from_host() tests</li>
<li>Additional commits viewable in <a
href="https://github.com/hickory-dns/resolv-conf/compare/v0.7.1...v0.7.3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
These are expected during deploys, so don't log them as errors. If the
Supervisor fails to start us after exhausting all attempts, it will log
an error.
Bumps [serde](https://github.com/serde-rs/serde) from 1.0.217 to
1.0.219.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/serde-rs/serde/releases">serde's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.219</h2>
<ul>
<li>Prevent <code>absolute_paths</code> Clippy restriction being
triggered inside macro-generated code (<a
href="https://redirect.github.com/serde-rs/serde/issues/2906">#2906</a>,
thanks <a
href="https://github.com/davidzeng0"><code>@davidzeng0</code></a>)</li>
</ul>
<h2>v1.0.218</h2>
<ul>
<li>Documentation improvements</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="49d098debd"><code>49d098d</code></a>
Release 1.0.219</li>
<li><a
href="40f1d19dbe"><code>40f1d19</code></a>
Wrap dummy.rs to 80 columns</li>
<li><a
href="514848b584"><code>514848b</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/serde/issues/2906">#2906</a>
from davidzeng0/master</li>
<li><a
href="168b6cf789"><code>168b6cf</code></a>
fix clippy absolute paths warning</li>
<li><a
href="a8bdd17333"><code>a8bdd17</code></a>
Remove unused Punctuated import</li>
<li><a
href="1c9601358b"><code>1c96013</code></a>
Resolve mem_replace_with_default clippy lint</li>
<li><a
href="f0d1ae08f3"><code>f0d1ae0</code></a>
Ignore elidable_lifetime_names pedantic clippy lint</li>
<li><a
href="e3eaa6a3dd"><code>e3eaa6a</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/serde/issues/2896">#2896</a>
from dtolnay/stabledoc</li>
<li><a
href="6a630cf283"><code>6a630cf</code></a>
Also link to stable proc_macro</li>
<li><a
href="7bfd518dd4"><code>7bfd518</code></a>
Release 1.0.218</li>
<li>Additional commits viewable in <a
href="https://github.com/serde-rs/serde/compare/v1.0.217...v1.0.219">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
By default, proptest runs all regression cases + 256 new ones. Given
that we run the tests on 3 different operating systems in various
versions each and that on each PR, we are likely hitting enough
different cases to detect any bugs.
Related: #8948
These take a long time and there is not really any benefit. We already
run smoke-tests on both Windows and Linux runners which ensures that the
GUI and IPC service compile and start. In addition, we run clippy across
the entire Rust codebase.
The only thing that doesn't get tested in CI if we remove this is the
bundling of the applications. This however rarely changes and one can
always trigger the Tauri workflow manually for a PR to see if certain
changes are working.
Related: #8948
