When using the Internet Resource, it can happen that Clients are still
receiving packets with a source IP that is different from the TUN IP.
Such packets are dropped on the Gateway already today and therefore have
never been routed to their destination.
The Gateway cannot route these packets because the reply packets would
have the original source address set as the destination and that one is
not unique across all Firezone Clients. Without a unique destination,
the Gateway cannot send the packet to the correct Client.
Today, these packets are filtered on the Gateway and thus trigger an
ICMP error. With the addition of #10462, we create a new flow for each
one of these packets. To prevent this spam, we drop such packets early
in the Client and don't even route them to the Gateway.
Bumps the aya group in /rust with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [aya](https://github.com/aya-rs/aya) | ``ec3eacc`` | ``fe99fa1`` |
| [aya-build](https://github.com/aya-rs/aya) | ``ec3eacc`` | ``fe99fa1``
|
| [aya-ebpf](https://github.com/aya-rs/aya) | ``ec3eacc`` | ``fe99fa1``
|
| [aya-log](https://github.com/aya-rs/aya) | ``ec3eacc`` | ``fe99fa1`` |
| [aya-log-ebpf](https://github.com/aya-rs/aya) | ``ec3eacc`` |
``fe99fa1`` |
Updates `aya` from `ec3eacc` to `fe99fa1`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe99fa1d2e"><code>fe99fa1</code></a>
ebpf: run clippy with target=bpf</li>
<li><a
href="552b69367f"><code>552b693</code></a>
xtask: remove outdated snippet</li>
<li><a
href="bb45904b08"><code>bb45904</code></a>
xtask: patch gen_init_cpio.c</li>
<li><a
href="8e31f5fa43"><code>8e31f5f</code></a>
Merge pull request <a
href="https://redirect.github.com/aya-rs/aya/issues/1355">#1355</a> from
aya-rs/dependabot/cargo/cargo-crates-7838c61200</li>
<li><a
href="ace02870f2"><code>ace0287</code></a>
build(deps): update cargo_metadata requirement in the cargo-crates
group</li>
<li><a
href="5f5305c2a8"><code>5f5305c</code></a>
lint all crates; enable strict pointer lints</li>
<li>See full diff in <a
href="ec3eacc1d8...fe99fa1d2e">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-build` from `ec3eacc` to `fe99fa1`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe99fa1d2e"><code>fe99fa1</code></a>
ebpf: run clippy with target=bpf</li>
<li><a
href="552b69367f"><code>552b693</code></a>
xtask: remove outdated snippet</li>
<li><a
href="bb45904b08"><code>bb45904</code></a>
xtask: patch gen_init_cpio.c</li>
<li><a
href="8e31f5fa43"><code>8e31f5f</code></a>
Merge pull request <a
href="https://redirect.github.com/aya-rs/aya/issues/1355">#1355</a> from
aya-rs/dependabot/cargo/cargo-crates-7838c61200</li>
<li><a
href="ace02870f2"><code>ace0287</code></a>
build(deps): update cargo_metadata requirement in the cargo-crates
group</li>
<li><a
href="5f5305c2a8"><code>5f5305c</code></a>
lint all crates; enable strict pointer lints</li>
<li>See full diff in <a
href="ec3eacc1d8...fe99fa1d2e">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-ebpf` from `ec3eacc` to `fe99fa1`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe99fa1d2e"><code>fe99fa1</code></a>
ebpf: run clippy with target=bpf</li>
<li><a
href="552b69367f"><code>552b693</code></a>
xtask: remove outdated snippet</li>
<li><a
href="bb45904b08"><code>bb45904</code></a>
xtask: patch gen_init_cpio.c</li>
<li><a
href="8e31f5fa43"><code>8e31f5f</code></a>
Merge pull request <a
href="https://redirect.github.com/aya-rs/aya/issues/1355">#1355</a> from
aya-rs/dependabot/cargo/cargo-crates-7838c61200</li>
<li><a
href="ace02870f2"><code>ace0287</code></a>
build(deps): update cargo_metadata requirement in the cargo-crates
group</li>
<li><a
href="5f5305c2a8"><code>5f5305c</code></a>
lint all crates; enable strict pointer lints</li>
<li>See full diff in <a
href="ec3eacc1d8...fe99fa1d2e">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-log` from `ec3eacc` to `fe99fa1`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe99fa1d2e"><code>fe99fa1</code></a>
ebpf: run clippy with target=bpf</li>
<li><a
href="552b69367f"><code>552b693</code></a>
xtask: remove outdated snippet</li>
<li><a
href="bb45904b08"><code>bb45904</code></a>
xtask: patch gen_init_cpio.c</li>
<li><a
href="8e31f5fa43"><code>8e31f5f</code></a>
Merge pull request <a
href="https://redirect.github.com/aya-rs/aya/issues/1355">#1355</a> from
aya-rs/dependabot/cargo/cargo-crates-7838c61200</li>
<li><a
href="ace02870f2"><code>ace0287</code></a>
build(deps): update cargo_metadata requirement in the cargo-crates
group</li>
<li><a
href="5f5305c2a8"><code>5f5305c</code></a>
lint all crates; enable strict pointer lints</li>
<li>See full diff in <a
href="ec3eacc1d8...fe99fa1d2e">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-log-ebpf` from `ec3eacc` to `fe99fa1`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe99fa1d2e"><code>fe99fa1</code></a>
ebpf: run clippy with target=bpf</li>
<li><a
href="552b69367f"><code>552b693</code></a>
xtask: remove outdated snippet</li>
<li><a
href="bb45904b08"><code>bb45904</code></a>
xtask: patch gen_init_cpio.c</li>
<li><a
href="8e31f5fa43"><code>8e31f5f</code></a>
Merge pull request <a
href="https://redirect.github.com/aya-rs/aya/issues/1355">#1355</a> from
aya-rs/dependabot/cargo/cargo-crates-7838c61200</li>
<li><a
href="ace02870f2"><code>ace0287</code></a>
build(deps): update cargo_metadata requirement in the cargo-crates
group</li>
<li><a
href="5f5305c2a8"><code>5f5305c</code></a>
lint all crates; enable strict pointer lints</li>
<li>See full diff in <a
href="ec3eacc1d8...fe99fa1d2e">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the npm_and_yarn group with 1 update in the /rust/gui-client
directory:
[vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Updates `vite` from 6.3.5 to 6.3.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v6.3.6</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v6.3.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/v6.3.6/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted -->6.3.6 (2025-09-08)<!-- raw HTML omitted
--></h2>
<ul>
<li>fix: apply <code>fs.strict</code> check to HTML files (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20736">#20736</a>)
(<a
href="0ab19ea9fc">0ab19ea</a>),
closes <a
href="https://redirect.github.com/vitejs/vite/issues/20736">#20736</a></li>
<li>fix: upgrade sirv to 3.0.2 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20735">#20735</a>)
(<a
href="e11d24008b">e11d240</a>),
closes <a
href="https://redirect.github.com/vitejs/vite/issues/20735">#20735</a></li>
<li>test: detect ts support via <code>process.features</code> (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20544">#20544</a>)
(<a
href="7d9922972b">7d99229</a>),
closes <a
href="https://redirect.github.com/vitejs/vite/issues/20544">#20544</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3f337c5e24"><code>3f337c5</code></a>
release: v6.3.6</li>
<li><a
href="e11d24008b"><code>e11d240</code></a>
fix: upgrade sirv to 3.0.2 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20735">#20735</a>)</li>
<li><a
href="0ab19ea9fc"><code>0ab19ea</code></a>
fix: apply <code>fs.strict</code> check to HTML files (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20736">#20736</a>)</li>
<li><a
href="7d9922972b"><code>7d99229</code></a>
test: detect ts support via <code>process.features</code> (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20544">#20544</a>)</li>
<li>See full diff in <a
href="https://github.com/vitejs/vite/commits/v6.3.6/packages/vite">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/firezone/firezone/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@fontsource-variable/source-sans-3](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/source-sans-3)
from 5.2.8 to 5.2.9.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/source-sans-3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The `mio` library which underpins `tokio` has a bug on Windows in
regards to named pipes where under certain circumstances an "unreachable
code" section is entered. See
https://github.com/tokio-rs/mio/issues/1819 for the upstream bug report.
In this PR, we patch in a fork of `mio` that aims to fix these issues by
handling the state transitions more gracefully. I am not a Windows
expert by any means so this will need some rigorous testing to make sure
the IPC channel between GUI and Tunnel service still works reliably.
Related: https://github.com/tokio-rs/mio/pull/1903
On Fedora, when a package gets upgraded, the new package is installed
first, followed by the uninstall of the old package. As a result, the
`prerm` script is called after the `postinst` script of the new package.
In our `prerm` script, we stop the tunnel service. On package upgrades,
this results in us stopping the tunnel service after installing the new
package, confronting the user with an error that the tunnel service is
not running.
`rpm` passes arguments to these maintenance scripts. In the case of
`prerm`, we receive the count of how many other instances of this
packages are installed. To fix this bug, we check whether the first
argument to the script is "1", meaning that we are being upgraded and
should not stop the tunnel service.
Whilst the regression seeds file itself is useful to have a fixed set of
tests that are always run, the comments what a specific seed samples to
quickly get outdated as the test suite evolves. Therefore, we remove the
comments to not confuse developers.
Firezone Clients set themselves as the system-wide DNS resolver on
startup. This is necessary to intercept queries for DNS resources which
resolve to proxy IPs whilst Firezone is active.
All DNS queries for non-resources are forwarded to either the resolver
defined on the system or the ones defined in the portal (if any). These
DNS servers can also be CIDR resources in which cases the queries get
forwarded through the tunnel to a Gateway.
Right now, the responses from these DNS servers are never cached. DNS is
pretty heavily relied on on most systems and having DNS fail or be slow
usually results in a bad user experience.
To improve on this, we embed a small DNS cache into connlib where for
each query, we first try to answer it from the cache. Queries otherwise
forwarded to the system/upstream resolver or through the tunnel will see
a much improved response time with this change.
When serving responses from this cache, the TTL is decremented
automatically based on how much time has passed since the entry was
first added to the cache. Outside of the response time being ~1ms, this
makes the cache fully transparent.
Resolves: #10508
Building on top of #10507, setting the initial Internet Resource state
is a piece of cake. All we need to do is thread a boolean variable
through to all call-sites of `Session::connect`. Without the need for
the Internet Resource's ID, we can simply pass in the boolean that is
saved in the configuration of each client.
Resolves: #10255
Instead of the generic "disable any kind of resource"-functionality that
connlib currently exposes, we now provide an API to only enable /
disable the Internet Resource. This is a lot simpler to deal with and
reason about than the previous system, especially when it comes to the
proptests. Those need to model connlib's behaviour correctly across its
entire API surface which makes them unnecessarily complex if we only
ever use the `set_disabled_resources` API with a single resource.
In preparation for #4789, I want to extend the proptests to cover
traffic filters (#7126). This will make them a fair bit more
complicated, so any prior removal of complexity is appreciated.
Simplifying the implementation here is also a good starting point to fix
#10255. Not implicitly enabling the Internet Resource when it gets added
should be quite simple after this change.
Finally, resolving #8885 should also be quite easy. We just need to
store the state of the Internet Resource once per API URL instead of
globally.
Resolves: #8404
---------
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
In #10347, we made sure that we always return all errors that happen
during a single tick of the event-loop. What we overlooked is that as
part of handling the errors, we need to use `continue` to jump to the
next one instead of returning directly from the function.
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
When a Client disconnects from a Gateway, we might still be receiving
packets that are either in-flight or are still being sent by the
resource. For some amount of time after a disconnect, this is expected
and not worth logging a warning for.
With this PR, we define this time to be 60s. If we cannot look up a
connection either by ID, session index or public key but the peer has
disconnected within the last 60s, we will now only print a DEBUG log
instead of a WARN.
Resolves: #10175
Instead of mirroring the ECN bits of an IP packet on the resulting UDP
packet in the event-loop, we can extend `Transmit` with an `ecn` field
and directly set it every time we construct a `Transmit`, mirroring the
ECN bits from the inner IP packet if the UDP packet contains an
encapsulated IP packet.
Extracted from #10485
When an application sends UDP packets that are larger than the MTU of
the underlying interface, the kernel fragments the packet at the IP
level. Firezone does not support fragmented IP packets because we need
to pack each IP packet into a UDP packet.
Right now, we don't check for fragmented IP packets which results in
packet parsing errors because the slice we are trying to parse the
packet from is not long enough.
To avoid spamming Sentry in these cases, we explicitly check for
fragmented IP packets and only log those on DEBUG.
Resolves: #10335
Bumps [zbus](https://github.com/dbus2/zbus) from 5.9.0 to 5.11.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dbus2/zbus/releases">zbus's
releases</a>.</em></p>
<blockquote>
<h2>🔖 zbus 5.11.0</h2>
<ul>
<li>✨ API to specify timeouts for method calls. Add a way to specify an
timeout for method calls. If
set, the method calls will timeout after the specified duration,
returning an error. This can be
used to handle the issues with non-answering D-Bus services.</li>
<li>🩹 Add <code>connection::socket::Split::new</code> method, allowing
<code>Socket</code> trait impls outside zbus.</li>
<li>📝 Mention receive_X_changes in <code>proxy</code> docs.</li>
</ul>
<h2>🔖 zbus 5.10.0</h2>
<ul>
<li>✨ Property stream will now first yield the current value.</li>
<li>🐛 Fall back to no groups rather than erroring out for peer
creds.</li>
<li>📝 Fix wrong documentation in blocking <code>Proxy</code>
methods.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="edd9a3c3d3"><code>edd9a3c</code></a>
Merge pull request <a
href="https://redirect.github.com/dbus2/zbus/issues/1494">#1494</a> from
zeenix/prep-zb-5.11</li>
<li><a
href="ee3fb1b4f7"><code>ee3fb1b</code></a>
🔖 zb,zm: Release 5.11.0</li>
<li><a
href="9f85ee4b3d"><code>9f85ee4</code></a>
✅ zb: Much shorter timeout in method timeout test</li>
<li><a
href="000039a7d8"><code>000039a</code></a>
♻️ zb: Micro simplification</li>
<li><a
href="dbd853e3be"><code>dbd853e</code></a>
⬆️ micro: Update chrono to v0.4.42 (<a
href="https://redirect.github.com/dbus2/zbus/issues/1493">#1493</a>)</li>
<li><a
href="bd4d5c722e"><code>bd4d5c7</code></a>
Merge pull request <a
href="https://redirect.github.com/dbus2/zbus/issues/1491">#1491</a> from
dbus2/security-policy</li>
<li><a
href="29825e74cc"><code>29825e7</code></a>
🔒️ Add comprehensive security policy</li>
<li><a
href="e46151c9ad"><code>e46151c</code></a>
Merge pull request <a
href="https://redirect.github.com/dbus2/zbus/issues/1477">#1477</a> from
sergeyfd/main</li>
<li><a
href="979f5f9030"><code>979f5f9</code></a>
✨ zb: API to specify timeouts for method calls</li>
<li><a
href="442063d295"><code>442063d</code></a>
⬆️ micro: Update time to v0.3.43 (<a
href="https://redirect.github.com/dbus2/zbus/issues/1490">#1490</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/dbus2/zbus/compare/zbus-5.9.0...zbus-5.11.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Instead of logging this inside the event-loop, it is better to move it
into the corresponding handler function to free up the event-loop from
as much "logic" as possible. It should ideally only be concerned with
linking the state machine with the IO components that actually cause the
side-effects.
Bumps [keyring](https://github.com/hwchen/keyring-rs) from 3.6.2 to
3.6.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hwchen/keyring-rs/releases">keyring's
releases</a>.</em></p>
<blockquote>
<h2>v3.6.3: Likely final release of v3</h2>
<p>This release integrates a few important bug fixes (thanks <a
href="https://github.com/vermiculus"><code>@vermiculus</code></a>, <a
href="https://github.com/unkcpz"><code>@unkcpz</code></a>) that have
come in since the release of v3.6.2, and is the last release expected
for the v3 series. The release of v4 is expected in about a month, and
it will bring significant changes:</p>
<ul>
<li>the cross-platform API will become its own crate: keyring-core.</li>
<li>each credential store will become its own store.</li>
<li>this crate will become an example of how to write a keyring-based
application.</li>
</ul>
<p>PLEASE NOTE: with this release, the main branch has changed
significantly. What was on the main branch has moved to be a v4 branch,
and the main branch was reverted to v3.6.2 and then had bug fix commits
added on. If you have an existing fork of this repository, you should
immediately sync your repo by choosing the "discard commits"
option, which will take your repo back to v3.6.2 and then pull the newer
commits. Then, if you have development work on one of your other
branches, you should rebase that work onto the updated main.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="315cbdf6c6"><code>315cbdf</code></a>
Credits for v3.6.3 release.</li>
<li><a
href="edee747db0"><code>edee747</code></a>
Merge pull request <a
href="https://redirect.github.com/hwchen/keyring-rs/issues/260">#260</a>
from open-source-cooperative/dependabot/cargo/windows...</li>
<li><a
href="a3470f1260"><code>a3470f1</code></a>
Update windows-sys requirement from 0.59 to 0.60</li>
<li><a
href="f38b5e9afa"><code>f38b5e9</code></a>
Cherry pick all contributions since 3.6.2.</li>
<li><a
href="b9af61dc5a"><code>b9af61d</code></a>
Zero out credential passwords before dealloc.</li>
<li><a
href="19ec928f2b"><code>19ec928</code></a>
Don't clone returned passwords.</li>
<li><a
href="46eebf5688"><code>46eebf5</code></a>
windows: use static value for 'comment' attribute</li>
<li><a
href="7b408eddc7"><code>7b408ed</code></a>
Revert variable renaming</li>
<li><a
href="88a3d6c01d"><code>88a3d6c</code></a>
Cosmetic fix: remove blank lines</li>
<li><a
href="afcc3148ca"><code>afcc314</code></a>
Implement default byte -> password conversion methods.</li>
<li>Additional commits viewable in <a
href="https://github.com/hwchen/keyring-rs/compare/v3.6.2...v3.6.3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the aya group in /rust with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [aya](https://github.com/aya-rs/aya) | ``3018246`` | ``ec3eacc`` |
| [aya-build](https://github.com/aya-rs/aya) | ``3018246`` | ``ec3eacc``
|
| [aya-ebpf](https://github.com/aya-rs/aya) | ``3018246`` | ``ec3eacc``
|
| [aya-log](https://github.com/aya-rs/aya) | ``3018246`` | ``ec3eacc`` |
| [aya-log-ebpf](https://github.com/aya-rs/aya) | ``3018246`` |
``ec3eacc`` |
Updates `aya` from `3018246` to `ec3eacc`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ec3eacc1d8"><code>ec3eacc</code></a>
Increase VM memory</li>
<li><a
href="d1bb7bcc38"><code>d1bb7bc</code></a>
deny clippy::unnecessary_cast</li>
<li><a
href="be4d74fd06"><code>be4d74f</code></a>
deny clippy::fn_to_numeric_cast{,_with_truncation}</li>
<li><a
href="fa03dbdb46"><code>fa03dbd</code></a>
deny clippy::char_lit_as_u8</li>
<li><a
href="a7206b9098"><code>a7206b9</code></a>
deny clippy::cast_precision_loss</li>
<li><a
href="72104c4076"><code>72104c4</code></a>
deny clippy::cast_lossless</li>
<li><a
href="82e72a14ad"><code>82e72a1</code></a>
Remove unused import</li>
<li><a
href="d1fdbb9930"><code>d1fdbb9</code></a>
Update to macOS 15 (<a
href="https://redirect.github.com/aya-rs/aya/issues/1351">#1351</a>)</li>
<li><a
href="e2a68ee384"><code>e2a68ee</code></a>
aya-log: add <code>#[must_use]</code> attribute to
<code>EbpfLogger</code></li>
<li>See full diff in <a
href="30182463bd...ec3eacc1d8">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-build` from `3018246` to `ec3eacc`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ec3eacc1d8"><code>ec3eacc</code></a>
Increase VM memory</li>
<li><a
href="d1bb7bcc38"><code>d1bb7bc</code></a>
deny clippy::unnecessary_cast</li>
<li><a
href="be4d74fd06"><code>be4d74f</code></a>
deny clippy::fn_to_numeric_cast{,_with_truncation}</li>
<li><a
href="fa03dbdb46"><code>fa03dbd</code></a>
deny clippy::char_lit_as_u8</li>
<li><a
href="a7206b9098"><code>a7206b9</code></a>
deny clippy::cast_precision_loss</li>
<li><a
href="72104c4076"><code>72104c4</code></a>
deny clippy::cast_lossless</li>
<li><a
href="82e72a14ad"><code>82e72a1</code></a>
Remove unused import</li>
<li><a
href="d1fdbb9930"><code>d1fdbb9</code></a>
Update to macOS 15 (<a
href="https://redirect.github.com/aya-rs/aya/issues/1351">#1351</a>)</li>
<li><a
href="e2a68ee384"><code>e2a68ee</code></a>
aya-log: add <code>#[must_use]</code> attribute to
<code>EbpfLogger</code></li>
<li>See full diff in <a
href="30182463bd...ec3eacc1d8">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-ebpf` from `3018246` to `ec3eacc`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ec3eacc1d8"><code>ec3eacc</code></a>
Increase VM memory</li>
<li><a
href="d1bb7bcc38"><code>d1bb7bc</code></a>
deny clippy::unnecessary_cast</li>
<li><a
href="be4d74fd06"><code>be4d74f</code></a>
deny clippy::fn_to_numeric_cast{,_with_truncation}</li>
<li><a
href="fa03dbdb46"><code>fa03dbd</code></a>
deny clippy::char_lit_as_u8</li>
<li><a
href="a7206b9098"><code>a7206b9</code></a>
deny clippy::cast_precision_loss</li>
<li><a
href="72104c4076"><code>72104c4</code></a>
deny clippy::cast_lossless</li>
<li><a
href="82e72a14ad"><code>82e72a1</code></a>
Remove unused import</li>
<li><a
href="d1fdbb9930"><code>d1fdbb9</code></a>
Update to macOS 15 (<a
href="https://redirect.github.com/aya-rs/aya/issues/1351">#1351</a>)</li>
<li><a
href="e2a68ee384"><code>e2a68ee</code></a>
aya-log: add <code>#[must_use]</code> attribute to
<code>EbpfLogger</code></li>
<li>See full diff in <a
href="30182463bd...ec3eacc1d8">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-log` from `3018246` to `ec3eacc`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ec3eacc1d8"><code>ec3eacc</code></a>
Increase VM memory</li>
<li><a
href="d1bb7bcc38"><code>d1bb7bc</code></a>
deny clippy::unnecessary_cast</li>
<li><a
href="be4d74fd06"><code>be4d74f</code></a>
deny clippy::fn_to_numeric_cast{,_with_truncation}</li>
<li><a
href="fa03dbdb46"><code>fa03dbd</code></a>
deny clippy::char_lit_as_u8</li>
<li><a
href="a7206b9098"><code>a7206b9</code></a>
deny clippy::cast_precision_loss</li>
<li><a
href="72104c4076"><code>72104c4</code></a>
deny clippy::cast_lossless</li>
<li><a
href="82e72a14ad"><code>82e72a1</code></a>
Remove unused import</li>
<li><a
href="d1fdbb9930"><code>d1fdbb9</code></a>
Update to macOS 15 (<a
href="https://redirect.github.com/aya-rs/aya/issues/1351">#1351</a>)</li>
<li><a
href="e2a68ee384"><code>e2a68ee</code></a>
aya-log: add <code>#[must_use]</code> attribute to
<code>EbpfLogger</code></li>
<li>See full diff in <a
href="30182463bd...ec3eacc1d8">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-log-ebpf` from `3018246` to `ec3eacc`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ec3eacc1d8"><code>ec3eacc</code></a>
Increase VM memory</li>
<li><a
href="d1bb7bcc38"><code>d1bb7bc</code></a>
deny clippy::unnecessary_cast</li>
<li><a
href="be4d74fd06"><code>be4d74f</code></a>
deny clippy::fn_to_numeric_cast{,_with_truncation}</li>
<li><a
href="fa03dbdb46"><code>fa03dbd</code></a>
deny clippy::char_lit_as_u8</li>
<li><a
href="a7206b9098"><code>a7206b9</code></a>
deny clippy::cast_precision_loss</li>
<li><a
href="72104c4076"><code>72104c4</code></a>
deny clippy::cast_lossless</li>
<li><a
href="82e72a14ad"><code>82e72a1</code></a>
Remove unused import</li>
<li><a
href="d1fdbb9930"><code>d1fdbb9</code></a>
Update to macOS 15 (<a
href="https://redirect.github.com/aya-rs/aya/issues/1351">#1351</a>)</li>
<li><a
href="e2a68ee384"><code>e2a68ee</code></a>
aya-log: add <code>#[must_use]</code> attribute to
<code>EbpfLogger</code></li>
<li>See full diff in <a
href="30182463bd...ec3eacc1d8">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
In Firezone, a Client requests an "access authorization" for a Resource
on the fly when it sees the first packet for said Resource going through
the tunnel. If we don't have a connection to the Gateway yet, this is
also where we will establish a connection and create the WireGuard
tunnel.
In order for this to work, the access authorization state between the
Client and the Gateway MUST NOT get out of sync. If the Client thinks it
has access to a Resource, it will just route the traffic to the Gateway.
If the access authorization on the Gateway has expired or vanished
otherwise, the packets will be black-holed.
Starting with #9816, the Gateway sends ICMP errors back to the
application whenever it filters a packet. This can happen either because
the access authorization is gone or because the traffic wasn't allowed
by the specific filter rules on the Resource.
With this patch, the Client will attempt to create a new flow (i.e.
re-authorize) traffic for this resource whenever it sees such an ICMP
error, therefore acting as a way of synchronizing the view of the world
between Client and Gateway should they ever run out of sync.
Testing turned out to be a bit tricky. If we let the authorization on
the Gateway lapse naturally, we portal will also toggle the Resource off
and on on the Client, resulting in "flushing" the current
authorizations. Additionally, it the Client had only access to one
Resource, then the Gateway will gracefully close the connection, also
resulting in the Client creating a new flow for the next packet.
To actually trigger this new behaviour we need to:
- Access at least two resources via the same Gateway
- Directly send `reject_access` to the Gateway for this particular
resource
To achieve this, we dynamically eval some code on the API node and
instruct the Gateway channel to send `reject_access`. The connection
stays intact because there is still another active access authorization
but packets for the other resource are answered with ICMP errors.
To achieve a safe roll-out, the new behaviour is feature-flagged. In
order to still test it, we now also allow feature flags to be set via
env variables.
Resolves: #10074
---------
Co-authored-by: Mariusz Klochowicz <mariusz@klochowicz.com>
Bumps the tauri group in /rust/gui-client with 2 updates:
[@tauri-apps/api](https://github.com/tauri-apps/tauri) and
[@tauri-apps/cli](https://github.com/tauri-apps/tauri).
Updates `@tauri-apps/api` from 2.7.0 to 2.8.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tauri-apps/tauri/releases"><code>@tauri-apps/api</code>'s
releases</a>.</em></p>
<blockquote>
<h2><code>@tauri-apps/api</code> v2.8.0</h2>
<!-- raw HTML omitted -->
<pre><code>No known vulnerabilities found
</code></pre>
<!-- raw HTML omitted -->
<h2>[2.8.0]</h2>
<h3>New Features</h3>
<ul>
<li><a
href="68874c68c5"><code>68874c68c</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13564">#13564</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../robertrpf"><code>@robertrpf</code></a>)
Add window focusable attribute and set_focusable API.</li>
<li><a
href="5110a762e9"><code>5110a762e</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13830">#13830</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../Sky-walkerX"><code>@Sky-walkerX</code></a>)
Added <code>Window::setSimpleFullscreen</code>.</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>
<p><a
href="5ba1c3faa4"><code>5ba1c3faa</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13722">#13722</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../s00d"><code>@s00d</code></a>)
Added icon (icon and nativeIcon) support for Submenu:</p>
<ul>
<li>In the Rust API (<code>tauri</code>), you can now set an icon for
submenus via the builder and dedicated methods.</li>
<li>In the JS/TS API (<code>@tauri-apps/api</code>),
<code>SubmenuOptions</code> now has an <code>icon</code> field, and the
<code>Submenu</code> class provides <code>setIcon</code> and
<code>setNativeIcon</code> methods.</li>
<li>Usage examples are added to the documentation and demo app.</li>
</ul>
<p>This is a backwards-compatible feature. Submenus can now display
icons just like regular menu items.</p>
</li>
</ul>
<!-- raw HTML omitted -->
<pre><code>> @tauri-apps/api@2.8.0 npm-publish
/home/runner/work/tauri/tauri/packages/api
> pnpm build && cd ./dist && pnpm publish --access
public --loglevel silly --no-git-checks
<p>> <code>@tauri-apps/api</code><a
href="https://github.com/2"><code>@2</code></a>.8.0 build
/home/runner/work/tauri/tauri/packages/api
> rollup -c --configPlugin typescript</p>
<p>[36m
[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts,
./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts,
./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts,
./src/window.ts[22m → [1m./dist, ./dist[22m...[39m
[32mcreated [1m./dist, ./dist[22m in [1m1.7s[22m[39m
[36m
[1msrc/index.ts[22m →
[1m../../crates/tauri/scripts/bundle.global.js[22m...[39m
[32mcreated [1m../../crates/tauri/scripts/bundle.global.js[22m in
[1m1.9s[22m[39m
npm verbose cli /opt/hostedtoolcache/node/20.19.4/x64/bin/node
/opt/hostedtoolcache/node/20.19.4/x64/bin/npm
npm info using npm@10.8.2
npm info using node@v20.19.4
npm silly config
load:file:/opt/hostedtoolcache/node/20.19.4/x64/lib/node_modules/npm/npmrc
npm silly config load:file:/tmp/dae4d7dba587bf04d8f1d71cbc53f9eb/.npmrc
npm silly config load:file:/home/runner/work/_temp/.npmrc
</tr></table>
</code></pre></p>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b4abb6cae8"><code>b4abb6c</code></a>
Apply Version Updates From Current Changes (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13887">#13887</a>)</li>
<li><a
href="1a3d1a024e"><code>1a3d1a0</code></a>
fix(ios): Tauri iOS build with binary XCFramework dependencies (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13995">#13995</a>)</li>
<li><a
href="37154ebdcd"><code>37154eb</code></a>
chore(deps): update dependency rollup to v4.46.3 (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14027">#14027</a>)</li>
<li><a
href="380656874e"><code>3806568</code></a>
Remove <code>AsRef\<Window></code> on <code>WebviewWindow</code>
(<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14026">#14026</a>)</li>
<li><a
href="bc4afe7dd4"><code>bc4afe7</code></a>
feat(cli): check plugin versions for incompatibilities (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13993">#13993</a>)</li>
<li><a
href="7c2eb31c83"><code>7c2eb31</code></a>
feat: add <code>PluginHandle::run_mobile_plugin_async</code> (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13895">#13895</a>)</li>
<li><a
href="737364b8d3"><code>737364b</code></a>
fix: a few regressions from previous PRs (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14020">#14020</a>)</li>
<li><a
href="68874c68c5"><code>68874c6</code></a>
feat(core): webview window focusable property, closes <a
href="https://redirect.github.com/tauri-apps/tauri/issues/11130">#11130</a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13564">#13564</a>)</li>
<li><a
href="dfadcb764b"><code>dfadcb7</code></a>
feat: add <code>WebView::set_cookie</code> and
<code>WebView::delete_cookie</code> (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13661">#13661</a>)</li>
<li><a
href="22d6bcacbb"><code>22d6bca</code></a>
feat(tauri): impl <code>App::set_device_event_filter</code> for
<code>AppHandle</code> also (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14008">#14008</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tauri-apps/tauri/compare/@tauri-apps/api-v2.7.0...@tauri-apps/api-v2.8.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `@tauri-apps/cli` from 2.7.1 to 2.8.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tauri-apps/tauri/releases"><code>@tauri-apps/cli</code>'s
releases</a>.</em></p>
<blockquote>
<h2><code>@tauri-apps/cli</code> v2.8.3</h2>
<h2>[2.8.3]</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="0ac89d3b6c"><code>0ac89d3b6</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/14078">#14078</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../FabianLars"><code>@FabianLars</code></a>)
Updated <code>cargo-mobile2</code> to allow running on iOS simulators
that have a higher version than the XCode SDK. This fixes compatiblity
issues with Apple's recent "iOS 18.5 + iOS 18.6 Simulator"
platform support component.</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Upgraded to <code>tauri-cli@2.8.2</code></li>
</ul>
<h2><code>@tauri-apps/cli</code> v2.8.2</h2>
<h2>[2.8.2]</h2>
<h3>Dependencies</h3>
<ul>
<li>Upgraded to <code>tauri-cli@2.8.1</code></li>
</ul>
<h2><code>@tauri-apps/cli</code> v2.8.1</h2>
<h2>[2.8.1]</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="f0172a454a"><code>f0172a454</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/14038">#14038</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../KushalMeghani1644"><code>@KushalMeghani1644</code></a>)
Fixes <code>removeDataStore</code> return type.</li>
</ul>
<h2><code>@tauri-apps/cli</code> v2.8.0</h2>
<h2>[2.8.0]</h2>
<h3>New Features</h3>
<ul>
<li><a
href="91508c0b8d"><code>91508c0b8</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13881">#13881</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../pepperoni505"><code>@pepperoni505</code></a>)
Introduces a new configuration option that allows you to specify custom
folders to watch for changes when running <code>tauri dev</code>.</li>
<li><a
href="bc4afe7dd4"><code>bc4afe7dd</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13993">#13993</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../lucasfernog"><code>@lucasfernog</code></a>)
Check installed plugin NPM/crate versions for incompatible
releases.</li>
<li><a
href="0c402bfb6b"><code>0c402bfb6</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13997">#13997</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../lucasfernog"><code>@lucasfernog</code></a>)
Increase default iOS deployment target iOS to 14.0.</li>
<li><a
href="d6d5f37077"><code>d6d5f3707</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13358">#13358</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../lucasfernog"><code>@lucasfernog</code></a>)
Added <code>--root-certificate-path</code> option to <code>android
dev</code> and <code>ios dev</code> to be able to connect to HTTPS dev
servers.</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li><a
href="8b465a12ba"><code>8b465a12b</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13913">#13913</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../FabianLars"><code>@FabianLars</code></a>)
The bundler now pulls the latest AppImage linuxdeploy plugin instead of
using the built-in one. This should remove the libfuse requirement.</li>
<li><a
href="390cb9c36a"><code>390cb9c36</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13953">#13953</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../FabianLars"><code>@FabianLars</code></a>)
Reduced the log level of the binary patcher crate <code>goblin</code> to
only show its debug logs in <code>-vv</code> and above.</li>
<li><a
href="4475e93e13"><code>4475e93e1</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13824">#13824</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../FabianLars"><code>@FabianLars</code></a>)
The bundler and cli will now read TLS Certificates installed on the
system when downloading tools and checking versions.</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="f0dcf9637c"><code>f0dcf9637</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13980">#13980</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../Legend-Master"><code>@Legend-Master</code></a>)
Fix the generated plugin init code of <code>tauri add</code> for
<code>tauri-plugin-autostart</code> and
<code>tauri-plugin-single-instance</code></li>
<li><a
href="4d270a96a8"><code>4d270a96a</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13943">#13943</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../acx0"><code>@acx0</code></a>)
Fix codesigning verification failures caused by binary-patching during
bundling</li>
<li><a
href="b21d86a8a3"><code>b21d86a8a</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13981">#13981</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../Legend-Master"><code>@Legend-Master</code></a>)
Fix <code>tauri permission add</code> could add duplicated permissions
to the capability files</li>
<li><a
href="9c938be452"><code>9c938be45</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13912">#13912</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../takecchi"><code>@takecchi</code></a>)
Properly migrate svelte to v5 in the plugin example template</li>
</ul>
<h3>Dependencies</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e81635aa3d"><code>e81635a</code></a>
apply version updates (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14079">#14079</a>)</li>
<li><a
href="0ac89d3b6c"><code>0ac89d3</code></a>
chore(deps): Update cargo-mobile2 for ios 18.6 sim support (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14078">#14078</a>)</li>
<li><a
href="4791d09a0a"><code>4791d09</code></a>
chore(deps): update dependency rollup to v4.48.1 (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14077">#14077</a>)</li>
<li><a
href="bc829ee24d"><code>bc829ee</code></a>
chore(deps): update dependency rollup to v4.48.0 (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14053">#14053</a>)</li>
<li><a
href="11800a0071"><code>11800a0</code></a>
chore(deps): update rust crate jsonschema to 0.33 (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14074">#14074</a>)</li>
<li><a
href="662b39adb3"><code>662b39a</code></a>
apply version updates (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14070">#14070</a>)</li>
<li><a
href="2aaa801c35"><code>2aaa801</code></a>
Improve documentation of <code>app > windows</code> (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14058">#14058</a>)</li>
<li><a
href="5349984064"><code>5349984</code></a>
fix: set webview2 path before initializing runtime (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14054">#14054</a>)</li>
<li><a
href="5f535b4150"><code>5f535b4</code></a>
fix(bench): lint warnings</li>
<li><a
href="f3df96fb38"><code>f3df96f</code></a>
fix(windows): binary patching 32 bit updater type (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14065">#14065</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.7.1...@tauri-apps/cli-v2.8.3">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
In order to allow the portal to more easily classify, what kind of
component is connecting, we extend the `get_user_agent` header to
include a component type instead of the generic `connlib/`.
---------
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Co-authored-by: Jamil <jamilbk@users.noreply.github.com>
As it turns out, the flaky test was caused by a bug in the eBPF kernel where we read the old channel data header from the wrong offset. This made us essentially read garbage data for the channel number, causing us to:
a. Compute a bad checksum
b. Send the packet on a completely wrong channel
The reason this caused a flaky test is that it requires on side to pick IPv4 to talk to the relay and the other side IPv6. The happy-eyeballs approach of the `allocation` module made that non-deterministic, only exposing this bug occasionally.
To ensure these kind of things are detected earlier in the future, I am adding an additional CI step that checks all packets emitted by the eBPF kernel for checksum errors.
Fixes: #10404
Co-authored-by: Jamil Bou Kheir <jamilbk@users.noreply.github.com>
We haven't updated `aya` in a while. Unfortunately, the update is not without problems. For one, the logging infrastructure changed, requiring us to drop the error details from `xdp_adjust_head`. See https://github.com/aya-rs/aya/issues/1348. Two, the `tokio` feature flag got removed but luckily that can be worked around quite easily.
Resolves: #10344
At present, the Gateway performs DNS resolution for A & AAAA queries via
`libc`. The `resolve` system call only provides us with the resolved IPs
but not any of the metadata around the query such as TTL. As a result,
we can only cache DNS queries for a static amount of time, currently
30s. It would be more correct to cache them for their TTL instead.
To do so, we re-introduce `hickory-resolver` to our codebase.
Deliberately, we only use it for resolving A and AAAA records on the
Gateway for now. DNS resolution for SRV & TXT records happens one layer
below and uses the same infrastructure as DNS resolution on the Client.
Merging this is difficult however because the Gateway still supports the
control protocol of 1.3.x clients. That one requires DNS resolution
prior to setting up the connection of DNS resources which means it needs
to happen in the event-loop of the Gateway binary and cannot be moved
into the `Tunnel` where DNS resolution for Client and SRV/TXT records
happen.
Once we can drop support for 1.3.x clients, this Gateway's event-loop
will simplify drastically which will allow us to refactor this to a more
unified approach of DNS resolution. Until then, we can at least fix the
hardcoded TTL by using `hickory-resolver` in the event-loop.
The functionality is guarded behind a feature-flag which - as usual - is
off by default (i.e. for as long as we haven't fetched the flags). The
feature flag is already configured to `true` for staging and production
so we can test the new behaviour.
Resolves: #8232
Related: #10385
In #10076, connlib gained the ability to gracefully close connections
between peers. The Gateway already uses this when it is being gracefully
shutdown such as during an upgrade. This allows Clients to immediately
fail-over to a different Gateway instead of waiting for an ICE timeout.
When a Client signs out, we currently just drop all the state, resulting
in an ICE timeout on the Gateway ~15 seconds later. This makes it
difficult for us to analyze, whether an ICE timeout in the logs presents
an actual problem where a network connection got cut or whether the
Client simply signed out.
Whilst not water-tight, attempting to gracefully close our connections
when the Client signs out is better than nothing so we implement this
here.
All Clients use the `Session` abstraction from `client-shared` which
spawns the event-loop into a dedicated task.
- For the Linux and Windows GUI client, the already present tokio
runtime instance of the tunnel service is used for this.
- For Android and Apple, we create a dedicated, single-threaded runtime
instance for connlib.
- For the headless client, we also reuse the already existing tokio
runtime instance of the binary.
In case of Android, Apple and the headless client, this means we need to
ensure the tokio runtime instances stays alive long enough to actually
complete the graceful shutdown task. We achieve this by draining the
`EventStream` returned from `Session`. The `EventStream` is a wrapper
around a channel connected to the event-loop. This stream only finishes
once the event-loop is entirely dropped (and therefore completed the
graceful shutdown) as it holds the sender-end of the channel.
In case of the Linux and Windows GUI client, the runtime outlives the
`Session` because it is scoped to the entire tunnel process. Therefore,
no additional measures are necessary there to ensure the graceful
shutdown task completes.
Previously, the Gateway would only proactively close connections to its
peers when it was shutdown gracefully via a SIGTERM or SIGINT signal. By
copying the same design for the event-loop as I've implemented in
#10400, we can now also initiate the graceful shutdown in case the
event-loop exits with an error.
A `Future` in Rust should not be polled once it has been completed as
that may lead to panics or otherwise undesirable behaviour. To avoid
this, a `Future` can be `fuse`d which will make it return
`Poll::Pending` indefinitely after it has returned `Ready`.
We have received several Sentry alerts of poll-after-completion panics
that I believe are all stemming from this particular code.
For whatever reason, we seem to sometimes lose the association with the
"room" we are meant to be in in order to send messages to the portal.
Without joining the right room, messages get dropped silently.
To fix this, we re-join the room on such errors. Long-term, this will be
fixed by ditching phoenix-channel in favor of simple HTTP requests.
Related: #9649
Sentry can group issues together that have unique identifiers in their
message. Unfortunately, it does that only well for integers and UUIDs
and not so much for hex-values. To avoid alert fatigue, we render the
public key as a u256 which hopefully allows Sentry to group these
together.
The event-loop inside `Tunnel` processes input according to a certain
priority. We only take input from lower priority sources when the higher
priority sources are not ready. The current priorities are:
- Flush all buffers
- Read from UDP sockets
- Read from TUN device
- Read from DNS servers
- Process recursive DNS queries
- Check timeout
The idea of this priority ordering is to keep all kinds of processing
bounded and "finish" any kind of work that is on-going before taking on
new work. Anything that sits in a buffer is basically done with
processing and just needs to be written out to the network / device.
Arriving UDP packets have already traversed the network and been
encrypted on the other end, meaning they are higher priority than
reading from the TUN device. Packets from the TUN device still need to
be encrypted and sent to the remote.
Whilst there is merit in this design, it also bears the potential of
starving input sources further down if the top ones are extremely busy.
To prevent this, we refactor `Io` to read from all input sources and
present it to the event-loop as a batch, allowing all sources to make
progress before looping around. Since this event-loop has first been
conceived, we have refactored `Io` to use background threads for the UDP
sockets and TUN device, meaning they will make progress by themselves
anyway until the channels to the main-thread fill up. As such, there
shouldn't be any latency increase in processing packets even though we
are performing slightly more work per event-loop tick.
This kind of batch-processing highlights a problem: Bailing out with an
error midway through processing a batch leaves the remainder of the
batch unprocessed, essentially dropping packets. To fix this, we
introduce a new `TunnelError` type that presents a collection of errors
that we encountered while processing the batch. This might actually also
be a problem with what is currently in `main` because we are already
batch-processing packets there but possibly are bailing out midway
through the batch.
---------
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Co-authored-by: Mariusz Klochowicz <mariusz@klochowicz.com>
The default send and receive buffer sizes on Linux are too small (only
~200 KB). Checking `nstat` after an iperf run revealed that the number
of dropped packets in the first interval directly correlates with the
number of receive buffer errors reported by `nstat`.
We already try to increase the send and receive buffer sizes for our UDP
socket but unfortunately, we cannot increase them beyond what the system
limits them to. To workaround this, we try to set `rmem_max` and
`wmem_max` during startup of the Linux headless client and Gateway. This
behaviour can be disabled by setting `FIREZONE_NO_INC_BUF=true`.
This doesn't work in Docker unfortunately, so we set the values manually
in the CI perf tests and verify after the test that we didn't encounter
any send and receive buffer errors.
It is yet to be determined how we should deal with this problem for all
the GUI clients. See #10350 as an issue tracking that.
Unfortunately, this doesn't fix all packet drops during the first iperf
interval. With this PR, we now see packet drops on the interface itself.
To facilitate direct connections, `connlib` generates "optimistic"
candidates that combine the port of the host candidate with the IP of
the server-reflexive candidate. This allows sysadmins to port-forward
the Firezone port 52625 on the Gateway, allowing for direct connections
to happen behind symmetric NAT.
This feature is only really useful for IPv4 as IPv6 doesn't need
symmetric NAT due to the larger address space. It is also quite common
that users have multiple IPv6 addresses on a single interface. The
combination of the two can result in CPU spikes on the Gateway if a
client connects and sends over e.g. 10 IPv6 host candidates and various
IPv6 server-reflexive candidates. The Gateway then ends up in a loop
where it creates an NxM matrix of all these candidates.
To mitigate this, we disable optimistic candidates for IPv6 altogether
and limit the number of IPv4 optimistic candidates to 2.
In earlier versions of Firezone, the WebSocket protocol with the portal
was using the request-response semantics built into Phoenix. This
however is quite cumbersome to work with to due to the polymorphic
nature of the protocol design.
We ended up moving away from it and instead only use one-way messages
where each event directly corresponds to a message type. However, we
have never removed the capability reply messages from the
`phoenix-channel` module, instead all usages just set it to `()`.
We can simplify the code here by always setting this to `()`.
Resolves: #7091
Quality of life improvements for macOS devs, mostly relevant when not
using Xcode as daily driver - although some convenience functions &
explicit sentry dependency should make it better there too.
Bumps [tempfile](https://github.com/Stebalien/tempfile) from 3.21.0 to
3.22.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md">tempfile's
changelog</a>.</em></p>
<blockquote>
<h2>3.22.0</h2>
<ul>
<li>Updated <code>windows-sys</code> requirement to allow version
0.61.x</li>
<li>Remove <code>unstable-windows-keep-open-tempfile</code>
feature.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f720dbe098"><code>f720dbe</code></a>
chore: release 3.22.0</li>
<li><a
href="55d742cb5d"><code>55d742c</code></a>
chore: remove deprecated unstable feature flag</li>
<li><a
href="bc41a0b586"><code>bc41a0b</code></a>
build(deps): update windows-sys requirement from >=0.52, <0.61 to
>=0.52, <0....</li>
<li><a
href="3c55387ede"><code>3c55387</code></a>
test: make sure we don't drop tempdirs early (<a
href="https://redirect.github.com/Stebalien/tempfile/issues/373">#373</a>)</li>
<li><a
href="17bf644406"><code>17bf644</code></a>
doc(builder): clarify permissions (<a
href="https://redirect.github.com/Stebalien/tempfile/issues/372">#372</a>)</li>
<li><a
href="c7423f1761"><code>c7423f1</code></a>
doc(env): document the alternative to setting the tempdir (<a
href="https://redirect.github.com/Stebalien/tempfile/issues/371">#371</a>)</li>
<li><a
href="5af60ca9e3"><code>5af60ca</code></a>
test(wasi): run a few tests that shouldn't have been disabled (<a
href="https://redirect.github.com/Stebalien/tempfile/issues/370">#370</a>)</li>
<li><a
href="6c0c56198a"><code>6c0c561</code></a>
fix(doc): temp_dir doesn't check if writable</li>
<li>See full diff in <a
href="https://github.com/Stebalien/tempfile/compare/v3.21.0...v3.22.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [serde_json](https://github.com/serde-rs/json) from 1.0.143 to
1.0.145.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/serde-rs/json/releases">serde_json's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.145</h2>
<ul>
<li>Raise serde version requirement to >=1.0.220</li>
</ul>
<h2>v1.0.144</h2>
<ul>
<li>Switch serde dependency to serde_core (<a
href="https://redirect.github.com/serde-rs/json/issues/1285">#1285</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="efa66e3a1d"><code>efa66e3</code></a>
Release 1.0.145</li>
<li><a
href="23679e2b9d"><code>23679e2</code></a>
Add serde version constraint</li>
<li><a
href="fc27bafbf7"><code>fc27baf</code></a>
Release 1.0.144</li>
<li><a
href="caef3c6ea6"><code>caef3c6</code></a>
Ignore uninlined_format_args pedantic clippy lint</li>
<li><a
href="81ba3aaaff"><code>81ba3aa</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/json/issues/1285">#1285</a>
from dtolnay/serdecore</li>
<li><a
href="d21e8ce7a7"><code>d21e8ce</code></a>
Switch serde dependency to serde_core</li>
<li><a
href="6beb6cd596"><code>6beb6cd</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/json/issues/1286">#1286</a>
from dtolnay/up</li>
<li><a
href="1dbc803749"><code>1dbc803</code></a>
Raise required compiler to Rust 1.61</li>
<li><a
href="0bf5d87003"><code>0bf5d87</code></a>
Enforce trybuild >= 1.0.108</li>
<li><a
href="d12e943590"><code>d12e943</code></a>
Update actions/checkout@v4 -> v5</li>
<li>See full diff in <a
href="https://github.com/serde-rs/json/compare/v1.0.143...v1.0.145">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [semver](https://github.com/dtolnay/semver) from 1.0.26 to 1.0.27.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dtolnay/semver/releases">semver's
releases</a>.</em></p>
<blockquote>
<h2>1.0.27</h2>
<ul>
<li>Switch serde dependency to serde_core (<a
href="https://redirect.github.com/dtolnay/semver/issues/333">#333</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6ed8561154"><code>6ed8561</code></a>
Release 1.0.27</li>
<li><a
href="6967bba0e2"><code>6967bba</code></a>
Add serde version constraint</li>
<li><a
href="84d30574ff"><code>84d3057</code></a>
Exclude build.rs from crates.io package</li>
<li><a
href="b09aac935d"><code>b09aac9</code></a>
Merge pull request <a
href="https://redirect.github.com/dtolnay/semver/issues/343">#343</a>
from dtolnay/up</li>
<li><a
href="49b8570e34"><code>49b8570</code></a>
Delete backport module</li>
<li><a
href="9b04afee2f"><code>9b04afe</code></a>
Merge pull request <a
href="https://redirect.github.com/dtolnay/semver/issues/342">#342</a>
from dtolnay/up</li>
<li><a
href="83a8e91dba"><code>83a8e91</code></a>
Delete no_nonzero_bitscan configuration</li>
<li><a
href="e606a17855"><code>e606a17</code></a>
Merge pull request <a
href="https://redirect.github.com/dtolnay/semver/issues/341">#341</a>
from dtolnay/up</li>
<li><a
href="ebe7cf1897"><code>ebe7cf1</code></a>
Delete no_unsafe_op_in_unsafe_fn_lint configuration</li>
<li><a
href="a381bff044"><code>a381bff</code></a>
Merge pull request <a
href="https://redirect.github.com/dtolnay/semver/issues/340">#340</a>
from dtolnay/up</li>
<li>Additional commits viewable in <a
href="https://github.com/dtolnay/semver/compare/1.0.26...1.0.27">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [humantime](https://github.com/chronotope/humantime) from 2.2.0 to
2.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/chronotope/humantime/releases">humantime's
releases</a>.</em></p>
<blockquote>
<h2>2.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Add 'wk', 'wks' for weeks and 'yr', 'yrs' for years by <a
href="https://github.com/ryo1kato"><code>@ryo1kato</code></a> in <a
href="https://redirect.github.com/chronotope/humantime/pull/50">chronotope/humantime#50</a></li>
<li>Allow parsing zero durations with no units by <a
href="https://github.com/RobertGauld"><code>@RobertGauld</code></a> in
<a
href="https://redirect.github.com/chronotope/humantime/pull/43">chronotope/humantime#43</a></li>
<li>Use µs not us by <a
href="https://github.com/RobertGauld"><code>@RobertGauld</code></a> in
<a
href="https://redirect.github.com/chronotope/humantime/pull/45">chronotope/humantime#45</a></li>
<li>feat: parse_duration("0") by <a
href="https://github.com/aatifsyed"><code>@aatifsyed</code></a> in <a
href="https://redirect.github.com/chronotope/humantime/pull/55">chronotope/humantime#55</a></li>
<li>Support fractional durations (with precision safeguards, without any
new dependency) by <a
href="https://github.com/TheElectronWill"><code>@TheElectronWill</code></a>
in <a
href="https://redirect.github.com/chronotope/humantime/pull/56">chronotope/humantime#56</a></li>
<li>feat: Accept "+00:00" as an alternative way to specify the
UTC timezone by <a
href="https://github.com/TheElectronWill"><code>@TheElectronWill</code></a>
in <a
href="https://redirect.github.com/chronotope/humantime/pull/59">chronotope/humantime#59</a></li>
<li>Fractional tweaks by <a
href="https://github.com/djc"><code>@djc</code></a> in <a
href="https://redirect.github.com/chronotope/humantime/pull/60">chronotope/humantime#60</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="7994b71298"><code>7994b71</code></a>
ci: disable for non-main pushes</li>
<li><a
href="1b590684c7"><code>1b59068</code></a>
Bump version to 2.3.0</li>
<li><a
href="cacdb9378f"><code>cacdb93</code></a>
ci: add audit job</li>
<li><a
href="5cc8dc59ba"><code>5cc8dc5</code></a>
ci: add job to check semver compatibility</li>
<li><a
href="0d5fe2d655"><code>0d5fe2d</code></a>
Bump version to 2.2.1</li>
<li><a
href="fc0e7ea366"><code>fc0e7ea</code></a>
duration: move current value out of Parser</li>
<li><a
href="1febd5251a"><code>1febd52</code></a>
duration: track current value as Duration</li>
<li><a
href="0adba1266e"><code>0adba12</code></a>
duration: track current nanoseconds as u32</li>
<li><a
href="786218f340"><code>786218f</code></a>
Extract unit parsing</li>
<li><a
href="9ff48bf9d0"><code>9ff48bf</code></a>
Re-order duration parser methods in top-down order</li>
<li>Additional commits viewable in <a
href="https://github.com/chronotope/humantime/compare/v2.2.0...v2.3.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [resolv-conf](https://github.com/hickory-dns/resolv-conf) from
0.7.4 to 0.7.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hickory-dns/resolv-conf/releases">resolv-conf's
releases</a>.</em></p>
<blockquote>
<h2>0.7.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Add support for no-aaaa option by <a
href="https://github.com/djc"><code>@djc</code></a> in <a
href="https://redirect.github.com/hickory-dns/resolv-conf/pull/53">hickory-dns/resolv-conf#53</a></li>
<li>Change to allow for easy linking with jemalloc for downstream crates
by <a href="https://github.com/savyajha"><code>@savyajha</code></a> in
<a
href="https://redirect.github.com/hickory-dns/resolv-conf/pull/55">hickory-dns/resolv-conf#55</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3573bed392"><code>3573bed</code></a>
Bump version to 0.7.5</li>
<li><a
href="c43f155386"><code>c43f155</code></a>
Change to allow for easy linking with jemalloc for downstream
crates</li>
<li><a
href="393a0e89c0"><code>393a0e8</code></a>
Add support for no-aaaa option</li>
<li><a
href="d9275ff9fa"><code>d9275ff</code></a>
Make Display implementation exhaustive</li>
<li><a
href="0e0807df4b"><code>0e0807d</code></a>
Move Config into crate root</li>
<li><a
href="a1bf309e9a"><code>a1bf309</code></a>
Combine v4/v6 network parsers into a single function</li>
<li><a
href="39b4846103"><code>39b4846</code></a>
Enable warnings for clippy::use_self</li>
<li><a
href="d381a76ffa"><code>d381a76</code></a>
Enable warnings for unreachable_pub</li>
<li><a
href="4de9829a54"><code>4de9829</code></a>
Move default Config value to Default impl</li>
<li><a
href="eb7fbfced5"><code>eb7fbfc</code></a>
Move simple items down</li>
<li>Additional commits viewable in <a
href="https://github.com/hickory-dns/resolv-conf/compare/v0.7.4...v0.7.5">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
We are seeing some very strange IP packet parse errors coming from MacOS
devices. To better understand these, we extend the error messages with
the src and dst IP as well as the L4 header.
Related: #10335
DNS replies are UDP packets often arriving to our ephemeral range. As
such, these get dropped because we attempt to look up a channel map for
them and fail to find anything.
To fix this, we assume all UDP packets arriving with a source port of 53
are DNS packets, and pass them up the stack.
There are likely other types of UDP traffic this could be problematic
for (QUIC comes to mind), but this fixes the immediate issue at hand for
now, as detecting STUN probes is somewhat complex.
Fixes#10329
Mariusz Klochowicz