mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-27 10:18:54 +00:00
166b0d1573
All of our Linux applications have a soft-dependency on systemd. That is, in the default configuration, we expect systemd to be present on the machine. The only exception here are the docker containers for Headless Client and Gateway. For the GUI client in particular, systemd is a hard-dependency in order to control DNS on the system which we do via `systemd-resolved`. To secure the communication between the GUI client and its tunnel process, we automatically create a group called `firezone-client` to which the user gets added. All members of the group are allowed to access the unix socket which is used for IPC between the two processes. Membership in this group is also a prerequisite for accessing any of the configuration files. On the first launch of the GUI client on a Linux system, this presents a problem. For group membership changes to take the effect, the user needs to reboot. We say that in the documentation but it is unclear whether all users will read that thoroughly enough. To help the user, the GUI client checks for membership of the current user in the group and alerts the user via a dialog box if that isn't the case. This would all be fine if it would actually work. Unfortunately, that check ends up being too late in the process. If we aren't a member of the group, we cannot read the device ID and bail early, thus never reaching the check and terminating the process without any dialog box or user-visible error. We could attempt to fix this by shuffling around some of the startup init code. That is a sub-optimal solution however because it a) may get broken again in the future and b) it means we have to delay initialisation of telemetry until a much later point. Given that this is only a problem on Linux, a better solution is to simply not rely on the disk-based device ID at all. Instead, we can integrate with systemd and deterministically derive a device ID from the unique machine ID and a randomly chosen "app ID". For backwards-compatibility reasons, the disk-based device ID is still prioritised. For all new installs however, we will use the one based on `/etc/machine-id`.
95 lines
3.2 KiB
TOML
95 lines
3.2 KiB
TOML
[package]
|
|
name = "firezone-bin-shared"
|
|
version = "0.1.0"
|
|
edition = { workspace = true }
|
|
description = "Firezone-specific modules shared between binaries."
|
|
license = { workspace = true }
|
|
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
atomicwrites = { workspace = true }
|
|
axum = { workspace = true, features = ["http1", "tokio"] }
|
|
clap = { workspace = true, features = ["derive", "env"] }
|
|
dns-types = { workspace = true }
|
|
firezone-logging = { workspace = true }
|
|
firezone-telemetry = { workspace = true }
|
|
futures = { workspace = true, features = ["std", "async-await"] }
|
|
gat-lending-iterator = { workspace = true }
|
|
hex = { workspace = true }
|
|
hex-literal = { workspace = true }
|
|
ip-packet = { workspace = true }
|
|
ip_network = { workspace = true, features = ["serde"] }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
smbios-lib = { workspace = true }
|
|
socket-factory = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true, features = ["io-util", "net", "rt", "sync", "process", "signal"] }
|
|
tracing = { workspace = true }
|
|
tun = { workspace = true }
|
|
uuid = { workspace = true, features = ["v4"] }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
atomicwrites = { workspace = true }
|
|
dirs = { workspace = true }
|
|
hmac = { workspace = true }
|
|
libc = { workspace = true }
|
|
netlink-packet-core = { workspace = true }
|
|
netlink-packet-route = { workspace = true }
|
|
nix = { workspace = true, features = ["socket"] }
|
|
resolv-conf = { workspace = true }
|
|
rtnetlink = { workspace = true }
|
|
tokio-util = { workspace = true }
|
|
zbus = { workspace = true } # Can't use `zbus`'s `tokio` feature here, or it will break toast popups all the way over in `gui-client`.
|
|
|
|
[target.'cfg(windows)'.dependencies]
|
|
dashmap = { workspace = true }
|
|
ipconfig = "0.3.2"
|
|
itertools = { workspace = true }
|
|
known-folders = { workspace = true }
|
|
ring = "0.17"
|
|
tokio-util = { workspace = true }
|
|
uuid = { workspace = true, features = ["v4"] }
|
|
windows-core = { workspace = true }
|
|
windows-implement = { workspace = true }
|
|
winreg = { workspace = true }
|
|
wintun = "0.5.1"
|
|
|
|
[target.'cfg(windows)'.dependencies.windows]
|
|
workspace = true
|
|
features = [
|
|
# For implementing COM interfaces
|
|
"Win32_Foundation",
|
|
# For listening for network change events
|
|
"Win32_Networking_NetworkListManager",
|
|
"Win32_NetworkManagement_IpHelper",
|
|
"Win32_NetworkManagement_Ndis",
|
|
"Win32_Networking_WinSock",
|
|
"Win32_Security",
|
|
"Win32_System_Com",
|
|
# Needed to listen for system DNS changes
|
|
"Win32_System_Registry",
|
|
"Win32_System_Threading",
|
|
"Win32_System_SystemInformation",
|
|
# For uptime
|
|
"Win32_System_GroupPolicy", # For NRPT when GPO is used
|
|
]
|
|
|
|
[dev-dependencies]
|
|
bufferpool = { workspace = true }
|
|
bytes = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
tokio = { workspace = true, features = ["macros", "rt-multi-thread", "fs"] }
|
|
|
|
[target.'cfg(target_os = "linux")'.dev-dependencies]
|
|
mutants = "0.0.3" # Needed to mark functions as exempt from `cargo-mutants` testing
|
|
|
|
[target.'cfg(windows)'.dev-dependencies]
|
|
ip-packet = { workspace = true }
|
|
tokio = { workspace = true, features = ["net", "time"] }
|
|
|
|
[lints]
|
|
workspace = true
|