mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-27 10:18:54 +00:00
ed2bc0bd25
Even prior to #10373, failures in resolving a name on the Gateway for a DNS resource resulted in a failure of setting up the DNS resource NAT. Without the DNS resource NAT, packets for that resource bounced on the Gateway because we didn't have any traffic filters. A non-existent filter is being treated as a "traffic not allowed" error and we respond with an ICMP permission denied error. For domains where both the A and AAAA query result in NXDOMAIN, that isn't necessarily appropriate. Instead, I am proposing that for such cases, we want to return a regular "address/host unreachable" ICMP error instead of the more specific "permission denied" variant. To achieve that, we refactor the Gateway's peer state to be able to hold an `Option<IpAddr>` inside the `TranslationState`. This allows us to always insert an entry for each proxy IP, even if we did not resolve any IPs for it. Then, when receiving traffic for a proxy IP where the resolved IP is `None`, we reply with the appropriate ICMP error. As part of this, we also simplify the assignment of the proxy IPs. With the NAT64 module removed, there is no more reason to cross-assign IPv4 and IPv6 addresses. We can simply leave the mappings for e.g. IPv6 proxy addresses empty if the AAAA query didn't resolve anything. From the Client's perspective, not much changes. The DNS resource NAT setup will now succeed, even for domains that don't resolve to anything. This doesn't change any behaviour though as we are currently already passing packets through for failed DNS resource NAT setups. The main change is that we now send back a different ICMP error. Most importantly, the "address/host unreachable variant" does not trigger #10462.
178 lines
7.1 KiB
YAML
178 lines
7.1 KiB
YAML
---
|
|
name: Rust
|
|
"on":
|
|
workflow_call:
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: ./rust
|
|
|
|
permissions:
|
|
contents: "read"
|
|
id-token: "write"
|
|
|
|
env:
|
|
RUSTFLAGS: "--cfg tokio_unstable"
|
|
|
|
jobs:
|
|
static-analysis:
|
|
name: static-analysis-${{ matrix.runs-on }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
# TODO: https://github.com/rust-lang/cargo/issues/5220
|
|
runs-on: [ubuntu-24.04, macos-14, windows-2022]
|
|
runs-on: ${{ matrix.runs-on }}
|
|
steps:
|
|
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
- uses: ./.github/actions/setup-rust
|
|
id: setup-rust
|
|
with:
|
|
sccache_azure_connection_string: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING }}
|
|
- uses: ./.github/actions/setup-tauri-v2
|
|
timeout-minutes: 15
|
|
- uses: taiki-e/install-action@d31232495ad76f47aad66e3501e47780b49f0f3e # v2.57.5
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
tool: cargo-udeps,cargo-deny
|
|
- uses: taiki-e/install-action@d31232495ad76f47aad66e3501e47780b49f0f3e # v2.57.5
|
|
if: ${{ runner.os == 'Linux' }}
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
tool: bpf-linker
|
|
|
|
- run: cargo clippy --all-targets --all-features ${{ steps.setup-rust.outputs.compile-packages }}
|
|
name: cargo clippy
|
|
shell: bash
|
|
- run: cargo doc --all-features --no-deps --document-private-items ${{ steps.setup-rust.outputs.compile-packages }}
|
|
name: cargo doc
|
|
shell: bash
|
|
- run: cargo fmt -- --check
|
|
- run: cargo +${{ steps.setup-rust.outputs.nightly_version }} udeps --all-targets --all-features ${{ steps.setup-rust.outputs.compile-packages }}
|
|
name: cargo udeps
|
|
- run: cargo deny check --hide-inclusion-graph --deny unnecessary-skip
|
|
shell: bash
|
|
|
|
test:
|
|
name: test-${{ matrix.runs-on }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
# TODO: https://github.com/rust-lang/cargo/issues/5220
|
|
runs-on:
|
|
[
|
|
ubuntu-22.04,
|
|
ubuntu-24.04,
|
|
macos-13,
|
|
macos-14,
|
|
macos-15,
|
|
windows-2022,
|
|
windows-2025,
|
|
]
|
|
runs-on: ${{ matrix.runs-on }}
|
|
steps:
|
|
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
- uses: ./.github/actions/setup-rust
|
|
id: setup-rust
|
|
with:
|
|
sccache_azure_connection_string: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING }}
|
|
- uses: ./.github/actions/setup-tauri-v2
|
|
- uses: taiki-e/install-action@d31232495ad76f47aad66e3501e47780b49f0f3e # v2.57.5
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
tool: ripgrep
|
|
- uses: taiki-e/install-action@d31232495ad76f47aad66e3501e47780b49f0f3e # v2.57.5
|
|
if: ${{ runner.os == 'Linux' }}
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
tool: bpf-linker
|
|
- name: "cargo test"
|
|
shell: bash
|
|
run: |
|
|
|
|
set -x
|
|
|
|
# First, run all tests.
|
|
cargo test --all-features ${{ steps.setup-rust.outputs.test-packages }} -- --include-ignored --nocapture
|
|
|
|
# Poor man's test coverage testing: Grep the generated logs for specific patterns / lines.
|
|
rg --count --no-ignore SendIcmpPacket "$TESTCASES_DIR"
|
|
rg --count --no-ignore SendUdpPacket "$TESTCASES_DIR"
|
|
rg --count --no-ignore ConnectTcp "$TESTCASES_DIR"
|
|
rg --count --no-ignore SendDnsQueries "$TESTCASES_DIR"
|
|
rg --count --no-ignore "Packet for DNS resource" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "Packet for CIDR resource" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "Packet for Internet resource" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "Truncating DNS response" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "ICMP Error error=V4Unreachable" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "ICMP Error error=V6Unreachable" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "ICMP Error error=V4TimeExceeded" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "ICMP Error error=V6TimeExceeded" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "Forwarding query for DNS resource to corresponding site" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "Revoking resource authorization" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "Re-seeding records for DNS resources" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "Resource is known but its addressability changed" "$TESTCASES_DIR"
|
|
rg --count --no-ignore "No A / AAAA records for domain" "$TESTCASES_DIR"
|
|
|
|
# Make sure we are recovering from ICE disconnect
|
|
rg --count --no-ignore "State change \(got new possible\): Disconnected -> Checking" "$TESTCASES_DIR"
|
|
|
|
env:
|
|
# <https://github.com/rust-lang/cargo/issues/5999>
|
|
# Needed to create tunnel interfaces in unit tests
|
|
CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER: "sudo --preserve-env"
|
|
PROPTEST_VERBOSE: 0 # Otherwise the output is very long.
|
|
PROPTEST_CASES: ${{ runner.os == 'Windows' && '0' || '256' }} # Default is only 256. Windows is very slow in GitHub Actions, so only run the regression cases there.
|
|
CARGO_PROFILE_TEST_OPT_LEVEL: 1 # Otherwise the tests take forever.
|
|
TESTCASES_DIR: "connlib/tunnel/testcases"
|
|
|
|
fuzz:
|
|
name: fuzz
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
fuzz-target: [ip_packet]
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
- uses: ./.github/actions/setup-rust
|
|
id: setup-rust
|
|
with:
|
|
sccache_azure_connection_string: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING }}
|
|
- uses: taiki-e/install-action@d31232495ad76f47aad66e3501e47780b49f0f3e # v2.57.5
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
tool: cargo-fuzz
|
|
- run: rustup run ${{ steps.setup-rust.outputs.nightly_version }} cargo fuzz run --target x86_64-unknown-linux-gnu --fuzz-dir tests/fuzz ${{ matrix.fuzz-target }} -- -max_total_time=120
|
|
env:
|
|
CARGO_PROFILE_RELEASE_LTO: false
|
|
|
|
headless-client:
|
|
name: headless-client-${{ matrix.test }}-${{ matrix.runs-on }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { runs-on: windows-2022, test: token-path-windows.ps1 }
|
|
- { runs-on: windows-2025, test: token-path-windows.ps1 }
|
|
- { runs-on: ubuntu-22.04, test: linux-group.sh }
|
|
- { runs-on: ubuntu-24.04, test: linux-group.sh }
|
|
- { runs-on: ubuntu-22.04, test: token-path-linux.sh }
|
|
- { runs-on: ubuntu-24.04, test: token-path-linux.sh }
|
|
runs-on: ${{ matrix.runs-on }}
|
|
steps:
|
|
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
- uses: ./.github/actions/setup-rust
|
|
with:
|
|
sccache_azure_connection_string: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING }}
|
|
- uses: ./.github/actions/setup-tauri-v2
|
|
timeout-minutes: 15
|
|
- run: scripts/tests/${{ matrix.test }}
|
|
name: "test script"
|
|
working-directory: ./
|