├── .dockerignore ├── .fpm ├── .github ├── pull_request_template.md ├── release.yml └── workflows │ ├── build-docker.yml │ ├── ci.yml │ ├── current.yml │ ├── docs.yml │ └── release.yml ├── .gitignore ├── .gitmodules ├── .pre-commit-config.yaml ├── Cargo.lock ├── Cargo.toml ├── Cross.toml ├── Dockerfile ├── LICENSE.md ├── README.md ├── after-install.sh ├── build.rs ├── defguard-gateway.service ├── defguard-gateway.service.freebsd ├── defguard-rc.conf ├── deny.toml ├── docs └── header.png ├── example-config.toml ├── examples └── server.rs ├── flake.lock ├── flake.nix ├── opnsense ├── Makefile └── src │ ├── etc │ └── inc │ │ └── plugins.inc.d │ │ └── defguardgateway.inc │ └── opnsense │ ├── mvc │ └── app │ │ ├── controllers │ │ └── OPNsense │ │ │ └── DefguardGateway │ │ │ ├── Api │ │ │ ├── ServiceController.php │ │ │ └── SettingsController.php │ │ │ ├── IndexController.php │ │ │ └── forms │ │ │ └── general.xml │ │ ├── models │ │ └── OPNsense │ │ │ └── DefguardGateway │ │ │ ├── DefguardGateway.php │ │ │ ├── DefguardGateway.xml │ │ │ └── Menu │ │ │ └── Menu.xml │ │ └── views │ │ └── OPNsense │ │ └── DefguardGateway │ │ └── index.volt │ └── service │ ├── conf │ └── actions.d │ │ └── actions_defguardgateway.conf │ └── templates │ └── OPNsense │ └── DefguardGateway │ ├── +TARGETS │ ├── config.toml │ └── rc.conf.d └── src ├── config.rs ├── enterprise ├── LICENSE.md ├── firewall │ ├── api.rs │ ├── dummy │ │ └── mod.rs │ ├── iprange.rs │ ├── mod.rs │ ├── nftables │ │ ├── mod.rs │ │ └── netfilter.rs │ └── packetfilter │ │ ├── api.rs │ │ ├── calls.rs │ │ ├── mod.rs │ │ └── rule.rs └── mod.rs ├── error.rs ├── gateway.rs ├── lib.rs ├── main.rs └── server.rs /.dockerignore: -------------------------------------------------------------------------------- 1 | target/ 2 | .github/ 3 | docs/ 4 | -------------------------------------------------------------------------------- /.fpm: -------------------------------------------------------------------------------- 1 | -s dir 2 | --name defguard-gateway 3 | --description "defguard VPN gateway service" 4 | --url "https://defguard.net/" 5 | --maintainer "teonite" 6 | --config-files /etc/defguard/gateway.toml.sample 7 | -------------------------------------------------------------------------------- /.github/pull_request_template.md: -------------------------------------------------------------------------------- 1 | ## 📖 Description 2 | 3 | 1. include a **summary of the changes and the related issue**, eg. _Closes #XYZ_ 4 | 2. Do not make a PR if you can't check **all the boxes below** 5 | 6 | ### 🛠️ Dev Branch Merge Checklist: 7 | 8 | #### Documentation ### 9 | 10 | - [ ] If testing requires changes in the environment or deployment, please **update the documentation** (https://defguard.gitbook.io) first and **attach the link to the documentation** section in this pool request 11 | - [ ] I have commented on my code, particularly in hard-to-understand areas 12 | 13 | #### Testing ### 14 | 15 | - [ ] I have prepared end-to-end tests for all new functionalities 16 | - [ ] I have performed end-to-end tests manually and they work 17 | - [ ] New and existing unit tests pass locally with my changes 18 | 19 | #### Deployment ### 20 | 21 | - [ ] If deployment is affected I have made corresponding/required changes to [deployment](https://github.com/defguard/deployment) (Docker, Kubernetes, one-line install) 22 | 23 | ### 🏚️ Main Branch Merge Checklist: 24 | 25 | #### Testing ### 26 | 27 | - [ ] I have merged my changes before to dev and the dev checklist is done 28 | - [ ] I have tested all functionalities on the dev instance and they work 29 | 30 | #### Documentation ### 31 | 32 | - [ ] I have made corresponding changes to the **user & admin documentation** and added new features documentation with screenshots for users/admins 33 | -------------------------------------------------------------------------------- /.github/release.yml: -------------------------------------------------------------------------------- 1 | changelog: 2 | exclude: 3 | labels: 4 | - ignore-for-release 5 | categories: 6 | - title: Breaking Changes 🛠 7 | labels: 8 | - Semver-Major 9 | - breaking-change 10 | - title: Exciting New Features 🎉 11 | labels: 12 | - Semver-Minor 13 | - enhancement 14 | - title: Other Changes 15 | labels: 16 | - "*" 17 | -------------------------------------------------------------------------------- /.github/workflows/build-docker.yml: -------------------------------------------------------------------------------- 1 | name: Build Docker image 2 | 3 | on: 4 | workflow_call: 5 | inputs: 6 | tags: 7 | description: "List of tags as key-value pair attributes" 8 | required: false 9 | type: string 10 | flavor: 11 | description: "List of flavors as key-value pair attributes" 12 | required: false 13 | type: string 14 | 15 | env: 16 | GHCR_REPO: ghcr.io/defguard/gateway 17 | 18 | jobs: 19 | build-docker: 20 | runs-on: 21 | - self-hosted 22 | - Linux 23 | - ${{ matrix.runner }} 24 | strategy: 25 | matrix: 26 | cpu: [arm64, amd64, arm/v7] 27 | include: 28 | - cpu: arm64 29 | runner: ARM64 30 | tag: arm64 31 | - cpu: amd64 32 | runner: X64 33 | tag: amd64 34 | - cpu: arm/v7 35 | runner: ARM 36 | tag: armv7 37 | steps: 38 | - name: Checkout 39 | uses: actions/checkout@v4 40 | with: 41 | submodules: recursive 42 | - name: Login to GitHub container registry 43 | uses: docker/login-action@v3 44 | with: 45 | registry: ghcr.io 46 | username: ${{ github.actor }} 47 | password: ${{ secrets.GITHUB_TOKEN }} 48 | - name: Set up Docker Buildx 49 | uses: docker/setup-buildx-action@v3 50 | with: 51 | buildkitd-config-inline: | 52 | [registry."docker.io"] 53 | mirrors = ["dockerhub-proxy.teonite.net"] 54 | - name: Build container 55 | uses: docker/build-push-action@v5 56 | with: 57 | context: . 58 | platforms: linux/${{ matrix.cpu }} 59 | provenance: false 60 | push: true 61 | tags: "${{ env.GHCR_REPO }}:${{ github.sha }}-${{ matrix.tag }}" 62 | cache-from: type=gha 63 | cache-to: type=gha,mode=max 64 | 65 | docker-manifest: 66 | runs-on: [self-hosted, Linux] 67 | needs: [build-docker] 68 | steps: 69 | - name: Docker meta 70 | id: meta 71 | uses: docker/metadata-action@v5 72 | with: 73 | images: | 74 | ${{ env.GHCR_REPO }} 75 | flavor: ${{ inputs.flavor }} 76 | tags: ${{ inputs.tags }} 77 | - name: Login to GitHub container registry 78 | uses: docker/login-action@v3 79 | with: 80 | registry: ghcr.io 81 | username: ${{ github.actor }} 82 | password: ${{ secrets.GITHUB_TOKEN }} 83 | - name: Create and push manifests 84 | run: | 85 | tags='${{ env.GHCR_REPO }}:${{ github.sha }} ${{ steps.meta.outputs.tags }}' 86 | for tag in ${tags} 87 | do 88 | docker manifest rm ${tag} || true 89 | docker manifest create ${tag} ${{ env.GHCR_REPO }}:${{ github.sha }}-amd64 ${{ env.GHCR_REPO }}:${{ github.sha }}-arm64 ${{ env.GHCR_REPO }}:${{ github.sha }}-armv7 90 | docker manifest push ${tag} 91 | done 92 | -------------------------------------------------------------------------------- /.github/workflows/ci.yml: -------------------------------------------------------------------------------- 1 | name: Continuous integration 2 | 3 | on: 4 | push: 5 | branches: 6 | - main 7 | - dev 8 | - 'release/**' 9 | paths-ignore: 10 | - "*.md" 11 | - "LICENSE" 12 | pull_request: 13 | branches: 14 | - main 15 | - dev 16 | - 'release/**' 17 | paths-ignore: 18 | - "*.md" 19 | - "LICENSE" 20 | 21 | env: 22 | CARGO_TERM_COLOR: always 23 | 24 | jobs: 25 | test: 26 | runs-on: [self-hosted, Linux, X64] 27 | container: rust:1 28 | 29 | steps: 30 | - name: Debug 31 | run: echo ${{ github.ref_name }} 32 | - name: Checkout 33 | uses: actions/checkout@v4 34 | with: 35 | submodules: recursive 36 | - name: Cache 37 | uses: Swatinem/rust-cache@v2 38 | with: 39 | key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} 40 | - name: Install dependencies 41 | run: apt-get update && apt-get -y install protobuf-compiler libnftnl-dev libmnl-dev 42 | - name: Check format 43 | run: | 44 | rustup component add rustfmt 45 | cargo fmt -- --check 46 | - name: Run clippy linter 47 | run: | 48 | rustup component add clippy 49 | cargo clippy --all-targets --all-features -- -D warnings 50 | - name: Run cargo deny 51 | uses: EmbarkStudios/cargo-deny-action@v2 52 | - name: Run tests 53 | run: cargo test --locked --no-fail-fast 54 | -------------------------------------------------------------------------------- /.github/workflows/current.yml: -------------------------------------------------------------------------------- 1 | name: Build current image 2 | on: 3 | push: 4 | branches: 5 | - main 6 | - dev 7 | - 'release/**' 8 | paths-ignore: 9 | - "*.md" 10 | - "LICENSE" 11 | 12 | concurrency: 13 | group: ${{ github.workflow }}-${{ github.ref }} 14 | cancel-in-progress: true 15 | 16 | jobs: 17 | build-current: 18 | uses: ./.github/workflows/build-docker.yml 19 | with: 20 | tags: | 21 | type=ref,event=branch 22 | type=sha 23 | -------------------------------------------------------------------------------- /.github/workflows/docs.yml: -------------------------------------------------------------------------------- 1 | name: rustdoc Github Pages 2 | on: 3 | push: 4 | branches: 5 | - main 6 | 7 | env: 8 | CARGO_INCREMENTAL: 0 9 | CARGO_NET_RETRY: 10 10 | RUSTFLAGS: "-D warnings -W unreachable-pub" 11 | RUSTUP_MAX_RETRIES: 10 12 | 13 | jobs: 14 | rustdoc: 15 | runs-on: [self-hosted, Linux] 16 | container: 17 | image: rust:1 18 | 19 | steps: 20 | - name: Checkout 21 | uses: actions/checkout@v4 22 | with: 23 | submodules: recursive 24 | 25 | - name: Install Rust toolchain 26 | run: rustup update --no-self-update stable 27 | 28 | - name: Install dependencies 29 | run: apt-get update && apt-get -y install protobuf-compiler libnftnl-dev libmnl-dev 30 | 31 | - name: Build Docs 32 | run: cargo doc --all --no-deps 33 | 34 | - name: Deploy Docs 35 | uses: peaceiris/actions-gh-pages@v3 36 | with: 37 | github_token: ${{ secrets.GITHUB_TOKEN }} 38 | publish_branch: gh-pages 39 | publish_dir: ./target/doc 40 | force_orphan: true 41 | -------------------------------------------------------------------------------- /.github/workflows/release.yml: -------------------------------------------------------------------------------- 1 | name: Publish 2 | on: 3 | push: 4 | tags: 5 | - v*.*.* 6 | 7 | concurrency: 8 | group: ${{ github.workflow }}-${{ github.ref }} 9 | cancel-in-progress: true 10 | 11 | jobs: 12 | build-docker-release: 13 | # Ignore tags with -, like v1.0.0-alpha 14 | # This job will build the docker container with the "latest" tag which 15 | # is a tag used in production, thus it should only be run for full releases. 16 | if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-') 17 | name: Build Release Docker image 18 | uses: ./.github/workflows/build-docker.yml 19 | with: 20 | tags: | 21 | type=raw,value=latest 22 | type=semver,pattern={{version}} 23 | type=semver,pattern={{major}}.{{minor}} 24 | type=sha 25 | 26 | build-docker-prerelease: 27 | # Only build tags with -, like v1.0.0-alpha 28 | if: startsWith(github.ref, 'refs/tags/') && contains(github.ref, '-') 29 | name: Build Pre-release Docker image 30 | uses: ./.github/workflows/build-docker.yml 31 | with: 32 | tags: | 33 | type=raw,value=pre-release 34 | type=semver,pattern={{version}} 35 | type=sha 36 | # Explicitly disable latest tag. It will be added otherwise. 37 | flavor: | 38 | latest=false 39 | 40 | create-release: 41 | name: create-release 42 | runs-on: self-hosted 43 | outputs: 44 | upload_url: ${{ steps.release.outputs.upload_url }} 45 | steps: 46 | - name: Create GitHub release 47 | id: release 48 | uses: softprops/action-gh-release@v1 49 | if: startsWith(github.ref, 'refs/tags/') 50 | with: 51 | draft: true 52 | generate_release_notes: true 53 | 54 | build-release: 55 | name: Release ${{ matrix.build }} 56 | needs: [create-release] 57 | runs-on: 58 | - self-hosted 59 | - ${{ matrix.os }} 60 | - X64 61 | strategy: 62 | fail-fast: false 63 | matrix: 64 | build: [linux, linux-arm64, freebsd] 65 | include: 66 | - build: linux 67 | arch: amd64 68 | os: Linux 69 | asset_name: defguard-gateway-linux-x86_64 70 | target: x86_64-unknown-linux-gnu 71 | - build: linux-arm64 72 | arch: arm64 73 | os: Linux 74 | asset_name: defguard-gateway-linux-arm64 75 | target: aarch64-unknown-linux-gnu 76 | - build: freebsd 77 | arch: amd64 78 | os: Linux 79 | asset_name: defguard-gateway-freebsd-x86_64 80 | target: x86_64-unknown-freebsd 81 | steps: 82 | # Store the version, stripping any v-prefix 83 | - name: Write release version 84 | run: | 85 | VERSION=${GITHUB_REF_NAME#v} 86 | echo Version: $VERSION 87 | echo "VERSION=$VERSION" >> $GITHUB_ENV 88 | 89 | - name: Checkout 90 | uses: actions/checkout@v3 91 | with: 92 | submodules: recursive 93 | 94 | - name: Install Rust stable 95 | uses: actions-rs/toolchain@v1 96 | with: 97 | toolchain: stable 98 | target: ${{ matrix.target }} 99 | override: true 100 | 101 | - name: Build release binary 102 | uses: actions-rs/cargo@v1 103 | with: 104 | use-cross: true 105 | command: build 106 | args: --locked --release --target ${{ matrix.target }} 107 | 108 | - name: Rename binary 109 | run: mv target/${{ matrix.target }}/release/defguard-gateway ${{ matrix.asset_name }}-${{ github.ref_name }} 110 | 111 | - name: Tar 112 | uses: a7ul/tar-action@v1.1.0 113 | with: 114 | command: c 115 | files: | 116 | ${{ matrix.asset_name }}-${{ github.ref_name }} 117 | outPath: ${{ matrix.asset_name }}-${{ github.ref_name }}-${{ matrix.target }}.tar.gz 118 | 119 | - name: Upload release archive 120 | uses: actions/upload-release-asset@v1 121 | env: 122 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 123 | with: 124 | upload_url: ${{ needs.create-release.outputs.upload_url }} 125 | asset_path: ${{ matrix.asset_name }}-${{ github.ref_name }}-${{ matrix.target }}.tar.gz 126 | asset_name: ${{ matrix.asset_name }}-${{ github.ref_name }}-${{ matrix.target }}.tar.gz 127 | asset_content_type: application/octet-stream 128 | 129 | - name: Build DEB package 130 | if: matrix.build != 'freebsd' 131 | uses: defGuard/fpm-action@main 132 | with: 133 | fpm_args: "${{ matrix.asset_name }}-${{ github.ref_name }}=/usr/sbin/defguard-gateway defguard-gateway.service=/usr/lib/systemd/system/defguard-gateway.service example-config.toml=/etc/defguard/gateway.toml.sample" 134 | fpm_opts: "--architecture ${{ matrix.arch }} --debug --output-type deb --version ${{ env.VERSION }} --package defguard-gateway_${{ env.VERSION }}_${{ matrix.target }}.deb --after-install after-install.sh" 135 | 136 | - name: Upload DEB 137 | if: matrix.build != 'freebsd' 138 | uses: actions/upload-release-asset@v1 139 | env: 140 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 141 | with: 142 | upload_url: ${{ needs.create-release.outputs.upload_url }} 143 | asset_path: defguard-gateway_${{ env.VERSION }}_${{ matrix.target }}.deb 144 | asset_name: defguard-gateway_${{ env.VERSION }}_${{ matrix.target }}.deb 145 | asset_content_type: application/octet-stream 146 | 147 | - name: Build RPM package 148 | if: matrix.build == 'linux' 149 | uses: defGuard/fpm-action@main 150 | with: 151 | fpm_args: "${{ matrix.asset_name }}-${{ github.ref_name }}=/usr/sbin/defguard-gateway defguard-gateway.service=/usr/lib/systemd/system/defguard-gateway.service example-config.toml=/etc/defguard/gateway.toml.sample" 152 | fpm_opts: "--architecture ${{ matrix.arch }} --debug --output-type rpm --version ${{ env.VERSION }} --package defguard-gateway_${{ env.VERSION }}_${{ matrix.target }}.rpm --after-install after-install.sh" 153 | 154 | - name: Upload RPM 155 | if: matrix.build == 'linux' 156 | uses: actions/upload-release-asset@v1 157 | env: 158 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 159 | with: 160 | upload_url: ${{ needs.create-release.outputs.upload_url }} 161 | asset_path: defguard-gateway_${{ env.VERSION }}_${{ matrix.target }}.rpm 162 | asset_name: defguard-gateway_${{ env.VERSION }}_${{ matrix.target }}.rpm 163 | asset_content_type: application/octet-stream 164 | 165 | - name: Build FreeBSD package 166 | if: matrix.build == 'freebsd' 167 | uses: defGuard/fpm-action@main 168 | with: 169 | fpm_args: 170 | "${{ matrix.asset_name }}-${{ github.ref_name }}=/usr/local/sbin/defguard-gateway 171 | defguard-gateway.service.freebsd=/usr/local/etc/rc.d/defguard_gateway 172 | example-config.toml=/etc/defguard/gateway.toml.sample 173 | defguard-rc.conf=/etc/rc.conf.d/defguard_gateway" 174 | fpm_opts: "--architecture ${{ matrix.arch }} --debug --output-type freebsd --version ${{ env.VERSION }} --package defguard-gateway_${{ env.VERSION }}_${{ matrix.target }}.pkg --freebsd-osversion '*'" 175 | 176 | - name: Upload FreeBSD 177 | if: matrix.build == 'freebsd' 178 | uses: actions/upload-release-asset@v1 179 | env: 180 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 181 | with: 182 | upload_url: ${{ needs.create-release.outputs.upload_url }} 183 | asset_path: defguard-gateway_${{ env.VERSION }}_${{ matrix.target }}.pkg 184 | asset_name: defguard-gateway_${{ env.VERSION }}_${{ matrix.target }}.pkg 185 | asset_content_type: application/octet-stream 186 | 187 | - name: Build OPNsense package 188 | if: matrix.build == 'freebsd' 189 | uses: defGuard/fpm-action@main 190 | with: 191 | fpm_args: 192 | "${{ matrix.asset_name }}-${{ github.ref_name }}=/usr/local/sbin/defguard-gateway 193 | defguard-gateway.service.freebsd=/usr/local/etc/rc.d/defguard_gateway 194 | example-config.toml=/etc/defguard/gateway.toml.sample 195 | defguard-rc.conf=/etc/rc.conf.d/defguard_gateway 196 | opnsense/src/etc/=/usr/local/etc/ 197 | opnsense/src/opnsense/=/usr/local/opnsense/" 198 | fpm_opts: "--architecture ${{ matrix.arch }} --debug --output-type freebsd --version ${{ env.VERSION }} --package defguard-gateway_${{ env.VERSION }}_x86_64-unknown-opnsense.pkg --freebsd-osversion '*'" 199 | 200 | - name: Upload OPNsense package 201 | if: matrix.build == 'freebsd' 202 | uses: actions/upload-release-asset@v1 203 | env: 204 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 205 | with: 206 | upload_url: ${{ needs.create-release.outputs.upload_url }} 207 | asset_path: defguard-gateway_${{ env.VERSION }}_x86_64-unknown-opnsense.pkg 208 | asset_name: defguard-gateway_${{ env.VERSION }}_x86_64-unknown-opnsense.pkg 209 | asset_content_type: application/octet-stream 210 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | /target 2 | /.idea 3 | .envrc 4 | .direnv/ 5 | -------------------------------------------------------------------------------- /.gitmodules: -------------------------------------------------------------------------------- 1 | [submodule "proto"] 2 | path = proto 3 | url = ../proto.git 4 | -------------------------------------------------------------------------------- /.pre-commit-config.yaml: -------------------------------------------------------------------------------- 1 | repos: 2 | - repo: https://github.com/pre-commit/pre-commit-hooks 3 | rev: v4.4.0 4 | hooks: 5 | - id: trailing-whitespace 6 | - id: end-of-file-fixer 7 | - id: check-added-large-files 8 | - repo: https://github.com/doublify/pre-commit-rust 9 | rev: v1.0 10 | hooks: 11 | - id: fmt 12 | - id: clippy 13 | -------------------------------------------------------------------------------- /Cargo.toml: -------------------------------------------------------------------------------- 1 | [package] 2 | name = "defguard-gateway" 3 | version = "1.4.0" 4 | edition = "2021" 5 | 6 | [dependencies] 7 | axum = { version = "0.8", features = ["macros"] } 8 | base64 = "0.22" 9 | clap = { version = "4.5", features = ["derive", "env"] } 10 | defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.7.5" } 11 | env_logger = "0.11" 12 | gethostname = "1.0" 13 | ipnetwork = "0.21" 14 | libc = { version = "0.2", default-features = false } 15 | log = "0.4" 16 | prost = "0.13" 17 | serde = { version = "1.0", features = ["derive"] } 18 | syslog = "7.0" 19 | thiserror = "2.0" 20 | tokio = { version = "1", features = ["macros", "rt-multi-thread", "signal"] } 21 | tokio-stream = { version = "0.1", features = [] } 22 | toml = { version = "0.8", default-features = false, features = ["parse"] } 23 | tonic = { version = "0.12", default-features = false, features = [ 24 | "codegen", 25 | "gzip", 26 | "prost", 27 | "tls-native-roots", 28 | ] } 29 | 30 | [target.'cfg(target_os = "linux")'.dependencies] 31 | nftnl = { git = "https://github.com/DefGuard/nftnl-rs.git", rev = "1a1147271f43b9d7182a114bb056a5224c35d38f" } 32 | mnl = "0.2" 33 | 34 | [target.'cfg(any(target_os = "freebsd", target_os = "macos", target_os = "netbsd"))'.dependencies] 35 | nix = { version = "0.30", default-features = false, features = ["ioctl"] } 36 | 37 | [dev-dependencies] 38 | tokio = { version = "1", features = ["io-std", "io-util"] } 39 | tonic = { version = "0.12", default-features = false, features = [ 40 | "codegen", 41 | "prost", 42 | "transport", 43 | ] } 44 | x25519-dalek = { version = "2.0", features = ["getrandom", "static_secrets"] } 45 | 46 | [build-dependencies] 47 | tonic-build = { version = "0.12" } 48 | vergen-git2 = { version = "1.0", features = ["build"] } 49 | 50 | [profile.release] 51 | codegen-units = 1 52 | panic = "abort" 53 | lto = "thin" 54 | strip = "symbols" 55 | -------------------------------------------------------------------------------- /Cross.toml: -------------------------------------------------------------------------------- 1 | [target.x86_64-unknown-linux-gnu] 2 | image = "ghcr.io/defguard/cross:x86_64-unknown-linux-gnu" 3 | pre-build = [ 4 | "dpkg --add-architecture $CROSS_DEB_ARCH", 5 | "apt-get update && apt-get install --assume-yes unzip libnftnl-dev:$CROSS_DEB_ARCH libmnl-dev:$CROSS_DEB_ARCH", 6 | "PB_REL='https://github.com/protocolbuffers/protobuf/releases'", 7 | "PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip", 8 | "unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr", 9 | ] 10 | 11 | [target.armv7-unknown-linux-gnueabihf] 12 | image = "ghcr.io/defguard/cross:armv7-unknown-linux-gnueabihf" 13 | pre-build = [ 14 | "dpkg --add-architecture $CROSS_DEB_ARCH", 15 | "apt-get update && apt-get install --assume-yes unzip libnftnl-dev:$CROSS_DEB_ARCH libmnl-dev:$CROSS_DEB_ARCH", 16 | "PB_REL='https://github.com/protocolbuffers/protobuf/releases'", 17 | "PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip", 18 | "unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr", 19 | ] 20 | 21 | 22 | [target.aarch64-unknown-linux-gnu] 23 | image = "ghcr.io/defguard/cross:aarch64-unknown-linux-gnu" 24 | pre-build = [ 25 | "dpkg --add-architecture $CROSS_DEB_ARCH", 26 | "apt-get update && apt-get install --assume-yes unzip libnftnl-dev libnftnl-dev:$CROSS_DEB_ARCH libmnl-dev libmnl-dev:$CROSS_DEB_ARCH", 27 | "PB_REL='https://github.com/protocolbuffers/protobuf/releases'", 28 | "PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip", 29 | "unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr", 30 | ] 31 | 32 | [target.x86_64-unknown-freebsd] 33 | image = "ghcr.io/defguard/cross:x86_64-unknown-freebsd" 34 | pre-build = [ 35 | "apt-get update && apt-get install --assume-yes unzip", 36 | "PB_REL='https://github.com/protocolbuffers/protobuf/releases'", 37 | "PB_VERSION='3.20.0' && curl -LO $PB_REL/download/v$PB_VERSION/protoc-$PB_VERSION-linux-x86_64.zip", 38 | "unzip protoc-$PB_VERSION-linux-x86_64.zip bin/protoc include/google/* -d /usr", 39 | ] 40 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM rust:1-slim as builder 2 | 3 | RUN apt-get update && apt-get -y install protobuf-compiler libnftnl-dev libmnl-dev 4 | WORKDIR /app 5 | COPY . . 6 | RUN cargo build --release 7 | 8 | FROM debian:bookworm-slim 9 | RUN apt-get update && apt-get -y --no-install-recommends install \ 10 | iproute2 wireguard-tools sudo ca-certificates iptables ebtables nftables && \ 11 | apt-get clean && rm -rf /var/lib/apt/lists/* 12 | WORKDIR /app 13 | COPY --from=builder /app/target/release/defguard-gateway /usr/local/bin 14 | ENTRYPOINT ["/usr/local/bin/defguard-gateway"] 15 | -------------------------------------------------------------------------------- /LICENSE.md: -------------------------------------------------------------------------------- 1 | # Dual license info 2 | The code in this repository is available under a dual licensing model: 3 | 4 | 1. Open Source License: The code, except for the contents of the "src/enterprise" directory, is licensed under the AGPL license (this license). This applies to the open core components of the software. 5 | 2. Enterprise License: All code in this repository (including within the "src/enterprise" directory) is licensed under a separate Enterprise License (see file src/enterprise/LICENSE.md). 6 | 7 | # GNU AFFERO GENERAL PUBLIC LICENSE 8 | 9 | Version 3, 19 November 2007 10 | 11 | Copyright (C) 2007 Free Software Foundation, Inc. 12 | 13 | 14 | Everyone is permitted to copy and distribute verbatim copies of this 15 | license document, but changing it is not allowed. 16 | 17 | ## Preamble 18 | 19 | The GNU Affero General Public License is a free, copyleft license for 20 | software and other kinds of works, specifically designed to ensure 21 | cooperation with the community in the case of network server software. 22 | 23 | The licenses for most software and other practical works are designed 24 | to take away your freedom to share and change the works. By contrast, 25 | our General Public Licenses are intended to guarantee your freedom to 26 | share and change all versions of a program--to make sure it remains 27 | free software for all its users. 28 | 29 | When we speak of free software, we are referring to freedom, not 30 | price. Our General Public Licenses are designed to make sure that you 31 | have the freedom to distribute copies of free software (and charge for 32 | them if you wish), that you receive source code or can get it if you 33 | want it, that you can change the software or use pieces of it in new 34 | free programs, and that you know you can do these things. 35 | 36 | Developers that use our General Public Licenses protect your rights 37 | with two steps: (1) assert copyright on the software, and (2) offer 38 | you this License which gives you legal permission to copy, distribute 39 | and/or modify the software. 40 | 41 | A secondary benefit of defending all users' freedom is that 42 | improvements made in alternate versions of the program, if they 43 | receive widespread use, become available for other developers to 44 | incorporate. Many developers of free software are heartened and 45 | encouraged by the resulting cooperation. However, in the case of 46 | software used on network servers, this result may fail to come about. 47 | The GNU General Public License permits making a modified version and 48 | letting the public access it on a server without ever releasing its 49 | source code to the public. 50 | 51 | The GNU Affero General Public License is designed specifically to 52 | ensure that, in such cases, the modified source code becomes available 53 | to the community. It requires the operator of a network server to 54 | provide the source code of the modified version running there to the 55 | users of that server. Therefore, public use of a modified version, on 56 | a publicly accessible server, gives the public access to the source 57 | code of the modified version. 58 | 59 | An older license, called the Affero General Public License and 60 | published by Affero, was designed to accomplish similar goals. This is 61 | a different license, not a version of the Affero GPL, but Affero has 62 | released a new version of the Affero GPL which permits relicensing 63 | under this license. 64 | 65 | The precise terms and conditions for copying, distribution and 66 | modification follow. 67 | 68 | ## TERMS AND CONDITIONS 69 | 70 | ### 0. Definitions. 71 | 72 | "This License" refers to version 3 of the GNU Affero General Public 73 | License. 74 | 75 | "Copyright" also means copyright-like laws that apply to other kinds 76 | of works, such as semiconductor masks. 77 | 78 | "The Program" refers to any copyrightable work licensed under this 79 | License. Each licensee is addressed as "you". "Licensees" and 80 | "recipients" may be individuals or organizations. 81 | 82 | To "modify" a work means to copy from or adapt all or part of the work 83 | in a fashion requiring copyright permission, other than the making of 84 | an exact copy. The resulting work is called a "modified version" of 85 | the earlier work or a work "based on" the earlier work. 86 | 87 | A "covered work" means either the unmodified Program or a work based 88 | on the Program. 89 | 90 | To "propagate" a work means to do anything with it that, without 91 | permission, would make you directly or secondarily liable for 92 | infringement under applicable copyright law, except executing it on a 93 | computer or modifying a private copy. Propagation includes copying, 94 | distribution (with or without modification), making available to the 95 | public, and in some countries other activities as well. 96 | 97 | To "convey" a work means any kind of propagation that enables other 98 | parties to make or receive copies. Mere interaction with a user 99 | through a computer network, with no transfer of a copy, is not 100 | conveying. 101 | 102 | An interactive user interface displays "Appropriate Legal Notices" to 103 | the extent that it includes a convenient and prominently visible 104 | feature that (1) displays an appropriate copyright notice, and (2) 105 | tells the user that there is no warranty for the work (except to the 106 | extent that warranties are provided), that licensees may convey the 107 | work under this License, and how to view a copy of this License. If 108 | the interface presents a list of user commands or options, such as a 109 | menu, a prominent item in the list meets this criterion. 110 | 111 | ### 1. Source Code. 112 | 113 | The "source code" for a work means the preferred form of the work for 114 | making modifications to it. "Object code" means any non-source form of 115 | a work. 116 | 117 | A "Standard Interface" means an interface that either is an official 118 | standard defined by a recognized standards body, or, in the case of 119 | interfaces specified for a particular programming language, one that 120 | is widely used among developers working in that language. 121 | 122 | The "System Libraries" of an executable work include anything, other 123 | than the work as a whole, that (a) is included in the normal form of 124 | packaging a Major Component, but which is not part of that Major 125 | Component, and (b) serves only to enable use of the work with that 126 | Major Component, or to implement a Standard Interface for which an 127 | implementation is available to the public in source code form. A 128 | "Major Component", in this context, means a major essential component 129 | (kernel, window system, and so on) of the specific operating system 130 | (if any) on which the executable work runs, or a compiler used to 131 | produce the work, or an object code interpreter used to run it. 132 | 133 | The "Corresponding Source" for a work in object code form means all 134 | the source code needed to generate, install, and (for an executable 135 | work) run the object code and to modify the work, including scripts to 136 | control those activities. However, it does not include the work's 137 | System Libraries, or general-purpose tools or generally available free 138 | programs which are used unmodified in performing those activities but 139 | which are not part of the work. For example, Corresponding Source 140 | includes interface definition files associated with source files for 141 | the work, and the source code for shared libraries and dynamically 142 | linked subprograms that the work is specifically designed to require, 143 | such as by intimate data communication or control flow between those 144 | subprograms and other parts of the work. 145 | 146 | The Corresponding Source need not include anything that users can 147 | regenerate automatically from other parts of the Corresponding Source. 148 | 149 | The Corresponding Source for a work in source code form is that same 150 | work. 151 | 152 | ### 2. Basic Permissions. 153 | 154 | All rights granted under this License are granted for the term of 155 | copyright on the Program, and are irrevocable provided the stated 156 | conditions are met. This License explicitly affirms your unlimited 157 | permission to run the unmodified Program. The output from running a 158 | covered work is covered by this License only if the output, given its 159 | content, constitutes a covered work. This License acknowledges your 160 | rights of fair use or other equivalent, as provided by copyright law. 161 | 162 | You may make, run and propagate covered works that you do not convey, 163 | without conditions so long as your license otherwise remains in force. 164 | You may convey covered works to others for the sole purpose of having 165 | them make modifications exclusively for you, or provide you with 166 | facilities for running those works, provided that you comply with the 167 | terms of this License in conveying all material for which you do not 168 | control copyright. Those thus making or running the covered works for 169 | you must do so exclusively on your behalf, under your direction and 170 | control, on terms that prohibit them from making any copies of your 171 | copyrighted material outside their relationship with you. 172 | 173 | Conveying under any other circumstances is permitted solely under the 174 | conditions stated below. Sublicensing is not allowed; section 10 makes 175 | it unnecessary. 176 | 177 | ### 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 178 | 179 | No covered work shall be deemed part of an effective technological 180 | measure under any applicable law fulfilling obligations under article 181 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 182 | similar laws prohibiting or restricting circumvention of such 183 | measures. 184 | 185 | When you convey a covered work, you waive any legal power to forbid 186 | circumvention of technological measures to the extent such 187 | circumvention is effected by exercising rights under this License with 188 | respect to the covered work, and you disclaim any intention to limit 189 | operation or modification of the work as a means of enforcing, against 190 | the work's users, your or third parties' legal rights to forbid 191 | circumvention of technological measures. 192 | 193 | ### 4. Conveying Verbatim Copies. 194 | 195 | You may convey verbatim copies of the Program's source code as you 196 | receive it, in any medium, provided that you conspicuously and 197 | appropriately publish on each copy an appropriate copyright notice; 198 | keep intact all notices stating that this License and any 199 | non-permissive terms added in accord with section 7 apply to the code; 200 | keep intact all notices of the absence of any warranty; and give all 201 | recipients a copy of this License along with the Program. 202 | 203 | You may charge any price or no price for each copy that you convey, 204 | and you may offer support or warranty protection for a fee. 205 | 206 | ### 5. Conveying Modified Source Versions. 207 | 208 | You may convey a work based on the Program, or the modifications to 209 | produce it from the Program, in the form of source code under the 210 | terms of section 4, provided that you also meet all of these 211 | conditions: 212 | 213 | - a) The work must carry prominent notices stating that you modified 214 | it, and giving a relevant date. 215 | - b) The work must carry prominent notices stating that it is 216 | released under this License and any conditions added under 217 | section 7. This requirement modifies the requirement in section 4 218 | to "keep intact all notices". 219 | - c) You must license the entire work, as a whole, under this 220 | License to anyone who comes into possession of a copy. This 221 | License will therefore apply, along with any applicable section 7 222 | additional terms, to the whole of the work, and all its parts, 223 | regardless of how they are packaged. This License gives no 224 | permission to license the work in any other way, but it does not 225 | invalidate such permission if you have separately received it. 226 | - d) If the work has interactive user interfaces, each must display 227 | Appropriate Legal Notices; however, if the Program has interactive 228 | interfaces that do not display Appropriate Legal Notices, your 229 | work need not make them do so. 230 | 231 | A compilation of a covered work with other separate and independent 232 | works, which are not by their nature extensions of the covered work, 233 | and which are not combined with it such as to form a larger program, 234 | in or on a volume of a storage or distribution medium, is called an 235 | "aggregate" if the compilation and its resulting copyright are not 236 | used to limit the access or legal rights of the compilation's users 237 | beyond what the individual works permit. Inclusion of a covered work 238 | in an aggregate does not cause this License to apply to the other 239 | parts of the aggregate. 240 | 241 | ### 6. Conveying Non-Source Forms. 242 | 243 | You may convey a covered work in object code form under the terms of 244 | sections 4 and 5, provided that you also convey the machine-readable 245 | Corresponding Source under the terms of this License, in one of these 246 | ways: 247 | 248 | - a) Convey the object code in, or embodied in, a physical product 249 | (including a physical distribution medium), accompanied by the 250 | Corresponding Source fixed on a durable physical medium 251 | customarily used for software interchange. 252 | - b) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by a 254 | written offer, valid for at least three years and valid for as 255 | long as you offer spare parts or customer support for that product 256 | model, to give anyone who possesses the object code either (1) a 257 | copy of the Corresponding Source for all the software in the 258 | product that is covered by this License, on a durable physical 259 | medium customarily used for software interchange, for a price no 260 | more than your reasonable cost of physically performing this 261 | conveying of source, or (2) access to copy the Corresponding 262 | Source from a network server at no charge. 263 | - c) Convey individual copies of the object code with a copy of the 264 | written offer to provide the Corresponding Source. This 265 | alternative is allowed only occasionally and noncommercially, and 266 | only if you received the object code with such an offer, in accord 267 | with subsection 6b. 268 | - d) Convey the object code by offering access from a designated 269 | place (gratis or for a charge), and offer equivalent access to the 270 | Corresponding Source in the same way through the same place at no 271 | further charge. You need not require recipients to copy the 272 | Corresponding Source along with the object code. If the place to 273 | copy the object code is a network server, the Corresponding Source 274 | may be on a different server (operated by you or a third party) 275 | that supports equivalent copying facilities, provided you maintain 276 | clear directions next to the object code saying where to find the 277 | Corresponding Source. Regardless of what server hosts the 278 | Corresponding Source, you remain obligated to ensure that it is 279 | available for as long as needed to satisfy these requirements. 280 | - e) Convey the object code using peer-to-peer transmission, 281 | provided you inform other peers where the object code and 282 | Corresponding Source of the work are being offered to the general 283 | public at no charge under subsection 6d. 284 | 285 | A separable portion of the object code, whose source code is excluded 286 | from the Corresponding Source as a System Library, need not be 287 | included in conveying the object code work. 288 | 289 | A "User Product" is either (1) a "consumer product", which means any 290 | tangible personal property which is normally used for personal, 291 | family, or household purposes, or (2) anything designed or sold for 292 | incorporation into a dwelling. In determining whether a product is a 293 | consumer product, doubtful cases shall be resolved in favor of 294 | coverage. For a particular product received by a particular user, 295 | "normally used" refers to a typical or common use of that class of 296 | product, regardless of the status of the particular user or of the way 297 | in which the particular user actually uses, or expects or is expected 298 | to use, the product. A product is a consumer product regardless of 299 | whether the product has substantial commercial, industrial or 300 | non-consumer uses, unless such uses represent the only significant 301 | mode of use of the product. 302 | 303 | "Installation Information" for a User Product means any methods, 304 | procedures, authorization keys, or other information required to 305 | install and execute modified versions of a covered work in that User 306 | Product from a modified version of its Corresponding Source. The 307 | information must suffice to ensure that the continued functioning of 308 | the modified object code is in no case prevented or interfered with 309 | solely because modification has been made. 310 | 311 | If you convey an object code work under this section in, or with, or 312 | specifically for use in, a User Product, and the conveying occurs as 313 | part of a transaction in which the right of possession and use of the 314 | User Product is transferred to the recipient in perpetuity or for a 315 | fixed term (regardless of how the transaction is characterized), the 316 | Corresponding Source conveyed under this section must be accompanied 317 | by the Installation Information. But this requirement does not apply 318 | if neither you nor any third party retains the ability to install 319 | modified object code on the User Product (for example, the work has 320 | been installed in ROM). 321 | 322 | The requirement to provide Installation Information does not include a 323 | requirement to continue to provide support service, warranty, or 324 | updates for a work that has been modified or installed by the 325 | recipient, or for the User Product in which it has been modified or 326 | installed. Access to a network may be denied when the modification 327 | itself materially and adversely affects the operation of the network 328 | or violates the rules and protocols for communication across the 329 | network. 330 | 331 | Corresponding Source conveyed, and Installation Information provided, 332 | in accord with this section must be in a format that is publicly 333 | documented (and with an implementation available to the public in 334 | source code form), and must require no special password or key for 335 | unpacking, reading or copying. 336 | 337 | ### 7. Additional Terms. 338 | 339 | "Additional permissions" are terms that supplement the terms of this 340 | License by making exceptions from one or more of its conditions. 341 | Additional permissions that are applicable to the entire Program shall 342 | be treated as though they were included in this License, to the extent 343 | that they are valid under applicable law. If additional permissions 344 | apply only to part of the Program, that part may be used separately 345 | under those permissions, but the entire Program remains governed by 346 | this License without regard to the additional permissions. 347 | 348 | When you convey a copy of a covered work, you may at your option 349 | remove any additional permissions from that copy, or from any part of 350 | it. (Additional permissions may be written to require their own 351 | removal in certain cases when you modify the work.) You may place 352 | additional permissions on material, added by you to a covered work, 353 | for which you have or can give appropriate copyright permission. 354 | 355 | Notwithstanding any other provision of this License, for material you 356 | add to a covered work, you may (if authorized by the copyright holders 357 | of that material) supplement the terms of this License with terms: 358 | 359 | - a) Disclaiming warranty or limiting liability differently from the 360 | terms of sections 15 and 16 of this License; or 361 | - b) Requiring preservation of specified reasonable legal notices or 362 | author attributions in that material or in the Appropriate Legal 363 | Notices displayed by works containing it; or 364 | - c) Prohibiting misrepresentation of the origin of that material, 365 | or requiring that modified versions of such material be marked in 366 | reasonable ways as different from the original version; or 367 | - d) Limiting the use for publicity purposes of names of licensors 368 | or authors of the material; or 369 | - e) Declining to grant rights under trademark law for use of some 370 | trade names, trademarks, or service marks; or 371 | - f) Requiring indemnification of licensors and authors of that 372 | material by anyone who conveys the material (or modified versions 373 | of it) with contractual assumptions of liability to the recipient, 374 | for any liability that these contractual assumptions directly 375 | impose on those licensors and authors. 376 | 377 | All other non-permissive additional terms are considered "further 378 | restrictions" within the meaning of section 10. If the Program as you 379 | received it, or any part of it, contains a notice stating that it is 380 | governed by this License along with a term that is a further 381 | restriction, you may remove that term. If a license document contains 382 | a further restriction but permits relicensing or conveying under this 383 | License, you may add to a covered work material governed by the terms 384 | of that license document, provided that the further restriction does 385 | not survive such relicensing or conveying. 386 | 387 | If you add terms to a covered work in accord with this section, you 388 | must place, in the relevant source files, a statement of the 389 | additional terms that apply to those files, or a notice indicating 390 | where to find the applicable terms. 391 | 392 | Additional terms, permissive or non-permissive, may be stated in the 393 | form of a separately written license, or stated as exceptions; the 394 | above requirements apply either way. 395 | 396 | ### 8. Termination. 397 | 398 | You may not propagate or modify a covered work except as expressly 399 | provided under this License. Any attempt otherwise to propagate or 400 | modify it is void, and will automatically terminate your rights under 401 | this License (including any patent licenses granted under the third 402 | paragraph of section 11). 403 | 404 | However, if you cease all violation of this License, then your license 405 | from a particular copyright holder is reinstated (a) provisionally, 406 | unless and until the copyright holder explicitly and finally 407 | terminates your license, and (b) permanently, if the copyright holder 408 | fails to notify you of the violation by some reasonable means prior to 409 | 60 days after the cessation. 410 | 411 | Moreover, your license from a particular copyright holder is 412 | reinstated permanently if the copyright holder notifies you of the 413 | violation by some reasonable means, this is the first time you have 414 | received notice of violation of this License (for any work) from that 415 | copyright holder, and you cure the violation prior to 30 days after 416 | your receipt of the notice. 417 | 418 | Termination of your rights under this section does not terminate the 419 | licenses of parties who have received copies or rights from you under 420 | this License. If your rights have been terminated and not permanently 421 | reinstated, you do not qualify to receive new licenses for the same 422 | material under section 10. 423 | 424 | ### 9. Acceptance Not Required for Having Copies. 425 | 426 | You are not required to accept this License in order to receive or run 427 | a copy of the Program. Ancillary propagation of a covered work 428 | occurring solely as a consequence of using peer-to-peer transmission 429 | to receive a copy likewise does not require acceptance. However, 430 | nothing other than this License grants you permission to propagate or 431 | modify any covered work. These actions infringe copyright if you do 432 | not accept this License. Therefore, by modifying or propagating a 433 | covered work, you indicate your acceptance of this License to do so. 434 | 435 | ### 10. Automatic Licensing of Downstream Recipients. 436 | 437 | Each time you convey a covered work, the recipient automatically 438 | receives a license from the original licensors, to run, modify and 439 | propagate that work, subject to this License. You are not responsible 440 | for enforcing compliance by third parties with this License. 441 | 442 | An "entity transaction" is a transaction transferring control of an 443 | organization, or substantially all assets of one, or subdividing an 444 | organization, or merging organizations. If propagation of a covered 445 | work results from an entity transaction, each party to that 446 | transaction who receives a copy of the work also receives whatever 447 | licenses to the work the party's predecessor in interest had or could 448 | give under the previous paragraph, plus a right to possession of the 449 | Corresponding Source of the work from the predecessor in interest, if 450 | the predecessor has it or can get it with reasonable efforts. 451 | 452 | You may not impose any further restrictions on the exercise of the 453 | rights granted or affirmed under this License. For example, you may 454 | not impose a license fee, royalty, or other charge for exercise of 455 | rights granted under this License, and you may not initiate litigation 456 | (including a cross-claim or counterclaim in a lawsuit) alleging that 457 | any patent claim is infringed by making, using, selling, offering for 458 | sale, or importing the Program or any portion of it. 459 | 460 | ### 11. Patents. 461 | 462 | A "contributor" is a copyright holder who authorizes use under this 463 | License of the Program or a work on which the Program is based. The 464 | work thus licensed is called the contributor's "contributor version". 465 | 466 | A contributor's "essential patent claims" are all patent claims owned 467 | or controlled by the contributor, whether already acquired or 468 | hereafter acquired, that would be infringed by some manner, permitted 469 | by this License, of making, using, or selling its contributor version, 470 | but do not include claims that would be infringed only as a 471 | consequence of further modification of the contributor version. For 472 | purposes of this definition, "control" includes the right to grant 473 | patent sublicenses in a manner consistent with the requirements of 474 | this License. 475 | 476 | Each contributor grants you a non-exclusive, worldwide, royalty-free 477 | patent license under the contributor's essential patent claims, to 478 | make, use, sell, offer for sale, import and otherwise run, modify and 479 | propagate the contents of its contributor version. 480 | 481 | In the following three paragraphs, a "patent license" is any express 482 | agreement or commitment, however denominated, not to enforce a patent 483 | (such as an express permission to practice a patent or covenant not to 484 | sue for patent infringement). To "grant" such a patent license to a 485 | party means to make such an agreement or commitment not to enforce a 486 | patent against the party. 487 | 488 | If you convey a covered work, knowingly relying on a patent license, 489 | and the Corresponding Source of the work is not available for anyone 490 | to copy, free of charge and under the terms of this License, through a 491 | publicly available network server or other readily accessible means, 492 | then you must either (1) cause the Corresponding Source to be so 493 | available, or (2) arrange to deprive yourself of the benefit of the 494 | patent license for this particular work, or (3) arrange, in a manner 495 | consistent with the requirements of this License, to extend the patent 496 | license to downstream recipients. "Knowingly relying" means you have 497 | actual knowledge that, but for the patent license, your conveying the 498 | covered work in a country, or your recipient's use of the covered work 499 | in a country, would infringe one or more identifiable patents in that 500 | country that you have reason to believe are valid. 501 | 502 | If, pursuant to or in connection with a single transaction or 503 | arrangement, you convey, or propagate by procuring conveyance of, a 504 | covered work, and grant a patent license to some of the parties 505 | receiving the covered work authorizing them to use, propagate, modify 506 | or convey a specific copy of the covered work, then the patent license 507 | you grant is automatically extended to all recipients of the covered 508 | work and works based on it. 509 | 510 | A patent license is "discriminatory" if it does not include within the 511 | scope of its coverage, prohibits the exercise of, or is conditioned on 512 | the non-exercise of one or more of the rights that are specifically 513 | granted under this License. You may not convey a covered work if you 514 | are a party to an arrangement with a third party that is in the 515 | business of distributing software, under which you make payment to the 516 | third party based on the extent of your activity of conveying the 517 | work, and under which the third party grants, to any of the parties 518 | who would receive the covered work from you, a discriminatory patent 519 | license (a) in connection with copies of the covered work conveyed by 520 | you (or copies made from those copies), or (b) primarily for and in 521 | connection with specific products or compilations that contain the 522 | covered work, unless you entered into that arrangement, or that patent 523 | license was granted, prior to 28 March 2007. 524 | 525 | Nothing in this License shall be construed as excluding or limiting 526 | any implied license or other defenses to infringement that may 527 | otherwise be available to you under applicable patent law. 528 | 529 | ### 12. No Surrender of Others' Freedom. 530 | 531 | If conditions are imposed on you (whether by court order, agreement or 532 | otherwise) that contradict the conditions of this License, they do not 533 | excuse you from the conditions of this License. If you cannot convey a 534 | covered work so as to satisfy simultaneously your obligations under 535 | this License and any other pertinent obligations, then as a 536 | consequence you may not convey it at all. For example, if you agree to 537 | terms that obligate you to collect a royalty for further conveying 538 | from those to whom you convey the Program, the only way you could 539 | satisfy both those terms and this License would be to refrain entirely 540 | from conveying the Program. 541 | 542 | ### 13. Remote Network Interaction; Use with the GNU General Public License. 543 | 544 | Notwithstanding any other provision of this License, if you modify the 545 | Program, your modified version must prominently offer all users 546 | interacting with it remotely through a computer network (if your 547 | version supports such interaction) an opportunity to receive the 548 | Corresponding Source of your version by providing access to the 549 | Corresponding Source from a network server at no charge, through some 550 | standard or customary means of facilitating copying of software. This 551 | Corresponding Source shall include the Corresponding Source for any 552 | work covered by version 3 of the GNU General Public License that is 553 | incorporated pursuant to the following paragraph. 554 | 555 | Notwithstanding any other provision of this License, you have 556 | permission to link or combine any covered work with a work licensed 557 | under version 3 of the GNU General Public License into a single 558 | combined work, and to convey the resulting work. The terms of this 559 | License will continue to apply to the part which is the covered work, 560 | but the work with which it is combined will remain governed by version 561 | 3 of the GNU General Public License. 562 | 563 | ### 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions 566 | of the GNU Affero General Public License from time to time. Such new 567 | versions will be similar in spirit to the present version, but may 568 | differ in detail to address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the Program 571 | specifies that a certain numbered version of the GNU Affero General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU Affero General Public License, you may choose any version ever 577 | published by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future versions 580 | of the GNU Affero General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | ### 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT 594 | WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT 595 | LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 596 | A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND 597 | PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE 598 | DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR 599 | CORRECTION. 600 | 601 | ### 16. Limitation of Liability. 602 | 603 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 604 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR 605 | CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, 606 | INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES 607 | ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT 608 | NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR 609 | LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM 610 | TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER 611 | PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 612 | 613 | ### 17. Interpretation of Sections 15 and 16. 614 | 615 | If the disclaimer of warranty and limitation of liability provided 616 | above cannot be given local legal effect according to their terms, 617 | reviewing courts shall apply local law that most closely approximates 618 | an absolute waiver of all civil liability in connection with the 619 | Program, unless a warranty or assumption of liability accompanies a 620 | copy of the Program in return for a fee. 621 | 622 | END OF TERMS AND CONDITIONS 623 | 624 | ## How to Apply These Terms to Your New Programs 625 | 626 | If you develop a new program, and you want it to be of the greatest 627 | possible use to the public, the best way to achieve this is to make it 628 | free software which everyone can redistribute and change under these 629 | terms. 630 | 631 | To do so, attach the following notices to the program. It is safest to 632 | attach them to the start of each source file to most effectively state 633 | the exclusion of warranty; and each file should have at least the 634 | "copyright" line and a pointer to where the full notice is found. 635 | 636 | 637 | Copyright (C) 638 | 639 | This program is free software: you can redistribute it and/or modify 640 | it under the terms of the GNU Affero General Public License as 641 | published by the Free Software Foundation, either version 3 of the 642 | License, or (at your option) any later version. 643 | 644 | This program is distributed in the hope that it will be useful, 645 | but WITHOUT ANY WARRANTY; without even the implied warranty of 646 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 647 | GNU Affero General Public License for more details. 648 | 649 | You should have received a copy of the GNU Affero General Public License 650 | along with this program. If not, see . 651 | 652 | Also add information on how to contact you by electronic and paper 653 | mail. 654 | 655 | If your software can interact with users remotely through a computer 656 | network, you should also make sure that it provides a way for users to 657 | get its source. For example, if your program is a web application, its 658 | interface could display a "Source" link that leads users to an archive 659 | of the code. There are many ways you could offer source, and different 660 | solutions will be better for different programs; see section 13 for 661 | the specific requirements. 662 | 663 | You should also get your employer (if you work as a programmer) or 664 | school, if any, to sign a "copyright disclaimer" for the program, if 665 | necessary. For more information on this, and how to apply and follow 666 | the GNU AGPL, see . 667 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 |

2 | defguard 3 |

4 | 5 | **defguard gateway** is a client service for [defguard](https://github.com/DefGuard/defguard) which can be used to create your own [WireGuard:tm:](https://www.wireguard.com/) VPN servers for secure and private networking. 6 | 7 | To learn more about the system see our [documentation](https://defguard.gitbook.io). 8 | 9 | ## Quick start 10 | 11 | If you already have your defguard instance running you can set up a gateway by following our [deployment guide](https://defguard.gitbook.io/defguard/features/setting-up-your-instance/gateway). 12 | 13 | ## Documentation 14 | 15 | See the [documentation](https://defguard.gitbook.io) for more information. 16 | 17 | ## Community and Support 18 | 19 | Find us on Matrix: [#defguard:teonite.com](https://matrix.to/#/#defguard:teonite.com) 20 | 21 | ## Contribution 22 | 23 | Please review the [Contributing guide](https://defguard.gitbook.io/defguard/for-developers/contributing) for information on how to get started contributing to the project. You might also find our [environment setup guide](https://defguard.gitbook.io/defguard/for-developers/dev-env-setup) handy. 24 | 25 | # Legal 26 | WireGuard is [registered trademarks](https://www.wireguard.com/trademark-policy/) of Jason A. Donenfeld. 27 | -------------------------------------------------------------------------------- /after-install.sh: -------------------------------------------------------------------------------- 1 | if systemctl is-enabled defguard-gateway --quiet; then 2 | systemctl restart defguard-gateway 3 | fi 4 | -------------------------------------------------------------------------------- /build.rs: -------------------------------------------------------------------------------- 1 | use vergen_git2::{Emitter, Git2Builder}; 2 | 3 | fn main() -> Result<(), Box> { 4 | // set VERGEN_GIT_SHA env variable based on git commit hash 5 | let git2 = Git2Builder::default().branch(true).sha(true).build()?; 6 | Emitter::default().add_instructions(&git2)?.emit()?; 7 | 8 | // compiling protos using path on build time 9 | let mut config = tonic_build::Config::new(); 10 | // enable optional fields 11 | config.protoc_arg("--experimental_allow_proto3_optional"); 12 | tonic_build::configure().compile_protos_with_config( 13 | config, 14 | &[ 15 | "proto/wireguard/gateway.proto", 16 | "proto/enterprise/firewall/firewall.proto", 17 | ], 18 | &["proto/wireguard", "proto/enterprise/firewall"], 19 | )?; 20 | println!("cargo:rerun-if-changed=proto"); 21 | Ok(()) 22 | } 23 | -------------------------------------------------------------------------------- /defguard-gateway.service: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=defguard VPN gateway service 3 | Documentation=https://defguard.gitbook.io/defguard/ 4 | Wants=network-online.target 5 | After=network-online.target 6 | 7 | [Service] 8 | ExecReload=/bin/kill -HUP $MAINPID 9 | ExecStart=/usr/sbin/defguard-gateway --config /etc/defguard/gateway.toml 10 | KillMode=process 11 | KillSignal=SIGINT 12 | LimitNOFILE=65536 13 | LimitNPROC=infinity 14 | Restart=on-failure 15 | RestartSec=2 16 | TasksMax=infinity 17 | OOMScoreAdjust=-1000 18 | 19 | [Install] 20 | WantedBy=multi-user.target 21 | -------------------------------------------------------------------------------- /defguard-gateway.service.freebsd: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | # PROVIDE: defguard-gateway 4 | # REQUIRE: NETWORKING wireguard 5 | # KEYWORD: shutdown 6 | 7 | . /etc/rc.subr 8 | 9 | name="defguard_gateway" 10 | rcvar=defguard_gateway_enable 11 | command="/usr/local/sbin/defguard-gateway" 12 | config="/etc/defguard/gateway.toml" 13 | start_cmd="${name}_start" 14 | 15 | defguard_gateway_start() 16 | { 17 | ${command} --config ${config} & 18 | } 19 | 20 | load_rc_config $name 21 | run_rc_command "$1" 22 | -------------------------------------------------------------------------------- /defguard-rc.conf: -------------------------------------------------------------------------------- 1 | defguard_gateway_enable="YES" 2 | -------------------------------------------------------------------------------- /deny.toml: -------------------------------------------------------------------------------- 1 | # This template contains all of the possible sections and their default values 2 | 3 | # Note that all fields that take a lint level have these possible values: 4 | # * deny - An error will be produced and the check will fail 5 | # * warn - A warning will be produced, but the check will not fail 6 | # * allow - No warning or error will be produced, though in some cases a note 7 | # will be 8 | 9 | # The values provided in this template are the default values that will be used 10 | # when any section or field is not specified in your own configuration 11 | 12 | # Root options 13 | 14 | # The graph table configures how the dependency graph is constructed and thus 15 | # which crates the checks are performed against 16 | [graph] 17 | # If 1 or more target triples (and optionally, target_features) are specified, 18 | # only the specified targets will be checked when running `cargo deny check`. 19 | # This means, if a particular package is only ever used as a target specific 20 | # dependency, such as, for example, the `nix` crate only being used via the 21 | # `target_family = "unix"` configuration, that only having windows targets in 22 | # this list would mean the nix crate, as well as any of its exclusive 23 | # dependencies not shared by any other crates, would be ignored, as the target 24 | # list here is effectively saying which targets you are building for. 25 | targets = [ 26 | # The triple can be any string, but only the target triples built in to 27 | # rustc (as of 1.40) can be checked against actual config expressions 28 | #"x86_64-unknown-linux-musl", 29 | # You can also specify which target_features you promise are enabled for a 30 | # particular target. target_features are currently not validated against 31 | # the actual valid features supported by the target architecture. 32 | #{ triple = "wasm32-unknown-unknown", features = ["atomics"] }, 33 | ] 34 | # When creating the dependency graph used as the source of truth when checks are 35 | # executed, this field can be used to prune crates from the graph, removing them 36 | # from the view of cargo-deny. This is an extremely heavy hammer, as if a crate 37 | # is pruned from the graph, all of its dependencies will also be pruned unless 38 | # they are connected to another crate in the graph that hasn't been pruned, 39 | # so it should be used with care. The identifiers are [Package ID Specifications] 40 | # (https://doc.rust-lang.org/cargo/reference/pkgid-spec.html) 41 | #exclude = [] 42 | # If true, metadata will be collected with `--all-features`. Note that this can't 43 | # be toggled off if true, if you want to conditionally enable `--all-features` it 44 | # is recommended to pass `--all-features` on the cmd line instead 45 | all-features = false 46 | # If true, metadata will be collected with `--no-default-features`. The same 47 | # caveat with `all-features` applies 48 | no-default-features = false 49 | # If set, these feature will be enabled when collecting metadata. If `--features` 50 | # is specified on the cmd line they will take precedence over this option. 51 | #features = [] 52 | 53 | # The output table provides options for how/if diagnostics are outputted 54 | [output] 55 | # When outputting inclusion graphs in diagnostics that include features, this 56 | # option can be used to specify the depth at which feature edges will be added. 57 | # This option is included since the graphs can be quite large and the addition 58 | # of features from the crate(s) to all of the graph roots can be far too verbose. 59 | # This option can be overridden via `--feature-depth` on the cmd line 60 | feature-depth = 1 61 | 62 | # This section is considered when running `cargo deny check advisories` 63 | # More documentation for the advisories section can be found here: 64 | # https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html 65 | [advisories] 66 | # The path where the advisory databases are cloned/fetched into 67 | #db-path = "$CARGO_HOME/advisory-dbs" 68 | # The url(s) of the advisory databases to use 69 | #db-urls = ["https://github.com/rustsec/advisory-db"] 70 | # A list of advisory IDs to ignore. Note that ignored advisories will still 71 | # output a note when they are encountered. 72 | ignore = [ 73 | { id = "RUSTSEC-2024-0436", reason = "Unmaintained" }, 74 | ] 75 | # If this is true, then cargo deny will use the git executable to fetch advisory database. 76 | # If this is false, then it uses a built-in git library. 77 | # Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support. 78 | # See Git Authentication for more information about setting up git authentication. 79 | #git-fetch-with-cli = true 80 | 81 | # This section is considered when running `cargo deny check licenses` 82 | # More documentation for the licenses section can be found here: 83 | # https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html 84 | [licenses] 85 | # List of explicitly allowed licenses 86 | # See https://spdx.org/licenses/ for list of possible licenses 87 | # [possible values: any SPDX 3.11 short identifier (+ optional exception)]. 88 | allow = [ 89 | "MIT", 90 | "Apache-2.0", 91 | "Apache-2.0 WITH LLVM-exception", 92 | "MPL-2.0", 93 | "BSD-3-Clause", 94 | "Unicode-3.0", 95 | "Unicode-DFS-2016", # unicode-ident 96 | "Zlib", 97 | "ISC", 98 | "BSL-1.0", 99 | "0BSD", 100 | "CC0-1.0", 101 | "OpenSSL", 102 | "CDLA-Permissive-2.0", 103 | ] 104 | # The confidence threshold for detecting a license from license text. 105 | # The higher the value, the more closely the license text must be to the 106 | # canonical license text of a valid SPDX license file. 107 | # [possible values: any between 0.0 and 1.0]. 108 | confidence-threshold = 0.8 109 | # Allow 1 or more licenses on a per-crate basis, so that particular licenses 110 | # aren't accepted for every possible crate as with the normal allow list 111 | exceptions = [ 112 | { allow = ["AGPL-3.0"], crate = "defguard-gateway" }, 113 | ] 114 | 115 | # Some crates don't have (easily) machine readable licensing information, 116 | # adding a clarification entry for it allows you to manually specify the 117 | # licensing information 118 | #[[licenses.clarify]] 119 | # The package spec the clarification applies to 120 | #crate = "ring" 121 | # The SPDX expression for the license requirements of the crate 122 | #expression = "MIT AND ISC AND OpenSSL" 123 | # One or more files in the crate's source used as the "source of truth" for 124 | # the license expression. If the contents match, the clarification will be used 125 | # when running the license check, otherwise the clarification will be ignored 126 | # and the crate will be checked normally, which may produce warnings or errors 127 | # depending on the rest of your configuration 128 | #license-files = [ 129 | # Each entry is a crate relative path, and the (opaque) hash of its contents 130 | #{ path = "LICENSE", hash = 0xbd0eed23 } 131 | #] 132 | 133 | [licenses.private] 134 | # If true, ignores workspace crates that aren't published, or are only 135 | # published to private registries. 136 | # To see how to mark a crate as unpublished (to the official registry), 137 | # visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field. 138 | ignore = false 139 | # One or more private registries that you might publish crates to, if a crate 140 | # is only published to private registries, and ignore is true, the crate will 141 | # not have its license(s) checked 142 | registries = [ 143 | #"https://sekretz.com/registry 144 | ] 145 | 146 | # This section is considered when running `cargo deny check bans`. 147 | # More documentation about the 'bans' section can be found here: 148 | # https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html 149 | [bans] 150 | # Lint level for when multiple versions of the same crate are detected 151 | multiple-versions = "warn" 152 | # Lint level for when a crate version requirement is `*` 153 | wildcards = "allow" 154 | # The graph highlighting used when creating dotgraphs for crates 155 | # with multiple versions 156 | # * lowest-version - The path to the lowest versioned duplicate is highlighted 157 | # * simplest-path - The path to the version with the fewest edges is highlighted 158 | # * all - Both lowest-version and simplest-path are used 159 | highlight = "all" 160 | # The default lint level for `default` features for crates that are members of 161 | # the workspace that is being checked. This can be overridden by allowing/denying 162 | # `default` on a crate-by-crate basis if desired. 163 | workspace-default-features = "allow" 164 | # The default lint level for `default` features for external crates that are not 165 | # members of the workspace. This can be overridden by allowing/denying `default` 166 | # on a crate-by-crate basis if desired. 167 | external-default-features = "allow" 168 | # List of crates that are allowed. Use with care! 169 | allow = [ 170 | #"ansi_term@0.11.0", 171 | #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is allowed" }, 172 | ] 173 | # List of crates to deny 174 | deny = [ 175 | #"ansi_term@0.11.0", 176 | #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is banned" }, 177 | # Wrapper crates can optionally be specified to allow the crate when it 178 | # is a direct dependency of the otherwise banned crate 179 | #{ crate = "ansi_term@0.11.0", wrappers = ["this-crate-directly-depends-on-ansi_term"] }, 180 | ] 181 | 182 | # List of features to allow/deny 183 | # Each entry the name of a crate and a version range. If version is 184 | # not specified, all versions will be matched. 185 | #[[bans.features]] 186 | #crate = "reqwest" 187 | # Features to not allow 188 | #deny = ["json"] 189 | # Features to allow 190 | #allow = [ 191 | # "rustls", 192 | # "__rustls", 193 | # "__tls", 194 | # "hyper-rustls", 195 | # "rustls", 196 | # "rustls-pemfile", 197 | # "rustls-tls-webpki-roots", 198 | # "tokio-rustls", 199 | # "webpki-roots", 200 | #] 201 | # If true, the allowed features must exactly match the enabled feature set. If 202 | # this is set there is no point setting `deny` 203 | #exact = true 204 | 205 | # Certain crates/versions that will be skipped when doing duplicate detection. 206 | skip = [ 207 | #"ansi_term@0.11.0", 208 | #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason why it can't be updated/removed" }, 209 | ] 210 | # Similarly to `skip` allows you to skip certain crates during duplicate 211 | # detection. Unlike skip, it also includes the entire tree of transitive 212 | # dependencies starting at the specified crate, up to a certain depth, which is 213 | # by default infinite. 214 | skip-tree = [ 215 | #"ansi_term@0.11.0", # will be skipped along with _all_ of its direct and transitive dependencies 216 | #{ crate = "ansi_term@0.11.0", depth = 20 }, 217 | ] 218 | 219 | # This section is considered when running `cargo deny check sources`. 220 | # More documentation about the 'sources' section can be found here: 221 | # https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html 222 | [sources] 223 | # Lint level for what to happen when a crate from a crate registry that is not 224 | # in the allow list is encountered 225 | unknown-registry = "warn" 226 | # Lint level for what to happen when a crate from a git repository that is not 227 | # in the allow list is encountered 228 | unknown-git = "warn" 229 | # List of URLs for allowed crate registries. Defaults to the crates.io index 230 | # if not specified. If it is specified but empty, no registries are allowed. 231 | allow-registry = ["https://github.com/rust-lang/crates.io-index"] 232 | # List of URLs for allowed Git repositories 233 | allow-git = [] 234 | 235 | [sources.allow-org] 236 | # github.com organizations to allow git sources for 237 | github = [] 238 | # gitlab.com organizations to allow git sources for 239 | gitlab = [] 240 | # bitbucket.org organizations to allow git sources for 241 | bitbucket = [] 242 | -------------------------------------------------------------------------------- /docs/header.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DefGuard/gateway/c20856249cb73ec9d042327f2f193a016c0a6656/docs/header.png -------------------------------------------------------------------------------- /example-config.toml: -------------------------------------------------------------------------------- 1 | # This is an example config file for defguard VPN gateway 2 | # To use it fill in actual values for your deployment below 3 | 4 | # Required: secret token generated by defguard 5 | # NOTE: must replace default with actual value 6 | token = "" 7 | # Required: defguard server gRPC endpoint URL 8 | # NOTE: must replace default with actual value 9 | grpc_url = "" 10 | # Optional: gateway name which will be displayed in defguard web UI 11 | name = "Gateway A" 12 | # Required: use userspace WireGuard implementation (e.g. wireguard-go) 13 | userspace = false 14 | # Optional: path to TLS cert file 15 | # grpc_ca = cert.pem 16 | # Required: how often should interface stat updates be sent to defguard server (in seconds) 17 | stats_period = 60 18 | # Required: name of WireGuard interface 19 | ifname = "wg0" 20 | # Optional: write PID to this file 21 | # pidfile = defguard-gateway.pid 22 | # Required: enable logging to syslog 23 | use_syslog = false 24 | # Required: which syslog facility to use 25 | syslog_facility = "LOG_USER" 26 | # Required: which socket to use for logging 27 | syslog_socket = "/var/run/log" 28 | 29 | # Optional: Command which will be run before bringing interface up 30 | # Example: Allow all traffic through WireGuard interface: 31 | #pre_up = "/path/to/iptables -A INPUT -i wg0 -j ACCEPT 32 | # example with multiple commands - add them to a shell script 33 | #pre_up = "/path/to/shell /path/to/script" 34 | 35 | # Optional: Command which will be run after bringing interface up 36 | # Example: Add a default route after WireGuard interface is up: 37 | #post_up = "/path/to/ip route add default via 192.168.1.1 dev wg0" 38 | 39 | 40 | # Optional: Command which will be run before bringing interface down 41 | # Example: Remove WireGuard-related firewall rules before interface is taken down: 42 | #pre_down = "/path/to/iptables -D INPUT -i wg0 -j ACCEPT" 43 | 44 | # Optional: Command which will be run after bringing interface down 45 | # Example: Remove the default route after WireGuard interface is down: 46 | #post_down = "/pat/to/ip route del default via 192.168.1.1 dev wg0" 47 | 48 | # A HTTP port that will expose the REST HTTP gateway health status 49 | # STATUS CODES: 50 | # 200 - Gateway is working and is connected to CORE 51 | # 503 - gateway works but is not connected to CORE 52 | #health_port = 55003 53 | 54 | # Optional: Enable automatic masquerading of traffic by the firewall 55 | #masquerade = true 56 | 57 | # Optional: Set the priority of the Defguard forward chain 58 | #fw_priority = 0 59 | -------------------------------------------------------------------------------- /examples/server.rs: -------------------------------------------------------------------------------- 1 | use std::{ 2 | collections::HashMap, 3 | io::{stdout, Write}, 4 | net::{IpAddr, Ipv4Addr, SocketAddr}, 5 | sync::{Arc, Mutex}, 6 | }; 7 | 8 | use defguard_gateway::proto; 9 | use defguard_wireguard_rs::{ 10 | host::{Host, Peer}, 11 | key::Key, 12 | net::IpAddrMask, 13 | }; 14 | use tokio::{ 15 | io::{AsyncBufReadExt, BufReader}, 16 | sync::{ 17 | mpsc::{self, UnboundedSender}, 18 | watch::{self, Receiver, Sender}, 19 | }, 20 | }; 21 | use tokio_stream::wrappers::UnboundedReceiverStream; 22 | use tonic::{transport::Server, Request, Response, Status, Streaming}; 23 | 24 | pub struct HostConfig { 25 | name: String, 26 | addresses: Vec, 27 | host: Host, 28 | } 29 | 30 | type ClientMap = HashMap>>; 31 | 32 | struct GatewayServer { 33 | config_rx: Receiver, 34 | clients: Arc>, 35 | } 36 | 37 | impl GatewayServer { 38 | pub fn new(config_rx: Receiver, clients: Arc>) -> Self { 39 | // watch for changes in host configuration 40 | let task_clients = clients.clone(); 41 | let mut task_config_rx = config_rx.clone(); 42 | tokio::spawn(async move { 43 | while task_config_rx.changed().await.is_ok() { 44 | let config = (&*task_config_rx.borrow()).into(); 45 | let update = proto::gateway::Update { 46 | update_type: proto::gateway::UpdateType::Modify as i32, 47 | update: Some(proto::gateway::update::Update::Network(config)), 48 | }; 49 | task_clients.lock().unwrap().retain( 50 | move |_addr, tx: &mut UnboundedSender>| { 51 | tx.send(Ok(update.clone())).is_ok() 52 | }, 53 | ); 54 | } 55 | }); 56 | 57 | Self { config_rx, clients } 58 | } 59 | } 60 | 61 | impl From<&HostConfig> for proto::gateway::Configuration { 62 | fn from(host_config: &HostConfig) -> Self { 63 | Self { 64 | name: host_config.name.clone(), 65 | prvkey: host_config 66 | .host 67 | .private_key 68 | .as_ref() 69 | .map(ToString::to_string) 70 | .unwrap_or_default(), 71 | addresses: host_config 72 | .addresses 73 | .iter() 74 | .map(ToString::to_string) 75 | .collect(), 76 | port: u32::from(host_config.host.listen_port), 77 | peers: host_config.host.peers.values().map(Into::into).collect(), 78 | firewall_config: None, 79 | } 80 | } 81 | } 82 | 83 | #[tonic::async_trait] 84 | impl proto::gateway::gateway_service_server::GatewayService for GatewayServer { 85 | type UpdatesStream = UnboundedReceiverStream>; 86 | 87 | async fn config( 88 | &self, 89 | request: Request, 90 | ) -> Result, Status> { 91 | let address = request.remote_addr().unwrap(); 92 | eprintln!("CONFIG connected from: {address}"); 93 | Ok(Response::new((&*self.config_rx.borrow()).into())) 94 | } 95 | 96 | async fn stats( 97 | &self, 98 | request: Request>, 99 | ) -> Result, Status> { 100 | let address = request.remote_addr().unwrap(); 101 | eprintln!("STATS connected from: {address}"); 102 | 103 | let mut stream = request.into_inner(); 104 | while let Some(peer_stats) = stream.message().await? { 105 | eprintln!("STATS {peer_stats:?}"); 106 | } 107 | Ok(Response::new(())) 108 | } 109 | 110 | async fn updates(&self, request: Request<()>) -> Result, Status> { 111 | let address = request.remote_addr().unwrap(); 112 | eprintln!("UPDATES connected from: {address}"); 113 | 114 | let (tx, rx) = mpsc::unbounded_channel(); 115 | self.clients.lock().unwrap().insert(address, tx); 116 | 117 | Ok(Response::new(UnboundedReceiverStream::new(rx))) 118 | } 119 | } 120 | 121 | pub async fn cli(tx: Sender, clients: Arc>) { 122 | let mut stdin = BufReader::new(tokio::io::stdin()); 123 | println!( 124 | "a|addr address - set host address\n\ 125 | c|peer key - create peer with public key\n\ 126 | d|del key - delete peer with public key\n\ 127 | k|key key - set private key\n\ 128 | p|port port - set listening port\n\ 129 | q|quit - quit\n\ 130 | " 131 | ); 132 | loop { 133 | print!("> "); 134 | stdout().flush().unwrap(); 135 | let mut line = String::new(); 136 | let _count = stdin.read_line(&mut line).await.unwrap(); 137 | let mut token_iter = line.split_whitespace(); 138 | if let Some(keyword) = token_iter.next() { 139 | match keyword { 140 | "a" | "addr" => { 141 | let mut addresses = Vec::new(); 142 | for address in token_iter.by_ref() { 143 | match address.parse() { 144 | Ok(ipaddr) => addresses.push(ipaddr), 145 | Err(err) => eprintln!("Skipping {address}: {err}"), 146 | } 147 | } 148 | if !addresses.is_empty() { 149 | tx.send_modify(|config| config.addresses = addresses); 150 | } 151 | } 152 | "c" | "peer" => { 153 | if let Some(key) = token_iter.next() { 154 | if let Ok(key) = Key::try_from(key) { 155 | let peer = Peer::new(key.clone()); 156 | 157 | let update = proto::gateway::Update { 158 | update_type: proto::gateway::UpdateType::Create as i32, 159 | update: Some(proto::gateway::update::Update::Peer((&peer).into())), 160 | }; 161 | clients.lock().unwrap().retain( 162 | move |addr, 163 | tx: &mut UnboundedSender< 164 | Result, 165 | >| { 166 | eprintln!("Sending peer update to {addr}"); 167 | tx.send(Ok(update.clone())).is_ok() 168 | }, 169 | ); 170 | 171 | // modify HostConfig, but do not notify the receiver 172 | tx.send_if_modified(|config| { 173 | config.host.peers.insert(key, peer); 174 | false 175 | }); 176 | } else { 177 | eprintln!("Parse error"); 178 | } 179 | } 180 | } 181 | "d" | "del" => { 182 | if let Some(key) = token_iter.next() { 183 | if let Ok(key) = Key::try_from(key) { 184 | let peer = Peer::new(key); 185 | 186 | let update = proto::gateway::Update { 187 | update_type: proto::gateway::UpdateType::Delete as i32, 188 | update: Some(proto::gateway::update::Update::Peer((&peer).into())), 189 | }; 190 | clients.lock().unwrap().retain( 191 | move |addr, 192 | tx: &mut UnboundedSender< 193 | Result, 194 | >| { 195 | eprintln!("Sending peer update to {addr}"); 196 | tx.send(Ok(update.clone())).is_ok() 197 | }, 198 | ); 199 | 200 | // modify HostConfig, but do not notify the receiver 201 | // tx.send_if_modified(|config| { 202 | // config.host.peers.retain(|entry| entry.public_key != peer.public_key); 203 | // false 204 | // }); 205 | } else { 206 | eprintln!("Parse error"); 207 | } 208 | } 209 | } 210 | "k" | "key" => { 211 | if let Some(key) = token_iter.next() { 212 | if let Ok(key) = Key::try_from(key) { 213 | tx.send_modify(|config| config.host.private_key = Some(key)); 214 | } else { 215 | eprintln!("Parse error"); 216 | } 217 | } 218 | } 219 | "p" | "port" => { 220 | if let Some(port) = token_iter.next() { 221 | if let Ok(port) = port.parse() { 222 | tx.send_modify(|config| config.host.listen_port = port); 223 | } else { 224 | eprintln!("Parse error"); 225 | } 226 | } 227 | } 228 | "q" | "quit" => break, 229 | _ => eprintln!("Unknown command"), 230 | } 231 | } 232 | } 233 | } 234 | 235 | pub async fn grpc( 236 | config_rx: Receiver, 237 | clients: Arc>, 238 | ) -> Result<(), tonic::transport::Error> { 239 | let gateway_service = proto::gateway::gateway_service_server::GatewayServiceServer::new( 240 | GatewayServer::new(config_rx, clients), 241 | ); 242 | let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), 50055); // TODO: port as an option 243 | Server::builder() 244 | .add_service(gateway_service) 245 | .serve(addr) 246 | .await 247 | } 248 | 249 | #[tokio::main] 250 | async fn main() -> Result<(), Box> { 251 | let configuration = HostConfig { 252 | name: "demo".into(), 253 | host: Host::new( 254 | 50505, 255 | Key::try_from("JPcD7xOfOAULx+cTdgzB3dIv6nvqqbmlACYzxrfJ4Dw=").unwrap(), 256 | ), 257 | addresses: vec!["192.168.68.68".parse().unwrap()], 258 | }; 259 | let (config_tx, config_rx) = watch::channel(configuration); 260 | let clients = Arc::new(Mutex::new(HashMap::new())); 261 | tokio::select! { 262 | _ = grpc(config_rx, clients.clone()) => eprintln!("gRPC completed"), 263 | () = cli(config_tx, clients) => eprintln!("CLI completed") 264 | }; 265 | 266 | Ok(()) 267 | } 268 | -------------------------------------------------------------------------------- /flake.lock: -------------------------------------------------------------------------------- 1 | { 2 | "nodes": { 3 | "flake-utils": { 4 | "inputs": { 5 | "systems": "systems" 6 | }, 7 | "locked": { 8 | "lastModified": 1731533236, 9 | "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", 10 | "owner": "numtide", 11 | "repo": "flake-utils", 12 | "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", 13 | "type": "github" 14 | }, 15 | "original": { 16 | "owner": "numtide", 17 | "repo": "flake-utils", 18 | "type": "github" 19 | } 20 | }, 21 | "nixpkgs": { 22 | "locked": { 23 | "lastModified": 1746904237, 24 | "narHash": "sha256-3e+AVBczosP5dCLQmMoMEogM57gmZ2qrVSrmq9aResQ=", 25 | "owner": "NixOS", 26 | "repo": "nixpkgs", 27 | "rev": "d89fc19e405cb2d55ce7cc114356846a0ee5e956", 28 | "type": "github" 29 | }, 30 | "original": { 31 | "owner": "NixOS", 32 | "ref": "nixos-unstable", 33 | "repo": "nixpkgs", 34 | "type": "github" 35 | } 36 | }, 37 | "root": { 38 | "inputs": { 39 | "flake-utils": "flake-utils", 40 | "nixpkgs": "nixpkgs", 41 | "rust-overlay": "rust-overlay" 42 | } 43 | }, 44 | "rust-overlay": { 45 | "inputs": { 46 | "nixpkgs": [ 47 | "nixpkgs" 48 | ] 49 | }, 50 | "locked": { 51 | "lastModified": 1747190175, 52 | "narHash": "sha256-s33mQ2s5L/2nyllhRTywgECNZyCqyF4MJeM3vG/GaRo=", 53 | "owner": "oxalica", 54 | "repo": "rust-overlay", 55 | "rev": "58160be7abad81f6f8cb53120d5b88c16e01c06d", 56 | "type": "github" 57 | }, 58 | "original": { 59 | "owner": "oxalica", 60 | "repo": "rust-overlay", 61 | "type": "github" 62 | } 63 | }, 64 | "systems": { 65 | "locked": { 66 | "lastModified": 1681028828, 67 | "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", 68 | "owner": "nix-systems", 69 | "repo": "default", 70 | "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", 71 | "type": "github" 72 | }, 73 | "original": { 74 | "owner": "nix-systems", 75 | "repo": "default", 76 | "type": "github" 77 | } 78 | } 79 | }, 80 | "root": "root", 81 | "version": 7 82 | } 83 | -------------------------------------------------------------------------------- /flake.nix: -------------------------------------------------------------------------------- 1 | { 2 | description = "Rust development flake"; 3 | 4 | inputs = { 5 | nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; 6 | flake-utils.url = "github:numtide/flake-utils"; 7 | rust-overlay = { 8 | url = "github:oxalica/rust-overlay"; 9 | inputs = { 10 | nixpkgs.follows = "nixpkgs"; 11 | }; 12 | }; 13 | }; 14 | 15 | outputs = { 16 | nixpkgs, 17 | flake-utils, 18 | rust-overlay, 19 | ... 20 | }: 21 | flake-utils.lib.eachDefaultSystem (system: let 22 | overlays = [(import rust-overlay)]; 23 | pkgs = import nixpkgs { 24 | inherit system overlays; 25 | }; 26 | rustToolchain = pkgs.rust-bin.stable.latest.default.override { 27 | extensions = ["rust-analyzer" "rust-src" "rustfmt" "clippy"]; 28 | }; 29 | in { 30 | devShells.default = pkgs.mkShell { 31 | packages = with pkgs; [ 32 | pkg-config 33 | openssl 34 | protobuf 35 | sqlx-cli 36 | rustToolchain 37 | libnftnl 38 | libmnl 39 | ]; 40 | }; 41 | }); 42 | } 43 | -------------------------------------------------------------------------------- /opnsense/Makefile: -------------------------------------------------------------------------------- 1 | PLUGIN_NAME= defguard-gateway 2 | PLUGIN_VERSION= 1.0.1 3 | PLUGIN_COMMENT= Gateway service for Defguard 4 | PLUGIN_MAINTAINER= defguard@community.net 5 | 6 | .include "../../Mk/plugins.mk" 7 | -------------------------------------------------------------------------------- /opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc: -------------------------------------------------------------------------------- 1 | "Defguard Gateway", 8 | "configd" => [ 9 | "start" => ["defguard_gateway start"], 10 | "restart" => ["defguard_gateway restart"], 11 | "stop" => ["defguard_gateway stop"], 12 | ], 13 | "name" => "defguard_gateway", 14 | "nocheck" => true, 15 | ]; 16 | 17 | return $services; 18 | } 19 | 20 | function defguardgateway_interfaces() 21 | { 22 | $interfaces = []; 23 | 24 | $interfaces["defguard"] = [ 25 | "descr" => gettext("Defguard (Group)"), 26 | "if" => "defguard", 27 | "virtual" => true, 28 | "enable" => true, 29 | "type" => "group", 30 | "networks" => [], 31 | ]; 32 | 33 | return $interfaces; 34 | } 35 | 36 | function defguardgateway_devices() 37 | { 38 | $names = []; 39 | 40 | $interface = (new OPNsense\DefguardGateway\DefguardGateway())->general 41 | ->IfName; 42 | 43 | $devices[] = [ 44 | "configurable" => false, 45 | "pattern" => "^wg", 46 | "type" => "wireguard", 47 | "volatile" => true, 48 | "names" => [ 49 | (string) $interface => [ 50 | "descr" => sprintf( 51 | "%s (Defguard Gateway)", 52 | (string) $interface 53 | ), 54 | "ifdescr" => "WireGuard interface used by Defguard Gateway", 55 | "name" => (string) $interface, 56 | ], 57 | ], 58 | ]; 59 | 60 | return $devices; 61 | } 62 | 63 | function defguardgateway_enabled() 64 | { 65 | global $config; 66 | 67 | return isset($config['OPNsense']['defguardgateway']['general']['Enabled']) && 68 | $config['OPNsense']['defguardgateway']['general']['Enabled'] == 1; 69 | } 70 | 71 | function defguardgateway_firewall($fw) 72 | { 73 | if (!defguardgateway_enabled()) { 74 | return; 75 | } 76 | 77 | // $fw->registerAnchor('defguard/*', 'nat', 1, 'head'); 78 | // $fw->registerAnchor('defguard/*', 'rdr', 1, 'head'); 79 | $fw->registerAnchor('defguard/*', 'fw', 1, 'head', true); 80 | } 81 | -------------------------------------------------------------------------------- /opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/Api/ServiceController.php: -------------------------------------------------------------------------------- 1 | view->pick("OPNsense/DefguardGateway/index"); 8 | $this->view->generalForm = $this->getForm("general"); 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml: -------------------------------------------------------------------------------- 1 |
2 | 3 | defguardgateway.general.Enabled 4 | 5 | checkbox 6 | Check to enable Defguard Gateway service. 7 | 8 | 9 | defguardgateway.general.Token 10 | 11 | text 12 | Required: Token obtained from Defguard Core after network creation. 13 | 14 | 15 | defguardgateway.general.GrpcUrl 16 | 17 | text 18 | Required: URL of Defguard Core's gRPC service. 19 | 20 | 21 | defguardgateway.general.GrpcCertPath 22 | 23 | text 24 | Required if custom SSL CA has been enabled in Defguard Core; more details here: https://docs.defguard.net/admin-and-features/setting-up-your-instance/grpc-ssl-communication#custom-ssl-ca-and-certificates. 25 | 26 | 27 | defguardgateway.general.Name 28 | 29 | text 30 | Name that will be displayed in Defguard 31 | Gateway OPNsense 32 | 33 | 34 | defguardgateway.general.UseSyslog 35 | 36 | checkbox 37 | Enable logging to syslog. 38 | 39 | 40 | defguardgateway.general.PidFile 41 | 42 | text 43 | Save PID to this file. 44 | Optional: write PID to this file. 45 | 46 | 47 | defguardgateway.general.SyslogSocket 48 | 49 | text 50 | Specify the syslog socket. 51 | Default value: /var/run/log 52 | 53 | 54 | defguardgateway.general.SyslogFacility 55 | 56 | text 57 | Default value: LOG_USER 58 | Specify the syslog facility. 59 | 60 | 61 | defguardgateway.general.IfName 62 | 63 | text 64 | Specify the WireGuard interface name 65 | Default value: wg0 66 | 67 | 68 | defguardgateway.general.StatsPeriod 69 | 70 | text 71 | Specify the stats period in seconds 72 | Default value: 60. 73 | 74 | 75 | defguardgateway.general.Userspace 76 | 77 | checkbox 78 | Use userspace WireGuard implementation; useful on systems without native WireGuard support. 79 | 80 | 81 | defguardgateway.general.PreUp 82 | 83 | text 84 | Command to run before bringing up the interface. 85 | 86 | 87 | defguardgateway.general.PreDown 88 | 89 | text 90 | Command to run before bringing down the interface. 91 | 92 | 93 | defguardgateway.general.PostUp 94 | 95 | text 96 | Command to run after bringing up the interface. 97 | 98 | 99 | defguardgateway.general.PostDown 100 | 101 | text 102 | Command to run after bringing down the interface. 103 | 104 |
105 | -------------------------------------------------------------------------------- /opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.php: -------------------------------------------------------------------------------- 1 | 2 | //OPNsense/defguardgateway 3 | Defguard Gateway plugin for OPNsense 4 | 5 | 6 | 7 | 0 8 | Y 9 | 10 | 11 | 0 12 | Y 13 | 14 | 15 | Y 16 | please add authorization token 17 | 18 | 19 | Y 20 | please specify Defguard Core gRPC URL 21 | 22 | 23 | N 24 | 25 | 26 | N 27 | 28 | 29 | 0 30 | Y 31 | 32 | 33 | N 34 | 35 | 36 | /var/run/log 37 | Y 38 | 39 | 40 | LOG_USER 41 | Y 42 | 43 | 44 | Y 45 | wg0 46 | 47 | 48 | Y 49 | 60 50 | 51 | 52 | N 53 | 54 | 55 | N 56 | 57 | 58 | N 59 | 60 | 61 | N 62 | 63 | 64 | 65 | 66 | -------------------------------------------------------------------------------- /opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/Menu/Menu.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /opnsense/src/opnsense/mvc/app/views/OPNsense/DefguardGateway/index.volt: -------------------------------------------------------------------------------- 1 |

Configuration

2 | 3 | 38 | 40 | 41 |
42 | {{ partial("layout_partials/base_form", ['fields':generalForm,'id':'frm_GeneralSettings']) }} 43 |
44 | 45 |
46 | 47 | 48 |
49 | -------------------------------------------------------------------------------- /opnsense/src/opnsense/service/conf/actions.d/actions_defguardgateway.conf: -------------------------------------------------------------------------------- 1 | [start] 2 | command:/usr/local/etc/rc.d/defguard_gateway start 3 | parameters: 4 | type:script 5 | message:starting Defguard Gateway 6 | 7 | [stop] 8 | command:/usr/local/etc/rc.d/defguard_gateway stop 9 | parameters: 10 | type:script 11 | message:stopping Defguard Gateway 12 | 13 | [restart] 14 | command:/usr/local/etc/rc.d/defguard_gateway restart 15 | parameters: 16 | type:script 17 | message:restarting Defguard Gateway 18 | 19 | [status] 20 | command:/usr/local/etc/rc.d/defguard_gateway status 21 | parameters: 22 | type:script 23 | message:request Defguard Gateway status 24 | -------------------------------------------------------------------------------- /opnsense/src/opnsense/service/templates/OPNsense/DefguardGateway/+TARGETS: -------------------------------------------------------------------------------- 1 | config.toml:/etc/defguard/gateway.toml 2 | rc.conf.d:/etc/rc.conf.d/defguard_gateway 3 | -------------------------------------------------------------------------------- /opnsense/src/opnsense/service/templates/OPNsense/DefguardGateway/config.toml: -------------------------------------------------------------------------------- 1 | # NOTE: must replace default with actual value 2 | token = "{{ OPNsense.defguardgateway.general.Token|default("") }}" 3 | # Required: defguard server gRPC endpoint URL 4 | # NOTE: must replace default with actual value 5 | grpc_url = "{{ OPNsense.defguardgateway.general.GrpcUrl|default("") }}" 6 | # Optional: gateway name which will be displayed in defguard web UI 7 | name = "{{ OPNsense.defguardgateway.general.Name|default("Gateway A") }}" 8 | # Required: use userspace WireGuard implementation (e.g. wireguard-go) 9 | {% if OPNsense.defguardgateway.general.Userspace == "1" %} 10 | userspace = true 11 | {% else %} 12 | userspace = false 13 | {% endif %} 14 | # Optional: path to TLS cert file 15 | {% if not helpers.empty('OPNsense.defguardgateway.general.GrpcCertPath') %} 16 | grpc_ca = "{{ OPNsense.defguardgateway.general.GrpcCertPath }}" 17 | {% endif %} 18 | # Required: how often should interface stat updates be sent to defguard server (in seconds) 19 | stats_period = {{ OPNsense.defguardgateway.general.StatsPeriod|default(60) }} 20 | # Required: name of WireGuard interface 21 | ifname = "{{ OPNsense.defguardgateway.general.IfName|default("wg0") }}" 22 | # Optional: write PID to this file 23 | {% if not helpers.empty('OPNsense.defguardgateway.general.PidFile') %} 24 | pidfile = "{{ OPNsense.defguardgateway.general.PidFile }}" 25 | {% endif %} 26 | # Required: enable logging to syslog 27 | {% if OPNsense.defguardgateway.general.UseSyslog == "1" %} 28 | use_syslog = true 29 | {% else %} 30 | use_syslog = false 31 | {% endif %} 32 | # Required: which syslog facility to use 33 | syslog_facility = "{{ OPNsense.defguardgateway.general.SyslogFacility|default("LOG_USER") }}" 34 | # Required: which socket to use for logging 35 | syslog_socket = "{{ OPNsense.defguardgateway.general.SyslogSocket|default("/var/run/log") }}" 36 | 37 | {% if not helpers.empty('OPNsense.defguardgateway.general.PreUp') %} 38 | pre_up = "{{ OPNsense.defguardgateway.general.PreUp }}" 39 | {% endif %} 40 | 41 | {% if not helpers.empty('OPNsense.defguardgateway.general.PreDown') %} 42 | pre_down = "{{ OPNsense.defguardgateway.general.PreDown }}" 43 | {% endif %} 44 | 45 | {% if not helpers.empty('OPNsense.defguardgateway.general.PostUp') %} 46 | post_up = "{{ OPNsense.defguardgateway.general.PostUp }}" 47 | {% endif %} 48 | 49 | {% if not helpers.empty('OPNsense.defguardgateway.general.PostDown') %} 50 | post_down = "{{ OPNsense.defguardgateway.general.PostDown }}" 51 | {% endif %} 52 | -------------------------------------------------------------------------------- /opnsense/src/opnsense/service/templates/OPNsense/DefguardGateway/rc.conf.d: -------------------------------------------------------------------------------- 1 | {% if helpers.exists("OPNsense.defguardgateway.general.Enabled") and OPNsense.defguardgateway.general.Enabled == '1' %} 2 | defguard_gateway_enable="YES" 3 | {% else %} 4 | defguard_gateway_enable="NO" 5 | {% endif %} 6 | -------------------------------------------------------------------------------- /src/config.rs: -------------------------------------------------------------------------------- 1 | use std::{fs, path::PathBuf}; 2 | 3 | use clap::Parser; 4 | use serde::Deserialize; 5 | use toml; 6 | 7 | use crate::error::GatewayError; 8 | 9 | #[derive(Debug, Parser, Clone, Deserialize)] 10 | #[clap(about = "Defguard VPN gateway service")] 11 | #[command(version)] 12 | pub struct Config { 13 | /// Token received from Defguard after completing the network wizard 14 | #[arg( 15 | long, 16 | short = 't', 17 | required_unless_present = "config_path", 18 | env = "DEFGUARD_TOKEN", 19 | default_value = "" 20 | )] 21 | pub token: String, 22 | 23 | #[arg(long, env = "DEFGUARD_GATEWAY_NAME")] 24 | pub name: Option, 25 | 26 | /// defguard server gRPC endpoint URL 27 | #[arg( 28 | long, 29 | short = 'g', 30 | required_unless_present = "config_path", 31 | env = "DEFGUARD_GRPC_URL", 32 | default_value = "" 33 | )] 34 | pub grpc_url: String, 35 | 36 | /// Use userspace WireGuard implementation e.g. wireguard-go 37 | #[arg(long, short = 'u', env = "DEFGUARD_USERSPACE")] 38 | pub userspace: bool, 39 | 40 | /// Path to CA file 41 | #[arg(long, env = "DEFGUARD_GRPC_CA")] 42 | pub grpc_ca: Option, 43 | 44 | /// Defines how often (in seconds) interface statistics are sent to Defguard server 45 | #[arg(long, short = 'p', env = "DEFGUARD_STATS_PERIOD", default_value = "30")] 46 | pub stats_period: u64, 47 | 48 | /// Network interface name (e.g. wg0) 49 | #[arg(long, short = 'i', env = "DEFGUARD_IFNAME", default_value = "wg0")] 50 | pub ifname: String, 51 | 52 | /// Write process ID (PID) to this file 53 | #[arg(long)] 54 | pub pidfile: Option, 55 | 56 | /// Log to syslog 57 | #[arg(long, short = 's')] 58 | pub use_syslog: bool, 59 | 60 | /// Syslog facility 61 | #[arg(long, default_value = "LOG_USER")] 62 | pub syslog_facility: String, 63 | 64 | /// Syslog socket path 65 | #[arg(long, default_value = "/var/run/log")] 66 | pub syslog_socket: PathBuf, 67 | 68 | /// Configuration file path 69 | #[arg(long = "config", short)] 70 | #[serde(skip)] 71 | config_path: Option, 72 | 73 | /// Command to run before bringing up the interface. 74 | #[arg(long, env = "PRE_UP")] 75 | pub pre_up: Option, 76 | 77 | /// Command to run after bringing up the interface. 78 | #[arg(long, env = "POST_UP")] 79 | pub post_up: Option, 80 | 81 | /// Command to run before bringing down the interface. 82 | #[arg(long, env = "PRE_DOWN")] 83 | pub pre_down: Option, 84 | 85 | /// Command to run after bringing down the interface. 86 | #[arg(long, env = "POST_DOWN")] 87 | pub post_down: Option, 88 | /// A HTTP port that will expose the REST HTTP gateway health status 89 | /// 200 Gateway is working and is connected to CORE 90 | /// 503 - gateway works but is not connected to CORE 91 | #[arg(long, env = "HEALTH_PORT")] 92 | pub health_port: Option, 93 | 94 | /// Whether the firewall should automatically apply masquerading 95 | #[arg(long, env = "DEFGUARD_MASQUERADE")] 96 | #[serde(default)] 97 | pub masquerade: bool, 98 | 99 | #[arg(long, env = "DEFGUARD_FW_PRIORITY")] 100 | #[serde(default)] 101 | pub fw_priority: Option, 102 | 103 | /// Whether all firewall management should be disabled 104 | /// Meant to be used as a workaround for incompatible hardware 105 | #[arg(long, env = "DEFGUARD_DISABLE_FW_MGMT")] 106 | #[serde(default)] 107 | pub disable_firewall_management: bool, 108 | } 109 | 110 | impl Default for Config { 111 | fn default() -> Self { 112 | Self { 113 | token: "TOKEN".into(), 114 | name: None, 115 | grpc_url: "http://localhost:50051".into(), 116 | userspace: false, 117 | grpc_ca: None, 118 | stats_period: 15, 119 | ifname: "wg0".into(), 120 | pidfile: None, 121 | use_syslog: false, 122 | syslog_facility: String::new(), 123 | syslog_socket: PathBuf::new(), 124 | config_path: None, 125 | pre_up: None, 126 | post_up: None, 127 | pre_down: None, 128 | post_down: None, 129 | health_port: None, 130 | masquerade: false, 131 | fw_priority: None, 132 | disable_firewall_management: false, 133 | } 134 | } 135 | } 136 | 137 | pub fn get_config() -> Result { 138 | // parse CLI arguments to get config file path 139 | let cli_config = Config::parse(); 140 | 141 | // load config from file if one was specified 142 | if let Some(config_path) = cli_config.config_path { 143 | let config_toml = fs::read_to_string(config_path) 144 | .map_err(|err| GatewayError::InvalidConfigFile(err.to_string()))?; 145 | let file_config: Config = toml::from_str(&config_toml) 146 | .map_err(|err| GatewayError::InvalidConfigFile(err.message().to_string()))?; 147 | return Ok(file_config); 148 | } 149 | 150 | Ok(cli_config) 151 | } 152 | 153 | #[test] 154 | fn verify_cli() { 155 | use clap::CommandFactory; 156 | Config::command().debug_assert(); 157 | } 158 | -------------------------------------------------------------------------------- /src/enterprise/LICENSE.md: -------------------------------------------------------------------------------- 1 | Copyright ©️ defguard sp. z o. o. 2 | 3 | defguard enterprise license / defguard.net 4 | 5 | Use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 6 | 7 | 1. Use is permitted for the purposes of the Licensee that paid for the relevant license only (no redistributions or products based on that). 8 | 9 | 2. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote the Licensee when using the product without specific prior written permission. 10 | 11 | 3. The Licensee may use the software in accordance with the terms and conditions of this license after paying the license fee to the Licensor, in accordance with the currently available price list on the defguard.net website, for the time period defined in the license. The Licensee is not permitted to resell, sublicense, or create derivative products based on the software. The Licensor may secure the ability to use the software with a license key or other technical protection. 12 | 13 | 5. You may not move, change, disable, or circumvent the license key functionality in the software, and you may not remove or obscure any functionality in the software that is protected by the license key. 14 | 15 | 6. The licensor can provide support for the use of the software. The current terms in this respect are on the website defguard.net 16 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 17 | -------------------------------------------------------------------------------- /src/enterprise/firewall/api.rs: -------------------------------------------------------------------------------- 1 | #[cfg(any(target_os = "freebsd", target_os = "macos", target_os = "netbsd"))] 2 | use std::fs::{File, OpenOptions}; 3 | 4 | #[cfg(target_os = "linux")] 5 | use nftnl::Batch; 6 | 7 | use super::{FirewallError, FirewallRule, Policy}; 8 | 9 | #[cfg(any(target_os = "freebsd", target_os = "macos", target_os = "netbsd"))] 10 | const DEV_PF: &str = "/dev/pf"; 11 | 12 | #[allow(dead_code)] 13 | pub struct FirewallApi { 14 | pub(crate) ifname: String, 15 | #[cfg(any(target_os = "freebsd", target_os = "macos", target_os = "netbsd"))] 16 | pub(crate) file: File, 17 | #[cfg(any(target_os = "freebsd", target_os = "macos", target_os = "netbsd"))] 18 | pub(crate) default_policy: Policy, 19 | #[cfg(target_os = "linux")] 20 | pub(crate) batch: Option, 21 | } 22 | 23 | impl FirewallApi { 24 | pub fn new>(ifname: S) -> Result { 25 | Ok(Self { 26 | ifname: ifname.into(), 27 | #[cfg(any(target_os = "freebsd", target_os = "macos", target_os = "netbsd"))] 28 | file: OpenOptions::new().read(true).write(true).open(DEV_PF)?, 29 | #[cfg(any(target_os = "freebsd", target_os = "macos", target_os = "netbsd"))] 30 | default_policy: Policy::Deny, 31 | #[cfg(target_os = "linux")] 32 | batch: None, 33 | }) 34 | } 35 | } 36 | 37 | pub(crate) trait FirewallManagementApi { 38 | /// Set up the firewall with `default_policy`, `priority`, and cleans up any existing rules. 39 | fn setup(&mut self, default_policy: Policy, priority: Option) 40 | -> Result<(), FirewallError>; 41 | 42 | /// Clean up the firewall rules. 43 | fn cleanup(&mut self) -> Result<(), FirewallError>; 44 | 45 | /// Add fireall `rules`. 46 | fn add_rules(&mut self, rules: Vec) -> Result<(), FirewallError>; 47 | 48 | /// Set masquerade status. 49 | fn set_masquerade_status(&mut self, enabled: bool) -> Result<(), FirewallError>; 50 | 51 | /// Begin rule transaction. 52 | fn begin(&mut self) -> Result<(), FirewallError>; 53 | 54 | /// Commit rule transaction. 55 | fn commit(&mut self) -> Result<(), FirewallError>; 56 | } 57 | -------------------------------------------------------------------------------- /src/enterprise/firewall/dummy/mod.rs: -------------------------------------------------------------------------------- 1 | use super::{ 2 | api::{FirewallApi, FirewallManagementApi}, 3 | FirewallError, FirewallRule, Policy, 4 | }; 5 | 6 | impl FirewallManagementApi for FirewallApi { 7 | fn setup( 8 | &mut self, 9 | _default_policy: Policy, 10 | _priority: Option, 11 | ) -> Result<(), FirewallError> { 12 | Ok(()) 13 | } 14 | 15 | fn cleanup(&mut self) -> Result<(), FirewallError> { 16 | Ok(()) 17 | } 18 | 19 | fn set_masquerade_status(&mut self, _enabled: bool) -> Result<(), FirewallError> { 20 | Ok(()) 21 | } 22 | 23 | fn add_rules(&mut self, _rules: Vec) -> Result<(), FirewallError> { 24 | Ok(()) 25 | } 26 | 27 | fn begin(&mut self) -> Result<(), FirewallError> { 28 | Ok(()) 29 | } 30 | 31 | fn commit(&mut self) -> Result<(), FirewallError> { 32 | Ok(()) 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /src/enterprise/firewall/iprange.rs: -------------------------------------------------------------------------------- 1 | //! Range of IP addresses. 2 | //! 3 | //! Encapsulates a range of IP addresses, which can be iterated. 4 | //! For the time being, `RangeInclusive` can't be used, because `IpAddr` does not implement 5 | //! `Step` trait. 6 | 7 | use std::{ 8 | fmt, 9 | net::{IpAddr, Ipv4Addr, Ipv6Addr}, 10 | ops::RangeInclusive, 11 | }; 12 | 13 | #[derive(Clone, Debug, PartialEq)] 14 | pub enum IpAddrRange { 15 | V4(RangeInclusive), 16 | V6(RangeInclusive), 17 | } 18 | 19 | #[derive(Debug, thiserror::Error)] 20 | pub enum IpAddrRangeError { 21 | MixedTypes, 22 | WrongOrder, 23 | } 24 | 25 | impl fmt::Display for IpAddrRangeError { 26 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { 27 | match self { 28 | Self::MixedTypes => write!(f, "mixed IPv4 and IPv6 addresses"), 29 | Self::WrongOrder => write!(f, "wrong order: higher address preceeds lower"), 30 | } 31 | } 32 | } 33 | 34 | #[allow(dead_code)] 35 | impl IpAddrRange { 36 | pub fn new(start: IpAddr, end: IpAddr) -> Result { 37 | if start > end { 38 | Err(IpAddrRangeError::WrongOrder) 39 | } else { 40 | match (start, end) { 41 | (IpAddr::V4(start), IpAddr::V4(end)) => Ok(Self::V4(start..=end)), 42 | (IpAddr::V6(start), IpAddr::V6(end)) => Ok(Self::V6(start..=end)), 43 | _ => Err(IpAddrRangeError::MixedTypes), 44 | } 45 | } 46 | } 47 | 48 | /// Returns `true` if `ipaddr` is contained in the range. 49 | pub fn contains(&self, ipaddr: &IpAddr) -> bool { 50 | match self { 51 | Self::V4(range) => range.contains(ipaddr), 52 | Self::V6(range) => range.contains(ipaddr), 53 | } 54 | } 55 | 56 | /// Returns `true` if the range contains no items. 57 | pub fn is_empty(&self) -> bool { 58 | match self { 59 | Self::V4(range) => range.is_empty(), 60 | Self::V6(range) => range.is_empty(), 61 | } 62 | } 63 | 64 | /// Returns `true` if range contains IPv4 address, and `false` otherwise. 65 | pub fn is_ipv4(&self) -> bool { 66 | match self { 67 | Self::V4(_) => true, 68 | Self::V6(_) => false, 69 | } 70 | } 71 | 72 | /// Returns `true` if range contains IPv6 address, and `false` otherwise. 73 | pub fn is_ipv6(&self) -> bool { 74 | match self { 75 | Self::V4(_) => false, 76 | Self::V6(_) => true, 77 | } 78 | } 79 | } 80 | 81 | impl Iterator for IpAddrRange { 82 | type Item = IpAddr; 83 | 84 | fn next(&mut self) -> Option { 85 | match self { 86 | Self::V4(range) => range.next().map(IpAddr::V4), 87 | Self::V6(range) => range.next().map(IpAddr::V6), 88 | } 89 | } 90 | } 91 | 92 | #[cfg(test)] 93 | mod tests { 94 | use super::*; 95 | 96 | #[test] 97 | fn test_range() { 98 | let start = IpAddr::V4(Ipv4Addr::LOCALHOST); 99 | let end = IpAddr::V4(Ipv4Addr::new(127, 0, 0, 3)); 100 | let range = start..=end; 101 | 102 | let addr = IpAddr::V4(Ipv4Addr::new(127, 0, 0, 2)); 103 | assert!(range.contains(&addr)); 104 | 105 | let addr = IpAddr::V4(Ipv4Addr::new(127, 0, 0, 5)); 106 | assert!(!range.contains(&addr)); 107 | 108 | // As of Rust 1.87.0, `IpAddr` does not implement `Step`. 109 | // assert_eq!(IpAddr::V4(Ipv4Addr::new(127, 0, 0, 5)), range.next()); 110 | } 111 | 112 | #[test] 113 | fn test_ipaddrrange() { 114 | let start = IpAddr::V4(Ipv4Addr::LOCALHOST); 115 | let end = IpAddr::V4(Ipv4Addr::new(127, 0, 0, 3)); 116 | let mut range = IpAddrRange::new(start, end).unwrap(); 117 | 118 | let addr = IpAddr::V4(Ipv4Addr::new(127, 0, 0, 2)); 119 | assert!(range.contains(&addr)); 120 | 121 | let addr = IpAddr::V4(Ipv4Addr::new(127, 0, 0, 5)); 122 | assert!(!range.contains(&addr)); 123 | 124 | assert_eq!(Some(IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1))), range.next()); 125 | assert_eq!(Some(IpAddr::V4(Ipv4Addr::new(127, 0, 0, 2))), range.next()); 126 | assert_eq!(Some(IpAddr::V4(Ipv4Addr::new(127, 0, 0, 3))), range.next()); 127 | assert_eq!(None, range.next()); 128 | } 129 | } 130 | -------------------------------------------------------------------------------- /src/enterprise/firewall/mod.rs: -------------------------------------------------------------------------------- 1 | pub mod api; 2 | #[cfg(test)] 3 | mod dummy; 4 | mod iprange; 5 | #[cfg(all(not(test), target_os = "linux"))] 6 | mod nftables; 7 | #[cfg(any(target_os = "freebsd", target_os = "macos", target_os = "netbsd"))] 8 | mod packetfilter; 9 | 10 | use std::{ 11 | fmt, 12 | net::{IpAddr, Ipv4Addr, Ipv6Addr}, 13 | str::FromStr, 14 | }; 15 | 16 | use ipnetwork::{IpNetwork, Ipv4Network, Ipv6Network}; 17 | use iprange::{IpAddrRange, IpAddrRangeError}; 18 | use thiserror::Error; 19 | 20 | use crate::proto; 21 | 22 | #[derive(Clone, Debug, PartialEq)] 23 | pub(crate) enum Address { 24 | Network(IpNetwork), 25 | Range(IpAddrRange), 26 | } 27 | 28 | impl Address { 29 | pub fn from_proto(ip: &proto::enterprise::firewall::IpAddress) -> Result { 30 | match &ip.address { 31 | Some(proto::enterprise::firewall::ip_address::Address::Ip(ip)) => { 32 | Ok(Self::Network(IpNetwork::from_str(ip).map_err(|err| { 33 | FirewallError::TypeConversionError(format!("Invalid IP format: {err}")) 34 | })?)) 35 | } 36 | Some(proto::enterprise::firewall::ip_address::Address::IpSubnet(network)) => Ok( 37 | Self::Network(IpNetwork::from_str(network).map_err(|err| { 38 | FirewallError::TypeConversionError(format!("Invalid subnet format: {err}")) 39 | })?), 40 | ), 41 | Some(proto::enterprise::firewall::ip_address::Address::IpRange(range)) => { 42 | let start = IpAddr::from_str(&range.start).map_err(|err| { 43 | FirewallError::TypeConversionError(format!("Invalid IP format: {err}")) 44 | })?; 45 | let end = IpAddr::from_str(&range.end).map_err(|err| { 46 | FirewallError::TypeConversionError(format!("Invalid IP format: {err}")) 47 | })?; 48 | if start > end { 49 | return Err(FirewallError::TypeConversionError(format!( 50 | "Invalid IP range: start IP ({start}) is greater than end IP ({end})", 51 | ))); 52 | } 53 | Ok(Self::Range(IpAddrRange::new(start, end)?)) 54 | } 55 | None => Err(FirewallError::TypeConversionError(format!( 56 | "Invalid IP address type. Must be one of Ip, IpSubnet, IpRange. Instead got {:?}", 57 | ip.address 58 | ))), 59 | } 60 | } 61 | } 62 | 63 | #[allow(dead_code)] 64 | #[derive(Debug, Copy, Clone, PartialEq)] 65 | pub(crate) enum Port { 66 | Any, 67 | Single(u16), 68 | Range(u16, u16), 69 | } 70 | 71 | impl Port { 72 | pub fn from_proto(port: &proto::enterprise::firewall::Port) -> Result { 73 | match &port.port { 74 | Some(proto::enterprise::firewall::port::Port::SinglePort(port)) => { 75 | let port_u16 = u16::try_from(*port).map_err(|err| { 76 | FirewallError::TypeConversionError(format!( 77 | "Invalid port number ({port}): {err}" 78 | )) 79 | })?; 80 | Ok(Self::Single(port_u16)) 81 | } 82 | Some(proto::enterprise::firewall::port::Port::PortRange(range)) => { 83 | let start_u16 = u16::try_from(range.start).map_err(|err| { 84 | FirewallError::TypeConversionError(format!( 85 | "Invalid range start port number ({}): {err}", 86 | range.start 87 | )) 88 | })?; 89 | let end_u16 = u16::try_from(range.end).map_err(|err| { 90 | FirewallError::TypeConversionError(format!( 91 | "Invalid range end port number ({}): {err}", 92 | range.end 93 | )) 94 | })?; 95 | if start_u16 > end_u16 { 96 | return Err(FirewallError::TypeConversionError(format!( 97 | "Invalid port range: start port ({start_u16}) is greater than end port ({end_u16})" 98 | ))); 99 | } 100 | Ok(Self::Range(start_u16, end_u16)) 101 | } 102 | _ => Err(FirewallError::TypeConversionError(format!( 103 | "Invalid port type. Must be one of SinglePort, PortRange. Instead got: {:?}", 104 | port.port 105 | ))), 106 | } 107 | } 108 | } 109 | 110 | impl fmt::Display for Port { 111 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { 112 | match self { 113 | Port::Any => Ok(()), // nothing here 114 | Port::Single(port) => write!(f, "port = {port}"), 115 | Port::Range(from, to) => write!(f, "port = {{{from}..{to}}}"), 116 | } 117 | } 118 | } 119 | 120 | /// As defined in `netinet/in.h`. 121 | #[allow(dead_code)] 122 | #[derive(Debug, Copy, Clone, PartialEq)] 123 | #[repr(u8)] 124 | pub(crate) enum Protocol { 125 | Any = libc::IPPROTO_IP as u8, 126 | Icmp = libc::IPPROTO_ICMP as u8, 127 | Tcp = libc::IPPROTO_TCP as u8, 128 | Udp = libc::IPPROTO_UDP as u8, 129 | IcmpV6 = libc::IPPROTO_ICMPV6 as u8, 130 | } 131 | 132 | #[allow(dead_code)] 133 | impl Protocol { 134 | #[must_use] 135 | pub(crate) fn supports_ports(self) -> bool { 136 | matches!(self, Protocol::Tcp | Protocol::Udp) 137 | } 138 | 139 | pub(crate) const fn from_proto( 140 | proto: proto::enterprise::firewall::Protocol, 141 | ) -> Result { 142 | match proto { 143 | proto::enterprise::firewall::Protocol::Tcp => Ok(Self::Tcp), 144 | proto::enterprise::firewall::Protocol::Udp => Ok(Self::Udp), 145 | proto::enterprise::firewall::Protocol::Icmp => Ok(Self::Icmp), 146 | // TODO: IcmpV6 147 | proto::enterprise::firewall::Protocol::Invalid => { 148 | Err(FirewallError::UnsupportedProtocol(proto as u8)) 149 | } 150 | } 151 | } 152 | } 153 | 154 | impl fmt::Display for Protocol { 155 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { 156 | let protocol = match self { 157 | Self::Any => "any", 158 | Self::Icmp => "icmp", 159 | Self::Tcp => "tcp", 160 | Self::Udp => "udp", 161 | Self::IcmpV6 => "icmp6", 162 | }; 163 | write!(f, "{protocol}") 164 | } 165 | } 166 | 167 | #[derive(Debug, Default, Clone, Copy, PartialEq)] 168 | pub(crate) enum Policy { 169 | #[default] 170 | Allow, 171 | Deny, 172 | } 173 | 174 | impl From for Policy { 175 | fn from(allow: bool) -> Self { 176 | if allow { 177 | Self::Allow 178 | } else { 179 | Self::Deny 180 | } 181 | } 182 | } 183 | 184 | impl Policy { 185 | #[must_use] 186 | pub const fn from_proto(verdict: proto::enterprise::firewall::FirewallPolicy) -> Self { 187 | match verdict { 188 | proto::enterprise::firewall::FirewallPolicy::Allow => Self::Allow, 189 | proto::enterprise::firewall::FirewallPolicy::Deny => Self::Deny, 190 | } 191 | } 192 | } 193 | 194 | #[derive(Debug, Clone, PartialEq)] 195 | pub(crate) struct FirewallRule { 196 | pub comment: Option, 197 | pub destination_addrs: Vec
, 198 | pub destination_ports: Vec, 199 | pub id: i64, 200 | pub verdict: Policy, 201 | pub protocols: Vec, 202 | pub source_addrs: Vec
, 203 | /// Whether a rule uses IPv4 (true) or IPv6 (false) 204 | pub ipv4: bool, // FIXME: is that really needed? 205 | } 206 | 207 | #[derive(Debug, Clone, PartialEq)] 208 | pub(crate) struct FirewallConfig { 209 | pub rules: Vec, 210 | pub default_policy: Policy, 211 | } 212 | 213 | impl FirewallConfig { 214 | pub fn from_proto( 215 | config: proto::enterprise::firewall::FirewallConfig, 216 | ) -> Result { 217 | debug!("Parsing following received firewall proto configuration: {config:?}"); 218 | let mut rules = Vec::new(); 219 | let default_policy = 220 | Policy::from_proto(config.default_policy.try_into().map_err(|err| { 221 | FirewallError::TypeConversionError(format!("Invalid default policy: {err:?}")) 222 | })?); 223 | debug!( 224 | "Default firewall policy defined: {default_policy:?}. Proceeding to parsing rules..." 225 | ); 226 | 227 | for rule in config.rules { 228 | debug!("Parsing the following received Defguard ACL proto rule: {rule:?}"); 229 | let mut source_addrs = Vec::new(); 230 | let mut destination_addrs = Vec::new(); 231 | let mut destination_ports = Vec::new(); 232 | let mut protocols = Vec::new(); 233 | 234 | for addr in rule.source_addrs { 235 | source_addrs.push(Address::from_proto(&addr)?); 236 | } 237 | 238 | for addr in rule.destination_addrs { 239 | destination_addrs.push(Address::from_proto(&addr)?); 240 | } 241 | 242 | for port in rule.destination_ports { 243 | destination_ports.push(Port::from_proto(&port)?); 244 | } 245 | 246 | for protocol in rule.protocols { 247 | protocols.push(Protocol::from_proto( 248 | // Since the protocol is an i32, convert it to the proto enum variant first 249 | proto::enterprise::firewall::Protocol::try_from(protocol).map_err(|err| { 250 | FirewallError::TypeConversionError(format!( 251 | "Invalid protocol: {protocol:?}. Details: {err:?}", 252 | )) 253 | })?, 254 | )?); 255 | } 256 | 257 | let verdict = Policy::from_proto(rule.verdict.try_into().map_err(|err| { 258 | FirewallError::TypeConversionError(format!("Invalid rule verdict: {err:?}")) 259 | })?); 260 | 261 | let ipv4 = rule.ip_version == proto::enterprise::firewall::IpVersion::Ipv4 as i32; 262 | // Add implicit unspecified address to pin it to a specific IP version. 263 | if source_addrs.is_empty() { 264 | source_addrs.push(if ipv4 { 265 | Address::Network(IpNetwork::V4( 266 | Ipv4Network::new(Ipv4Addr::UNSPECIFIED, 0).unwrap(), 267 | )) 268 | } else { 269 | Address::Network(IpNetwork::V6( 270 | Ipv6Network::new(Ipv6Addr::UNSPECIFIED, 0).unwrap(), 271 | )) 272 | }); 273 | } 274 | let firewall_rule = FirewallRule { 275 | id: rule.id, 276 | source_addrs, 277 | destination_addrs, 278 | destination_ports, 279 | protocols, 280 | verdict, 281 | ipv4, 282 | comment: rule.comment, 283 | }; 284 | 285 | debug!("Parsed received proto rule as: {firewall_rule:?}"); 286 | 287 | rules.push(firewall_rule); 288 | } 289 | 290 | Ok(Self { 291 | rules, 292 | default_policy, 293 | }) 294 | } 295 | } 296 | 297 | #[derive(Debug, Error)] 298 | pub enum FirewallError { 299 | #[error("IP address range: {0}")] 300 | IpAddrRange(#[from] IpAddrRangeError), 301 | #[error("Io error: {0}")] 302 | Io(#[from] std::io::Error), 303 | #[cfg(any(target_os = "freebsd", target_os = "macos", target_os = "netbsd"))] 304 | #[error("Errno:{0}")] 305 | Errno(#[from] nix::errno::Errno), 306 | #[error("Type conversion error: {0}")] 307 | TypeConversionError(String), 308 | #[error("Out of memory: {0}")] 309 | OutOfMemory(String), 310 | #[error("Unsupported protocol: {0}")] 311 | UnsupportedProtocol(u8), 312 | #[cfg(target_os = "linux")] 313 | #[error("Netlink error: {0}")] 314 | NetlinkError(String), 315 | #[error("Invalid configuration: {0}")] 316 | InvalidConfiguration(String), 317 | #[error( 318 | "Firewall transaction not started. Start the firewall transaction first in order to \ 319 | interact with the firewall API." 320 | )] 321 | TransactionNotStarted, 322 | #[error("Firewall transaction failed: {0}")] 323 | TransactionFailed(String), 324 | } 325 | -------------------------------------------------------------------------------- /src/enterprise/firewall/nftables/mod.rs: -------------------------------------------------------------------------------- 1 | pub mod netfilter; 2 | 3 | use std::sync::atomic::{AtomicU32, Ordering}; 4 | 5 | use netfilter::{ 6 | allow_established_traffic, apply_filter_rules, drop_table, ignore_unrelated_traffic, 7 | init_firewall, send_batch, set_masq, 8 | }; 9 | use nftnl::Batch; 10 | 11 | use super::{ 12 | api::{FirewallApi, FirewallManagementApi}, 13 | Address, FirewallError, FirewallRule, Policy, Port, Protocol, 14 | }; 15 | 16 | static SET_ID_COUNTER: AtomicU32 = AtomicU32::new(0); 17 | 18 | pub fn get_set_id() -> u32 { 19 | SET_ID_COUNTER.fetch_add(1, Ordering::Relaxed) 20 | } 21 | 22 | #[allow(dead_code)] 23 | #[derive(Debug, Default)] 24 | enum State { 25 | #[default] 26 | Established, 27 | Invalid, 28 | New, 29 | Related, 30 | } 31 | 32 | #[derive(Debug, Default)] 33 | struct FilterRule<'a> { 34 | src_ips: &'a [Address], 35 | dest_ips: &'a [Address], 36 | // src_ports: &'a [Port], 37 | dest_ports: &'a [Port], 38 | protocols: Vec, 39 | oifname: Option, 40 | iifname: Option, 41 | action: Policy, 42 | states: Vec, 43 | counter: bool, 44 | // The ID of the associated Defguard rule. 45 | // The filter rules may not always be a 1:1 representation of the Defguard rules, so 46 | // this value helps to keep track of them. 47 | defguard_rule_id: i64, 48 | v4: bool, 49 | comment: Option, 50 | negated_oifname: bool, 51 | negated_iifname: bool, 52 | } 53 | 54 | impl FirewallApi { 55 | fn add_rule(&mut self, rule: FirewallRule) -> Result<(), FirewallError> { 56 | debug!("Applying the following Defguard ACL rule: {rule:?}"); 57 | let mut rules = Vec::new(); 58 | let batch = if let Some(ref mut batch) = self.batch { 59 | batch 60 | } else { 61 | return Err(FirewallError::TransactionNotStarted); 62 | }; 63 | 64 | debug!( 65 | "The rule will be split into multiple nftables rules based on the specified \ 66 | destination ports and protocols." 67 | ); 68 | if rule.destination_ports.is_empty() { 69 | debug!( 70 | "No destination ports specified, applying single aggregate nftables rule for \ 71 | every protocol." 72 | ); 73 | let rule = FilterRule { 74 | src_ips: &rule.source_addrs, 75 | dest_ips: &rule.destination_addrs, 76 | protocols: rule.protocols, 77 | action: rule.verdict, 78 | counter: true, 79 | defguard_rule_id: rule.id, 80 | v4: rule.ipv4, 81 | comment: rule.comment.clone(), 82 | ..Default::default() 83 | }; 84 | rules.push(rule); 85 | } else if !rule.protocols.is_empty() { 86 | debug!( 87 | "Destination ports and protocols specified, applying individual nftables rules \ 88 | for each protocol." 89 | ); 90 | for protocol in rule.protocols { 91 | debug!("Applying rule for protocol: {protocol:?}"); 92 | if protocol.supports_ports() { 93 | debug!("Protocol supports ports, rule."); 94 | let rule = FilterRule { 95 | src_ips: &rule.source_addrs, 96 | dest_ips: &rule.destination_addrs, 97 | dest_ports: &rule.destination_ports, 98 | protocols: vec![protocol], 99 | action: rule.verdict, 100 | counter: true, 101 | defguard_rule_id: rule.id, 102 | v4: rule.ipv4, 103 | comment: rule.comment.clone(), 104 | ..Default::default() 105 | }; 106 | rules.push(rule); 107 | } else { 108 | debug!( 109 | "Protocol does not support ports, applying nftables rule and ignoring \ 110 | destination ports." 111 | ); 112 | let rule = FilterRule { 113 | src_ips: &rule.source_addrs, 114 | dest_ips: &rule.destination_addrs, 115 | protocols: vec![protocol], 116 | action: rule.verdict, 117 | counter: true, 118 | defguard_rule_id: rule.id, 119 | v4: rule.ipv4, 120 | comment: rule.comment.clone(), 121 | ..Default::default() 122 | }; 123 | rules.push(rule); 124 | } 125 | } 126 | } else { 127 | debug!( 128 | "Destination ports specified, but no protocols specified, applying nftables rules \ 129 | for each protocol that support ports." 130 | ); 131 | for protocol in [Protocol::Tcp, Protocol::Udp] { 132 | debug!("Applying nftables rule for protocol: {protocol:?}"); 133 | let rule = FilterRule { 134 | src_ips: &rule.source_addrs, 135 | dest_ips: &rule.destination_addrs, 136 | dest_ports: &rule.destination_ports, 137 | protocols: vec![protocol], 138 | action: rule.verdict, 139 | counter: true, 140 | defguard_rule_id: rule.id, 141 | v4: rule.ipv4, 142 | comment: rule.comment.clone(), 143 | ..Default::default() 144 | }; 145 | rules.push(rule); 146 | } 147 | } 148 | 149 | apply_filter_rules(rules, batch, &self.ifname)?; 150 | 151 | debug!( 152 | "Applied firewall rules for Defguard ACL rule ID: {}", 153 | rule.id 154 | ); 155 | Ok(()) 156 | } 157 | } 158 | 159 | impl FirewallManagementApi for FirewallApi { 160 | /// Sets up the firewall with the given default policy and priority. Drops the previous table. 161 | /// 162 | /// This function also begins a batch of operations which can be applied later using the [`apply`] method. 163 | /// This allows for making atomic changes to the firewall rules. 164 | fn setup( 165 | &mut self, 166 | default_policy: Policy, 167 | priority: Option, 168 | ) -> Result<(), FirewallError> { 169 | debug!("Initializing firewall, VPN interface: {}", self.ifname); 170 | if let Some(batch) = &mut self.batch { 171 | drop_table(batch, &self.ifname)?; 172 | init_firewall(default_policy, priority, batch, &self.ifname) 173 | .expect("Failed to setup chains"); 174 | debug!("Allowing all established traffic"); 175 | ignore_unrelated_traffic(batch, &self.ifname)?; 176 | allow_established_traffic(batch, &self.ifname)?; 177 | debug!("Allowed all established traffic"); 178 | debug!("Initialized firewall"); 179 | Ok(()) 180 | } else { 181 | Err(FirewallError::TransactionNotStarted) 182 | } 183 | } 184 | 185 | /// Cleans up the whole Defguard table. 186 | fn cleanup(&mut self) -> Result<(), FirewallError> { 187 | debug!("Cleaning up all previous firewall rules, if any"); 188 | if let Some(batch) = &mut self.batch { 189 | drop_table(batch, &self.ifname)?; 190 | } else { 191 | return Err(FirewallError::TransactionNotStarted); 192 | } 193 | debug!("Cleaned up all previous firewall rules"); 194 | Ok(()) 195 | } 196 | 197 | // Allows for changing the default policy of the firewall. 198 | // fn set_firewall_default_policy(&mut self, policy: Policy) -> Result<(), FirewallError> { 199 | // debug!("Setting default firewall policy to: {policy:?}"); 200 | // if let Some(batch) = &mut self.batch { 201 | // set_default_policy(policy, batch, &self.ifname)?; 202 | // } else { 203 | // return Err(FirewallError::TransactionNotStarted); 204 | // } 205 | // debug!("Set firewall default policy to {policy:?}"); 206 | // Ok(()) 207 | // } 208 | 209 | /// Allows for changing the masquerade status of the firewall. 210 | fn set_masquerade_status(&mut self, enabled: bool) -> Result<(), FirewallError> { 211 | debug!("Setting masquerade status to: {enabled:?}"); 212 | if let Some(batch) = &mut self.batch { 213 | set_masq(&self.ifname, enabled, batch)?; 214 | } else { 215 | return Err(FirewallError::TransactionNotStarted); 216 | } 217 | debug!("Set masquerade status to: {enabled:?}"); 218 | Ok(()) 219 | } 220 | 221 | fn add_rules(&mut self, rules: Vec) -> Result<(), FirewallError> { 222 | debug!("Applying the following Defguard ACL rules: {rules:?}"); 223 | for rule in rules { 224 | self.add_rule(rule)?; 225 | } 226 | debug!("Applied all Defguard ACL rules"); 227 | Ok(()) 228 | } 229 | 230 | fn begin(&mut self) -> Result<(), FirewallError> { 231 | if self.batch.is_none() { 232 | debug!("Starting new firewall transaction"); 233 | let batch = Batch::new(); 234 | self.batch = Some(batch); 235 | debug!("Firewall transaction successfully started"); 236 | Ok(()) 237 | } else { 238 | Err(FirewallError::TransactionFailed( 239 | "There is another firewall transaction already in progress. Commit or \ 240 | rollback it before starting a new one." 241 | .to_string(), 242 | )) 243 | } 244 | } 245 | 246 | /// Apply whole firewall configuration and send it in one go to the kernel. 247 | fn commit(&mut self) -> Result<(), FirewallError> { 248 | if let Some(batch) = self.batch.take() { 249 | debug!("Committing firewall transaction"); 250 | let finalized = batch.finalize(); 251 | debug!("Firewall batch finalized, sending to kernel"); 252 | send_batch(&finalized)?; 253 | debug!("Firewall transaction successfully committed to kernel"); 254 | Ok(()) 255 | } else { 256 | Err(FirewallError::TransactionNotStarted) 257 | } 258 | } 259 | } 260 | -------------------------------------------------------------------------------- /src/enterprise/firewall/packetfilter/api.rs: -------------------------------------------------------------------------------- 1 | use std::os::fd::AsRawFd; 2 | 3 | use super::{ 4 | calls::{pf_begin, pf_commit, pf_rollback, IocTrans, IocTransElement}, 5 | rule::RuleSet, 6 | FirewallRule, 7 | }; 8 | use crate::enterprise::firewall::{ 9 | api::{FirewallApi, FirewallManagementApi}, 10 | FirewallError, Policy, 11 | }; 12 | 13 | impl FirewallManagementApi for FirewallApi { 14 | fn setup( 15 | &mut self, 16 | default_policy: Policy, 17 | _priority: Option, 18 | ) -> Result<(), FirewallError> { 19 | self.default_policy = default_policy; 20 | Ok(()) 21 | } 22 | 23 | /// Clean up the firewall rules. 24 | fn cleanup(&mut self) -> Result<(), FirewallError> { 25 | Ok(()) 26 | } 27 | 28 | /// Add firewall `rules`. 29 | fn add_rules(&mut self, rules: Vec) -> Result<(), FirewallError> { 30 | let anchor = &self.anchor(); 31 | // Begin transaction. 32 | debug!("Begin pf transaction."); 33 | let mut elements = [IocTransElement::new(RuleSet::Filter, anchor)]; 34 | let mut ioc_trans = IocTrans::new(elements.as_mut_slice()); 35 | // This will create an anchor if it doesn't exist. 36 | unsafe { 37 | pf_begin(self.fd(), &mut ioc_trans)?; 38 | } 39 | 40 | let ticket = elements[0].ticket; 41 | let pool_ticket = self.get_pool_ticket(anchor)?; 42 | 43 | // Create first rule from the default policy. 44 | if let Err(err) = self.add_rule_policy(ticket, pool_ticket, anchor) { 45 | error!("Default policy rule can't be added."); 46 | debug!("Rollback pf transaction."); 47 | // Rule cannot be added, so rollback. 48 | unsafe { 49 | pf_rollback(self.fd(), &mut ioc_trans)?; 50 | return Err(FirewallError::TransactionFailed(err.to_string())); 51 | } 52 | } 53 | 54 | for mut rule in rules { 55 | if let Err(err) = self.add_rule(&mut rule, ticket, pool_ticket, anchor) { 56 | error!("Firewall rule {} can't be added.", &rule.id); 57 | debug!("Rollback pf transaction."); 58 | // Rule cannot be added, so rollback. 59 | unsafe { 60 | pf_rollback(self.fd(), &mut ioc_trans)?; 61 | return Err(FirewallError::TransactionFailed(err.to_string())); 62 | } 63 | } 64 | } 65 | 66 | // Commit transaction. 67 | debug!("Commit pf transaction."); 68 | unsafe { 69 | pf_commit(self.file.as_raw_fd(), &mut ioc_trans).unwrap(); 70 | } 71 | 72 | Ok(()) 73 | } 74 | 75 | /// Set masquerade status. 76 | fn set_masquerade_status(&mut self, _enabled: bool) -> Result<(), FirewallError> { 77 | Ok(()) 78 | } 79 | 80 | /// Begin rule transaction. 81 | fn begin(&mut self) -> Result<(), FirewallError> { 82 | // TODO: remove this no-op. 83 | Ok(()) 84 | } 85 | 86 | /// Commit rule transaction. 87 | fn commit(&mut self) -> Result<(), FirewallError> { 88 | // TODO: remove this no-op. 89 | Ok(()) 90 | } 91 | } 92 | -------------------------------------------------------------------------------- /src/enterprise/firewall/packetfilter/calls.rs: -------------------------------------------------------------------------------- 1 | //! Low level communication with Packet Filter. 2 | 3 | use std::{ 4 | ffi::{c_char, c_int, c_long, c_uchar, c_uint, c_ulong, c_ushort, c_void}, 5 | fmt, 6 | mem::{size_of, zeroed, MaybeUninit}, 7 | ptr, 8 | }; 9 | 10 | use ipnetwork::IpNetwork; 11 | use libc::{pid_t, uid_t, IFNAMSIZ}; 12 | use nix::{ioctl_none, ioctl_readwrite}; 13 | 14 | use super::rule::{Action, AddressFamily, Direction, PacketFilterRule, RuleSet, State}; 15 | use crate::enterprise::firewall::Port; 16 | 17 | /// Equivalent to `struct pf_addr`: fits 128-bit address, either IPv4 or IPv6. 18 | type Addr = [u8; 16]; // Do not use u128 for the sake of alignment. 19 | /// Equivalent to `pf_poolhashkey`: 128-bit hash key. 20 | type PoolHashKey = [u8; 16]; 21 | 22 | /// Equivalent to `struct pf_addr_wrap_addr_mask`. 23 | #[derive(Clone, Copy, Debug)] 24 | #[repr(C)] 25 | struct AddrMask { 26 | addr: Addr, 27 | mask: Addr, 28 | } 29 | 30 | impl From for AddrMask { 31 | fn from(ip_network: IpNetwork) -> Self { 32 | match ip_network { 33 | IpNetwork::V4(ipnet4) => { 34 | let mut addr_mask = Self { 35 | addr: [0; 16], 36 | mask: [0; 16], 37 | }; 38 | // Fill the first 4 bytes of `addr` and `mask`. 39 | addr_mask.addr[..4].copy_from_slice(&ipnet4.ip().octets()); 40 | addr_mask.mask[..4].copy_from_slice(&ipnet4.mask().octets()); 41 | 42 | addr_mask 43 | } 44 | 45 | IpNetwork::V6(ipnet6) => Self { 46 | addr: ipnet6.ip().octets(), 47 | mask: ipnet6.mask().octets(), 48 | }, 49 | } 50 | } 51 | } 52 | 53 | union VTarget { 54 | a: AddrMask, 55 | ifname: [u8; IFNAMSIZ], 56 | // tblname: [u8; 32], 57 | // rtlabelname: [u8; 32], 58 | // rtlabel: c_uint, 59 | } 60 | 61 | // const PFI_AFLAG_NETWORK: u8 = 1; 62 | // const PFI_AFLAG_BROADCAST: u8 = 2; 63 | // const PFI_AFLAG_PEER: u8 = 4; 64 | // const PFI_AFLAG_MODEMASK: u8 = 7; 65 | // const PFI_AFLAG_NOALIAS: u8 = 8; 66 | 67 | /// Equivalent to `struct pf_addr_wrap`. 68 | /// Only the `v` part of the union, as `p` is not used in this crate. 69 | #[repr(C)] 70 | struct AddrWrap { 71 | v: VTarget, 72 | // Unused in this crate. 73 | p: u64, 74 | // Determines type of field `v`. 75 | r#type: AddrType, 76 | // See PFI_AFLAG 77 | iflags: u8, 78 | } 79 | 80 | #[allow(dead_code)] 81 | #[derive(Debug)] 82 | #[repr(u8)] 83 | pub enum AddrType { 84 | // PF_ADDR_ADDRMASK = 0, 85 | AddrMask, 86 | // PF_ADDR_NOROUTE = 1, 87 | NoRoute, 88 | // PF_ADDR_DYNIFTL = 2, 89 | DynIftl, 90 | // PF_ADDR_TABLE = 3, 91 | Table, 92 | // Values below differ on macOS and FreeBSD. 93 | // PF_ADDR_RTLABEL = 4, 94 | // RtLabel, 95 | // // PF_ADDR_URPFFAILED = 5, 96 | // UrpfFailed, 97 | // // PF_ADDR_RANGE = 6, 98 | // Range, 99 | } 100 | 101 | impl AddrWrap { 102 | #[must_use] 103 | fn with_network(ip_network: IpNetwork) -> Self { 104 | Self { 105 | v: VTarget { 106 | a: ip_network.into(), 107 | }, 108 | p: 0, 109 | r#type: AddrType::AddrMask, 110 | iflags: 0, 111 | } 112 | } 113 | 114 | #[allow(dead_code)] 115 | #[must_use] 116 | fn with_interface(ifname: &str) -> Self { 117 | let mut uninit = MaybeUninit::::zeroed(); 118 | let self_ptr = uninit.as_mut_ptr(); 119 | let len = ifname.len().min(IFNAMSIZ - 1); 120 | unsafe { 121 | (*self_ptr).v.ifname[..len].copy_from_slice(&ifname.as_bytes()[..len]); 122 | // Probably, this is needed only for pfctl to omit displaying number of bits. 123 | // FIXME: Fill all bytes for IPv6. 124 | (*self_ptr).v.a.mask[..4].fill(255); 125 | (*self_ptr).r#type = AddrType::DynIftl; 126 | } 127 | 128 | unsafe { uninit.assume_init() } 129 | } 130 | } 131 | 132 | impl fmt::Debug for AddrWrap { 133 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { 134 | let mut debug = f.debug_struct("AddrWrap"); 135 | match self.r#type { 136 | AddrType::AddrMask => { 137 | debug.field("v.a", unsafe { &self.v.a }); 138 | } 139 | AddrType::DynIftl => { 140 | debug.field("v.ifname", unsafe { &self.v.ifname }); 141 | } 142 | _ => (), 143 | } 144 | debug.field("p", &self.p); 145 | debug.field("type", &self.r#type); 146 | debug.field("iflags", &self.iflags); 147 | debug.finish() 148 | } 149 | } 150 | 151 | /// Equivalent to `struct pf_rule_addr`. 152 | #[derive(Debug)] 153 | #[repr(C)] 154 | pub(super) struct RuleAddr { 155 | addr: AddrWrap, 156 | // macOS: here `union pf_rule_xport` is flattened to its first variant: `struct pf_port_range`. 157 | port: [c_ushort; 2], 158 | #[cfg(any(target_os = "freebsd", target_os = "macos"))] 159 | op: PortOp, 160 | #[cfg(target_os = "macos")] 161 | _padding: [c_uchar; 3], 162 | #[cfg(any(target_os = "macos", target_os = "netbsd"))] 163 | neg: c_uchar, 164 | #[cfg(target_os = "netbsd")] 165 | op: PortOp, 166 | } 167 | 168 | impl RuleAddr { 169 | #[must_use] 170 | pub(super) fn new(ip_network: IpNetwork, port: Port) -> Self { 171 | let addr = AddrWrap::with_network(ip_network); 172 | let from_port; 173 | let to_port; 174 | let op; 175 | match port { 176 | Port::Any => { 177 | from_port = 0; 178 | to_port = 0; 179 | op = PortOp::None; 180 | } 181 | Port::Single(port) => { 182 | from_port = port; 183 | to_port = 0; 184 | op = PortOp::None; 185 | } 186 | Port::Range(from, to) => { 187 | from_port = from; 188 | to_port = to; 189 | op = PortOp::Equal; 190 | } 191 | } 192 | Self { 193 | addr, 194 | port: [from_port, to_port], 195 | op, 196 | #[cfg(target_os = "macos")] 197 | _padding: [0; 3], 198 | #[cfg(any(target_os = "macos", target_os = "netbsd"))] 199 | neg: 0, 200 | } 201 | } 202 | } 203 | 204 | #[derive(Debug)] 205 | #[repr(C)] 206 | struct TailQueue { 207 | tqh_first: *mut T, 208 | tqh_last: *mut *mut T, 209 | } 210 | 211 | impl TailQueue { 212 | fn init(&mut self) { 213 | self.tqh_first = ptr::null_mut(); 214 | self.tqh_last = &mut self.tqh_first; 215 | } 216 | } 217 | 218 | #[derive(Debug)] 219 | #[repr(C)] 220 | struct TailQueueEntry { 221 | tqe_next: *mut T, 222 | tqe_prev: *mut *mut T, 223 | } 224 | 225 | /// Equivalent to `struct pf_pooladdr`. 226 | #[derive(Debug)] 227 | #[repr(C)] 228 | pub struct PoolAddr { 229 | addr: AddrWrap, 230 | entries: TailQueueEntry, 231 | ifname: [u8; IFNAMSIZ], 232 | kif: usize, // *mut c_void, 233 | } 234 | 235 | impl PoolAddr { 236 | #[allow(dead_code)] 237 | #[must_use] 238 | pub fn with_network(ip_network: IpNetwork) -> Self { 239 | Self { 240 | addr: AddrWrap::with_network(ip_network), 241 | entries: unsafe { zeroed::>() }, 242 | ifname: [0; IFNAMSIZ], 243 | kif: 0, 244 | } 245 | } 246 | 247 | #[allow(dead_code)] 248 | #[must_use] 249 | pub fn with_interface(ifname: &str) -> Self { 250 | Self { 251 | addr: AddrWrap::with_interface(ifname), 252 | entries: unsafe { zeroed::>() }, 253 | ifname: [0; IFNAMSIZ], 254 | kif: 0, 255 | } 256 | } 257 | } 258 | 259 | #[allow(dead_code)] 260 | #[derive(Debug)] 261 | #[repr(u8)] 262 | pub(super) enum PoolOpts { 263 | /// PF_POOL_NONE = 0 264 | None, 265 | /// PF_POOL_BITMASK = 1 266 | BitMask, 267 | /// PF_POOL_RANDOM = 2 268 | Random, 269 | /// PF_POOL_SRCHASH = 3 270 | SrcHash, 271 | /// PF_POOL_ROUNDROBIN = 4 272 | RoundRobin, 273 | } 274 | 275 | /// Equivalent to `struct pf_pool`. 276 | #[derive(Debug)] 277 | #[repr(C)] 278 | pub(super) struct Pool { 279 | list: TailQueue, 280 | cur: *mut PoolAddr, 281 | key: PoolHashKey, 282 | counter: Addr, 283 | tblidx: c_int, 284 | pub(super) proxy_port: [c_ushort; 2], 285 | #[cfg(any(target_os = "macos", target_os = "netbsd"))] 286 | port_op: PortOp, 287 | pub(super) opts: PoolOpts, 288 | #[cfg(target_os = "macos")] 289 | af: AddressFamily, 290 | } 291 | 292 | #[allow(dead_code)] 293 | #[derive(Debug)] 294 | #[repr(u8)] 295 | enum PortOp { 296 | /// PF_OP_NONE = 0 297 | None, 298 | /// PF_OP_IRG = 1 299 | InclRange, // ((p > a1) && (p < a2)) 300 | /// PF_OP_EQ = 2 301 | Equal, 302 | /// PF_OP_NE = 3, 303 | NotEqual, 304 | /// PF_OP_LT = 4 305 | Less, 306 | /// PF_OP_LE = 5 307 | LessOrEqual, 308 | /// PF_OP_GT = 6 309 | Greater, 310 | /// PF_OP_GE = 7 311 | GreaterOrEqual = 7, 312 | /// PF_OP_XRG = 8 313 | ExclRange, // ((p < a1) || (p > a2)) 314 | /// PF_OP_RRG = 9 315 | Range = 9, // ((p >= a1) && (p <= a2)) 316 | } 317 | 318 | #[allow(dead_code)] 319 | impl Pool { 320 | #[must_use] 321 | pub(super) fn new(from_port: u16, to_port: u16) -> Self { 322 | let mut uninit = MaybeUninit::::zeroed(); 323 | let self_ptr = uninit.as_mut_ptr(); 324 | unsafe { 325 | (*self_ptr).proxy_port[0] = from_port; 326 | (*self_ptr).proxy_port[1] = to_port; 327 | } 328 | 329 | unsafe { uninit.assume_init() } 330 | } 331 | 332 | /// Insert `PoolAddr` at the end of the list. Take ownership of the given `PoolAddr`. 333 | pub(super) fn insert_pool_addr(&mut self, mut pool_addr: PoolAddr) { 334 | // TODO: Traverse tail queue; for now assume empty tail queue. 335 | if !self.list.tqh_first.is_null() { 336 | panic!("Expected one entry in PoolAddr TailQueue."); 337 | } 338 | self.list.tqh_first = &mut pool_addr; 339 | self.list.tqh_last = &mut pool_addr.entries.tqe_next; 340 | pool_addr.entries.tqe_next = ptr::null_mut(); 341 | pool_addr.entries.tqe_prev = &mut self.list.tqh_first; 342 | } 343 | } 344 | 345 | impl Drop for Pool { 346 | // `Pool` owns the list of `PoolAddr`, so drop them here. 347 | fn drop(&mut self) { 348 | let mut next = self.list.tqh_first; 349 | while !next.is_null() { 350 | unsafe { 351 | next = (*next).entries.tqe_next; 352 | ptr::drop_in_place(self.list.tqh_first); 353 | } 354 | } 355 | } 356 | } 357 | 358 | #[repr(C)] 359 | struct pf_anchor_node { 360 | rbe_left: *mut pf_anchor, 361 | rbe_right: *mut pf_anchor, 362 | rbe_parent: *mut pf_anchor, 363 | } 364 | 365 | #[repr(C)] 366 | struct pf_ruleset_rule { 367 | ptr: *mut TailQueue, 368 | ptr_array: *mut *mut Rule, 369 | rcount: c_uint, 370 | rsize: c_uint, 371 | ticket: c_uint, 372 | open: c_int, 373 | } 374 | 375 | #[repr(C)] 376 | struct pf_ruleset_rules { 377 | queues: [TailQueue; 2], 378 | active: pf_ruleset_rule, 379 | inactive: pf_ruleset_rule, 380 | } 381 | 382 | #[repr(C)] 383 | struct pf_ruleset { 384 | rules: [pf_ruleset_rules; 6], 385 | anchor: *mut pf_anchor, 386 | tticket: c_uint, 387 | tables: c_int, 388 | topen: c_int, 389 | } 390 | 391 | #[repr(C)] 392 | struct pf_anchor { 393 | entry_global: pf_anchor_node, 394 | entry_node: pf_anchor_node, 395 | parent: *mut pf_anchor, 396 | children: pf_anchor_node, 397 | name: [c_char; 64], 398 | path: [c_char; MAXPATHLEN], 399 | ruleset: pf_ruleset, 400 | refcnt: c_int, 401 | match_: c_int, 402 | owner: [c_char; 64], 403 | } 404 | 405 | #[derive(Debug)] 406 | #[repr(C)] 407 | struct pf_rule_conn_rate { 408 | limit: c_uint, 409 | seconds: c_uint, 410 | } 411 | 412 | #[derive(Debug)] 413 | #[repr(C)] 414 | struct pf_rule_id { 415 | uid: [uid_t; 2], 416 | op: c_uchar, 417 | //_pad: [u_int8_t; 3], 418 | } 419 | 420 | /// As defined in `net/pfvar.h`. 421 | const PF_RULE_LABEL_SIZE: usize = 64; 422 | 423 | /// Equivalent to 'struct pf_rule'. 424 | #[derive(Debug)] 425 | #[repr(C)] 426 | pub(super) struct Rule { 427 | src: RuleAddr, 428 | dst: RuleAddr, 429 | 430 | skip: [usize; 8], 431 | label: [c_uchar; PF_RULE_LABEL_SIZE], 432 | ifname: [c_uchar; IFNAMSIZ], 433 | qname: [c_uchar; 64], 434 | pqname: [c_uchar; 64], 435 | tagname: [c_uchar; 64], 436 | match_tagname: [c_uchar; 64], 437 | overload_tblname: [c_uchar; 32], 438 | 439 | entries: TailQueueEntry, 440 | pub(super) rpool: Pool, 441 | 442 | evaluations: c_long, 443 | packets: [c_ulong; 2], 444 | bytes: [c_ulong; 2], 445 | 446 | #[cfg(target_os = "macos")] 447 | ticket: c_ulong, 448 | #[cfg(target_os = "macos")] 449 | owner: [c_char; 64], 450 | #[cfg(target_os = "macos")] 451 | priority: c_int, 452 | 453 | kif: *mut c_void, // struct pfi_kif, kernel only 454 | anchor: *mut pf_anchor, 455 | overload_tbl: *mut c_void, // struct pfr_ktable, kernel only 456 | 457 | os_fingerprint: c_uint, 458 | 459 | rtableid: c_int, 460 | #[cfg(any(target_os = "freebsd", target_os = "netbsd"))] 461 | timeout: [c_uint; 20], 462 | #[cfg(target_os = "macos")] 463 | timeout: [c_uint; 26], 464 | #[cfg(any(target_os = "macos", target_os = "netbsd"))] 465 | states: c_uint, 466 | max_states: c_uint, 467 | #[cfg(any(target_os = "macos", target_os = "netbsd"))] 468 | src_nodes: c_uint, 469 | max_src_nodes: c_uint, 470 | max_src_states: c_uint, 471 | max_src_conn: c_uint, 472 | max_src_conn_rate: pf_rule_conn_rate, 473 | qid: c_uint, 474 | pqid: c_uint, 475 | rt_listid: c_uint, 476 | nr: c_uint, 477 | prob: c_uint, 478 | cuid: uid_t, 479 | cpid: pid_t, 480 | 481 | #[cfg(target_os = "freebsd")] 482 | states_cur: u64, 483 | #[cfg(target_os = "freebsd")] 484 | states_tot: u64, 485 | #[cfg(target_os = "freebsd")] 486 | src_nodes: u64, 487 | 488 | return_icmp: c_ushort, 489 | return_icmp6: c_ushort, 490 | max_mss: c_ushort, 491 | tag: c_ushort, 492 | match_tag: c_ushort, 493 | #[cfg(target_os = "freebsd")] 494 | scrub_flags: c_ushort, 495 | 496 | uid: pf_rule_id, 497 | gid: pf_rule_id, 498 | 499 | rule_flag: c_uint, // RuleFlag 500 | pub(super) action: Action, 501 | direction: Direction, 502 | log: c_uchar, // LogFlags 503 | logif: c_uchar, 504 | quick: bool, 505 | ifnot: c_uchar, 506 | match_tag_not: c_uchar, 507 | natpass: c_uchar, 508 | 509 | keep_state: State, 510 | af: AddressFamily, 511 | proto: c_uchar, 512 | r#type: c_uchar, 513 | code: c_uchar, 514 | flags: c_uchar, // TCP_FLAG 515 | flagset: c_uchar, // TCP_FLAG 516 | min_ttl: c_uchar, 517 | allow_opts: c_uchar, 518 | rt: c_uchar, 519 | return_ttl: c_uchar, 520 | 521 | tos: c_uchar, 522 | #[cfg(target_os = "freebsd")] 523 | set_tos: c_uchar, 524 | anchor_relative: c_uchar, 525 | anchor_wildcard: c_uchar, 526 | flush: c_uchar, 527 | #[cfg(target_os = "freebsd")] 528 | prio: c_uchar, 529 | #[cfg(target_os = "freebsd")] 530 | set_prio: [c_uchar; 2], 531 | 532 | #[cfg(target_os = "freebsd")] 533 | divert: (Addr, u16), 534 | 535 | #[cfg(target_os = "freebsd")] 536 | u_states_cur: u64, 537 | #[cfg(target_os = "freebsd")] 538 | u_states_tot: u64, 539 | #[cfg(target_os = "freebsd")] 540 | u_src_nodes: u64, 541 | 542 | #[cfg(target_os = "macos")] 543 | proto_variant: c_uchar, 544 | #[cfg(target_os = "macos")] 545 | extfilter: c_uchar, 546 | #[cfg(target_os = "macos")] 547 | extmap: c_uchar, 548 | #[cfg(target_os = "macos")] 549 | dnpipe: c_uint, 550 | #[cfg(target_os = "macos")] 551 | dntype: c_uint, 552 | } 553 | 554 | impl Rule { 555 | pub(super) fn from_pf_rule(pf_rule: &PacketFilterRule) -> Self { 556 | let mut uninit = MaybeUninit::::zeroed(); 557 | let self_ptr = uninit.as_mut_ptr(); 558 | 559 | unsafe { 560 | if let Some(from) = pf_rule.from { 561 | (*self_ptr).src = RuleAddr::new(from, pf_rule.from_port); 562 | } 563 | if let Some(to) = pf_rule.to { 564 | (*self_ptr).dst = RuleAddr::new(to, pf_rule.to_port); 565 | } 566 | if let Some(interface) = &pf_rule.interface { 567 | let len = interface.len().min(IFNAMSIZ - 1); 568 | (*self_ptr).ifname[..len].copy_from_slice(&interface.as_bytes()[..len]); 569 | } 570 | if let Some(label) = &pf_rule.label { 571 | let len = label.len().min(PF_RULE_LABEL_SIZE - 1); 572 | (*self_ptr).label[..len].copy_from_slice(&label.as_bytes()[..len]); 573 | } 574 | 575 | // Don't use routing tables. 576 | #[cfg(any(target_os = "freebsd", target_os = "netbsd"))] 577 | { 578 | (*self_ptr).rtableid = -1; 579 | } 580 | #[cfg(target_os = "macos")] 581 | { 582 | (*self_ptr).rtableid = 0; 583 | } 584 | 585 | (*self_ptr).action = pf_rule.action; 586 | (*self_ptr).direction = pf_rule.direction; 587 | (*self_ptr).log = pf_rule.log; 588 | (*self_ptr).quick = pf_rule.quick; 589 | 590 | (*self_ptr).keep_state = pf_rule.state; 591 | let af = pf_rule.address_family(); 592 | (*self_ptr).af = af; 593 | #[cfg(target_os = "macos")] 594 | { 595 | (*self_ptr).rpool.af = af; 596 | } 597 | (*self_ptr).proto = pf_rule.proto as u8; 598 | (*self_ptr).flags = pf_rule.tcp_flags; 599 | (*self_ptr).flagset = pf_rule.tcp_flags_set; 600 | 601 | (*self_ptr).rpool.list.init(); 602 | 603 | uninit.assume_init() 604 | } 605 | } 606 | } 607 | 608 | /// Equivalent to PF_CHANGE_... enum. 609 | #[allow(dead_code)] 610 | #[repr(u32)] 611 | pub(crate) enum Change { 612 | // PF_CHANGE_NONE = 0 613 | None, 614 | // PF_CHANGE_ADD_HEAD = 1 615 | AddHead, 616 | // PF_CHANGE_ADD_TAIL = 2 617 | AddTail, 618 | // PF_CHANGE_ADD_BEFORE = 3 619 | AddBefore, 620 | // PF_CHANGE_ADD_AFTER = 4 621 | AddAfter, 622 | // PF_CHANGE_REMOVE = 5 623 | Remove, 624 | // PF_CHANGE_GET_TICKET = 6 625 | GetTicket, 626 | } 627 | 628 | /// Rule flags, equivalent to PFRULE_... 629 | #[allow(dead_code)] 630 | #[repr(u32)] 631 | pub(crate) enum RuleFlag { 632 | Drop = 0, 633 | ReturnRST = 1, 634 | Fragment = 2, 635 | ReturnICMP = 4, 636 | Return = 8, 637 | NoSync = 16, 638 | SrcTrack = 32, 639 | RuleSrcTrack = 64, 640 | // ... 641 | } 642 | 643 | pub(crate) const MAXPATHLEN: usize = libc::PATH_MAX as usize; 644 | 645 | /// Equivalent to `struct pfioc_rule`. 646 | #[repr(C)] 647 | pub(super) struct IocRule { 648 | pub action: Change, 649 | pub ticket: c_uint, 650 | pub pool_ticket: c_uint, 651 | pub nr: c_uint, 652 | pub anchor: [c_uchar; MAXPATHLEN], 653 | pub anchor_call: [c_uchar; MAXPATHLEN], 654 | pub rule: Rule, 655 | } 656 | 657 | impl IocRule { 658 | #[must_use] 659 | pub(super) fn with_rule(anchor: &str, rule: Rule) -> Self { 660 | let mut uninit = MaybeUninit::::zeroed(); 661 | let self_ptr = uninit.as_mut_ptr(); 662 | 663 | // Copy anchor name. 664 | let len = anchor.len().min(MAXPATHLEN - 1); 665 | unsafe { 666 | (*self_ptr).anchor[..len].copy_from_slice(&anchor.as_bytes()[..len]); 667 | (*self_ptr).rule = rule; 668 | } 669 | 670 | unsafe { uninit.assume_init() } 671 | } 672 | } 673 | 674 | /// Equivalent to `struct pfioc_pooladdr`. 675 | #[repr(C)] 676 | pub(super) struct IocPoolAddr { 677 | action: Change, 678 | pub(super) ticket: c_uint, 679 | nr: c_uint, 680 | r_num: c_uint, 681 | r_action: c_uchar, 682 | r_last: c_uchar, 683 | af: c_uchar, 684 | anchor: [c_uchar; MAXPATHLEN], 685 | addr: PoolAddr, 686 | } 687 | 688 | impl IocPoolAddr { 689 | #[must_use] 690 | pub(super) fn new(anchor: &str) -> Self { 691 | let mut uninit = MaybeUninit::::zeroed(); 692 | let self_ptr = uninit.as_mut_ptr(); 693 | 694 | // Copy anchor name. 695 | let len = anchor.len().min(MAXPATHLEN - 1); 696 | unsafe { 697 | (*self_ptr).anchor[..len].copy_from_slice(&anchor.as_bytes()[..len]); 698 | } 699 | 700 | unsafe { uninit.assume_init() } 701 | } 702 | 703 | #[allow(dead_code)] 704 | #[must_use] 705 | pub(super) fn with_pool_addr(addr: PoolAddr, ticket: c_uint) -> Self { 706 | let mut uninit = MaybeUninit::::zeroed(); 707 | let self_ptr = uninit.as_mut_ptr(); 708 | unsafe { 709 | (*self_ptr).ticket = ticket; 710 | (*self_ptr).addr = addr; 711 | } 712 | 713 | unsafe { uninit.assume_init() } 714 | } 715 | } 716 | 717 | /// Equivalent to `struct pfioc_trans_pfioc_trans_e`. 718 | #[repr(C)] 719 | pub(super) struct IocTransElement { 720 | rs_num: RuleSet, 721 | anchor: [c_uchar; MAXPATHLEN], 722 | pub(super) ticket: c_uint, 723 | } 724 | 725 | impl IocTransElement { 726 | #[must_use] 727 | pub(super) fn new(ruleset: RuleSet, anchor: &str) -> Self { 728 | let mut uninit = MaybeUninit::::zeroed(); 729 | let self_ptr = uninit.as_mut_ptr(); 730 | 731 | // Copy anchor name. 732 | let len = anchor.len().min(MAXPATHLEN - 1); 733 | unsafe { 734 | (*self_ptr).rs_num = ruleset; 735 | (*self_ptr).anchor[..len].copy_from_slice(&anchor.as_bytes()[..len]); 736 | } 737 | 738 | unsafe { uninit.assume_init() } 739 | } 740 | } 741 | 742 | /// Equivalent to `struct pfioc_trans`. 743 | #[repr(C)] 744 | pub(super) struct IocTrans { 745 | /// Number of elements. 746 | size: c_int, 747 | /// Size of each element in bytes. 748 | esize: c_int, 749 | array: *mut IocTransElement, 750 | } 751 | 752 | impl IocTrans { 753 | #[must_use] 754 | pub(super) fn new(elements: &mut [IocTransElement]) -> Self { 755 | Self { 756 | size: elements.len() as i32, 757 | esize: size_of::() as i32, 758 | array: elements.as_mut_ptr(), 759 | } 760 | } 761 | } 762 | 763 | // DIOCSTART 764 | // Start the packet filter. 765 | ioctl_none!(pf_start, b'D', 1); 766 | 767 | // DIOCSTOP 768 | // Stop the packet filter. 769 | ioctl_none!(pf_stop, b'D', 2); 770 | 771 | // DIOCADDRULE 772 | // Add rule at the end of the inactive ruleset. This call requires a ticket obtained through 773 | // a preceding DIOCXBEGIN call and a pool_ticket obtained through a DIOCBEGINADDRS call. 774 | // DIOCADDADDR must also be called if any pool addresses are required. The optional anchor name 775 | // indicates the anchor in which to append the rule. `nr` and `action` are ignored. 776 | ioctl_readwrite!(pf_add_rule, b'D', 4, IocRule); 777 | 778 | // DIOCGETRULES 779 | ioctl_readwrite!(pf_get_rules, b'D', 6, IocRule); 780 | 781 | // DIOCGETRULE 782 | ioctl_readwrite!(pf_get_rule, b'D', 7, IocRule); 783 | 784 | // DIOCCLRSTATES 785 | // ioctl_readwrite!(pf_clear_states, b'D', 18, pfioc_state_kill); 786 | 787 | // DIOCGETSTATUS 788 | // ioctl_readwrite!(pf_get_status, b'D', 21, pf_status); 789 | 790 | // DIOCGETSTATES (COMPAT_FREEBSD14) 791 | // ioctl_readwrite!(pf_get_states, b'D', 25, pfioc_states); 792 | 793 | // DIOCCHANGERULE 794 | ioctl_readwrite!(pf_change_rule, b'D', 26, IocRule); 795 | 796 | // DIOCINSERTRULE 797 | // Substituted on FreeBSD, NetBSD, and OpenBSD by DIOCCHANGERULE with rule.action = PF_CHANGE_REMOVE 798 | #[cfg(target_os = "macos")] 799 | ioctl_readwrite!(pf_insert_rule, b'D', 27, IocRule); 800 | 801 | // DIOCDELETERULE 802 | // Substituted on FreeBSD, NetBSD, and OpenBSD by DIOCCHANGERULE with rule.action = PF_CHANGE_REMOVE 803 | #[cfg(target_os = "macos")] 804 | ioctl_readwrite!(pf_delete_rule, b'D', 28, IocRule); 805 | 806 | // DIOCKILLSTATES 807 | // ioctl_readwrite!(pf_kill_states, b'D', 41, pfioc_state_kill); 808 | 809 | // DIOCBEGINADDRS 810 | // Clear the buffer address pool and get a ticket for subsequent DIOCADDADDR, DIOCADDRULE, and 811 | // DIOCCHANGERULE calls. 812 | ioctl_readwrite!(pf_begin_addrs, b'D', 51, IocPoolAddr); 813 | 814 | // DIOCADDADDR 815 | // Add the pool address `addr` to the buffer address pool to be used in the following DIOCADDRULE 816 | // or DIOCCHANGERULE call. All other members of the structure are ignored. 817 | ioctl_readwrite!(pf_add_addr, b'D', 52, IocPoolAddr); 818 | 819 | // DIOCGETADDRS 820 | // Get a ticket for subsequent DIOCGETADDR calls and the number nr of pool addresses in the rule 821 | // specified with r_action, r_num, and anchor. 822 | ioctl_readwrite!(pf_get_addrs, b'D', 53, IocPoolAddr); 823 | 824 | // DIOCGETADDR 825 | // Get the pool address addr by its number nr from the rule specified with r_action, r_num, and 826 | // anchor using the ticket obtained through a preceding DIOCGETADDRS call. 827 | ioctl_readwrite!(pf_get_addr, b'D', 54, IocPoolAddr); 828 | 829 | // DIOCCHANGEADDR 830 | // ioctl_readwrite!(pf_change_addr, b'D', 55, IocPoolAddr); 831 | 832 | // DIOCGETRULESETS 833 | // ioctl_readwrite!(pf_get_rulesets, b'D', 58, PFRuleset); 834 | 835 | // DIOCGETRULESET 836 | // ioctl_readwrite!(pf_get_ruleset, b'D', 59, PFRuleset); 837 | 838 | // DIOCXBEGIN 839 | ioctl_readwrite!(pf_begin, b'D', 81, IocTrans); 840 | 841 | // DIOCXCOMMIT 842 | ioctl_readwrite!(pf_commit, b'D', 82, IocTrans); 843 | 844 | // DIOCXROLLBACK 845 | ioctl_readwrite!(pf_rollback, b'D', 83, IocTrans); 846 | 847 | #[cfg(test)] 848 | mod tests { 849 | use ipnetwork::{Ipv4Network, Ipv6Network}; 850 | 851 | use std::{ 852 | mem::align_of, 853 | net::{Ipv4Addr, Ipv6Addr}, 854 | }; 855 | 856 | use super::*; 857 | 858 | #[test] 859 | fn check_align_and_size() { 860 | assert_eq!(align_of::(), 8); 861 | assert_eq!(size_of::(), 48); 862 | 863 | assert_eq!(align_of::(), 8); 864 | assert_eq!(size_of::(), 72); 865 | 866 | assert_eq!(align_of::(), 8); 867 | assert_eq!(size_of::(), 16); 868 | 869 | assert_eq!(align_of::(), 4); 870 | assert_eq!(size_of::(), 1032); 871 | 872 | assert_eq!(align_of::(), 8); 873 | #[cfg(target_os = "freebsd")] 874 | assert_eq!(size_of::(), 976); 875 | #[cfg(target_os = "macos")] 876 | assert_eq!(size_of::(), 1040); 877 | 878 | assert_eq!(align_of::(), 8); 879 | #[cfg(target_os = "freebsd")] 880 | assert_eq!(size_of::(), 56); 881 | #[cfg(target_os = "macos")] 882 | assert_eq!(size_of::(), 64); 883 | #[cfg(target_os = "netbsd")] 884 | assert_eq!(size_of::(), 56); 885 | 886 | assert_eq!(align_of::(), 8); 887 | #[cfg(target_os = "freebsd")] 888 | assert_eq!(size_of::(), 3040); 889 | #[cfg(target_os = "macos")] 890 | assert_eq!(size_of::(), 3104); 891 | #[cfg(target_os = "netbsd")] 892 | assert_eq!(size_of::(), 2976); 893 | } 894 | 895 | #[test] 896 | fn check_addr_mask() { 897 | let ipnetv4 = IpNetwork::V4(Ipv4Network::new(Ipv4Addr::LOCALHOST, 8).unwrap()); 898 | 899 | let addr_mask = AddrMask::from(ipnetv4); 900 | assert_eq!( 901 | addr_mask.addr, 902 | [127, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] 903 | ); 904 | assert_eq!( 905 | addr_mask.mask, 906 | [255, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] 907 | ); 908 | 909 | let ipv6 = IpNetwork::V6(Ipv6Network::new(Ipv6Addr::LOCALHOST, 32).unwrap()); 910 | let addr_wrap = AddrMask::from(ipv6); 911 | assert_eq!( 912 | addr_wrap.addr, 913 | [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1] 914 | ); 915 | assert_eq!( 916 | addr_wrap.mask, 917 | [255, 255, 255, 255, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] 918 | ); 919 | } 920 | } 921 | -------------------------------------------------------------------------------- /src/enterprise/firewall/packetfilter/mod.rs: -------------------------------------------------------------------------------- 1 | //! Interface to Packet Filter. 2 | //! 3 | //! Source code: 4 | //! 5 | //! Darwin: 6 | //! - https://github.com/apple-oss-distributions/xnu/blob/main/bsd/net/pfvar.h 7 | //! 8 | //! FreeBSD: 9 | //! - https://github.com/freebsd/freebsd-src/blob/main/sys/net/pfvar.h 10 | //! - https://github.com/freebsd/freebsd-src/blob/main/sys/netpfil/pf/pf.h 11 | //! 12 | //! https://man.netbsd.org/pf.4 13 | //! https://man.freebsd.org/cgi/man.cgi?pf 14 | //! https://man.openbsd.org/pf.4 15 | 16 | mod calls; 17 | mod rule; 18 | 19 | use std::os::fd::{AsRawFd, RawFd}; 20 | 21 | use calls::{pf_begin_addrs, IocPoolAddr}; 22 | use rule::PacketFilterRule; 23 | 24 | use self::calls::{pf_add_rule, Change, IocRule, Rule}; 25 | use super::{api::FirewallApi, FirewallError, FirewallRule}; 26 | use crate::enterprise::firewall::Port; 27 | 28 | const ANCHOR_PREFIX: &str = "defguard/"; 29 | 30 | impl FirewallApi { 31 | /// Construct anchor name based on prefix and network interface name. 32 | fn anchor(&self) -> String { 33 | ANCHOR_PREFIX.to_owned() + &self.ifname 34 | } 35 | 36 | /// Return raw file descriptor to Packet Filter device. 37 | fn fd(&self) -> RawFd { 38 | self.file.as_raw_fd() 39 | } 40 | 41 | fn get_pool_ticket(&self, anchor: &str) -> Result { 42 | let mut ioc = IocPoolAddr::new(anchor); 43 | 44 | unsafe { 45 | pf_begin_addrs(self.fd(), &mut ioc)?; 46 | } 47 | 48 | Ok(ioc.ticket) 49 | } 50 | 51 | fn add_rule_policy( 52 | &mut self, 53 | ticket: u32, 54 | pool_ticket: u32, 55 | anchor: &str, 56 | ) -> Result<(), FirewallError> { 57 | let rule = PacketFilterRule::for_policy(self.default_policy, &self.ifname); 58 | let mut ioc = IocRule::with_rule(anchor, Rule::from_pf_rule(&rule)); 59 | ioc.ticket = ticket; 60 | ioc.pool_ticket = pool_ticket; 61 | if let Err(err) = unsafe { pf_add_rule(self.fd(), &mut ioc) } { 62 | error!("Packet filter rule {rule} can't be added."); 63 | return Err(err.into()); 64 | } 65 | 66 | Ok(()) 67 | } 68 | 69 | /// Add a single firewall `rule`. 70 | fn add_rule( 71 | &mut self, 72 | rule: &mut FirewallRule, 73 | ticket: u32, 74 | pool_ticket: u32, 75 | anchor: &str, 76 | ) -> Result<(), FirewallError> { 77 | debug!("add_rule {rule:?}"); 78 | let rules = PacketFilterRule::from_firewall_rule(&self.ifname, rule); 79 | 80 | for rule in rules { 81 | let mut ioc = IocRule::with_rule(anchor, Rule::from_pf_rule(&rule)); 82 | ioc.action = Change::None; 83 | ioc.ticket = ticket; 84 | ioc.pool_ticket = pool_ticket; 85 | if let Err(err) = unsafe { pf_add_rule(self.fd(), &mut ioc) } { 86 | error!("Packet filter rule {rule} can't be added."); 87 | return Err(err.into()); 88 | } 89 | } 90 | 91 | Ok(()) 92 | } 93 | } 94 | 95 | #[cfg(not(test))] 96 | mod api; 97 | -------------------------------------------------------------------------------- /src/enterprise/firewall/packetfilter/rule.rs: -------------------------------------------------------------------------------- 1 | use std::fmt; 2 | 3 | use ipnetwork::IpNetwork; 4 | use libc::{AF_INET, AF_INET6, AF_UNSPEC}; 5 | 6 | use super::{FirewallRule, Port}; 7 | use crate::enterprise::firewall::{Address, Policy, Protocol}; 8 | 9 | /// Packet filter rule action. 10 | #[allow(dead_code)] 11 | #[derive(Clone, Copy, Debug)] 12 | #[repr(u8)] 13 | pub enum Action { 14 | /// PF_PASS = 0, 15 | Pass, 16 | // PF_DROP = 1, 17 | Drop, 18 | // PF_SCRUB = 2, 19 | Scrub, 20 | // PF_NOSCRUB = 3, 21 | NoScrub, 22 | // PF_NAT = 4, 23 | Nat, 24 | // PF_NONAT = 5, 25 | NoNat, 26 | // PF_BINAT = 6, 27 | BiNat, 28 | // PF_NOBINAT = 7, 29 | NoBiNat, 30 | // PF_RDR = 8, 31 | Redirect, 32 | // PF_NORDR = 9, 33 | NoRedirect, 34 | // PF_SYNPROXY_DROP = 10, 35 | // PF_DUMMYNET = 11, 36 | // PF_NODUMMYNET = 12, 37 | // PF_NAT64 = 13, 38 | // PF_NONAT64 = 14, 39 | } 40 | 41 | impl fmt::Display for Action { 42 | /// Display `Action` as pf.conf keyword. 43 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { 44 | let action = match self { 45 | Self::Pass => "pass", 46 | Self::Drop => "block drop", 47 | Self::Scrub => "scrub", 48 | Self::NoScrub => "block scrub", 49 | Self::Nat => "nat", 50 | Self::NoNat => "block nat", 51 | Self::BiNat => "binat", 52 | Self::NoBiNat => "block binat", 53 | Self::Redirect => "rdr", 54 | Self::NoRedirect => "block rdr", 55 | }; 56 | write!(f, "{action}") 57 | } 58 | } 59 | 60 | #[allow(dead_code)] 61 | #[derive(Clone, Copy, Debug)] 62 | #[repr(u8)] 63 | pub(super) enum AddressFamily { 64 | Unspec = AF_UNSPEC as u8, 65 | Inet = AF_INET as u8, 66 | Inet6 = AF_INET6 as u8, 67 | } 68 | 69 | /// Packet filter rule direction. 70 | #[allow(dead_code)] 71 | #[derive(Clone, Copy, Debug)] 72 | #[repr(u8)] 73 | pub enum Direction { 74 | /// PF_INOUT = 0 75 | InOut, 76 | /// PF_IN = 1 77 | In, 78 | /// PF_OUT = 2 79 | Out, 80 | } 81 | 82 | impl fmt::Display for Direction { 83 | /// Display `Direction` as pf.conf keyword. 84 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { 85 | let direction = match self { 86 | Self::InOut => "", 87 | Self::In => "in", 88 | Self::Out => "out", 89 | }; 90 | write!(f, "{direction}") 91 | } 92 | } 93 | 94 | const PF_LOG: u8 = 0x01; 95 | // const PF_LOG_ALL: u8 = 0x02; 96 | // const PF_LOG_SOCKET_LOOKUP: u8 = 0x04; 97 | // #[cfg(target_os = "freebsd")] 98 | // const PF_LOG_FORCE: u8 = 0x08; 99 | // #[cfg(target_os = "freebsd")] 100 | // const PF_LOG_MATCHES: u8 = 0x10; 101 | 102 | /// Equivalent to `PF_RULESET_...`. 103 | #[allow(dead_code)] 104 | #[derive(Clone, Copy, Debug)] 105 | #[repr(i32)] 106 | pub enum RuleSet { 107 | /// PF_RULESET_SCRUB = 0 108 | Scrub, 109 | /// PF_RULESET_FILTER = 1 110 | Filter, 111 | /// PF_RULESET_NAT = 2 112 | Nat, 113 | /// PF_RULESET_BINAT = 3 114 | BiNat, 115 | /// PF_RULESET_RDR = 4 116 | Redirect, 117 | /// PF_RULESET_ALTQ = 5 118 | Altq, 119 | /// PF_RULESET_TABLE = 6 120 | Table, 121 | /// PF_RULESET_ETH = 7 122 | Eth, 123 | } 124 | 125 | // Equivalent to `PF_STATE_...`. 126 | #[allow(dead_code)] 127 | #[derive(Clone, Copy, Debug)] 128 | #[repr(u8)] 129 | pub enum State { 130 | // Don't keep state. 131 | None = 0, 132 | // PF_STATE_NORMAL = 1 133 | Normal = 1, 134 | // PF_STATE_MODULATE = 2 135 | Modulate = 2, 136 | // PF_STATE_SYNPROXY = 3 137 | SynProxy = 3, 138 | } 139 | 140 | impl fmt::Display for State { 141 | /// Display `State` as in pf.conf. 142 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { 143 | let state = match self { 144 | Self::None => "no state", 145 | Self::Normal => "keep state", 146 | Self::Modulate => "modulate state", 147 | Self::SynProxy => "synproxy state", 148 | }; 149 | write!(f, "{state}") 150 | } 151 | } 152 | 153 | /// TCP flags as defined in `netinet/tcp.h`. 154 | /// Final: Set on the last segment. 155 | #[allow(dead_code)] 156 | const TH_FIN: u8 = 0x01; 157 | /// Synchronization: New conn with dst port. 158 | const TH_SYN: u8 = 0x02; 159 | /// Reset: Announce to peer conn terminated. 160 | #[allow(dead_code)] 161 | const TH_RST: u8 = 0x04; 162 | /// Push: Immediately send, don't buffer seg. 163 | #[allow(dead_code)] 164 | const TH_PUSH: u8 = 0x08; 165 | /// Acknowledge: Part of connection establish. 166 | const TH_ACK: u8 = 0x10; 167 | /// Urgent: send special marked segment now. 168 | #[allow(dead_code)] 169 | const TH_URG: u8 = 0x20; 170 | /// ECN Echo. 171 | #[allow(dead_code)] 172 | const TH_ECE: u8 = 0x40; 173 | /// Congestion Window Reduced. 174 | #[allow(dead_code)] 175 | const TH_CWR: u8 = 0x80; 176 | 177 | #[derive(Debug)] 178 | pub(super) struct PacketFilterRule { 179 | /// Source address; `Option::None` means "any". 180 | pub(super) from: Option, 181 | /// Source port; 0 means "any". 182 | pub(super) from_port: Port, 183 | /// Destination address; `Option::None` means "any". 184 | pub(super) to: Option, 185 | /// Destination port; 0 means "any". 186 | pub(super) to_port: Port, 187 | pub(super) action: Action, 188 | pub(super) direction: Direction, 189 | pub(super) quick: bool, 190 | /// See `PF_LOG`. 191 | pub(super) log: u8, 192 | pub(super) state: State, 193 | pub(super) interface: Option, 194 | pub(super) proto: Protocol, 195 | pub(super) tcp_flags: u8, 196 | pub(super) tcp_flags_set: u8, 197 | pub(super) label: Option, 198 | } 199 | 200 | impl PacketFilterRule { 201 | /// Default rule for policy. 202 | #[must_use] 203 | pub(super) fn for_policy(policy: Policy, ifname: &str) -> Self { 204 | let (action, state) = match policy { 205 | Policy::Allow => (Action::Pass, State::Normal), 206 | Policy::Deny => (Action::Drop, State::None), 207 | }; 208 | Self { 209 | from: None, 210 | from_port: Port::Any, 211 | to: None, 212 | to_port: Port::Any, 213 | action, 214 | direction: Direction::In, 215 | quick: false, 216 | log: PF_LOG, 217 | state, 218 | interface: Some(ifname.to_owned()), 219 | proto: Protocol::Any, 220 | tcp_flags: TH_SYN, 221 | tcp_flags_set: TH_SYN | TH_ACK, 222 | label: None, 223 | } 224 | } 225 | 226 | /// Determine address family. 227 | pub(super) fn address_family(&self) -> AddressFamily { 228 | match self.to { 229 | None => match self.from { 230 | None => AddressFamily::Unspec, 231 | Some(IpNetwork::V4(_)) => AddressFamily::Inet, 232 | Some(IpNetwork::V6(_)) => AddressFamily::Inet6, 233 | }, 234 | Some(IpNetwork::V4(_)) => AddressFamily::Inet, 235 | Some(IpNetwork::V6(_)) => AddressFamily::Inet6, 236 | } 237 | } 238 | 239 | /// Expand `FirewallRule` into a set of `PacketFilterRule`s. 240 | pub(super) fn from_firewall_rule(ifname: &str, fr: &mut FirewallRule) -> Vec { 241 | let mut rules = Vec::new(); 242 | let (action, state) = match fr.verdict { 243 | Policy::Allow => (Action::Pass, State::Normal), 244 | Policy::Deny => (Action::Drop, State::None), 245 | }; 246 | 247 | let mut from_addrs = Vec::new(); 248 | if fr.source_addrs.is_empty() { 249 | from_addrs.push(None); 250 | } else { 251 | for src in &fr.source_addrs { 252 | match src { 253 | Address::Network(net) => from_addrs.push(Some(*net)), 254 | Address::Range(range) => { 255 | for addr in range.clone() { 256 | from_addrs.push(Some(IpNetwork::from(addr))); 257 | } 258 | } 259 | } 260 | } 261 | } 262 | 263 | let mut to_addrs = Vec::new(); 264 | if fr.destination_addrs.is_empty() { 265 | to_addrs.push(None); 266 | } else { 267 | for src in &fr.destination_addrs { 268 | match src { 269 | Address::Network(net) => to_addrs.push(Some(*net)), 270 | Address::Range(range) => { 271 | for addr in range.clone() { 272 | to_addrs.push(Some(IpNetwork::from(addr))); 273 | } 274 | } 275 | } 276 | } 277 | } 278 | 279 | if fr.destination_ports.is_empty() { 280 | fr.destination_ports.push(Port::Any); 281 | } 282 | 283 | if fr.protocols.is_empty() { 284 | fr.protocols.push(Protocol::Any); 285 | } 286 | 287 | for from in &from_addrs { 288 | for to in &to_addrs { 289 | for to_port in &fr.destination_ports { 290 | for proto in &fr.protocols { 291 | let rule = Self { 292 | from: *from, 293 | from_port: Port::Any, 294 | to: *to, 295 | to_port: *to_port, 296 | action, 297 | direction: Direction::In, 298 | // Enable quick to match NFTables behaviour. 299 | quick: true, 300 | log: PF_LOG, 301 | state, 302 | interface: Some(ifname.to_owned()), 303 | proto: *proto, 304 | // For stateful connections, the default is flags S/SA. 305 | tcp_flags: TH_SYN, 306 | tcp_flags_set: TH_SYN | TH_ACK, 307 | label: fr.comment.clone(), 308 | }; 309 | rules.push(rule); 310 | } 311 | } 312 | } 313 | } 314 | 315 | rules 316 | } 317 | } 318 | 319 | impl fmt::Display for PacketFilterRule { 320 | // Display `PacketFilterRule` in similar format to rules in pf.conf. 321 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { 322 | write!(f, "{} {}", self.action, self.direction)?; 323 | // TODO: log 324 | if self.quick { 325 | write!(f, " quick")?; 326 | } 327 | if let Some(interface) = &self.interface { 328 | write!(f, " on {interface}")?; 329 | } 330 | write!(f, " from")?; 331 | if let Some(from) = self.from { 332 | write!(f, " {from}")?; 333 | } else { 334 | write!(f, " any")?; 335 | } 336 | write!(f, " {} to", self.from_port)?; 337 | if let Some(to) = self.to { 338 | write!(f, " {to}")?; 339 | } else { 340 | write!(f, " any")?; 341 | } 342 | // TODO: tcp_flags/tcp_flags_set 343 | write!(f, " {} {}", self.to_port, self.state)?; 344 | if let Some(label) = &self.label { 345 | write!(f, " label \"{label}\"")?; 346 | } 347 | 348 | Ok(()) 349 | } 350 | } 351 | 352 | #[cfg(test)] 353 | mod tests { 354 | use std::net::{IpAddr, Ipv4Addr}; 355 | 356 | use super::*; 357 | 358 | #[test] 359 | fn unroll_firewall_rule() { 360 | // Empty rule 361 | let mut fr = FirewallRule { 362 | comment: None, 363 | destination_addrs: Vec::new(), 364 | destination_ports: Vec::new(), 365 | id: 0, 366 | verdict: Policy::Allow, 367 | protocols: Vec::new(), 368 | source_addrs: Vec::new(), 369 | ipv4: true, 370 | }; 371 | 372 | let rules = PacketFilterRule::from_firewall_rule("lo0", &mut fr); 373 | assert_eq!(1, rules.len()); 374 | assert_eq!( 375 | rules[0].to_string(), 376 | "pass in quick on lo0 from any to any keep state" 377 | ); 378 | 379 | // One address, one port. 380 | let addr1 = Address::Network( 381 | IpNetwork::new(IpAddr::V4(Ipv4Addr::new(192, 168, 1, 10)), 24).unwrap(), 382 | ); 383 | let mut fr = FirewallRule { 384 | comment: None, 385 | destination_addrs: vec![addr1], 386 | destination_ports: vec![Port::Single(1138)], 387 | id: 0, 388 | verdict: Policy::Allow, 389 | protocols: Vec::new(), 390 | source_addrs: Vec::new(), 391 | ipv4: true, 392 | }; 393 | 394 | let rules = PacketFilterRule::from_firewall_rule("lo0", &mut fr); 395 | assert_eq!(1, rules.len()); 396 | assert_eq!( 397 | rules[0].to_string(), 398 | "pass in quick on lo0 from any to 192.168.1.10/24 port = 1138 keep state" 399 | ); 400 | 401 | // Two addresses, two ports. 402 | let addr1 = Address::Network( 403 | IpNetwork::new(IpAddr::V4(Ipv4Addr::new(192, 168, 1, 10)), 24).unwrap(), 404 | ); 405 | let addr2 = Address::Network( 406 | IpNetwork::new(IpAddr::V4(Ipv4Addr::new(192, 168, 1, 20)), 24).unwrap(), 407 | ); 408 | let mut fr = FirewallRule { 409 | comment: None, 410 | destination_addrs: vec![addr1, addr2], 411 | destination_ports: vec![Port::Single(1138), Port::Single(42)], 412 | id: 0, 413 | verdict: Policy::Allow, 414 | protocols: Vec::new(), 415 | source_addrs: Vec::new(), 416 | ipv4: true, 417 | }; 418 | 419 | let rules = PacketFilterRule::from_firewall_rule("lo0", &mut fr); 420 | assert_eq!(4, rules.len()); 421 | assert_eq!( 422 | rules[0].to_string(), 423 | "pass in quick on lo0 from any to 192.168.1.10/24 port = 1138 keep state" 424 | ); 425 | assert_eq!( 426 | rules[1].to_string(), 427 | "pass in quick on lo0 from any to 192.168.1.10/24 port = 42 keep state" 428 | ); 429 | assert_eq!( 430 | rules[2].to_string(), 431 | "pass in quick on lo0 from any to 192.168.1.20/24 port = 1138 keep state" 432 | ); 433 | assert_eq!( 434 | rules[3].to_string(), 435 | "pass in quick on lo0 from any to 192.168.1.20/24 port = 42 keep state" 436 | ); 437 | } 438 | } 439 | -------------------------------------------------------------------------------- /src/enterprise/mod.rs: -------------------------------------------------------------------------------- 1 | pub mod firewall; 2 | -------------------------------------------------------------------------------- /src/error.rs: -------------------------------------------------------------------------------- 1 | use defguard_wireguard_rs::error::WireguardInterfaceError; 2 | use thiserror::Error; 3 | 4 | use crate::enterprise::firewall::FirewallError; 5 | 6 | #[derive(Debug, Error)] 7 | pub enum GatewayError { 8 | #[error("Command {command} execution failed. Error: {error}")] 9 | CommandExecutionFailed { command: String, error: String }, 10 | 11 | #[error("WireGuard key error")] 12 | KeyDecode(#[from] base64::DecodeError), 13 | 14 | #[error("Logger error")] 15 | Logger(#[from] log::SetLoggerError), 16 | 17 | #[error("Syslog error")] 18 | Syslog(#[from] syslog::Error), 19 | 20 | #[error("Token parsing error")] 21 | Token(#[from] tonic::metadata::errors::InvalidMetadataValue), 22 | 23 | #[error("Tonic error")] 24 | Tonic(#[from] tonic::transport::Error), 25 | 26 | #[error("Uri error")] 27 | Uri(#[from] tonic::codegen::http::uri::InvalidUri), 28 | 29 | #[error("Invalid config file. Error: {0}")] 30 | InvalidConfigFile(String), 31 | 32 | #[error("WireGuard error {0}")] 33 | WireguardError(#[from] WireguardInterfaceError), 34 | 35 | #[error("HTTP error")] 36 | HttpServer(String), 37 | 38 | #[error("Invalid CA file. Error")] 39 | InvalidCaFile, 40 | 41 | #[error(transparent)] 42 | IoError(#[from] std::io::Error), 43 | 44 | #[error("Firewall error: {0}")] 45 | FirewallError(#[from] FirewallError), 46 | } 47 | -------------------------------------------------------------------------------- /src/lib.rs: -------------------------------------------------------------------------------- 1 | pub mod config; 2 | pub mod error; 3 | pub mod gateway; 4 | pub mod server; 5 | 6 | pub mod proto { 7 | pub mod gateway { 8 | tonic::include_proto!("gateway"); 9 | } 10 | pub mod enterprise { 11 | pub mod firewall { 12 | tonic::include_proto!("enterprise.firewall"); 13 | } 14 | } 15 | } 16 | 17 | #[macro_use] 18 | extern crate log; 19 | 20 | use std::{process::Command, str::FromStr, time::SystemTime}; 21 | 22 | use config::Config; 23 | use defguard_wireguard_rs::{host::Peer, net::IpAddrMask, InterfaceConfiguration}; 24 | use error::GatewayError; 25 | use syslog::{BasicLogger, Facility, Formatter3164}; 26 | 27 | pub mod enterprise; 28 | 29 | pub const VERSION: &str = concat!(env!("CARGO_PKG_VERSION"), "-", env!("VERGEN_GIT_SHA")); 30 | 31 | /// Masks object's field with "***" string. 32 | /// Used to log sensitive/secret objects. 33 | #[macro_export] 34 | macro_rules! mask { 35 | ($object:expr, $field:ident) => {{ 36 | let mut object = $object.clone(); 37 | object.$field = String::from("***"); 38 | object 39 | }}; 40 | } 41 | 42 | /// Initialize logging to syslog. 43 | pub fn init_syslog(config: &Config, pid: u32) -> Result<(), GatewayError> { 44 | let formatter = Formatter3164 { 45 | facility: Facility::from_str(&config.syslog_facility).unwrap_or_default(), 46 | hostname: None, 47 | process: "defguard-gateway".into(), 48 | pid, 49 | }; 50 | let logger = syslog::unix_custom(formatter, &config.syslog_socket)?; 51 | log::set_boxed_logger(Box::new(BasicLogger::new(logger)))?; 52 | log::set_max_level(log::LevelFilter::Debug); 53 | Ok(()) 54 | } 55 | 56 | /// Execute command passed as argument. 57 | pub fn execute_command(command: &str) -> Result<(), GatewayError> { 58 | let mut command_parts = command.split_whitespace(); 59 | 60 | if let Some(command) = command_parts.next() { 61 | let output = Command::new(command) 62 | .args(command_parts) 63 | .output() 64 | .map_err(|err| { 65 | error!("Failed to execute command {command}. Error: {err}"); 66 | GatewayError::CommandExecutionFailed { 67 | command: command.to_string(), 68 | error: err.to_string(), 69 | } 70 | })?; 71 | 72 | if output.status.success() { 73 | let stdout = String::from_utf8_lossy(&output.stdout); 74 | let stderr = String::from_utf8_lossy(&output.stderr); 75 | 76 | info!("Command {command} executed successfully. Stdout: {stdout}",); 77 | if !stderr.is_empty() { 78 | error!("Stderr:\n{stderr}"); 79 | } 80 | } else { 81 | let stderr = String::from_utf8_lossy(&output.stderr); 82 | error!("Error executing command {command}. Stderr:\n{stderr}"); 83 | } 84 | } 85 | Ok(()) 86 | } 87 | 88 | impl From for InterfaceConfiguration { 89 | fn from(config: proto::gateway::Configuration) -> Self { 90 | let peers = config.peers.into_iter().map(Peer::from).collect(); 91 | // Try to convert an array of `String`s to `IpAddrMask`, leaving out the failed ones. 92 | let addresses = config 93 | .addresses 94 | .into_iter() 95 | .filter_map(|s| IpAddrMask::from_str(&s).ok()) 96 | .collect(); 97 | InterfaceConfiguration { 98 | name: config.name, 99 | prvkey: config.prvkey, 100 | addresses, 101 | port: config.port, 102 | peers, 103 | mtu: None, 104 | } 105 | } 106 | } 107 | 108 | impl From for Peer { 109 | fn from(proto_peer: proto::gateway::Peer) -> Self { 110 | let mut peer = Self::new(proto_peer.pubkey.as_str().try_into().unwrap_or_default()); 111 | peer.persistent_keepalive_interval = proto_peer 112 | .keepalive_interval 113 | .and_then(|interval| u16::try_from(interval).ok()); 114 | peer.preshared_key = proto_peer 115 | .preshared_key 116 | .map(|key| key.as_str().try_into().unwrap_or_default()); 117 | peer.allowed_ips = proto_peer 118 | .allowed_ips 119 | .iter() 120 | .filter_map(|entry| IpAddrMask::from_str(entry).ok()) 121 | .collect(); 122 | peer 123 | } 124 | } 125 | 126 | impl From<&Peer> for proto::gateway::Peer { 127 | fn from(peer: &Peer) -> Self { 128 | let preshared_key = peer.preshared_key.as_ref().map(ToString::to_string); 129 | Self { 130 | pubkey: peer.public_key.to_string(), 131 | allowed_ips: peer.allowed_ips.iter().map(ToString::to_string).collect(), 132 | preshared_key, 133 | keepalive_interval: peer.persistent_keepalive_interval.map(u32::from), 134 | } 135 | } 136 | } 137 | 138 | impl From<&Peer> for proto::gateway::PeerStats { 139 | fn from(peer: &Peer) -> Self { 140 | Self { 141 | public_key: peer.public_key.to_string(), 142 | endpoint: peer 143 | .endpoint 144 | .map_or(String::new(), |endpoint| endpoint.to_string()), 145 | allowed_ips: peer.allowed_ips.iter().map(ToString::to_string).collect(), 146 | latest_handshake: peer.last_handshake.map_or(0, |ts| { 147 | ts.duration_since(SystemTime::UNIX_EPOCH) 148 | .map_or(0, |duration| duration.as_secs()) 149 | }), 150 | download: peer.rx_bytes, 151 | upload: peer.tx_bytes, 152 | keepalive_interval: u32::from(peer.persistent_keepalive_interval.unwrap_or_default()), 153 | } 154 | } 155 | } 156 | -------------------------------------------------------------------------------- /src/main.rs: -------------------------------------------------------------------------------- 1 | use std::{fs::File, io::Write, process, sync::Arc}; 2 | 3 | use defguard_gateway::{ 4 | config::get_config, enterprise::firewall::api::FirewallApi, error::GatewayError, 5 | execute_command, gateway::Gateway, init_syslog, server::run_server, 6 | }; 7 | #[cfg(not(any(target_os = "macos", target_os = "netbsd")))] 8 | use defguard_wireguard_rs::Kernel; 9 | use defguard_wireguard_rs::{Userspace, WGApi}; 10 | use env_logger::{init_from_env, Env, DEFAULT_FILTER_ENV}; 11 | use tokio::task::JoinSet; 12 | 13 | #[tokio::main] 14 | async fn main() -> Result<(), GatewayError> { 15 | // parse config 16 | let config = get_config()?; 17 | 18 | // setup pidfile 19 | let pid = process::id(); 20 | 21 | if let Some(pidfile) = &config.pidfile { 22 | let mut file = File::create(pidfile)?; 23 | file.write_all(pid.to_string().as_bytes())?; 24 | } 25 | 26 | // setup logging 27 | if config.use_syslog { 28 | if let Err(error) = init_syslog(&config, pid) { 29 | log::error!("Unable to initialize syslog. Is the syslog daemon running?"); 30 | return Err(error); 31 | } 32 | } else { 33 | init_from_env(Env::default().filter_or(DEFAULT_FILTER_ENV, "info")); 34 | } 35 | 36 | if let Some(pre_up) = &config.pre_up { 37 | log::info!("Executing specified PRE_UP command: {pre_up}"); 38 | execute_command(pre_up)?; 39 | } 40 | 41 | let ifname = config.ifname.clone(); 42 | let firewall_api = FirewallApi::new(&ifname)?; 43 | 44 | let mut gateway = if config.userspace { 45 | let wgapi = WGApi::::new(ifname)?; 46 | Gateway::new(config.clone(), wgapi, firewall_api)? 47 | } else { 48 | #[cfg(not(any(target_os = "macos", target_os = "netbsd")))] 49 | { 50 | let wgapi = WGApi::::new(ifname)?; 51 | Gateway::new(config.clone(), wgapi, firewall_api)? 52 | } 53 | #[cfg(any(target_os = "macos", target_os = "netbsd"))] 54 | { 55 | eprintln!("Gateway only supports userspace WireGuard for macOS"); 56 | return Ok(()); 57 | } 58 | }; 59 | 60 | let mut tasks = JoinSet::new(); 61 | if let Some(health_port) = config.health_port { 62 | tasks.spawn(run_server(health_port, Arc::clone(&gateway.connected))); 63 | } 64 | tasks.spawn(async move { gateway.start().await }); 65 | while let Some(Ok(result)) = tasks.join_next().await { 66 | result?; 67 | } 68 | 69 | if let Some(post_down) = &config.post_down { 70 | log::info!("Executing specified POST_DOWN command: {post_down}"); 71 | execute_command(post_down)?; 72 | } 73 | 74 | Ok(()) 75 | } 76 | -------------------------------------------------------------------------------- /src/server.rs: -------------------------------------------------------------------------------- 1 | use std::{ 2 | net::{IpAddr, Ipv4Addr, SocketAddr}, 3 | sync::{ 4 | atomic::{AtomicBool, Ordering}, 5 | Arc, 6 | }, 7 | }; 8 | 9 | use axum::{extract::Extension, http::StatusCode, routing::get, serve, Router}; 10 | use tokio::net::TcpListener; 11 | 12 | use crate::error::GatewayError; 13 | 14 | async fn healthcheck<'a>( 15 | Extension(connected): Extension>, 16 | ) -> (StatusCode, &'a str) { 17 | if connected.load(Ordering::Relaxed) { 18 | (StatusCode::OK, "Alive") 19 | } else { 20 | (StatusCode::SERVICE_UNAVAILABLE, "Not connected to core") 21 | } 22 | } 23 | 24 | pub async fn run_server(http_port: u16, connected: Arc) -> Result<(), GatewayError> { 25 | let app = Router::new() 26 | .route("/health", get(healthcheck)) 27 | .layer(Extension(connected)); 28 | 29 | // run server 30 | let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), http_port); 31 | let listener = TcpListener::bind(&addr).await?; 32 | info!("Health check listening on {addr}"); 33 | serve(listener, app.into_make_service()) 34 | .await 35 | .map_err(|err| GatewayError::HttpServer(err.to_string())) 36 | } 37 | --------------------------------------------------------------------------------