vopono_core 0.1.22

Library code for running VPN connections in network namespaces
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

use std::path::Path;

use crate::util::unix::run_program_in_netns_with_path_redirect;

use super::firewall::Firewall;
use super::netns::NetworkNamespace;
use anyhow::{Context, anyhow};
use log::{debug, error, info};
use serde::{Deserialize, Serialize};

// Cloudflare Warp

#[derive(Serialize, Deserialize, Debug)]
pub struct Warp {
    pid: u32,
}

impl Warp {
    #[allow(clippy::too_many_arguments)]
    pub fn run(
        netns: &NetworkNamespace,
        open_ports: Option<&Vec<u16>>,
        forward_ports: Option<&Vec<u16>>,
        firewall: Firewall,
    ) -> anyhow::Result<Self> {
        // TODO: Add Killswitch using - https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/firewall/

        if let Err(x) = which::which("warp-svc") {
            error!("Cloudflare Warp warp-svc not found. Is warp-svc installed and on PATH?");
            return Err(anyhow!(
                "warp-svc not found. Is warp-svc installed and on PATH?: {:?}",
                x
            ));
        }

        // Ensure /etc/netns/{netns.name}/resolv.conf exists
        let resolv_conf_path = format!("/etc/netns/{}/resolv.conf", netns.name);
        let dir_path = format!("/etc/netns/{}", netns.name);
        if !std::path::Path::new(&resolv_conf_path).exists() {
            std::fs::create_dir_all(Path::new(&dir_path))?;
            std::fs::File::create(&resolv_conf_path)
                .with_context(|| format!("Failed to create resolv.conf: {}", resolv_conf_path))?;
        }

        info!("Launching Warp...");
        let id = run_program_in_netns_with_path_redirect(
            "warp-svc",
            &[],
            &netns.name,
            "/etc/resolv.conf",
            &resolv_conf_path,
        )
        .context("Failed to launch warp-svc - is warp-svc installed?")?;
        info!("Warp launched with PID: {id}");
        // Allow input to and output from open ports (for port forwarding in tunnel)
        if let Some(opens) = open_ports {
            crate::util::open_ports(netns, opens.as_slice(), firewall)?;
        }

        // Allow input to and output from forwarded ports
        if let Some(forwards) = forward_ports {
            crate::util::open_ports(netns, forwards.as_slice(), firewall)?;
        }

        Ok(Self { pid: id })
    }
}

impl Drop for Warp {
    fn drop(&mut self) {
        match nix::sys::signal::kill(
            nix::unistd::Pid::from_raw(self.pid as i32),
            nix::sys::signal::Signal::SIGKILL,
        ) {
            Ok(_) => debug!("Killed warp-svc (pid: {})", self.pid),
            Err(e) => error!("Failed to kill warp-svc (pid: {}): {:?}", self.pid, e),
        }
    }
}