Make AllowedEndpoint optional

7 files changed, 35 insertions, 18 deletions

diff --git a/mullvad-daemon/src/main.rs b/mullvad-daemon/src/main.rs
index 8991ed8daf..13b4d8a268 100644
--- a/mullvad-daemon/src/main.rs
+++ b/mullvad-daemon/src/main.rs
@@ -50,12 +50,12 @@ fn main() {
 fn init_logging(config: &cli::Config) -> Result<Option<PathBuf>, String> {
     let log_dir = get_log_dir(config)?;
 
-    let log_file_name = if cfg!(target_os = "linux") {
-        if config.initialize_firewall_and_exit {
-            EARLY_BOOT_LOG_FILENAME
-        } else {
-            DAEMON_LOG_FILENAME
-        }
+    #[cfg(not(target_os = "linux"))]
+    let log_file_name = DAEMON_LOG_FILENAME;
+
+    #[cfg(target_os = "linux")]
+    let log_file_name = if config.initialize_firewall_and_exit {
+        EARLY_BOOT_LOG_FILENAME
     } else {
         DAEMON_LOG_FILENAME
     };
diff --git a/talpid-core/src/firewall/linux.rs b/talpid-core/src/firewall/linux.rs
index cf4fb267dc..b873d71b62 100644
--- a/talpid-core/src/firewall/linux.rs
+++ b/talpid-core/src/firewall/linux.rs
@@ -605,7 +605,9 @@ impl<'a> PolicyBatch<'a> {
                 allow_lan,
                 allowed_endpoint,
             } => {
-                self.add_allow_endpoint_rules(&allowed_endpoint.endpoint);
+                if let Some(endpoint) = allowed_endpoint {
+                    self.add_allow_endpoint_rules(&endpoint.endpoint);
+                }
 
                 // Important to drop DNS before allowing LAN (to stop DNS leaking to the LAN)
                 self.add_drop_dns_rule();
diff --git a/talpid-core/src/firewall/macos.rs b/talpid-core/src/firewall/macos.rs
index 43b8e81bc1..6f59020990 100644
--- a/talpid-core/src/firewall/macos.rs
+++ b/talpid-core/src/firewall/macos.rs
@@ -178,7 +178,9 @@ impl Firewall {
                 ..
             } => {
                 let mut rules = Vec::new();
-                rules.push(self.get_allowed_endpoint_rule(allowed_endpoint.endpoint)?);
+                if let Some(allowed_endpoint) = allowed_endpoint {
+                    rules.push(self.get_allowed_endpoint_rule(allowed_endpoint.endpoint)?);
+                }
 
                 if *allow_lan {
                     // Important to block DNS before allow LAN (so DNS does not leak to the LAN)
diff --git a/talpid-core/src/firewall/mod.rs b/talpid-core/src/firewall/mod.rs
index 599fa0b6ba..1f99fc2692 100644
--- a/talpid-core/src/firewall/mod.rs
+++ b/talpid-core/src/firewall/mod.rs
@@ -137,7 +137,7 @@ pub enum FirewallPolicy {
         /// Flag setting if communication with LAN networks should be possible.
         allow_lan: bool,
         /// Host that should be reachable while in the blocked state.
-        allowed_endpoint: AllowedEndpoint,
+        allowed_endpoint: Option<AllowedEndpoint>,
         /// Desination port for DNS traffic redirection. Traffic destined to `127.0.0.1:53` will be
         /// redirected to `127.0.0.1:$dns_redirect_port`.
         #[cfg(target_os = "macos")]
@@ -210,9 +210,12 @@ impl fmt::Display for FirewallPolicy {
                 ..
             } => write!(
                 f,
-                "Blocked. {} LAN. Allowing endpoint {}",
+                "Blocked. {} LAN. Allowing endpoint: {}",
                 if *allow_lan { "Allowing" } else { "Blocking" },
-                allowed_endpoint,
+                allowed_endpoint
+                    .as_ref()
+                    .map(|endpoint| -> &dyn std::fmt::Display { endpoint })
+                    .unwrap_or(&"none"),
             ),
         }
     }
diff --git a/talpid-core/src/firewall/windows.rs b/talpid-core/src/firewall/windows.rs
index db0060f25d..23be309a63 100644
--- a/talpid-core/src/firewall/windows.rs
+++ b/talpid-core/src/firewall/windows.rs
@@ -128,7 +128,7 @@ impl Firewall {
                 let cfg = &WinFwSettings::new(allow_lan);
                 self.set_blocked_state(
                     &cfg,
-                    &WinFwAllowedEndpointContainer::from(allowed_endpoint).as_endpoint(),
+                    allowed_endpoint.map(|endpoint| WinFwAllowedEndpointContainer::from(endpoint)),
                 )
             }
         }
@@ -255,13 +255,23 @@ impl Firewall {
     fn set_blocked_state(
         &mut self,
         winfw_settings: &WinFwSettings,
-        allowed_endpoint: &WinFwAllowedEndpoint<'_>,
+        allowed_endpoint: Option<WinFwAllowedEndpointContainer>,
     ) -> Result<(), Error> {
         log::trace!("Applying 'blocked' firewall policy");
+        let endpoint = allowed_endpoint
+            .as_ref()
+            .map(WinFwAllowedEndpointContainer::as_endpoint);
+
         unsafe {
-            WinFw_ApplyPolicyBlocked(winfw_settings, allowed_endpoint)
-                .into_result()
-                .map_err(Error::ApplyingBlockedPolicy)
+            WinFw_ApplyPolicyBlocked(
+                winfw_settings,
+                endpoint
+                    .as_ref()
+                    .map(|container| container as *const _)
+                    .unwrap_or(ptr::null()),
+            )
+            .into_result()
+            .map_err(Error::ApplyingBlockedPolicy)
         }
     }
 }
diff --git a/talpid-core/src/tunnel_state_machine/disconnected_state.rs b/talpid-core/src/tunnel_state_machine/disconnected_state.rs
index 7b54384780..b6b52bbc45 100644
--- a/talpid-core/src/tunnel_state_machine/disconnected_state.rs
+++ b/talpid-core/src/tunnel_state_machine/disconnected_state.rs
@@ -23,7 +23,7 @@ impl DisconnectedState {
         let result = if shared_values.block_when_disconnected {
             let policy = FirewallPolicy::Blocked {
                 allow_lan: shared_values.allow_lan,
-                allowed_endpoint: shared_values.allowed_endpoint.clone(),
+                allowed_endpoint: Some(shared_values.allowed_endpoint.clone()),
                 #[cfg(target_os = "macos")]
                 dns_redirect_port: shared_values.filtering_resolver.listening_port(),
             };
diff --git a/talpid-core/src/tunnel_state_machine/error_state.rs b/talpid-core/src/tunnel_state_machine/error_state.rs
index b12beecff4..7fe95c9f67 100644
--- a/talpid-core/src/tunnel_state_machine/error_state.rs
+++ b/talpid-core/src/tunnel_state_machine/error_state.rs
@@ -22,7 +22,7 @@ impl ErrorState {
     ) -> Result<(), FirewallPolicyError> {
         let policy = FirewallPolicy::Blocked {
             allow_lan: shared_values.allow_lan,
-            allowed_endpoint: shared_values.allowed_endpoint.clone(),
+            allowed_endpoint: Some(shared_values.allowed_endpoint.clone()),
             #[cfg(target_os = "macos")]
             dns_redirect_port: shared_values.filtering_resolver.listening_port(),
         };