diff options
| -rw-r--r-- | mullvad-daemon/src/main.rs | 12 | ||||
| -rw-r--r-- | talpid-core/src/firewall/linux.rs | 4 | ||||
| -rw-r--r-- | talpid-core/src/firewall/macos.rs | 4 | ||||
| -rw-r--r-- | talpid-core/src/firewall/mod.rs | 9 | ||||
| -rw-r--r-- | talpid-core/src/firewall/windows.rs | 20 | ||||
| -rw-r--r-- | talpid-core/src/tunnel_state_machine/disconnected_state.rs | 2 | ||||
| -rw-r--r-- | talpid-core/src/tunnel_state_machine/error_state.rs | 2 |
7 files changed, 35 insertions, 18 deletions
diff --git a/mullvad-daemon/src/main.rs b/mullvad-daemon/src/main.rs index 8991ed8daf..13b4d8a268 100644 --- a/mullvad-daemon/src/main.rs +++ b/mullvad-daemon/src/main.rs @@ -50,12 +50,12 @@ fn main() { fn init_logging(config: &cli::Config) -> Result<Option<PathBuf>, String> { let log_dir = get_log_dir(config)?; - let log_file_name = if cfg!(target_os = "linux") { - if config.initialize_firewall_and_exit { - EARLY_BOOT_LOG_FILENAME - } else { - DAEMON_LOG_FILENAME - } + #[cfg(not(target_os = "linux"))] + let log_file_name = DAEMON_LOG_FILENAME; + + #[cfg(target_os = "linux")] + let log_file_name = if config.initialize_firewall_and_exit { + EARLY_BOOT_LOG_FILENAME } else { DAEMON_LOG_FILENAME }; diff --git a/talpid-core/src/firewall/linux.rs b/talpid-core/src/firewall/linux.rs index cf4fb267dc..b873d71b62 100644 --- a/talpid-core/src/firewall/linux.rs +++ b/talpid-core/src/firewall/linux.rs @@ -605,7 +605,9 @@ impl<'a> PolicyBatch<'a> { allow_lan, allowed_endpoint, } => { - self.add_allow_endpoint_rules(&allowed_endpoint.endpoint); + if let Some(endpoint) = allowed_endpoint { + self.add_allow_endpoint_rules(&endpoint.endpoint); + } // Important to drop DNS before allowing LAN (to stop DNS leaking to the LAN) self.add_drop_dns_rule(); diff --git a/talpid-core/src/firewall/macos.rs b/talpid-core/src/firewall/macos.rs index 43b8e81bc1..6f59020990 100644 --- a/talpid-core/src/firewall/macos.rs +++ b/talpid-core/src/firewall/macos.rs @@ -178,7 +178,9 @@ impl Firewall { .. } => { let mut rules = Vec::new(); - rules.push(self.get_allowed_endpoint_rule(allowed_endpoint.endpoint)?); + if let Some(allowed_endpoint) = allowed_endpoint { + rules.push(self.get_allowed_endpoint_rule(allowed_endpoint.endpoint)?); + } if *allow_lan { // Important to block DNS before allow LAN (so DNS does not leak to the LAN) diff --git a/talpid-core/src/firewall/mod.rs b/talpid-core/src/firewall/mod.rs index 599fa0b6ba..1f99fc2692 100644 --- a/talpid-core/src/firewall/mod.rs +++ b/talpid-core/src/firewall/mod.rs @@ -137,7 +137,7 @@ pub enum FirewallPolicy { /// Flag setting if communication with LAN networks should be possible. allow_lan: bool, /// Host that should be reachable while in the blocked state. - allowed_endpoint: AllowedEndpoint, + allowed_endpoint: Option<AllowedEndpoint>, /// Desination port for DNS traffic redirection. Traffic destined to `127.0.0.1:53` will be /// redirected to `127.0.0.1:$dns_redirect_port`. #[cfg(target_os = "macos")] @@ -210,9 +210,12 @@ impl fmt::Display for FirewallPolicy { .. } => write!( f, - "Blocked. {} LAN. Allowing endpoint {}", + "Blocked. {} LAN. Allowing endpoint: {}", if *allow_lan { "Allowing" } else { "Blocking" }, - allowed_endpoint, + allowed_endpoint + .as_ref() + .map(|endpoint| -> &dyn std::fmt::Display { endpoint }) + .unwrap_or(&"none"), ), } } diff --git a/talpid-core/src/firewall/windows.rs b/talpid-core/src/firewall/windows.rs index db0060f25d..23be309a63 100644 --- a/talpid-core/src/firewall/windows.rs +++ b/talpid-core/src/firewall/windows.rs @@ -128,7 +128,7 @@ impl Firewall { let cfg = &WinFwSettings::new(allow_lan); self.set_blocked_state( &cfg, - &WinFwAllowedEndpointContainer::from(allowed_endpoint).as_endpoint(), + allowed_endpoint.map(|endpoint| WinFwAllowedEndpointContainer::from(endpoint)), ) } } @@ -255,13 +255,23 @@ impl Firewall { fn set_blocked_state( &mut self, winfw_settings: &WinFwSettings, - allowed_endpoint: &WinFwAllowedEndpoint<'_>, + allowed_endpoint: Option<WinFwAllowedEndpointContainer>, ) -> Result<(), Error> { log::trace!("Applying 'blocked' firewall policy"); + let endpoint = allowed_endpoint + .as_ref() + .map(WinFwAllowedEndpointContainer::as_endpoint); + unsafe { - WinFw_ApplyPolicyBlocked(winfw_settings, allowed_endpoint) - .into_result() - .map_err(Error::ApplyingBlockedPolicy) + WinFw_ApplyPolicyBlocked( + winfw_settings, + endpoint + .as_ref() + .map(|container| container as *const _) + .unwrap_or(ptr::null()), + ) + .into_result() + .map_err(Error::ApplyingBlockedPolicy) } } } diff --git a/talpid-core/src/tunnel_state_machine/disconnected_state.rs b/talpid-core/src/tunnel_state_machine/disconnected_state.rs index 7b54384780..b6b52bbc45 100644 --- a/talpid-core/src/tunnel_state_machine/disconnected_state.rs +++ b/talpid-core/src/tunnel_state_machine/disconnected_state.rs @@ -23,7 +23,7 @@ impl DisconnectedState { let result = if shared_values.block_when_disconnected { let policy = FirewallPolicy::Blocked { allow_lan: shared_values.allow_lan, - allowed_endpoint: shared_values.allowed_endpoint.clone(), + allowed_endpoint: Some(shared_values.allowed_endpoint.clone()), #[cfg(target_os = "macos")] dns_redirect_port: shared_values.filtering_resolver.listening_port(), }; diff --git a/talpid-core/src/tunnel_state_machine/error_state.rs b/talpid-core/src/tunnel_state_machine/error_state.rs index b12beecff4..7fe95c9f67 100644 --- a/talpid-core/src/tunnel_state_machine/error_state.rs +++ b/talpid-core/src/tunnel_state_machine/error_state.rs @@ -22,7 +22,7 @@ impl ErrorState { ) -> Result<(), FirewallPolicyError> { let policy = FirewallPolicy::Blocked { allow_lan: shared_values.allow_lan, - allowed_endpoint: shared_values.allowed_endpoint.clone(), + allowed_endpoint: Some(shared_values.allowed_endpoint.clone()), #[cfg(target_os = "macos")] dns_redirect_port: shared_values.filtering_resolver.listening_port(), }; |