Firezone

Recent Commits

• Thomas Eizinger(25 Oct 26)

  refactor(connlib): drop the reasons from timeout deadlines (#15959) `poll_timeout` in snownet and tunnel-proto returned a label naming the timer alongside each deadline. Nothing reads those labels, so the deadlines are now plain `Instant`s.

• Thomas Eizinger(25 Oct 26)

  refactor(fuzz): one probe assertion per expected outcome (#15945) The probe assertions pick which observations to expect from the outcome the reference predicts. Two TCP cases were filed under an outcome that doesn't match what actually happens, so the assertions also had to look at the request to handle them: - A connect to a port nobody listens on was predicted as a rejection. But the request does reach the far end, which answers with a reset, so it looks like a round trip. - A write that gets echoed back was predicted as an ordinary round trip. But the Client sees it as a completed stream, not as a received request and a reply. A round trip now also says how the far end answers: an echo, a reset, the echoed write, or a reset to the write. A rejection only means an ICMP error sent before the request reaches anyone. Every outcome then has exactly one expected set of observations, and the assertions match on the outcome alone, one arm per case. Co-authored-by: Claude <[email protected]>

• Thomas Eizinger(25 Oct 26)

  refactor(connlib): resolve recursive DNS queries in a task (#15958) Recursive DNS queries are now resolved by their own task instead of inside `Io`'s event loop. The task owns the DoH clients and their bootstrap, the bootstrap DNS client, the Gateway's nameserver selection and the per-query timeouts. It talks to the event loop over channels: queries go in, responses come out, and changes to the system resolvers, the configured upstreams and network resets arrive as control messages. DoH clients for the configured upstreams are warmed up by the task itself. The event loop no longer polls DNS futures, DoH bootstrap or nameserver evaluation, and `Io` no longer depends on tokio's timers.

• Thomas Eizinger(25 Oct 26)

  refactor(fuzz): hold resource authorizations in one map (#15927) The reference client tracked what it is connected to in three sets, one per resource kind, plus a per-site status that had to be kept in step with them. A client's authorizations are one thing: the resources the portal authorized and the Gateway each goes through. The model now holds them in one map and derives a site's status from it, online while the client holds an authorization for a resource in the site. The Gateway preferred per site stays separate, as it outlives the authorizations. --------- Co-authored-by: Claude <[email protected]>

• Firezone Bot(25 Oct 26)

  chore(fuzz): grow the tunnel-proto corpus (#15855) The nightly fuzz job found inputs for `tunnel-proto` that reach edges the committed corpus did not.

• Firezone Bot(25 Oct 26)

  chore(fuzz): grow the x509-claims corpus (#15952) The nightly fuzz job found inputs for `x509-claims` that reach edges the committed corpus did not.

• Firezone Bot(25 Oct 26)

  chore(fuzz): grow the ip-packet corpus (#15934) The nightly fuzz job found inputs for `ip-packet` that reach edges the committed corpus did not.

• Thomas Eizinger(25 Oct 26)

  refactor(connlib): let the UDP sockets own their socket factory (#15938) `Io` passed the same UDP socket factory to `Sockets` on startup and on every reset. `Sockets` now keeps the factory it was created with and rebinds through it. Sockets created without a factory, such as the fake sockets in tests, keep their sockets across a rebind and only drop the items waiting for room.

• Thomas Eizinger(25 Oct 26)

  refactor(fuzz): split packet verdict from state update (#15926) The reference model's `dispatch` predicted a packet's outcome while mutating the client state it read along the way: connecting to the resource, recording and installing peer authorizations and preparing DNS resolutions. That made the decision hard to read as the list of rules it implements, and packets on retained flows went through a separate, partial copy of the Gateway's checks. The prediction is now a pure `verdict` that returns the outcome together with the authorization the sender holds afterwards, applied in one place, and a packet on a retained flow is judged by the same code as a new one. Related: #15800 --------- Co-authored-by: Claude <[email protected]>

• Jamil(25 Oct 26)

  fix(connlib): map the EU API host to its mTLS host (#15948) When a client signs in with a device certificate, it has to connect to a special mTLS address instead of the normal API address. The client only knew that address for the US cloud and staging. This teaches it the one for the new Firezone Cloud (EU), so certificate-based device trust also works there.

• Jamil(25 Oct 26)

  fix(portal): require the conditions entitlement in the API (#15956) The REST API accepted policy conditions from accounts whose plan does not include them. The web UI already dropped them. The API now returns 403 for non-empty conditions without the `policy_conditions` entitlement, like it does for postures. Removing conditions with an empty list is still allowed, so an account can clean up after a downgrade.

• Jamil(25 Oct 26)

  fix(portal): require attestation per policy (#15955) An attested device is now matched to posture provider records only by the MDM device ID and serial number that its certificate proves. Before, the serial number the Client reported also counted. Device attestation is now a "Require device attestation" switch on the policy instead of a policy condition, so every plan can use it. The switch needs at least one trust anchor to turn on. The posture editor warns when device checks are set and attestation is off. In the REST API, the `device_attested` condition is replaced by the `require_attestation` field. --- Fixes https://github.com/firezone/firezone/security/advisories/GHSA-fr97-vvc7-6r4p

• Jamil(24 Oct 26)

  fix(portal): fix provider forms and shorten admin notices (#15951) Fix removal of additional verified tenants and domains, hide empty verification alerts for unrelated validation errors, and clear verification errors when switching or reopening provider forms. Shorten Entra and Google admin notices to the security benefit and action item, and route replies to support. Related: #15942

• Jamil(23 Oct 26)

  feat(portal): allow multiple verified tenants and domains (#15942) Allow Entra and Google providers to combine multiple verified organizations behind one sign-in option. Migrate Entra to tenant ID arrays, verify additions through the existing setup flow, and expose tenant/domain arrays through REST and MCP. Prevent overlapping tenants or Workspace domains within an account, including disabled providers. Allow multiple Google Workspace providers with disjoint domains and one provider without domains per account. New providers without domains accept personal accounts only; existing unrestricted providers retain their behavior until an admin verifies Workspace domains. Keep Entra and Google names as entered and retain the original Entra verification scopes. Add temporary Portal.Ops helpers to notify affected Entra and Google account admins using account-specific HTML and plaintext notices with the existing email styling. Helpers preview recipients and prompt before queueing; no notices have been sent. Supersedes #15941. Related: https://github.com/firezone/website/pull/838

• Thomas Eizinger(23 Oct 26)

  ci(rust): re-pin cargo-sort 2.1.4 checksums (#15944) The `v2.1.4` tag of `cargo-sort` moved and its release assets were rebuilt, so every job that installs it without a warm tool cache fails `mise`'s checksum verification. Co-authored-by: Claude <[email protected]>

• Jamil(23 Oct 26)

  fix(portal): check the Entra tenant on sign-in (#15940) Entra sign-in now accepts an ID token only when it comes from the tenant that the auth provider was verified with.

• Jamil(23 Oct 26)

  build(deps): bump plug_crypto to 2.2.1 (#15939) Bumps `plug_crypto` from 2.2.0 to 2.2.1. Validation: - `mix hex.audit` - `mix deps.audit` - `mix compile --warnings-as-errors` - `git diff --check`

• Thomas Eizinger(23 Oct 26)

  refactor(connlib): drop the Gateway's per-peer event queue (#15937) `ClientOnGateway` has a queue of buffered events that nothing ever pushes to, yet `GatewayState::poll_event` visited every peer on each call to drain it. This removes the queue and the loop.

• Thomas Eizinger(23 Oct 26)

  test(fuzz): extract the seeded RNG into its own crate (#15936)

• Thomas Eizinger(23 Oct 26)

  build(deps): bump ctutils to 0.4.5 (#15930) Versions of `ctutils` before 0.4.4 can generate branches in the mask generation of `Choice` on common platforms, and in its `u128` comparisons on 32-bit targets, so they are not constant-time. This is a new advisory that fails `cargo deny` on every PR. Related: https://github.com/RustCrypto/utils/pull/1569

• Thomas Eizinger(23 Oct 26)

  feat(connlib): run crypto inline without workers (#15928) A crypto worker that dies or cannot be spawned no longer takes the tunnel down. Today, losing every worker raises a fatal error in both the Client and the Gateway, and if none can be spawned at all, every packet is dropped. Instead, connlib now removes a stopped worker and carries on, and once none are left it degrades to encrypting and decrypting on the event-loop thread.

• Thomas Eizinger(23 Oct 26)

  test(fuzz): let the stub portal pick the first candidate (#15923) The portal authorizes the first resource an access request names, which is the client's most preferred one. The stub portal picked a candidate by a fuzzer-chosen index instead. The client routes through the most specific allowed resource and names only that one, so the two agreed for ordinary packets, but a re-request after a `NoAuthorization` event can name several resources, and there the stub could authorize a less preferred resource than the reference model predicts. The stub now takes the first candidate like the portal does, and the index is no longer part of the generated input. Related: #15745 Co-authored-by: Claude <[email protected]>

• Thomas Eizinger(23 Oct 26)

  test(connlib): add fake UDP sockets for tests (#15925) `Sockets::fake` creates the IPv4 and IPv6 sockets without their threads and hands the threads' channel ends to the test, which can then fill, stall or release them deterministically. `remove_v4` / `remove_v6` drop a family's socket to model a host without it, and `num_waiting` exposes how many items wait for room in a socket's channel. --------- Co-authored-by: Claude <[email protected]>

• dependabot[bot](23 Oct 26)

  build(deps): bump the codeql group (#15378) Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.39.0 Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.39.0 Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.39.0 Updates `github/codeql-action/init` from 4.37.7 to 4.39.0 Updates `github/codeql-action/autobuild` from 4.37.7 to 4.39.0 Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Thomas Eizinger(23 Oct 26)

  test(fuzz): expect exact traces under ICE-less connections (#15924) The reference model tolerates two packet losses that classic ICE produces: the packet that wakes a WireGuard session idle past its re-key window, and packets sent to a peer that reset its connections within the ICE timeout. Both were granted regardless of the connection mode. ICE-less connections re-key in place and keep their session across a reset, so the reference now expects every trace to be exact when the portal hands out ICE-less flows; the committed corpus replays cleanly that way. The model, the transitions and the assertions that exist only for classic ICE carry a TODO so they can be removed together with it. Related: #14019 Related: #14306 Co-authored-by: Claude <[email protected]>

• Thomas Eizinger(23 Oct 26)

  test(connlib): move `Io` tests into their own file (#15922) The `Io` tests move from an inline module in `io.rs` to `io/tests.rs`, so the file can grow without bloating `io.rs`. No test changes. Co-authored-by: Claude <[email protected]>

• Thomas Eizinger(23 Oct 26)

  test(connlib): share a fake TUN device for tests (#15912) Tests now get a fake TUN device from the `tun` crate via `tun::fake`, which isn't backed by a real TUN device, instead of each defining their own. The `Io` tests that never touched the TUN device no longer set one up. --------- Co-authored-by: Claude <[email protected]>

• Thomas Eizinger(23 Oct 26)

  refactor(connlib): split UDP socket channels from their thread (#15913) The channels connecting a UDP socket's thread to the event loop are now created separately from spawning the thread, as `MainThreadEnds` and `SocketThreadEnds`. This lets a test hold the thread's ends directly and fill, stall or release them deterministically, without spawning a socket thread. No behaviour change. Co-authored-by: Claude <[email protected]>

• Thomas Eizinger(23 Oct 26)

  chore(rust): fix cargo-deny warnings and deny license ones (#15890) The advisory database now lists `webpki-roots` 0.26.11 as unaffected by RUSTSEC-2026-0381, and no crate in the tree uses the NCSA license anymore, so both allowances are dropped. `dlopen2` declares its license only via `license-file`, so it is clarified as MIT, pinned to the hash of that file. The `ring` clarification is dropped: its hash no longer matches the license file, and `ring` declares its license in its manifest. To keep these from piling up again, unused license allowances and exceptions, and crates without a license field (including ones whose clarification no longer matches), now fail the check instead of warning. --------- Co-authored-by: Claude <[email protected]>

• dependabot[bot](23 Oct 26)

  build(deps): bump org.robolectric:robolectric from 4.16.1 to 4.17 in /kotlin/android (#15351) Robolectric 4.17 needs `--add-opens=java.base/jdk.internal.access=ALL-UNNAMED` on the unit test JVM. Its `FileDescriptor` interceptor reflects into `jdk.internal.access.SharedSecrets`, which JDK 17+ denies otherwise, failing every Robolectric test with an `IllegalAccessException`. See Robolectric's [notes on running with Java 17 and higher](https://robolectric.org/getting-started/). --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude <[email protected]>