chore(connlib): add some additional details about UnallowedPacket (#4241

)

ref: #4018 

extracted from #4163

rust/connlib/shared/src/error.rs

@@ -1,6 +1,7 @@
 //! Error module.
 use base64::{DecodeError, DecodeSliceError};
 use boringtun::noise::errors::WireGuardError;
+use std::net::IpAddr;
 use thiserror::Error;
 use tokio::task::JoinError;
 
@@ -156,8 +157,8 @@ pub enum ConnlibError {
 
     #[error(transparent)]
     Snownet(#[from] snownet::Error),
-    #[error("Detected non-allowed packet in channel")]
-    UnallowedPacket,
+    #[error("Detected non-allowed packet in channel from {0}")]
+    UnallowedPacket(IpAddr),
 
     // Error variants for `systemd-resolved` DNS control
     #[error("Failed to control system DNS with `resolvectl`")]

rust/connlib/tunnel/src/gateway.rs

@@ -276,6 +276,8 @@ impl GatewayState {
         let packet = match peer.untransform(packet.into()) {
             Ok(packet) => packet,
             Err(e) => {
+                // Note: this can happen with apps such as cURL that if started before the tunnel routes are address
+                // source ips can be sticky.
                 tracing::warn!(%conn_id, %local, %from, "Failed to transform packet: {e}");
 
                 return None;

rust/connlib/tunnel/src/peer.rs

@@ -85,7 +85,7 @@ where
         let (packet, addr) = self.transform.packet_untransform(packet)?;
 
         if !self.is_allowed(addr) {
-            return Err(Error::UnallowedPacket);
+            return Err(Error::UnallowedPacket(addr));
         }
 
         Ok(packet)