feat(linux-client): generate firezone-id (device ID) automatically if it's not provided at launch #3920

ReactorScram · 2024-03-04T21:17:11Z

Changes that are breaking (but these aren't in production so it should be okay)

Windows, renaming device_id.json to firezone-id.json to match the rest of the code
Linux GUI, storing the firezone-id under /var/lib instead of under $HOME
Linux GUI, bails out if not run with sudo --preserve-env by detecting $HOME == root or $USER != root

…ed when it's not there already

vercel · 2024-03-04T21:17:16Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Ignored Deployment

Name	Status	Preview	Comments	Updated (UTC)
firezone	⬜️ Ignored (Inspect)	Visit Preview		Mar 7, 2024 3:39pm

github-actions · 2024-03-04T21:19:01Z

Terraform Cloud Plan Output

Plan: 8 to add, 7 to change, 2 to destroy.

Terraform Cloud Plan

github-actions · 2024-03-04T21:25:30Z

Performance Test Results

TCP

Test Name	Received/s	Sent/s	Retransmits
direct-tcp-client2server	65.8 MiB (+0%)	66.3 MiB (+0%)	39 (-22%)
direct-tcp-server2client	53.1 MiB (-3%)	53.4 MiB (-3%)	38 (+27%)
relayed-tcp-client2server	29.2 MiB (+3%)	32.3 MiB (+4%)	0 (-100%)
relayed-tcp-server2client	28.2 MiB (-1%)	30.3 MiB (+1%)	149 (-11%)

UDP

Test Name	Total/s	Jitter	Lost
direct-udp-client2server	50.0 MiB (-0%)	0.27ms (+41%)	0.00% (NaN%)
direct-udp-server2client	50.0 MiB (+0%)	0.24ms (+17%)	0.00% (NaN%)
relayed-udp-client2server	50.0 MiB (-0%)	0.35ms (+58%)	19.99% (-20%)
relayed-udp-server2client	50.0 MiB (+0%)	0.71ms (+45%)	19.76% (+7%)

ReactorScram · 2024-03-04T21:54:34Z

docker-compose.yml

@@ -113,7 +113,6 @@ services:
      FIREZONE_TOKEN: "n.SFMyNTY.g2gDaANtAAAAJGM4OWJjYzhjLTkzOTItNGRhZS1hNDBkLTg4OGFlZjZkMjhlMG0AAAAkN2RhN2QxY2QtMTExYy00NGE3LWI1YWMtNDAyN2I5ZDIzMGU1bQAAACtBaUl5XzZwQmstV0xlUkFQenprQ0ZYTnFJWktXQnMyRGR3XzJ2Z0lRdkZnbgYAGUmu74wBYgABUYA.UN3vSLLcAMkHeEh5VHumPOutkuue8JA6wlxM9JxJEPE"
      RUST_LOG: firezone_linux_client=trace,wire=trace,connlib_client_shared=trace,firezone_tunnel=trace,connlib_shared=trace,boringtun=debug,snownet=debug,str0m=debug,info
      FIREZONE_API_URL: ws://api:8081
-      FIREZONE_ID: D0455FDE-8F65-4960-A778-B934E4E85A5F


Remove FIREZONE_ID from docker-compose to prove that the change works.

ReactorScram · 2024-03-04T21:55:12Z

rust/connlib/shared/src/device_id.rs

@@ -1,7 +1,7 @@
-use tokio::fs;
+use std::fs;


Gave up on tokio::fs for this since the Linux CLI client doesn't have a Tokio runtime. I personally like async FS operations but it's not a big deal, especially since it's only used at startup.

ReactorScram · 2024-03-04T21:57:21Z

rust/connlib/shared/src/lib.rs

@@ -9,6 +9,7 @@ pub mod control;
 pub mod error;
 pub mod messages;

+pub mod device_id;


This module moved upstream to connlib_shared so that the Linux CLI, Linux GUI, and Windows GUI can all share it.

ReactorScram · 2024-03-04T21:57:46Z

rust/linux-client/src/main.rs

@@ -19,10 +19,16 @@ fn main() -> Result<()> {
        handle,
    };

+    // AKA "Device ID", not the Firezone slug


Just in case I forget again

:(

Signed-off-by: Reactor Scram <ReactorScram@users.noreply.github.com>

…one into feat/generate-firezone-id

ReactorScram · 2024-03-05T18:39:35Z

rust/gui-client/src-tauri/src/client/logging.rs

@@ -54,6 +54,7 @@ pub(crate) fn setup(log_filter: &str) -> Result<Handles, Error> {
        );
    }
    LogTracer::init()?;
+    tracing::debug!(?log_path, "Log path");


Used to debug CI. Switching between sudo and non-sudo makes the logs show up in different places, and it's easier just to double-check in stderr on a dev system with a terminal.

ReactorScram · 2024-03-05T18:40:05Z

rust/gui-client/src-tauri/src/client/settings.rs

@@ -110,7 +110,8 @@ pub(crate) async fn save(settings: &AdvancedSettings) -> Result<()> {
        .parent()
        .context("settings path should have a parent")?;
    tokio::fs::create_dir_all(dir).await?;
-    tokio::fs::write(path, serde_json::to_string(settings)?).await?;
+    tokio::fs::write(&path, serde_json::to_string(settings)?).await?;
+    tracing::debug!(?path, "Saved settings");


Used for CI debugging

jamilbk · 2024-03-05T18:53:35Z

Linux GUI, storing the firezone-id under /var/lib instead of under $HOME

Makes sense. This will be needed in #3713

jamilbk

Awesome work! I'll leave the approval to @conectado for the Rust bits.

jamilbk · 2024-03-05T19:00:28Z

rust/connlib/shared/src/lib.rs

+/// Only properly implemented on Linux and Windows (platforms with Tauri and headless client)
+pub mod device_id;
+
+// Must be compiled on Mac so the Mac runner can do `version-check` on `linux-client`


Hmm I can refactor that if it continues to be a nuissance.

I don't remember what I needed it for, but I did just stub out the Tauri client for macOS in #3977 so I can do some of the checks locally without waiting on CI. So that might go in soon.

We could rename linux-client to cli-client too so it's not weird to say that a Mac might compile the "Linux" client even if headless Mac clients are not supported for production.

This would allow me to fix compile / check / fmt errors from macOS CI runners locally, e.g. #3920 (comment) It can't sign in or start connlib, but it shows the GUI ![image](https://github.com/firezone/firezone/assets/13400041/5307b66e-9874-4fe5-a6a6-43082dd6e385) --------- Signed-off-by: Reactor Scram <ReactorScram@users.noreply.github.com> Co-authored-by: User <user@Users-MacBook-Pro.local> Co-authored-by: Jamil <jamilbk@users.noreply.github.com>

Signed-off-by: Reactor Scram <ReactorScram@users.noreply.github.com>

ReactorScram · 2024-03-05T22:43:37Z

Taking this back to drafts since Jamil reminded me that sudo --preserve-env would make this all much simpler.

conectado

Looks good, just left a couple of comments

rust/connlib/shared/src/device_id.rs

conectado · 2024-03-06T02:31:26Z

rust/connlib/shared/src/device_id.rs

+    // Try to read it from the disk
+    if let Some(j) = fs::read_to_string(&path)
+        .ok()
+        .and_then(|s| serde_json::from_str::<DeviceIdJson>(&s).ok())


Is there any point on using DeviceIdJson it seems that we only read and write the id we could just use a plain string.

I was thinking in case we ever need to add other fields or version it for any reason. I can change it to a string but I'll have to delete the ID file on my dev systems and ask any beta customers who have used it to do the same, or the whole JSON object will be the ID. (Which the portal can probably handle, it'll just look odd)

Or I could stick a schema version in advanced_settings and then it can do the migration automatically (If there's no version stored, rewrite firezone-id, if there is a version, leave it alone) but then it's not atomic since it's two files.

JSON is probably fine, we use it already for log storage.

Not sure how the other settings are stored, but you could even stick it in there theoretically if we want to persist settings across installs

…e-id

ReactorScram · 2024-03-07T15:40:32Z

rust/connlib/shared/Cargo.toml

@@ -28,7 +29,7 @@ resolv-conf = "0.7.0"
 serde = { version = "1.0", default-features = false, features = ["derive", "std"] }
 serde_json = { version = "1.0", default-features = false, features = ["std"] }
 thiserror = { version = "1.0", default-features = false }
-tokio = { version = "1.36", default-features = false, features = ["rt", "rt-multi-thread"]}
+tokio = { version = "1.36", default-features = false, features = ["fs", "rt", "rt-multi-thread"]}


This isn't part of the change but I noticed it when running Cargo clippy, I guess the dependency solver had been adding fs to Tokio but this crate wasn't asking for it directly.

Is there a way to find these problems automatically?

ReactorScram · 2024-03-07T15:42:47Z

rust/gui-client/src-tauri/src/client/elevation.rs

+        // Must use `eprintln` here because `tracing` won't be initialized yet.
+
+        let user = std::env::var("USER").context("USER env var should be set")?;
+        if user != "root" {
+            eprintln!("Firezone must run with root permissions to set up DNS. Re-run it with `sudo --preserve-env`");
+            return Ok(false);
+        }
+        let home = std::env::var("HOME").context("HOME env var should be set")?;
+        if home == "/root" {
+            eprintln!("If Firezone is run with `$HOME == /root`, deep links will not work. Re-run it with `sudo --preserve-env`");
+            // If we don't bail out here, this message will probably never be read.
+            return Ok(false);
+        }
        Ok(true)
    }

    pub(crate) fn elevate() -> Result<()> {
-        todo!()
+        anyhow::bail!("Firezone does not self-elevate on Linux.");


I added all this stuff as part of debugging, when trying to get sudo working just right in CI. It's not directly related to firezone-id but it should go into main eventually.

Closes #3961 No tests yet, might be tricky to test since it's all I/O. I cued it off the device ID being generated, so it will have a minor merge conflict with #3920 ```[tasklist] ### Before merging - [ ] UI polish, or disable the welcome screen temporarily ``` <img width="664" alt="image" src="https://github.com/firezone/firezone/assets/13400041/d5def59c-b075-4135-91e5-85f9f9212fa5"> --------- Co-authored-by: Jamil Bou Kheir <jamilbk@users.noreply.github.com>

ReactorScram added 2 commits March 4, 2024 14:59

refactor: make device_id sync

4963470

double up the smoke tests to check that the device ID is only generat…

dfad5c5

…ed when it's not there already

ReactorScram added kind/feature New feature or request area/linux_client Linux client labels Mar 4, 2024

ReactorScram self-assigned this Mar 4, 2024

make it optional

f52edd0

ReactorScram commented Mar 4, 2024

View reviewed changes

ReactorScram added 17 commits March 4, 2024 16:01

patch macOS compile error

0f182cd

patch Windows and remember to run the client with sudo

79de6fb

fix paths

79ad37d

whoops that won't work

c380a0a

patch macOS

50a0cd9

patch script

65516e9

fix

4b3ac1c

fix

d55612f

fix

59d7f06

fix

47595eb

:(

Merge branch 'main' into feat/generate-firezone-id

5fae89a

Signed-off-by: Reactor Scram <ReactorScram@users.noreply.github.com>

fix

0683a3a

Merge branch 'feat/generate-firezone-id' of github.com:firezone/firez…

30d1ef7

…one into feat/generate-firezone-id

fix

8dea2e8

log log path

8c995f6

fix

39991c8

fix

b719854

ReactorScram commented Mar 5, 2024

View reviewed changes

ReactorScram marked this pull request as ready for review March 5, 2024 18:41

ReactorScram requested review from conectado and jamilbk March 5, 2024 18:41

jamilbk reviewed Mar 5, 2024

View reviewed changes

ReactorScram mentioned this pull request Mar 5, 2024

chore: make stub of the Tauri client for macOS #3977

Merged

Update smoke-test-gui-linux.sh

99e17f1

Signed-off-by: Reactor Scram <ReactorScram@users.noreply.github.com>

ReactorScram marked this pull request as draft March 5, 2024 22:42

ReactorScram added 2 commits March 5, 2024 16:45

remember to use preserve-env

2ccda26

bail out if we don't have the right perms and env

b85d88f

ReactorScram marked this pull request as ready for review March 5, 2024 23:14

jamilbk removed kind/feature New feature or request area/linux_client Linux client labels Mar 6, 2024

conectado reviewed Mar 6, 2024

View reviewed changes

ReactorScram mentioned this pull request Mar 6, 2024

feat(gui-client): Tauri welcome screen #4013

Merged

ReactorScram added 2 commits March 7, 2024 09:14

Merge remote-tracking branch 'origin/main' into feat/generate-firezon…

8c2f5d5

…e-id

remove thiserror type

9017b37

ReactorScram commented Mar 7, 2024

View reviewed changes

ReactorScram requested a review from conectado March 7, 2024 15:43

conectado approved these changes Mar 8, 2024

View reviewed changes

ReactorScram added this pull request to the merge queue Mar 8, 2024

Merged via the queue into main with commit 7211e88 Mar 8, 2024
65 checks passed

ReactorScram deleted the feat/generate-firezone-id branch March 8, 2024 16:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(linux-client): generate firezone-id (device ID) automatically if it's not provided at launch #3920

feat(linux-client): generate firezone-id (device ID) automatically if it's not provided at launch #3920

ReactorScram commented Mar 4, 2024 •

edited

vercel bot commented Mar 4, 2024 •

edited

github-actions bot commented Mar 4, 2024 •

edited

github-actions bot commented Mar 4, 2024 •

edited

ReactorScram Mar 4, 2024

ReactorScram Mar 4, 2024

ReactorScram Mar 4, 2024

ReactorScram Mar 4, 2024

ReactorScram Mar 5, 2024 •

edited

ReactorScram Mar 5, 2024

jamilbk commented Mar 5, 2024

jamilbk left a comment

jamilbk Mar 5, 2024

ReactorScram Mar 5, 2024

ReactorScram Mar 5, 2024

ReactorScram commented Mar 5, 2024

conectado left a comment

conectado Mar 6, 2024

ReactorScram Mar 7, 2024

jamilbk Mar 7, 2024

ReactorScram Mar 7, 2024

ReactorScram Mar 7, 2024

feat(linux-client): generate firezone-id (device ID) automatically if it's not provided at launch #3920

feat(linux-client): generate firezone-id (device ID) automatically if it's not provided at launch #3920

Conversation

ReactorScram commented Mar 4, 2024 • edited

vercel bot commented Mar 4, 2024 • edited

github-actions bot commented Mar 4, 2024 • edited

Terraform Cloud Plan Output

github-actions bot commented Mar 4, 2024 • edited

Performance Test Results

TCP

UDP

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ReactorScram Mar 5, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jamilbk commented Mar 5, 2024

jamilbk left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ReactorScram commented Mar 5, 2024

conectado left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ReactorScram commented Mar 4, 2024 •

edited

vercel bot commented Mar 4, 2024 •

edited

github-actions bot commented Mar 4, 2024 •

edited

github-actions bot commented Mar 4, 2024 •

edited

ReactorScram Mar 5, 2024 •

edited