LLT-6647: Use libfirewall.so #1566

stalowyjez · 2025-11-06T16:17:42Z

Problem

Libtelio should use dynamically loaded libfirewall.so library

Solution

Add loader, load firewall library and use it instead of the implementation inside telio-firewall, which this PR removes.

☑️ Definition of Done checklist

Commit history is clean (requirements)
README.md is updated
Functionality is covered by unit or integration tests

mathiaspeters · 2025-12-19T15:46:36Z

Cargo.toml

 once_cell.workspace = true
 nat-detect.workspace = true
 time.workspace = true
+libloading = "0.8.9"


Let's make this a workspace dependency since it's used in two crates

Which is the second crate that uses it?

mathiaspeters · 2025-12-19T15:47:07Z

.env

@@ -1 +1 @@
-TRIGGERED_REF=LLT-6812-add_jobs_for_integration_tests
+TRIGGERED_REF=LLT-6647-add_fixes_for_libfirewall_loading


Gentle reminder to remember to update this

crates/telio-firewall/src/firewall.rs

mathiaspeters · 2025-12-19T15:50:35Z

crates/telio-firewall/src/firewall.rs

+        #[cfg(any(target_os = "macos", target_os = "ios", target_os = "tvos",))]
+        let lib_name = "libfirewall.dylib";
+
+        #[cfg(target_os = "windows")]
+        let lib_name = "firewall.dll";
+
+        #[cfg(not(any(
+            target_os = "macos",
+            target_os = "ios",
+            target_os = "tvos",
+            target_os = "windows"
+        )))]
+        let lib_name = "libfirewall.so";
+
+        // We want to use this path when these are our tests or libtelio tests
+        let libfirewall_path = PathBuf::from(lib_name);


libloading can do this for you: https://docs.rs/libloading/latest/libloading/fn.library_filename.html

mathiaspeters · 2025-12-19T15:57:26Z

nat-lab/bin/client


 /libtelio/nat-lab/bin/configure_route.sh primary

+cp /libtelio/nat-lab/tests/uniffi/libfirewall.so /usr/lib/libfirewall.so


Is this executed if I run natlab locally? Because if so this would fail when executing locally and I think personally I would rather have the tests that depend on libfirewall fail if this copy fails, rather than the container setup failing

Hmm, co should that be checked and maybe-copied in the beginning in the any firewall test? Do you have some particular solution on your mind? Should that be some additional option when creating connection, or just a function to run or sth else?

mathiaspeters · 2025-12-19T15:59:02Z

nat-lab/tests/utils/vm/mac_vm_util.py

+            f"{DIST_PATH}libfirewall.dylib",
+            f"{NATLAB_CWD}/libfirewall.dylib",
+            True,


Same here, I would rather have this succeed (with a warning) if the file is not there than failing at this stage

mathiaspeters · 2025-12-19T16:04:30Z

src/device/wg_controller.rs

 }

+#[cfg(feature = "enable_firewall")]
 fn upsert_peer_whitelist<F: Firewall>(


Were all of these basically no-ops when we were using telio-firewall?

I'm not sure if that's what you mean, but it seems that the only thing it was doing when StatefullFirewall was not used, it was just feeding the pet firewall (which wasn't doing any real work) with configs from time to time

Since it's a generated file, it doesn't make sense to complain about too long function or unused variable.

Co-authored-by: Mathias Peters <52065850+mathiaspeters@users.noreply.github.com>

stalowyjez requested a review from a team as a code owner November 6, 2025 16:17

stalowyjez marked this pull request as draft November 6, 2025 16:18

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from 73ad664 to a1dd30e Compare November 6, 2025 16:35

stalowyjez temporarily deployed to Internal November 6, 2025 16:35 — with GitHub Actions Inactive

stalowyjez temporarily deployed to Internal November 7, 2025 11:06 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from e84422e to 3449633 Compare December 8, 2025 15:52

stalowyjez temporarily deployed to Internal December 8, 2025 15:52 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from 3449633 to e97d8d9 Compare December 8, 2025 16:02

stalowyjez temporarily deployed to Internal December 8, 2025 16:03 — with GitHub Actions Inactive

stalowyjez temporarily deployed to Internal December 9, 2025 11:01 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from a9c4f30 to 9e04ce8 Compare December 9, 2025 11:32

stalowyjez temporarily deployed to Internal December 9, 2025 11:32 — with GitHub Actions Inactive

stalowyjez temporarily deployed to Internal December 9, 2025 14:56 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from 2e519e4 to ea4dbac Compare December 9, 2025 15:52

stalowyjez temporarily deployed to Internal December 9, 2025 15:52 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from ea4dbac to 61830c1 Compare December 11, 2025 13:00

stalowyjez temporarily deployed to Internal December 11, 2025 13:00 — with GitHub Actions Inactive

stalowyjez temporarily deployed to Internal December 11, 2025 15:16 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from de8f7b6 to dc263c8 Compare December 11, 2025 20:38

stalowyjez temporarily deployed to Internal December 11, 2025 20:38 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from dc263c8 to 76c0f19 Compare December 11, 2025 21:57

stalowyjez temporarily deployed to Internal December 11, 2025 21:58 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from 76c0f19 to 058fa4f Compare December 12, 2025 14:48

stalowyjez temporarily deployed to Internal December 12, 2025 14:48 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from 058fa4f to ddeb5a8 Compare December 14, 2025 22:34

stalowyjez temporarily deployed to Internal December 14, 2025 22:34 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from ddeb5a8 to f21965b Compare December 15, 2025 09:41

stalowyjez temporarily deployed to Internal December 15, 2025 09:41 — with GitHub Actions Inactive

stalowyjez temporarily deployed to Internal December 15, 2025 15:54 — with GitHub Actions Inactive

stalowyjez temporarily deployed to Internal December 16, 2025 01:45 — with GitHub Actions Inactive

stalowyjez temporarily deployed to Internal December 16, 2025 15:45 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from d5bfd68 to 868fe02 Compare December 16, 2025 15:54

stalowyjez temporarily deployed to Internal December 16, 2025 15:54 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from 868fe02 to e3e2f78 Compare December 16, 2025 16:57

stalowyjez temporarily deployed to Internal December 16, 2025 16:57 — with GitHub Actions Inactive

stalowyjez temporarily deployed to Internal December 16, 2025 21:34 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from 40c7dd3 to 58e207b Compare December 16, 2025 22:49

stalowyjez temporarily deployed to Internal December 16, 2025 22:50 — with GitHub Actions Inactive

stalowyjez added 2 commits December 17, 2025 02:06

Update conntrack to post-imcp-proptest

1946028

Add bindgen glue code

4048f53

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from 58e207b to f542f59 Compare December 17, 2025 00:06

stalowyjez temporarily deployed to Internal December 17, 2025 00:06 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from f542f59 to 9dee7a3 Compare December 17, 2025 09:09

stalowyjez temporarily deployed to Internal December 17, 2025 09:10 — with GitHub Actions Inactive

stalowyjez marked this pull request as ready for review December 17, 2025 09:27

stalowyjez changed the base branch from main to LLT-6812-move_libfirewall_dependent_tests_to_gitlab December 17, 2025 09:31

mathiaspeters reviewed Dec 19, 2025

View reviewed changes

stalowyjez temporarily deployed to Internal December 22, 2025 19:35 — with GitHub Actions Inactive

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from e14f7d8 to 9578ef9 Compare December 22, 2025 20:41

stalowyjez temporarily deployed to Internal December 22, 2025 20:41 — with GitHub Actions Inactive

stalowyjez and others added 8 commits December 22, 2025 23:00

Use dynamically loaded libfirewall

d9184dd

Remove libfirewall internal files

b6fba7f

Silence clippy warnings in libfirewall.rs

e847b49

Since it's a generated file, it doesn't make sense to complain about too long function or unused variable.

Fixing pipelines

7f31e5a

Remove asserts for specific arch

1a2a553

Make firewall compile-time optinal

6c08b99

Copy libfirewall to client containers

570f1e9

Fix firewall struct name

885dcfe

Co-authored-by: Mathias Peters <52065850+mathiaspeters@users.noreply.github.com>

stalowyjez force-pushed the LLT-6647-use_libfirewall branch from 9578ef9 to 885dcfe Compare December 22, 2025 21:02

stalowyjez temporarily deployed to Internal December 22, 2025 21:02 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

LLT-6647: Use libfirewall.so #1566

LLT-6647: Use libfirewall.so #1566

Uh oh!

stalowyjez commented Nov 6, 2025 •

edited

Loading

Uh oh!

mathiaspeters Dec 19, 2025

Uh oh!

stalowyjez Dec 22, 2025

Uh oh!

mathiaspeters Dec 19, 2025

Uh oh!

Uh oh!

mathiaspeters Dec 19, 2025

Uh oh!

stalowyjez Dec 22, 2025

Uh oh!

mathiaspeters Dec 19, 2025

Uh oh!

stalowyjez Dec 22, 2025

Uh oh!

mathiaspeters Dec 19, 2025

Uh oh!

mathiaspeters Dec 19, 2025

Uh oh!

stalowyjez Dec 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -1 +1 @@
		TRIGGERED_REF=LLT-6812-add_jobs_for_integration_tests
		TRIGGERED_REF=LLT-6647-add_fixes_for_libfirewall_loading


		/libtelio/nat-lab/bin/configure_route.sh primary

		cp /libtelio/nat-lab/tests/uniffi/libfirewall.so /usr/lib/libfirewall.so

LLT-6647: Use libfirewall.so #1566

Are you sure you want to change the base?

LLT-6647: Use libfirewall.so #1566

Uh oh!

Conversation

stalowyjez commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

☑️ Definition of Done checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

stalowyjez commented Nov 6, 2025 •

edited

Loading