Aleksandr Bogomiakov
5495cb5b34
When file capabilities are granted with `sudo setcap ...+p`, capabilities are placed into the thread's permitted set rather than its effective set. While TUN interface provisioning in `tsunagi` properly acquired and dropped CAP_NET_ADMIN using `caps::raise`, `tsunagi-tcp-tls` attempted to bind port 443 directly without activating CAP_NET_BIND_SERVICE, resulting in EACCES (os error 13 Permission denied). Fixes and improvements: - Add `caps` dependency to `tsunagi-tcp-tls` on Linux. - Implement `NetBindServiceGuard` to temporarily raise CAP_NET_BIND_SERVICE into the effective set for the synchronous `TcpListener::bind` invocation and immediately drop it afterwards. - Clarify diagnostic warnings to distinguish between default port 443 fallback and explicitly requested port failure. - Update all privilege diagnostics and error hints across the codebase to uniformly recommend granting both capabilities: `sudo setcap cap_net_admin,cap_net_bind_service+p <path>`. Validation on Linux: - `cargo fmt --all -- --check` passed. - `cargo clippy --locked --workspace --all-targets -- -D warnings` passed. - `cargo test --locked --workspace --all-targets` passed (all workspace unit, integration, and protocol tests passed).
42 lines
1.1 KiB
TOML
42 lines
1.1 KiB
TOML
[package]
|
|
name = "tsunagi-tcp-tls"
|
|
version = "0.1.0"
|
|
description = "TCP TLS 443 transport and E2EE tunnel protocol for tsunagi mesh networks."
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
|
|
[dependencies]
|
|
tsunagi = { path = "../tsunagi", version = "0.1.0" }
|
|
iroh.workspace = true
|
|
tokio = { workspace = true, features = ["net", "io-util", "time", "sync", "macros"] }
|
|
rustls = "0.23"
|
|
tokio-rustls = "0.26"
|
|
rcgen = { version = "0.14", default-features = false, features = ["ring"] }
|
|
x25519-dalek = { version = "2.0", features = ["static_secrets"] }
|
|
chacha20poly1305 = "0.10"
|
|
sha2 = "0.11"
|
|
hkdf = "0.13"
|
|
rand = "0.10"
|
|
subtle = "2.6"
|
|
zeroize = { version = "1.9", features = ["derive"] }
|
|
bytes.workspace = true
|
|
serde.workspace = true
|
|
postcard.workspace = true
|
|
tracing.workspace = true
|
|
thiserror.workspace = true
|
|
hex.workspace = true
|
|
netdev = "0.46"
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
caps = "0.5"
|
|
|
|
[dev-dependencies]
|
|
tsunagi = { path = "../tsunagi", features = ["testing"] }
|
|
tempfile.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|