support protobuf versioning

Cargo.toml

@@ -76,6 +76,7 @@ parse_link_header = "0.4"
 paste = "1.0"
 pgp = { version = "0.19", default-features = false }
 prost = "0.14"
+prost-types = "0.14"
 pulldown-cmark = "0.13"
 # match version used by sqlx
 rand = "0.8"

crates/defguard_core/src/enterprise/firewall/mod.rs

@@ -559,6 +559,7 @@ fn get_source_addrs(
                     None
                 }
             }
+            IpVersion::Unspecified => None,
         })
         .collect();
 

crates/defguard_core/src/enterprise/grpc/desktop_client_mfa.rs

@@ -1,5 +1,8 @@
 use defguard_common::{db::models::Settings, types::AuthFlowType};
-use defguard_proto::proxy::{ClientMfaOidcAuthenticateRequest, DeviceInfo, MfaMethod};
+use defguard_proto::{
+    client_types::MfaMethod,
+    proxy::{ClientMfaOidcAuthenticateRequest, DeviceInfo},
+};
 use openidconnect::{AuthorizationCode, Nonce};
 use tonic::Status;
 

crates/defguard_core/src/enterprise/grpc/polling.rs

@@ -2,7 +2,10 @@ use defguard_common::db::{
     Id,
     models::{Device, polling_token::PollingToken, user::User},
 };
-use defguard_proto::proxy::{DeviceInfo, InstanceInfoRequest, InstanceInfoResponse};
+use defguard_proto::{
+    client_types::{InstanceInfoRequest, InstanceInfoResponse},
+    proxy::DeviceInfo,
+};
 use sqlx::PgPool;
 use tonic::Status;
 

crates/defguard_core/src/events.rs

@@ -8,7 +8,7 @@ use defguard_common::db::{
         gateway::Gateway, group::Group, oauth2client::OAuth2Client, proxy::Proxy,
     },
 };
-use defguard_proto::proxy::MfaMethod;
+use defguard_proto::client_types::MfaMethod;
 
 use crate::{
     db::WebHook,

crates/defguard_core/src/grpc/client_version.rs

@@ -1,5 +1,5 @@
 use base64::{Engine, prelude::BASE64_STANDARD};
-use defguard_proto::proxy::{ClientPlatformInfo, DeviceInfo};
+use defguard_proto::{client_types::ClientPlatformInfo, proxy::DeviceInfo};
 use prost::Message;
 use semver::Version;
 

crates/defguard_core/src/grpc/mod.rs

@@ -194,7 +194,7 @@ impl InstanceInfo {
     }
 }
 
-impl From<InstanceInfo> for defguard_proto::proxy::InstanceInfo {
+impl From<InstanceInfo> for defguard_proto::client_types::InstanceInfo {
     fn from(instance: InstanceInfo) -> Self {
         Self {
             name: instance.name,

crates/defguard_core/src/grpc/proxy/client_mfa.rs

@@ -19,11 +19,16 @@ use defguard_common::{
     types::user_info::UserInfo,
 };
 use defguard_mail::templates::mfa_code_mail;
-use defguard_proto::proxy::{
-    self, AwaitRemoteMfaFinishRequest, AwaitRemoteMfaFinishResponse, ClientMfaFinishRequest,
-    ClientMfaFinishResponse, ClientMfaStartRequest, ClientMfaStartResponse,
-    ClientMfaTokenValidationRequest, ClientMfaTokenValidationResponse, CoreResponse, MfaMethod,
-    core_response::Payload,
+use defguard_proto::{
+    client_types::{
+        ClientMfaFinishRequest, ClientMfaFinishResponse, ClientMfaStartRequest,
+        ClientMfaStartResponse, MfaMethod,
+    },
+    proxy::{
+        self, AwaitRemoteMfaFinishRequest, AwaitRemoteMfaFinishResponse,
+        ClientMfaTokenValidationRequest, ClientMfaTokenValidationResponse, CoreResponse,
+        core_response::Payload,
+    },
 };
 use sqlx::{PgConnection, PgPool};
 use thiserror::Error;

crates/defguard_core/src/grpc/utils.rs

@@ -11,9 +11,12 @@ use defguard_common::{
         },
     },
 };
-use defguard_proto::proxy::{
-    DeviceConfig as ProtoDeviceConfig, DeviceConfigResponse, DeviceInfo,
-    LocationMfaMode as ProtoLocationMfaMode,
+use defguard_proto::{
+    client_types::{
+        DeviceConfig as ProtoDeviceConfig, DeviceConfigResponse,
+        LocationMfaMode as ProtoLocationMfaMode,
+    },
+    proxy::DeviceInfo,
 };
 use sqlx::PgPool;
 use tonic::Status;
@@ -94,33 +97,31 @@ pub async fn build_device_config_response(
 
             // DEPRECATED(1.5): superseeded by location_mfa_mode
             let mfa_enabled = network.location_mfa_mode == LocationMfaMode::Internal;
-            let config =
-                ProtoDeviceConfig {
-                    config: Device::create_config(&network, &wireguard_network_device),
-                    network_id: network.id,
-                    network_name: network.name,
-                    assigned_ip: wireguard_network_device.wireguard_ips.as_csv(),
-                    endpoint: format!("{}:{}", network.endpoint, network.port),
-                    pubkey: network.pubkey,
-                    allowed_ips: network.allowed_ips.as_csv(),
-                    dns: network.dns,
-                    keepalive_interval: network.keepalive_interval,
-                    #[allow(deprecated)]
-                    mfa_enabled,
-                    location_mfa_mode: Some(
-                        <LocationMfaMode as Into<ProtoLocationMfaMode>>::into(
-                            network.location_mfa_mode,
-                        )
-                        .into(),
-                    ),
-                    service_location_mode:
-                        Some(
-                            <ServiceLocationMode as Into<
-                                defguard_proto::proxy::ServiceLocationMode,
-                            >>::into(network.service_location_mode)
-                            .into(),
-                        ),
-                };
+            let config = ProtoDeviceConfig {
+                config: Device::create_config(&network, &wireguard_network_device),
+                network_id: network.id,
+                network_name: network.name,
+                assigned_ip: wireguard_network_device.wireguard_ips.as_csv(),
+                endpoint: format!("{}:{}", network.endpoint, network.port),
+                pubkey: network.pubkey,
+                allowed_ips: network.allowed_ips.as_csv(),
+                dns: network.dns,
+                keepalive_interval: network.keepalive_interval,
+                #[allow(deprecated)]
+                mfa_enabled,
+                location_mfa_mode: Some(
+                    <LocationMfaMode as Into<ProtoLocationMfaMode>>::into(
+                        network.location_mfa_mode,
+                    )
+                    .into(),
+                ),
+                service_location_mode: Some(
+                    <ServiceLocationMode as Into<
+                        defguard_proto::client_types::ServiceLocationMode,
+                    >>::into(network.service_location_mode)
+                    .into(),
+                ),
+            };
             configs.push(config);
         }
     } else {
@@ -173,13 +174,12 @@ pub async fn build_device_config_response(
                         )
                         .into(),
                     ),
-                    service_location_mode:
-                        Some(
-                            <ServiceLocationMode as Into<
-                                defguard_proto::proxy::ServiceLocationMode,
-                            >>::into(network.service_location_mode)
-                            .into(),
-                        ),
+                    service_location_mode: Some(
+                        <ServiceLocationMode as Into<
+                            defguard_proto::client_types::ServiceLocationMode,
+                        >>::into(network.service_location_mode)
+                        .into(),
+                    ),
                 };
                 configs.push(config);
             }

crates/defguard_core/src/handlers/component_setup.rs

@@ -29,10 +29,11 @@ use defguard_common::{
     types::proxy::ProxyControlMessage,
 };
 use defguard_proto::{
+    common::{CertificateInfo, DerPayload},
     gateway::gateway_setup_client::GatewaySetupClient,
     proxy::{
-        AcmeChallenge, AcmeLogs, AcmeStep, CertificateInfo, DerPayload, acme_issue_event,
-        proxy_client::ProxyClient, proxy_setup_client::ProxySetupClient,
+        AcmeChallenge, AcmeLogs, AcmeStep, acme_issue_event, proxy_client::ProxyClient,
+        proxy_setup_client::ProxySetupClient,
     },
 };
 use defguard_version::{Version, client::ClientVersionInterceptor};
@@ -946,7 +947,7 @@ pub async fn setup_gateway_tls_stream(
         };
 
         let csr_response = match client
-            .get_csr(defguard_proto::gateway::CertificateInfo {
+            .get_csr(CertificateInfo {
                 cert_hostname: hostname.to_string(),
             })
             .await
@@ -1007,7 +1008,7 @@ pub async fn setup_gateway_tls_stream(
         // Step 6: Configure TLS
         yield Ok(flow.step(SetupStep::ConfiguringTls));
 
-        let response = defguard_proto::gateway::DerPayload {
+        let response = DerPayload {
             der_data: cert.der().to_vec(),
         };
 

crates/defguard_core/src/lib.rs

@@ -1046,7 +1046,7 @@ pub async fn gateway_config(
     let mut config = Configuration::new(&location, peers, maybe_firewall_config);
 
     // overwrite private key just in case
-    config.prvkey = "REDACTED".into();
+    config.private_key = "REDACTED".into();
 
     Ok(config)
 }

crates/defguard_core/tests/integration/grpc/health.rs

@@ -13,7 +13,7 @@ async fn worker_service_health_is_serving(_: PgPoolOptions, options: PgConnectOp
 
     let response = client
         .check(HealthCheckRequest {
-            service: "worker.WorkerService".into(),
+            service: "defguard.worker.v1.WorkerService".into(),
         })
         .await
         .expect("health check should succeed")

crates/defguard_gateway_manager/Cargo.toml

@@ -18,6 +18,7 @@ defguard_version.workspace = true
 anyhow.workspace = true
 chrono.workspace = true
 hyper-rustls.workspace = true
+prost-types.workspace = true
 reqwest.workspace = true
 semver.workspace = true
 serde_json.workspace = true