Linux network manager plugin

.github/actions/setup-server/action.yml

@@ -6,16 +6,21 @@ inputs:
     description: The IP address that will be used for testing
     required: true
     default: example.com
-  lower_port:
+  container-engine:
+    description: Container engine that will be used for running VPN server
+    default: docker
+  firewall-mode:
+    description: The way how access to the target will be limited ('host' for host machine, 'container' for containers)
+    default: host
+  lower-port:
     description: The minimum source port number that will be used for testing
-    required: true
-    default: 44443
-  higher_port:
+  higher-port:
     description: The maximum source port number that will be used for testing
-    required: true
-    default: 44445
   test-command:
     description: Test command for no VPN access test
+  test-runner:
+    description: Shell wrapper that would be used for containerized test command execution
+    default: ${{ runner.os == 'Linux' && 'bash -c "{0}"' || 'powershell -Command "{0}"' }}
 
 outputs:
   connection-certificate:
@@ -33,6 +38,13 @@ runs:
         distribution: Ubuntu-24.04
         set-as-default: true
 
+    - name: Setup Podman
+      if: runner.os == 'Linux' && inputs.container-engine == 'podman'
+      shell: bash
+      run: |
+          sudo apt-get update
+          sudo apt-get install podman-compose
+
     - name: Install NodeJS
       uses: actions/setup-node@v4.1.0
       with:
@@ -76,8 +88,9 @@ runs:
       shell: bash
       env:
         SUDO: ${{ runner.os == 'Linux' && 'sudo -E env "PATH=$PATH"' || '' }}
+        ARGUMENTS: ${{ inputs.lower-port && format('-l {0}', inputs.lower-port) }} ${{ inputs.higher-port && format('-h {0}', inputs.higher-port) }} -f ${{ inputs.firewall-mode }} -t ${{ steps.resolve-target.outputs.target-ip }} -e ${{ inputs.container-engine }} -s
       run: |
-        SERVER_IP=$(${{ env.SUDO }} node actions/setup-server/configure_viridian_test.mjs -l ${{ inputs.lower_port }} -h ${{ inputs.higher_port }} -t ${{ steps.resolve-target.outputs.target-ip }} -s)
+        SERVER_IP=$(${{ env.SUDO }} node actions/setup-server/configure_viridian_test.mjs ${{ env.ARGUMENTS }})
         echo "server-ip=${SERVER_IP}" >> $GITHUB_OUTPUT
 
     - name: Get Connection Certificate
@@ -94,8 +107,6 @@ runs:
         echo "connection-certificate=${CONNECTION_CERTIFICATE_FILE}" >> $GITHUB_OUTPUT
 
     - name: Test Echo Server Access (no VPN)
-      if: ${{ inputs.test-command != '' }}
+      if: ${{ inputs.test-command }}
       shell: bash
-      env:
-        RUNNER: ${{ runner.os == 'Linux' && 'bash -c' || 'powershell -Command' }}
-      run: ${{ env.RUNNER }} "${{ inputs.test-command }}" && exit 1 || true
+      run: ${{ format(inputs.test-runner, inputs.test-command) }} && exit 1 || true

.github/actions/setup-server/compose.yml

@@ -11,12 +11,12 @@ services:
         SEASIDE_ADDRESS: ${SEASIDE_HOST_ADDRESS}
     networks:
       sea-net:
-        ipv4_address: 10.1.0.87
+        ipv4_address: 10.11.0.87
 
 
 networks:
   sea-net:
     ipam:
       config:
-        - subnet: 10.1.0.0/24
-          gateway: 10.1.0.1
+        - subnet: 10.11.0.0/24
+          gateway: 10.11.0.1

.github/actions/setup-server/configure_viridian_test.mjs

@@ -11,6 +11,9 @@ import { sleep } from "../../scripts/script_utils.mjs";
 const BLUE = "\x1b[34m";
 const RESET = "\x1b[0m";
 
+const FIREWALL_MODE_HOST = "host";
+const FIREWALL_MODE_CONTAINER = "container";
+
 // Timeout for Docker compose to initialize (and stop completely in case of an error).
 const DOCKER_COMPOSE_TIMEOUT = 45;
 // Echo server network for VPN access.
@@ -122,6 +125,10 @@ function parseArguments() {
 			type: "string",
 			short: "t"
 		},
+		engine: {
+			type: "string",
+			short: "e"
+		},
 		lower_port: {
 			type: "string",
 			short: "l"
@@ -130,6 +137,11 @@ function parseArguments() {
 			type: "string",
 			short: "h"
 		},
+		firewall: {
+			type: "string",
+			short: "f",
+			default: "host"
+		},
 		help: {
 			type: "boolean",
 			short: "h",
@@ -183,15 +195,20 @@ function getOutputConnection(unreachable) {
  * @param {string} unreachableNetwork network that will become unreachable (directly).
  * @param {string | null} name the given name for the unreachable IP and network.
  */
-function setupRouting(unreachable, lower_port, higher_port, iface, address, silent) {
+function setupRouting(unreachable, whirlpool_ip, firewall, lower_port, higher_port, iface, address, silent) {
 	print(`Disabling access to ${unreachable} address...`, silent);
-	runCommandForSystem(
-		`iptables -t mangle -A POSTROUTING -o ${iface} -s ${address} -d ${unreachable} -p tcp --sport ${lower_port}:${higher_port} -j DROP`,
-		`Start-Process -FilePath "${convertPathToWindows(process.env.WINDIVERT_PATH)}\\\\netfilter" -ArgumentList '"ip and outbound and (ifIdx == ${iface}) and ((tcp.SrcPort >= ${lower_port}) and (tcp.SrcPort <= ${higher_port})) and (ip.SrcAddr == ${address}) and (ip.DstAddr == ${unreachable})" 16' -NoNewWindow`,
-		undefined,
-		{},
-		"ignore"
-	);
+	if (firewall == FIREWALL_MODE_HOST)
+		runCommandForSystem(
+			`iptables -t mangle -A POSTROUTING -o ${iface} -s ${address} -d ${unreachable} -p tcp --sport ${lower_port}:${higher_port} -j DROP`,
+			`Start-Process -FilePath "${convertPathToWindows(process.env.WINDIVERT_PATH)}\\\\netfilter" -ArgumentList '"ip and outbound and (ifIdx == ${iface}) and ((tcp.SrcPort >= ${lower_port}) and (tcp.SrcPort <= ${higher_port})) and (ip.SrcAddr == ${address}) and (ip.DstAddr == ${unreachable})" 16' -NoNewWindow`,
+			undefined,
+			{},
+			"ignore"
+		);
+	else if (firewall == FIREWALL_MODE_CONTAINER)
+		runCommand(`iptables -A FORWARD -o ${iface} ! -s ${whirlpool_ip} -d ${unreachable} -p tcp -j DROP`);
+	else
+		throw Error(`Unknown firewall mode: ${firewall}!`);
 	print(`Accessing ${unreachable} is no longer possible!`, silent);
 }
 
@@ -200,16 +217,16 @@ function setupRouting(unreachable, lower_port, higher_port, iface, address, sile
  * Wait for some time to check if it started successfully and throw an error if it did.
  * @param {string} path Docker Compose standalone project file path.
  */
-async function launchWhirlpool(whirlpool, silent) {
+async function launchWhirlpool(engine, whirlpool, silent) {
 	print("Preparing whirlpool executable...", silent);
-	runCommandForSystem(`docker compose -f ${DOCKER_COMPOSE_PATH} build ${DOCKER_COMPOSE_CONTAINER}`, `poetry poe -C ${VIRIDIAN_ALGAE_ROOT} bundle`, undefined, {
+	runCommandForSystem(`${engine} compose -f ${DOCKER_COMPOSE_PATH} build ${DOCKER_COMPOSE_CONTAINER}`, `poetry poe -C ${VIRIDIAN_ALGAE_ROOT} bundle`, undefined, {
 		SEASIDE_HOST_ADDRESS: whirlpool
 	});
 	print("Generating certificates...", silent);
 	runCommandForSystem(`true`, `poetry -C ${VIRIDIAN_ALGAE_ROOT} run python3 ${INSTALLER_PATH} --just-certs ${whirlpool}`, undefined);
 	print("Spawning whirlpool process...", silent);
 	runCommandForSystem(
-		`docker compose -f ${DOCKER_COMPOSE_PATH} up --detach ${DOCKER_COMPOSE_CONTAINER}`,
+		`${engine} compose -f ${DOCKER_COMPOSE_PATH} up --detach ${DOCKER_COMPOSE_CONTAINER}`,
 		`wsl -u root python3 ${convertPathToWSL(INSTALLER_PATH)} -o -a back whirlpool -l "${convertPathToWSL(CAERULEAN_WHIRLPOOL_ROOT)}" -r compile -k "${process.env.SEASIDE_SERVER_KEY}" -a ${whirlpool} -e ${whirlpool} -i ${process.env.SEASIDE_API_PORT} --certificates-path ${convertPathToWSL(SERVER_CERTIFICATES)} --log-level DEBUG`,
 		undefined,
 		{
@@ -226,6 +243,6 @@ async function launchWhirlpool(whirlpool, silent) {
 const args = parseArguments();
 const whirlpoolIP = getWhirlpoolIP(args.silent);
 const { iface, address } = getOutputConnection(args.target);
-await launchWhirlpool(whirlpoolIP, args.silent);
-setupRouting(args.target, args.lower_port, args.higher_port, iface, address, args.silent);
+await launchWhirlpool(args.engine, whirlpoolIP, args.silent);
+setupRouting(args.target, whirlpoolIP, args.firewall, args.lower_port, args.higher_port, iface, address, args.silent);
 print(whirlpoolIP, !args.silent);

.github/workflows/build.yml

@@ -72,7 +72,9 @@ jobs:
 
       - name: Setup GCC 🐃
         working-directory: caerulean/whirlpool
-        run: sudo apt-get install -y build-essential
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential
 
       - name: Setup Go 1.23 🦫
         uses: actions/setup-go@v5
@@ -89,7 +91,7 @@ jobs:
         env:
           LINKING_FLAGS: -w -s
           GOARCH: ${{ matrix.arch }}
-          EXEC_NAME: ${{ format('caerulean_whirlpool_executable_{0}', matrix.arch) }}
+          EXEC_NAME: caerulean_whirlpool_executable_${{ matrix.arch }}
         run: make build EXEC_NAME=${{ env.EXEC_NAME }}.run
 
       - name: Create Artifact Name From Branch Name 🌱
@@ -133,28 +135,23 @@ jobs:
       - name: Setup Rust 🦀
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          toolchain: stable
+          toolchain: "1.89.0"
           target: ${{ matrix.target }}
           rust-src-dir: viridian/reef
           override: true
 
-      - name: Download Dependencies 🔮
-        if: runner.os == 'Windows'
-        working-directory: viridian/reef
-        shell: bash
-        run: make dependencies
-
       - name: Build Viridian Reef 🏗️
+        working-directory: viridian/reef
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           WINDIVERT_PATH: ${{ github.workspace }}/viridian/reef/windivert-bin
-        run: cargo build --release --features cli-exec --bin cli --manifest-path viridian/reef/Cargo.toml
+        run: make build-standalone-executable
 
       - name: Rename Executable 📛
         working-directory: viridian/reef
         env:
-          EXEC_SRC: ${{ runner.os == 'Linux' && 'cli' || 'cli.exe' }}
-          EXEC_STEM: ${{ format('viridian_reef_executable_{0}_{1}', runner.os, matrix.arch) }}
+          EXEC_SRC: ${{ runner.os == 'Linux' && 'seaside_standalone' || 'seaside_standalone.exe' }}
+          EXEC_STEM: viridian_reef_executable_${{ runner.os }}_${{ matrix.arch }}
           EXEC_EXT: ${{ runner.os == 'Linux' && 'run' || 'exe' }}
         run: mv target/release/${{ env.EXEC_SRC }} target/${{ env.EXEC_STEM }}.${{ env.EXEC_EXT }}
 

.github/workflows/lint.yml

@@ -41,7 +41,9 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install Dependencies 🔮
-        run: sudo apt-get install -y shellcheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
 
       - name: Lint Scripts 🧪
         run: make lint-scripts

.github/workflows/test.yml

@@ -61,78 +61,126 @@
         uses: ./.github/actions/setup-server
         with:
           target: ${{ env.TARGET_ADDRESS }}
-          lower_port: ${{ env.TARGET_LOWER_PORT }}
-          higher_port: ${{ env.TARGET_HIGHER_PORT }}
+          lower-port: ${{ env.TARGET_LOWER_PORT }}
+          higher-port: ${{ env.TARGET_HIGHER_PORT }}
           test-command: ${{ env.TEST_COMMAND }} --local-port 44443
 
       - name: Test Viridian Algae PORT (standalone) 🧪
-        id: test-viridian-algae-port
         working-directory: viridian/algae
         run: sudo -E env "PATH=$PATH" poetry poe client -m port -f "${{ steps.setup-test-server.outputs.connection-certificate }}" --capture-ports "${{ env.TARGET_LOWER_PORT }}-${{ env.TARGET_HIGHER_PORT }}" -c "${{ env.TEST_COMMAND }} --local-port 44444"
 
       - name: Test Viridian Algae TYPHOON (standalone) 🧪
-        id: test-viridian-algae-typhoon
         working-directory: viridian/algae
         run: sudo -E env "PATH=$PATH" poetry poe client -m typhoon -f "${{ steps.setup-test-server.outputs.connection-certificate }}" --capture-ports "${{ env.TARGET_LOWER_PORT }}-${{ env.TARGET_HIGHER_PORT }}" -c "${{ env.TEST_COMMAND }} --local-port 44445"
 
   viridian-reef-test:
-    name: Test Viridian Reef
-    runs-on: ${{ format('{0}-latest', matrix.os) }}
+    name: Test Viridian Reef Standalone Executable
+    runs-on: ${{ matrix.os }}-latest
     env:
       TARGET_ADDRESS: 1.1.1.1
       TARGET_LOWER_PORT: 44442
       TARGET_HIGHER_PORT: 44446
       SEASIDE_LOG_LEVEL: reeflib=DEBUG,INFO
       WINDIVERT_PATH: ${{ github.workspace }}/viridian/reef/windivert-bin
       SUDO: ${{ matrix.os == 'ubuntu' && 'sudo -E env "PATH=$PATH"' || '' }}
       TEST_COMMAND: ${{ matrix.os == 'ubuntu' && 'curl' || '& curl.exe' }} -v -I --fail --max-time 15 https://1.1.1.1
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu, windows]
 
     steps:
       - name: Checkout 🛎️
         uses: actions/checkout@v4
 
       - name: Setup Rust 🦀
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          toolchain: stable
+          toolchain: "1.89.0"
           target: ${{ matrix.os == 'ubuntu' && 'x86_64-unknown-linux-gnu' || 'x86_64-pc-windows-msvc' }}
           rust-src-dir: viridian/reef
           override: true
 
-      - name: Download Dependencies 🔮
-        if: runner.os == 'Windows'
-        working-directory: viridian/reef
-        shell: bash
-        run: make dependencies runtime
-
       - name: Test Viridian Reef (unit) 🧪
         working-directory: viridian/reef
-        run: ${{ env.SUDO }} cargo test --package SeasideVPN-Reef --lib -- --nocapture --show-output
+        run: ${{ env.SUDO }} cargo test --workspace -- --nocapture --show-output
 
       - name: Setup VPN Server 🖴
         id: setup-test-server
         uses: ./.github/actions/setup-server
         with:
           target: ${{ env.TARGET_ADDRESS }}
-          lower_port: ${{ env.TARGET_LOWER_PORT }}
-          higher_port: ${{ env.TARGET_HIGHER_PORT }}
+          lower-port: ${{ env.TARGET_LOWER_PORT }}
+          higher-port: ${{ env.TARGET_HIGHER_PORT }}
           test-command: ${{ env.TEST_COMMAND }} --local-port 44443
 
       - name: Test Viridian Reef PORT (integration) 🧪
-        id: test-viridian-reef-port
         working-directory: viridian/reef
-        run: ${{ env.SUDO }} cargo run --features cli-exec --bin cli -- -m port -f "${{ steps.setup-test-server.outputs.connection-certificate }}" --capture-ports ${{ env.TARGET_LOWER_PORT }}-${{ env.TARGET_HIGHER_PORT }} -c "${{ env.TEST_COMMAND }} --local-port 44444"
+        run: ${{ env.SUDO }} cargo run --bin seaside_standalone -- -m port -f "${{ steps.setup-test-server.outputs.connection-certificate }}" --capture-ports ${{ env.TARGET_LOWER_PORT }}-${{ env.TARGET_HIGHER_PORT }} -c "${{ env.TEST_COMMAND }} --local-port 44444"
 
       - name: Test Viridian Reef TYPHOON (integration) 🧪
-        id: test-viridian-reef-typhoon
         working-directory: viridian/reef
-        run: ${{ env.SUDO }} cargo run --features cli-exec --bin cli -- -m typhoon -f "${{ steps.setup-test-server.outputs.connection-certificate }}" --capture-ports ${{ env.TARGET_LOWER_PORT }}-${{ env.TARGET_HIGHER_PORT }} -c "${{ env.TEST_COMMAND }} --local-port 44445"
+        run: ${{ env.SUDO }} cargo run --bin seaside_standalone -- -m typhoon -f "${{ steps.setup-test-server.outputs.connection-certificate }}" --capture-ports ${{ env.TARGET_LOWER_PORT }}-${{ env.TARGET_HIGHER_PORT }} -c "${{ env.TEST_COMMAND }} --local-port 44445"
+
+  viridian-reef-nm-plugin-test:
+    name: Test Viridian Reef NetworkManager Plugin
+    runs-on: ubuntu-latest
+    env:
+      TARGET_ADDRESS: 1.1.1.1
+      TEST_COMMAND: curl --help
+    strategy:
+      fail-fast: false
+      matrix:
+          os: [ubuntu]
+
+    steps:
+      - name: Checkout 🛎️
+        uses: actions/checkout@v4
+
+      - name: Setup Rust 🦀
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: "1.89.0"
+          target: ${{ matrix.os == 'ubuntu' && 'x86_64-unknown-linux-gnu' || 'x86_64-pc-windows-msvc' }}
+          rust-src-dir: viridian/reef
+          override: true
+
+      - name: Install Dependencies 🔮
+        run: |
+          sudo apt-get update
+          sudo apt-get install build-essential meson pkg-config libglib2.0-dev libgtk-3-dev libgtk-4-dev libnm-dev libsecret-1-dev
+
+      - name: Build NetworkManager Plugin 🏗️
+        working-directory: viridian/reef
+        run: make build-platform-plugin
+
+      - name: Build NetworkManager Runner Image 🖼️
+        working-directory: viridian/reef/nm_plugin
+        run: make prepare-image
+
+      - name: Setup VPN Server 🖴
+        id: setup-test-server
+        uses: ./.github/actions/setup-server
+        with:
+          target: ${{ env.TARGET_ADDRESS }}
+          container-engine: podman
+          firewall-mode: container
+          test-command: ${{ env.TEST_COMMAND }}
+          test-runner: make -C viridian/reef/nm_plugin -s --no-print-directory TEST_COMMAND="bash -c \"{0}\"" test
+
+      - name: Test Viridian Reef PORT 🧪
+        working-directory: viridian/reef/nm_plugin
+        env:
+          TEST_VAR: bash ../nm_container_test.sh -m port -f "${{ steps.setup-test-server.outputs.connection-certificate }}" -c ${{ env.TEST_COMMAND }}"
+        run: make -s --no-print-directory TEST_COMMAND="${{ env.TEST_VAR }}" test
+
+      - name: Test Viridian Reef TYPHOON 🧪
+        working-directory: viridian/reef/nm_plugin
+        env:
+          TEST_VAR: bash ../nm_container_test.sh -m typhoon -f "${{ steps.setup-test-server.outputs.connection-certificate }}" -c ${{ env.TEST_COMMAND }}"
+        run: make -s --no-print-directory TEST_COMMAND="${{ env.TEST_VAR }}" test
 
   caerulean-whirlpool-test:
     name: Test Caerulean Whirlpool
     runs-on: ubuntu-latest
 

.gitignore

@@ -80,7 +80,7 @@ viridian/reef/Cargo.lock
 viridian/reef/target
 
 ## Rust generated files:
-viridian/reef/src/generated
+viridian/reef/shared_library/include
 
 ## Test files:
 viridian/reef/certificates/
@@ -89,3 +89,20 @@ viridian/reef/certificates/
 viridian/reef/WinDivert-*.zip
 viridian/reef/windivert-bin/
 viridian/reef/windivert-source/
+viridian/reef/wintun-*.zip
+viridian/reef/wintun-bin/
+viridian/reef/wintun-source/
+
+
+
+# C and C++:
+
+## Binary build:
+viridian/reef/nm_plugin/.build
+viridian/reef/nm_plugin/dist
+
+
+
+# Miscellaneous:
+
+viridian/reef/nm_plugin/NetworkManager