0.8.1

Author: nbari

CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.8.1
+* Improved VPN peer IP detection (added WireGuard and Tailscale support)
+* Fixed memory leak in CLI version string
+* Refactored network detection for better reliability
+* Added comprehensive test script
+
 ## 0.8.0
 * Rewrite from Go to Rust
 * VPN gateway detection via sysctl, netstat, scutil, and ifconfig fallbacks

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "vpn-kill-switch"
-version = "0.8.0"
+version = "0.8.1"
 authors = ["Nicolas Embriz <nbari@tequila.io>"]
 description = "VPN kill switch for macOS"
 documentation = "https://killswitch.network"

Cargo.toml

@@ -2,12 +2,15 @@ use clap::{
     Arg, ArgAction, ColorChoice, Command,
     builder::styling::{AnsiColor, Effects, Styles},
 };
+use std::sync::OnceLock;
 
 pub mod built_info {
     #![allow(clippy::doc_markdown)]
     include!(concat!(env!("OUT_DIR"), "/built.rs"));
 }
 
+static LONG_VERSION: OnceLock<String> = OnceLock::new();
+
 #[must_use]
 pub fn new() -> Command {
     let styles = Styles::styled()
@@ -16,9 +19,10 @@ pub fn new() -> Command {
         .literal(AnsiColor::Blue.on_default() | Effects::BOLD)
         .placeholder(AnsiColor::Green.on_default());
 
-    let git_hash = built_info::GIT_COMMIT_HASH.unwrap_or("unknown");
-    let long_version: &'static str =
-        Box::leak(format!("{} - {}", env!("CARGO_PKG_VERSION"), git_hash).into_boxed_str());
+    let long_version: &str = LONG_VERSION.get_or_init(|| {
+        let git_hash = built_info::GIT_COMMIT_HASH.unwrap_or("unknown");
+        format!("{} - {git_hash}", env!("CARGO_PKG_VERSION"))
+    });
 
     Command::new(env!("CARGO_PKG_NAME"))
         .about(env!("CARGO_PKG_DESCRIPTION"))

src/cli/commands/mod.rs

@@ -5,6 +5,22 @@ mod rules;
 use crate::cli::verbosity::Verbosity;
 use anyhow::{Context, Result, bail};
 
+/// Check if an IP address is in a private/reserved range (RFC 1918, loopback, link-local)
+#[must_use]
+pub fn is_private_ip(ip: &std::net::Ipv4Addr) -> bool {
+    let o = ip.octets();
+    // 10.0.0.0/8
+    o[0] == 10
+        // 172.16.0.0/12
+        || (o[0] == 172 && (16..=31).contains(&o[1]))
+        // 192.168.0.0/16
+        || (o[0] == 192 && o[1] == 168)
+        // 127.0.0.0/8 (loopback)
+        || o[0] == 127
+        // 169.254.0.0/16 (link-local)
+        || (o[0] == 169 && o[1] == 254)
+}
+
 fn check_root() -> Result<()> {
     let euid = unsafe { libc::geteuid() };
     if euid != 0 {
@@ -19,13 +35,7 @@ fn validate_ipv4(ip: &str) -> Result<()> {
     let IpAddr::V4(v4) = addr else {
         bail!("IPv6 addresses are not supported: {ip}");
     };
-    let o = v4.octets();
-    if o[0] == 10
-        || (o[0] == 172 && (16..=31).contains(&o[1]))
-        || (o[0] == 192 && o[1] == 168)
-        || o[0] == 127
-        || (o[0] == 169 && o[1] == 254)
-    {
+    if is_private_ip(&v4) {
         bail!("{ip} is a private/reserved IP address. VPN peer must be a public IP");
     }
     Ok(())
@@ -91,6 +101,7 @@ pub fn disable(verbose: Verbosity) -> Result<()> {
 ///
 /// # Errors
 /// Returns an error if the firewall status cannot be queried
+#[must_use = "status returns the current state which should be displayed or checked"]
 pub fn status() -> Result<String> {
     pf::status()
 }
@@ -129,10 +140,16 @@ pub fn show_interfaces(verbose: Verbosity) -> Result<String> {
     let mut out = String::new();
     let _ = writeln!(out, "Interface  MAC address         IP");
 
-    let has_vpn = interfaces.iter().any(|i| i.is_p2p);
+    let has_vpn = interfaces.iter().any(network::InterfaceInfo::is_p2p);
 
     for iface in &interfaces {
-        let _ = writeln!(out, "{:<10} {:<19} {}", iface.name, iface.mac, iface.ip);
+        let _ = writeln!(
+            out,
+            "{:<10} {:<19} {}",
+            iface.name(),
+            iface.mac(),
+            iface.ip()
+        );
     }
 
     // Show public IP