Gateway TLS verification (#2049)

* move tls code to separate crate, make it generic

* prime the cache

* restore error log when certs don't match

* non-optional ProxyHandler::shutdown_signal

* gateway cert verification

* defguard_gateway_manager crate

* fix tests

* cargo fmt

* remove unused imports

* allow(clippy::result_large_err)

* rename proxy_handler module to handler

* defguard_gateway_manager::error module

* move gateway handler-related structs to handler module

* move gen_config function to handler module

* tighten modules visibility

* remove unused GatewayError variants

* send purge request on gateway delete trigger, GatewayManager

* refactor TriggerOperation::Delete match branch

* cert verification throws CertificateError::ApplicationVerificationFailure

* move auth, generic grpc methods to core

* fix imports, cargo fmt

* fix sync Mutex used across await issue

* GatewayManager::run

* update protos

* cargo update

* update sqlx query data

* fix clippy issues

* cargo fmt

* fix cargo deny issues

* cargo machete, i32::cast_unsigned

* more i32::cast_unsigned conversions

* cargo fmt

Author: j-chmielewski

…38d3e2deb43d5ca3458724deb3ead69389a.json …351bf9bf9650acca042a12ad75a71fdee71.json.sqlx/query-b43694450d7abe3b93ea88fa7c95c38d3e2deb43d5ca3458724deb3ead69389a.json renamed to .sqlx/query-161dca354966b0bc33849d2ef1245351bf9bf9650acca042a12ad75a71fdee71.json .sqlx/query-b43694450d7abe3b93ea88fa7c95c38d3e2deb43d5ca3458724deb3ead69389a.json renamed to .sqlx/query-161dca354966b0bc33849d2ef1245351bf9bf9650acca042a12ad75a71fdee71.json

@@ -3,7 +3,7 @@ edition = "2024"
 license-file = "LICENSE.md"
 homepage = "https://defguard.net/"
 repository = "https://github.com/DefGuard/defguard"
-rust-version = "1.85.1"
+rust-version = "1.87.0"
 
 [workspace]
 members = ["crates/*", "tools/*"]
@@ -16,6 +16,7 @@ defguard_common = { path = "./crates/defguard_common", version = "2.0.0" }
 defguard_core = { path = "./crates/defguard_core", version = "0.0.0" }
 defguard_event_logger = { path = "./crates/defguard_event_logger", version = "0.0.0" }
 defguard_event_router = { path = "./crates/defguard_event_router", version = "0.0.0" }
+defguard_gateway_manager = { path = "./crates/defguard_gateway_manager", version = "0.0.0" }
 defguard_mail = { path = "./crates/defguard_mail", version = "0.0.0" }
 defguard_proto = { path = "./crates/defguard_proto", version = "0.0.0" }
 defguard_proxy_manager = { path = "./crates/defguard_proxy_manager", version = "0.0.0" }
@@ -24,6 +25,7 @@ defguard_version = { path = "./crates/defguard_version", version = "0.0.0" }
 defguard_vpn_stats_purge = { path = "./crates/defguard_vpn_stats_purge", version = "0.0.0" }
 defguard_web_ui = { path = "./crates/defguard_web_ui", version = "0.0.0" }
 defguard_certs = { path = "./crates/defguard_certs", version = "0.0.0" }
+defguard_grpc_tls = { path = "./crates/defguard_grpc_tls", version = "0.0.0" }
 defguard_setup = { path = "./crates/defguard_setup", version = "0.0.0" }
 model_derive = { path = "./crates/model_derive", version = "0.0.0" }
 
@@ -49,6 +51,7 @@ claims = "0.8"
 clap = { version = "4.5", features = ["derive", "env"] }
 futures = "0.3"
 http = "1.4"
+hyper-rustls = { version = "0.27", features = ["http2"] }
 humantime = "2.1"
 # match version used by sqlx
 ipnetwork = "0.20"
@@ -61,6 +64,7 @@ md4 = "0.10"
 openidconnect = { version = "4.0", default-features = false, features = [
     "reqwest",
 ] }
+os_info = "3.12"
 parse_link_header = "0.4"
 paste = "1.0"
 pgp = { version = "0.19", default-features = false }
@@ -72,6 +76,7 @@ rcgen = { version = "0.14", features = ["x509-parser", "pem"] }
 reqwest = { version = "0.12", features = ["json"] }
 rsa = "0.9"
 rust-ini = "0.21"
+rustls = { version = "0.23", features = ["ring"] }
 rustls-pki-types = "1.14"
 semver = { version = "1.0", features = ["serde"] }
 secrecy = { version = "0.10", features = ["serde"] }
@@ -115,7 +120,9 @@ tonic-health = "0.14"
 tonic-prost = "0.14"
 tonic-prost-build = "0.14"
 totp-lite = { version = "2.0" }
+tower = "0.5"
 tower-http = { version = "0.6", features = ["fs", "trace", "set-header"] }
+tower-service = "0.3"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 trait-variant = "0.1"

.sqlx/query-2f614ae8a1c1c62c11ed2e9b11e7004f869008e9dec303033ddbec8b0cee53f5.json

@@ -13,6 +13,7 @@ defguard_common = { workspace = true }
 defguard_core = { workspace = true }
 defguard_event_router = { workspace = true }
 defguard_event_logger = { workspace = true }
+defguard_gateway_manager = { workspace = true }
 defguard_proxy_manager = { workspace = true }
 defguard_session_manager = { workspace = true }
 defguard_version = { workspace = true }