Skip to content
This repository has been archived by the owner on Sep 29, 2024. It is now read-only.

Commit

Permalink
Support --route-nopull (#280)
Browse files Browse the repository at this point in the history 
* Parse --route-no-pull

When provided, pull everything except:

- Routes
- DNS
- Proxy

Implement with higher granularity compared to OpenVPN.

* Apply no-pull mask in tunnel settings

Pull server settings by default to match standard OpenVPN
behavior. Library was prioritizing client over server.

* Add link in CHANGELOG
  • Loading branch information
@keeshux
keeshux authored Oct 8, 2022
1 parent 9f5de0f commit a382267
Show file tree
Hide file tree
Showing 4 changed files with 99 additions and 26 deletions.
8 changes: 8 additions & 0 deletions CHANGELOG.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## Unreleased

### Added

- OpenVPN: Support for `--route-nopull`. [#280](https://github.com/passepartoutvpn/tunnelkit/pull/280)

### Changed

- Upgrade OpenSSL to 1.1.1q.

### Fixed

- OpenVPN: Prioritize server configuration over client (standard behavior).

## 5.0.0 (2022-09-23)

### Added
Expand Down
71 changes: 47 additions & 24 deletions Sources/TunnelKitOpenVPNAppExtension/OpenVPNTunnelProvider.swift
View file
Original file line number Diff line number Diff line change
Expand Up @@ -563,7 +563,12 @@ extension OpenVPNTunnelProvider: OpenVPNSessionDelegate {
}

private func bringNetworkUp(remoteAddress: String, localOptions: OpenVPN.Configuration, options: OpenVPN.Configuration, completionHandler: @escaping (Error?) -> Void) {
let routingPolicies = localOptions.routingPolicies ?? options.routingPolicies
let pullMask = localOptions.pullMask
let pullRoutes = pullMask?.contains(.routes) ?? false
let pullDNS = pullMask?.contains(.dns) ?? false
let pullProxy = pullMask?.contains(.proxy) ?? false

let routingPolicies = pullRoutes ? options.routingPolicies : localOptions.routingPolicies
let isIPv4Gateway = routingPolicies?.contains(.IPv4) ?? false
let isIPv6Gateway = routingPolicies?.contains(.IPv6) ?? false
let isGateway = isIPv4Gateway || isIPv6Gateway
Expand All @@ -585,13 +590,15 @@ extension OpenVPNTunnelProvider: OpenVPNSessionDelegate {
log.info("Routing.IPv4: Setting default gateway to \(ipv4.defaultGateway.maskedDescription)")
}

for r in ipv4.routes {
let ipv4Route = NEIPv4Route(destinationAddress: r.destination, subnetMask: r.mask)
ipv4Route.gatewayAddress = r.gateway
routes.append(ipv4Route)
log.info("Routing.IPv4: Adding route \(r.destination.maskedDescription)/\(r.mask) -> \(r.gateway)")
if pullRoutes {
for r in ipv4.routes {
let ipv4Route = NEIPv4Route(destinationAddress: r.destination, subnetMask: r.mask)
ipv4Route.gatewayAddress = r.gateway
routes.append(ipv4Route)
log.info("Routing.IPv4: Adding route \(r.destination.maskedDescription)/\(r.mask) -> \(r.gateway)")
}
}

ipv4Settings = NEIPv4Settings(addresses: [ipv4.address], subnetMasks: [ipv4.addressMask])
ipv4Settings?.includedRoutes = routes
ipv4Settings?.excludedRoutes = []
Expand All @@ -614,11 +621,13 @@ extension OpenVPNTunnelProvider: OpenVPNSessionDelegate {
log.info("Routing.IPv6: Setting default gateway to \(ipv6.defaultGateway.maskedDescription)")
}

for r in ipv6.routes {
let ipv6Route = NEIPv6Route(destinationAddress: r.destination, networkPrefixLength: r.prefixLength as NSNumber)
ipv6Route.gatewayAddress = r.gateway
routes.append(ipv6Route)
log.info("Routing.IPv6: Adding route \(r.destination.maskedDescription)/\(r.prefixLength) -> \(r.gateway)")
if pullRoutes {
for r in ipv6.routes {
let ipv6Route = NEIPv6Route(destinationAddress: r.destination, networkPrefixLength: r.prefixLength as NSNumber)
ipv6Route.gatewayAddress = r.gateway
routes.append(ipv6Route)
log.info("Routing.IPv6: Adding route \(r.destination.maskedDescription)/\(r.prefixLength) -> \(r.gateway)")
}
}

ipv6Settings = NEIPv6Settings(addresses: [ipv6.address], networkPrefixLengths: [ipv6.addressPrefixLength as NSNumber])
Expand Down Expand Up @@ -671,15 +680,29 @@ extension OpenVPNTunnelProvider: OpenVPNSessionDelegate {
}
}

// ensure that non-nil arrays also imply non-empty
if let array = options.dnsServers {
precondition(!array.isEmpty)
}
if let array = options.searchDomains {
precondition(!array.isEmpty)
}
if let array = options.proxyBypassDomains {
precondition(!array.isEmpty)
}
if let array = cfg.configuration.dnsServers {
precondition(!array.isEmpty)
}
if let array = cfg.configuration.searchDomains {
precondition(!array.isEmpty)
}
if let array = cfg.configuration.proxyBypassDomains {
precondition(!array.isEmpty)
}

// fall back
if dnsSettings == nil {
dnsServers = []
if let servers = localOptions.dnsServers,
!servers.isEmpty {
dnsServers = servers
} else if let servers = options.dnsServers {
dnsServers = servers
}
dnsServers = (pullDNS ? options.dnsServers : localOptions.dnsServers) ?? []
if !dnsServers.isEmpty {
log.info("DNS: Using servers \(dnsServers.maskedDescription)")
dnsSettings = NEDNSSettings(servers: dnsServers)
Expand All @@ -695,7 +718,7 @@ extension OpenVPNTunnelProvider: OpenVPNSessionDelegate {
dnsSettings?.matchDomains = [""]
}

if let searchDomains = localOptions.searchDomains ?? options.searchDomains {
if let searchDomains = pullDNS ? options.searchDomains : localOptions.searchDomains {
log.info("DNS: Using search domains \(searchDomains.maskedDescription)")
dnsSettings?.domainName = searchDomains.first
dnsSettings?.searchDomains = searchDomains
Expand All @@ -718,21 +741,21 @@ extension OpenVPNTunnelProvider: OpenVPNSessionDelegate {

var proxySettings: NEProxySettings?
if localOptions.isProxyEnabled ?? true {
if let httpsProxy = cfg.configuration.httpsProxy ?? options.httpsProxy {
if let httpsProxy = pullProxy ? options.httpsProxy : localOptions.httpsProxy {
proxySettings = NEProxySettings()
proxySettings?.httpsServer = httpsProxy.neProxy()
proxySettings?.httpsEnabled = true
log.info("Routing: Setting HTTPS proxy \(httpsProxy.address.maskedDescription):\(httpsProxy.port)")
}
if let httpProxy = localOptions.httpProxy ?? options.httpProxy {
if let httpProxy = pullProxy ? options.httpProxy : localOptions.httpProxy {
if proxySettings == nil {
proxySettings = NEProxySettings()
}
proxySettings?.httpServer = httpProxy.neProxy()
proxySettings?.httpEnabled = true
log.info("Routing: Setting HTTP proxy \(httpProxy.address.maskedDescription):\(httpProxy.port)")
}
if let pacURL = localOptions.proxyAutoConfigurationURL ?? options.proxyAutoConfigurationURL {
if let pacURL = pullProxy ? options.proxyAutoConfigurationURL : localOptions.proxyAutoConfigurationURL {
if proxySettings == nil {
proxySettings = NEProxySettings()
}
Expand All @@ -742,7 +765,7 @@ extension OpenVPNTunnelProvider: OpenVPNSessionDelegate {
}

// only set if there is a proxy (proxySettings set to non-nil above)
if let bypass = localOptions.proxyBypassDomains ?? options.proxyBypassDomains {
if let bypass = pullProxy ? options.proxyBypassDomains : localOptions.proxyBypassDomains {
proxySettings?.exceptionList = bypass
log.info("Routing: Setting proxy by-pass list: \(bypass.maskedDescription)")
}
Expand Down
37 changes: 35 additions & 2 deletions Sources/TunnelKitOpenVPNCore/Configuration.swift
View file
Original file line number Diff line number Diff line change
Expand Up @@ -152,6 +152,19 @@ extension OpenVPN {
case blockLocal
}

/// Settings that can be pulled from server.
public enum PullMask: String, Codable, CaseIterable {

/// Routes and gateways.
case routes

/// DNS settings.
case dns

/// Proxy settings.
case proxy
}

/// The way to create a `Configuration` object for a `OpenVPNSession`.
public struct ConfigurationBuilder {

Expand Down Expand Up @@ -289,6 +302,9 @@ extension OpenVPN {
/// Policies for redirecting traffic through the VPN gateway.
public var routingPolicies: [RoutingPolicy]?

/// Server settings that must not be pulled.
public var noPullMask: [PullMask]?

/**
Creates a `ConfigurationBuilder`.

Expand Down Expand Up @@ -347,7 +363,8 @@ extension OpenVPN {
httpsProxy: httpsProxy,
proxyAutoConfigurationURL: proxyAutoConfigurationURL,
proxyBypassDomains: proxyBypassDomains,
routingPolicies: routingPolicies
routingPolicies: routingPolicies,
noPullMask: noPullMask
)
}
}
Expand Down Expand Up @@ -478,6 +495,9 @@ extension OpenVPN {
/// - Seealso: `ConfigurationBuilder.routingPolicies`
public let routingPolicies: [RoutingPolicy]?

/// - Seealso: `ConfigurationBuilder.noPullMask`
public let noPullMask: [PullMask]?

// MARK: Shortcuts

public var fallbackCipher: Cipher {
Expand All @@ -495,6 +515,15 @@ extension OpenVPN {
public var fallbackCompressionAlgorithm: CompressionAlgorithm {
return compressionAlgorithm ?? Fallback.compressionAlgorithm
}

public var pullMask: [PullMask]? {
let all = PullMask.allCases
guard let notPulled = noPullMask else {
return all
}
let pulled = Array(Set(all).subtracting(notPulled))
return !pulled.isEmpty ? pulled : nil
}
}
}

Expand Down Expand Up @@ -523,6 +552,7 @@ extension OpenVPN.Configuration {
builder.keepAliveInterval = keepAliveInterval
builder.keepAliveTimeout = keepAliveTimeout
builder.renegotiatesAfter = renegotiatesAfter
builder.xorMask = xorMask
builder.remotes = remotes
builder.checksEKU = checksEKU
builder.checksSANHost = checksSANHost
Expand All @@ -547,7 +577,7 @@ extension OpenVPN.Configuration {
builder.proxyAutoConfigurationURL = proxyAutoConfigurationURL
builder.proxyBypassDomains = proxyBypassDomains
builder.routingPolicies = routingPolicies
builder.xorMask = xorMask
builder.noPullMask = noPullMask
return builder
}
}
Expand Down Expand Up @@ -655,5 +685,8 @@ extension OpenVPN.Configuration {
} else {
log.info("\tMTU: default")
}
if let noPullMask = noPullMask {
log.info("\tNot pulled: \(noPullMask.map(\.rawValue))")
}
}
}
9 changes: 9 additions & 0 deletions Sources/TunnelKitOpenVPNCore/ConfigurationParser.swift
View file
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,8 @@ extension OpenVPN {

static let redirectGateway = NSRegularExpression("^redirect-gateway.*")

static let routeNoPull = NSRegularExpression("^route-nopull")

// MARK: Unsupported

// static let fragment = NSRegularExpression("^fragment +\\d+")
Expand Down Expand Up @@ -291,6 +293,7 @@ extension OpenVPN {
var optProxyAutoConfigurationURL: URL?
var optProxyBypass: [String]?
var optRedirectGateway: Set<RedirectGateway>?
var optRouteNoPull: Bool?

log.verbose("Configuration file:")
for line in lines {
Expand Down Expand Up @@ -702,6 +705,9 @@ extension OpenVPN {
optRedirectGateway?.insert(opt)
}
}
Regex.routeNoPull.enumerateComponents(in: line) { _ in
optRouteNoPull = true
}

//

Expand Down Expand Up @@ -888,6 +894,9 @@ extension OpenVPN {
sessionBuilder.httpsProxy = optHTTPSProxy
sessionBuilder.proxyAutoConfigurationURL = optProxyAutoConfigurationURL
sessionBuilder.proxyBypassDomains = optProxyBypass
if optRouteNoPull ?? false {
sessionBuilder.noPullMask = [.routes, .dns, .proxy]
}

if let flags = optRedirectGateway {
var policies: Set<RoutingPolicy> = []
Expand Down

0 comments on commit a382267

Please sign in to comment.