Keychain: prevent call to stat() when determining appex path

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Kit: Go: use Windows-style retry sleep loop on bind updates

Something odd happens in the network extension that we still don't
understand. Attempt to poke it in this terrible way.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

UI: Model: remove 0.0.0.0/8 from non-private IPs

macOS freaks out if you try to explicitly route to 0.0.0.0/8 in its
includedRoutes parameter. Even though 0.0.0.0/8 isn't RFC1918, it is
marked in RFC6890 as "this host on this network", so removing it from
the Internet routes makes sense semantically too.

This commit changes 0.0.0.0/5 into:
- 1.0.0.0/8
- 2.0.0.0/8
- 3.0.0.0/8
- 4.0.0.0/6

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

UI: iOS: remove donation link

Apple forbids us from having a simple link to wireguard.com/donations/
in the version info window, citing the existence of this link as a form
of payment outside of their in-app purchase framework that requires 30%.
The link had been there for around two years. After rejecting an app
update for a critical networking regression unrelated to this, they
wrote:

    Dec 17, 2020 at 8:35 PM
    From Apple

    3.1.1 - Business - Payments - In-App Purchase

    We noticed that your app allows users to contribute donations to the
    development of your app with a mechanism other than the in-app
    purchase API, which is not appropriate for the App Store.

    Next Steps

    To resolve this issue, please revise your app to use the in-app
    purchase API to pay for this type of transaction. Please note that
    even though tipping another individual is optional, the tip is
    connected to or associated with the receipt of digital content or
    services in your app and must be purchased through in-app purchase
    in accordance with guideline 3.1.1 of the App Store Review
    Guidelines.

    Please see attached screenshot for details.

Trying to appeal this or reason with Apple is not going to be a fruitful
endeavor, so instead we simply cut our losses and remove the donation
link entirely. The goal, anyway, is to get a timely critical update into
the hands of users, and encouraging Apple to block that further would be
a disservice.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

UI: macOS: Fix UTF-8 and UTF-16 conversions in highlighter code

NSString uses UTF-16 internally, while String uses UTF-8 in Swift 5.

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

project: generate more stable locale IDs

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

build: disable hardened runtime on iOS but keep it enabled on macOS

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Version bump

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

UI: add missing translations to incomplete locales

This is the wrong way to fix the problem. The correct way will involve
moving away from the whacky tr() macro and using translations functions
properly. But migrating to that will require some heavy scripting work.
So for now, use a hammer.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Kit: Adapter: do not treat NE settings timeouts as fatal

The general Network Extension framework is incredibly buggy, and a
timeout when setting the network settings does not necessarily imply
that the whole operation failed. Simply log the condition and move on.
This restores the app's old behavior.

Reported-by: Filipe Mendonça <cfilipem@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Kit: PacketTunnelSettingsGenerator: do not require DNS queries if no DNS

Prior, we would set matchDomains=[""] even if the user didn't provide
any DNS servers. This was kind of incoherent, but I guess we had in mind
some kind of non-sensical leakproof scheme that never really worked
anyway. NetworkExtension didn't like this, so setTunnelNetworkSettings
would, rather than return an error, simply timeout and never call its
callback function. But everything worked fine, so we had code in the UI
to check to make sure everything was okay after 5 seconds or so of no
callback. Recent changes made the timeout fatal on the network extension
side, so rather than succeed, configs with no DNS server started
erroring out, causing user reports.

This commit attempts to handle the root cause of the timeout issue by
not twiddling with DNS settings if no DNS server was specified. For now,
however, it leaves the hard-timeout semantics in place.

Reported-by: Filipe Mendonça <cfilipem@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

UI: macOS: remove donation link

Apple forbids us from having a simple donation link in the "About
WireGuard" dialog, due to new policies. And arguing with the giant is
not going to be a fruitful battle. Do the practical thing and just
remove it.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Version bump

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

WireGuardApp: Refactor TunnelListCell

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Replace AnyObject with a concrete NSKeyValueObservation

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Animate switch control in TunnelListCell

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Remove 200ms delay when updating tunnel status switch

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Pin status switch to cell margin

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Refactor indicator view initialization

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Use Bundle.forInfoDictionaryKey to access Info.plist fields

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Refactor indicator initialization

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Fix window background color to default black

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

global: support DNS search domains

This has been supported by Windows and Linux for quite some time. Add
support here for iOS and macOS.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

WireGuardKitGo: update to latest wireguard-go tag

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Revert "[REVERT ME SOON] TunnelsManager: Workaround for macOS Catalina deleting tunnels arbitrarily"

This reverts commit 028e76eb3fda127d84eb88dc5cb96d4278f37b96.

It's been over a year. I really hope this is fixed by Apple.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

WireGuardApp: modify xcodeproj when syncing translations

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

WireGuardKit: Let wireguard-go backend run in offline on macOS

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: add CrowdIn syncer and run it

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

WireGuardKit: Conditionally turn on/off wireguard-go

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardGoKit: drop support for armv7

Apple and Go have both dropped it, so we do the same.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

global: fix remaining swiftlint violations

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

WireGuardKitGo: get rid of missing -Wno-unused-command-line-argument flag

Recent toolchains error out on it, and it's no longer needed.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

WireGuardKitGo: rebase boottime patch onto Go 1.15.6

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

global: bump year in header

A bit overdue, but better late than never.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

WireGuardApp: Update target membership to exclude sources that are only used in network extensions

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Delegate IPv*Address initialization to self.init

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Remove backend version call in Logger.swift & extract wireguard-go version script from network extension targets

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Log XLAT resolution errors

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Disable SWIFT_PRECOMPILE_BRIDGING_HEADER

Clang automatically picks up module.modulemap files from WireGuardKit directories when precompiling bridging header file, which causes the compiler to fail with obscure error.

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Update swift version from 4.2 to 5.0

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Update checkout path in README

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Keychain: Avoid roundtrip via items when accessing item label (stored in kSecAttrLabel)

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Keychain: Remove unnecessary cast to String in Keychain queries

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Remove WireGuardKit.swift from Xcode source tree

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuadKit: Rename WireGuardAdapter.version -> .backendVersion & remove `var wireGuardVersion` with WireGuardKit.swift

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Add back the wireguard-go version extraction script and use WIREGUARD_GO_VERSION directly

Avoids linking against libwg-go.a in order to access the WireGuard backend version.

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Include headers from WireGuardKitC

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: integrate WireGuardKit sources directly

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Remove Sources/ in project folder names

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Rename WireGuardKitSwift -> WireGuardKit

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Linter: Fix all linter issues across the codebase

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Fix build working dir for go-bridge targets

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardNetworkExtension: Remove wireguard.h from bridging header

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Fix paths pointing to xcconfigs

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Add wireguard-go files to exclude list to eliminate SwiftPM warnings

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Set publicHeadersPath = "." to flatten public headers structure

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Fix module map for WireGuardKitC

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Fix import statements

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Move all source files to `Sources/` and rename WireGuardKit targets

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Assert that resolutionResults must not contain failures

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Only assign self.settingsGenerator upon success to set tunnel network settings to avoid inconsistent state

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Remove handleLogLine from WireGuardAdapter

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Remove isStarted: bool from WireGuardAdapter

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Fix docs for WireGuardAdapterError

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Fix docs for WireGuardLogLevel

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Pass logHandler via constructor

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Packet tunnel: Remove last error in the completion handler given to adapter.stop

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Rename cannotLocateSocketDescriptor -> cannotLocateTunnelFileDescriptor in WireGuardAdapterError

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardApp: Switch WireGuardKit to master branch

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Add TODO to log the error coming from `withReresolvedIP`

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Change getWireGuardVersion() -> wireGuardVersion

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Update README

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Packet tunnel: Implement packet tunnel provider using WireGuardAdapter

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Add WireGuardAdapter

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Add wrappers for PrivateKey, PublicKey, PreSharedKey

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

iOS/macOS: Remove "Extract wireguard-go version" build phase

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

iOS/macOS: Remove main bundle apps dependence on WireGuardgoBridge.

Main bundle apps do not have to depend on WireGuardGoBridge<PLATFORM> as they depend on network extnesions which in turn depend on WireGuardGoBridge<PLATFORM>.

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

iOS/macOS: Integrate WireGuardKit

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

go-bridge: Add context support for wgSetLogger

Cherry picked cda99bf45c3cb95ca56204549689a0ae91ff4813 from jd/loggerCtx with the fix for wgSetLogger signature in the C header file.

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Add WireGuardKitCTarget with private C sources

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Set public access level for shared structs

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Move shared structs to WireGuardKit

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit: Add swift package scaffolding

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

go-bridge: dup tunFd so as to not confuse NetworkExtension

The extension isn't banking on tunFd being closed ever, so dup it before
handing it to the rest of wireguard-go.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Change QoS to .utility

As per comment by eskimo:
https://developer.apple.com/forums/thread/107904?answerId=328525022#328525022

Signed-off-by: Andrej Mihajlov <and@mullvad.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Make sure that the tunnel and path monitor run on the same serial queue

Signed-off-by: Andrej Mihajlov <and@mullvad.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Fix retain cycle between NWPathMonitor and PacketTunnelProvider

See: https://www.marisibrothers.com/2017/04/memory-leak-in-swift-assigning-function.html

Signed-off-by: Andrej Mihajlov <and@mullvad.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Refactor interface name query

Signed-off-by: Andrej Mihajlov <and@mullvad.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Localization: Update Japanese

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Localization: macOS: Add translations for 'Edit' button

By copying the 'macMenuEdit' entries to 'macButtonEdit'.

Signed-off-by: Roopesh Chander <roop@roopc.net>

Localization: macOS: Fix localization for 'Edit' button

Signed-off-by: Roopesh Chander <roop@roopc.net>

Localization: Add German translation

Signed-off-by: Roopesh Chander <roop@roopc.net>

Localization: Add Italian translation

Signed-off-by: Roopesh Chander <roop@roopc.net>

Localization: Wire up Japanese translation

By adding the translated Localizable.strings to the Xcode project

Signed-off-by: Roopesh Chander <roop@roopc.net>

highlighter: insist on 256-bit keys, not 257-bit or 258-bit

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Japanese Translation

Translation for wireguard-apple. Checked on Xcode iOS simulator but not
all messages.

Signed-off-by: Eiji Tanioka <tanioka404@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

wireguard-go-bridge: use C string instead of gostring_t

Signed-off-by: Andrej Mihajlov <and@mullvad.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Version bump

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

wireguard-go-bridge: bump

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Update repo urls

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>