let resolvedEndpoint = tuple.1
if let endpoint = endpoint {
if resolvedEndpoint == nil {
- // DNS resolution failed
guard let hostname = endpoint.hostname() else { fatalError() }
hostnamesWithDnsResolutionFailure.append(hostname)
}
}
return resolvedEndpoints
}
-}
-
-extension DNSResolver {
- // Based on DNS resolution code by Jason Donenfeld <jason@zx2c4.com>
- // in parse_endpoint() in src/tools/config.c in the WireGuard codebase
- //swiftlint:disable:next cyclomatic_complexity
private static func resolveSync(endpoint: Endpoint) -> Endpoint? {
switch endpoint.host {
case .name(let name, _):
var resultPointer = UnsafeMutablePointer<addrinfo>(OpaquePointer(bitPattern: 0))
-
- // The endpoint is a hostname and needs DNS resolution
- if addressInfo(for: name, port: endpoint.port, resultPointer: &resultPointer) == 0 {
- // getaddrinfo succeeded
- let ipv4Buffer = UnsafeMutablePointer<Int8>.allocate(capacity: Int(INET_ADDRSTRLEN))
- let ipv6Buffer = UnsafeMutablePointer<Int8>.allocate(capacity: Int(INET6_ADDRSTRLEN))
- var ipv4AddressString: String?
- var ipv6AddressString: String?
- while resultPointer != nil {
- let result = resultPointer!.pointee
- resultPointer = result.ai_next
- if result.ai_family == AF_INET && result.ai_addrlen == MemoryLayout<sockaddr_in>.size {
- var sa4 = UnsafeRawPointer(result.ai_addr)!.assumingMemoryBound(to: sockaddr_in.self).pointee
- if inet_ntop(result.ai_family, &sa4.sin_addr, ipv4Buffer, socklen_t(INET_ADDRSTRLEN)) != nil {
- ipv4AddressString = String(cString: ipv4Buffer)
- // If we found an IPv4 address, we can stop
- break
- }
- } else if result.ai_family == AF_INET6 && result.ai_addrlen == MemoryLayout<sockaddr_in6>.size {
- if ipv6AddressString != nil {
- // If we already have an IPv6 address, we can skip this one
- continue
- }
- var sa6 = UnsafeRawPointer(result.ai_addr)!.assumingMemoryBound(to: sockaddr_in6.self).pointee
- if inet_ntop(result.ai_family, &sa6.sin6_addr, ipv6Buffer, socklen_t(INET6_ADDRSTRLEN)) != nil {
- ipv6AddressString = String(cString: ipv6Buffer)
- }
- }
- }
- ipv4Buffer.deallocate()
- ipv6Buffer.deallocate()
- // We prefer an IPv4 address over an IPv6 address
- if let ipv4AddressString = ipv4AddressString, let ipv4Address = IPv4Address(ipv4AddressString) {
- return Endpoint(host: .ipv4(ipv4Address), port: endpoint.port)
- } else if let ipv6AddressString = ipv6AddressString, let ipv6Address = IPv6Address(ipv6AddressString) {
- return Endpoint(host: .ipv6(ipv6Address), port: endpoint.port)
- } else {
- return nil
+ var hints = addrinfo(
+ ai_flags: AI_ALL, // We set this to ALL so that we get v4 addresses even on DNS64 networks
+ ai_family: AF_UNSPEC,
+ ai_socktype: SOCK_DGRAM,
+ ai_protocol: IPPROTO_UDP,
+ ai_addrlen: 0,
+ ai_canonname: nil,
+ ai_addr: nil,
+ ai_next: nil)
+ if getaddrinfo(name, "\(endpoint.port)", &hints, &resultPointer) != 0 {
+ return nil
+ }
+ var next = resultPointer
+ var ipv4Address: IPv4Address?
+ var ipv6Address: IPv6Address?
+ while next != nil {
+ let result = next!.pointee
+ next = result.ai_next
+ if result.ai_family == AF_INET && result.ai_addrlen == MemoryLayout<sockaddr_in>.size {
+ var sa4 = UnsafeRawPointer(result.ai_addr)!.assumingMemoryBound(to: sockaddr_in.self).pointee
+ ipv4Address = IPv4Address(Data(bytes: &sa4.sin_addr, count: MemoryLayout<in_addr>.size))
+ break // If we found an IPv4 address, we can stop
+ } else if result.ai_family == AF_INET6 && result.ai_addrlen == MemoryLayout<sockaddr_in6>.size {
+ var sa6 = UnsafeRawPointer(result.ai_addr)!.assumingMemoryBound(to: sockaddr_in6.self).pointee
+ ipv6Address = IPv6Address(Data(bytes: &sa6.sin6_addr, count: MemoryLayout<in6_addr>.size))
+ continue // If we already have an IPv6 address, we can skip this one
}
+ }
+ freeaddrinfo(resultPointer)
+
+ // We prefer an IPv4 address over an IPv6 address
+ if let ipv4Address = ipv4Address {
+ return Endpoint(host: .ipv4(ipv4Address), port: endpoint.port)
+ } else if let ipv6Address = ipv6Address {
+ return Endpoint(host: .ipv6(ipv6Address), port: endpoint.port)
} else {
- // getaddrinfo failed
return nil
}
default:
- // The endpoint is already resolved
return endpoint
}
}
+}
+
+extension Endpoint {
+ func withReresolvedIP() -> Endpoint {
+ var ret = self
+ let hostname: String
+ switch host {
+ case .name(let name, _):
+ hostname = name
+ case .ipv4(let address):
+ hostname = "\(address)"
+ case .ipv6(let address):
+ hostname = "\(address)"
+ }
- private static func addressInfo(for name: String, port: NWEndpoint.Port, resultPointer: inout UnsafeMutablePointer<addrinfo>?) -> Int32 {
+ var resultPointer = UnsafeMutablePointer<addrinfo>(OpaquePointer(bitPattern: 0))
var hints = addrinfo(
- ai_flags: 0,
+ ai_flags: 0, // We set this to zero so that we actually resolve this using DNS64
ai_family: AF_UNSPEC,
- ai_socktype: SOCK_DGRAM, // WireGuard is UDP-only
- ai_protocol: IPPROTO_UDP, // WireGuard is UDP-only
+ ai_socktype: SOCK_DGRAM,
+ ai_protocol: IPPROTO_UDP,
ai_addrlen: 0,
ai_canonname: nil,
ai_addr: nil,
ai_next: nil)
-
- return getaddrinfo(
- name.cString(using: .utf8), // Hostname
- "\(port)".cString(using: .utf8), // Port
- &hints,
- &resultPointer)
+ if getaddrinfo(hostname, "\(port)", &hints, &resultPointer) != 0 || resultPointer == nil {
+ return ret
+ }
+ let result = resultPointer!.pointee
+ if result.ai_family == AF_INET && result.ai_addrlen == MemoryLayout<sockaddr_in>.size {
+ var sa4 = UnsafeRawPointer(result.ai_addr)!.assumingMemoryBound(to: sockaddr_in.self).pointee
+ let addr = IPv4Address(Data(bytes: &sa4.sin_addr, count: MemoryLayout<in_addr>.size))
+ ret = Endpoint(host: .ipv4(addr!), port: port)
+ } else if result.ai_family == AF_INET6 && result.ai_addrlen == MemoryLayout<sockaddr_in6>.size {
+ var sa6 = UnsafeRawPointer(result.ai_addr)!.assumingMemoryBound(to: sockaddr_in6.self).pointee
+ let addr = IPv6Address(Data(bytes: &sa6.sin6_addr, count: MemoryLayout<in6_addr>.size))
+ ret = Endpoint(host: .ipv6(addr!), port: port)
+ }
+ freeaddrinfo(resultPointer)
+ if ret.host != host {
+ wg_log(.debug, message: "DNS64: mapped \(host) to \(ret.host)")
+ } else {
+ wg_log(.debug, message: "DNS64: mapped \(host) to itself.")
+ }
+ return ret
}
}
var wgSettings = ""
for (index, peer) in tunnelConfiguration.peers.enumerated() {
wgSettings.append("public_key=\(peer.publicKey.hexEncodedString())\n")
- if let endpoint = resolvedEndpoints[index] {
+ if let endpoint = resolvedEndpoints[index]?.withReresolvedIP() {
if case .name(_, _) = endpoint.host { assert(false, "Endpoint is not resolved") }
wgSettings.append("endpoint=\(endpoint.stringRepresentation)\n")
}
if let preSharedKey = peer.preSharedKey {
wgSettings.append("preshared_key=\(preSharedKey.hexEncodedString())\n")
}
- if let endpoint = resolvedEndpoints[index] {
+ if let endpoint = resolvedEndpoints[index]?.withReresolvedIP() {
if case .name(_, _) = endpoint.host { assert(false, "Endpoint is not resolved") }
wgSettings.append("endpoint=\(endpoint.stringRepresentation)\n")
}
* make sense. So, we fill it in with this placeholder, which is not
* a valid IP address that will actually route over the Internet.
*/
- var remoteAddress = "0.0.0.0"
- let endpointsCompact = resolvedEndpoints.compactMap { $0 }
- if endpointsCompact.count == 1 {
- switch endpointsCompact.first!.host {
- case .ipv4(let address):
- remoteAddress = "\(address)"
- case .ipv6(let address):
- remoteAddress = "\(address)"
- default:
- break
- }
- }
+ let remoteAddress = "0.0.0.0"
let networkSettings = NEPacketTunnelNetworkSettings(tunnelRemoteAddress: remoteAddress)
let (ipv4Routes, ipv6Routes) = routes()
let (ipv4IncludedRoutes, ipv6IncludedRoutes) = includedRoutes()
- let (ipv4ExcludedRoutes, ipv6ExcludedRoutes) = excludedRoutes()
let ipv4Settings = NEIPv4Settings(addresses: ipv4Routes.map { $0.destinationAddress }, subnetMasks: ipv4Routes.map { $0.destinationSubnetMask })
ipv4Settings.includedRoutes = ipv4IncludedRoutes
- ipv4Settings.excludedRoutes = ipv4ExcludedRoutes
networkSettings.ipv4Settings = ipv4Settings
let ipv6Settings = NEIPv6Settings(addresses: ipv6Routes.map { $0.destinationAddress }, networkPrefixLengths: ipv6Routes.map { $0.destinationNetworkPrefixLength })
ipv6Settings.includedRoutes = ipv6IncludedRoutes
- ipv6Settings.excludedRoutes = ipv6ExcludedRoutes
networkSettings.ipv6Settings = ipv6Settings
return networkSettings
}
return (ipv4IncludedRoutes, ipv6IncludedRoutes)
}
-
- private func excludedRoutes() -> ([NEIPv4Route], [NEIPv6Route]) {
- var ipv4ExcludedRoutes = [NEIPv4Route]()
- var ipv6ExcludedRoutes = [NEIPv6Route]()
- for endpoint in resolvedEndpoints {
- guard let endpoint = endpoint else { continue }
- switch endpoint.host {
- case .ipv4(let address):
- ipv4ExcludedRoutes.append(NEIPv4Route(destinationAddress: "\(address)", subnetMask: "255.255.255.255"))
- case .ipv6(let address):
- ipv6ExcludedRoutes.append(NEIPv6Route(destinationAddress: "\(address)", networkPrefixLength: NSNumber(value: UInt8(128))))
- default:
- fatalError()
- }
- }
- return (ipv4ExcludedRoutes, ipv6ExcludedRoutes)
- }
-
}
private extension Data {
projects / thirdparty / wireguard-apple.git / commitdiff
