Re: WireGuard is broken on iOS 15 beta

[Andrej Mihajlov <and@mullvad.net>]

IIRC one thing to consider with that lookup: iOS enables users to run Personal VPN and Custom VPN (aka WireGuard) side-by-side so there is a chance you may pick the wrong utun.

> On 11 Jun 2021, at 00:33, David Crawshaw <crawshaw@tailscale.com> wrote:
> 
> I finally managed to get a device running iPadOS 15 and an Xcode 13
> beta. This technique works. Some modified code with logging:
> 
> func tunnelFD(provider: NEPacketTunnelProvider) -> Int32 {
>    os_log("tunnelFD searching")
>    var buf = [CChar](repeating: 0, count: Int(IFNAMSIZ))
>    for fd: Int32 in 4...64 {
>        var len = socklen_t(buf.count)
>        if getsockopt(fd, 2 /* SYSPROTO_CONTROL */, 2, &buf, &len) == 0 {
>            let str = String(cString: buf)
>            os_log("%{public}@", "tunnelFD \(fd): \(str)")
>            if str.starts(with: "utun") {
>                os_log("tunnelFD found likely fd")
>                return fd
>            }
>        }
>    }
>    os_log("tunnelFD found nothing")
>    return -1
> }
> 
> produces the logs:
> 
>    tunnelFD searching
>    tunnelFD 7: utun3
>    tunnelFD found likely fd
> 
> Note that the current technique of calling
> provider.packetFlow.value(forKeyPath: "socket.fileDescriptor") causes
> the NetworkExtension to crash under iOS 15. The logs say the kernel
> sandbox killed it:
> 
>    Sandbox: process(525) deny(2) file-test-existence /private/etc/.mdns_debug
> 
> On Thu, Jun 10, 2021 at 8:44 AM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
>> 
>> I won't have an updated OS to test this out in until next week at the
>> earliest, but perhaps this hack will work?
>> https://git.zx2c4.com/wireguard-apple/commit/?h=jd/fd-search-hack
>> Let me know if that is successful, or if it blows up.
>> 
>> Jason