From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: samuel@sholland.org Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 1da52b8d for ; Tue, 3 Jul 2018 18:05:45 +0000 (UTC) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 5627a95a for ; Tue, 3 Jul 2018 18:05:45 +0000 (UTC) Subject: Re: Android app whitelist/blacklist feature To: "Jason A. Donenfeld" , eric@bluelinelabs.com References: From: Samuel Holland Message-ID: <72472182-2f17-ff6d-f76c-f0fa6c98d45e@sholland.org> Date: Tue, 3 Jul 2018 13:12:10 -0500 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Cc: WireGuard mailing list List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On 07/02/18 21:31, Jason A. Donenfeld wrote: > On Tue, Jul 3, 2018 at 4:27 AM Eric Kuck wrote: >> >> I was originally thinking the new fragment would be a per-tunnel thing >> (set when you create the tunnel or edit it), but you’re right - making it >> a general setting likely makes a whole lot more sense. I can’t think of >> any use-cases for different tunnels handling different apps. > > It might actually make most sense to make it a per-tunnel thing. We'd then > have to introduce conf key called, "ExemptedApplications=" or something. > Samuel - any thoughts on this? Right, trying to make it a global setting requires either some sort of out-of-band way to pass the information to wg-quick, or rewriting the configuration file every time the tunnel is brought up. Since from netd's point of view, this is a per-network setting anyway, I agree it makes sense to configure it per-tunnel. ExemptedApplications works as a configuration key, though I prefer ExcludedApplications--the application isn't just not required to use the tunnel, it's not allowed to use the tunnel. In that case, here are my UI suggestions: - Add a button in the editor that switches to a fragment or pops up a Dialog similar to a MultiSelectListPreference. - For consistency, checked means excluded -- everything defaults to unchecked. - The package names of excluded apps are put in the com.wireguard.config.Interface, and wg-quick handles package name to uid translation. How does that sound? Samuel