wireguard.lists.zx2c4.com archive mirror
 help / color / mirror / Atom feed
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: Miguel Arroz <miguel.arroz@gmail.com>
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>,
	Eddie <stunnel@attglobal.net>,  Anatoli <me@anatoli.ws>,
	Roopesh Chander S <roop@roopc.net>,
	Alan Graham <alan@meshify.app>,
	oss@jacobwilder.org
Subject: Re: WireGuard Configurations Gone After iOS 15 Upgrade
Date: Wed, 22 Sep 2021 21:09:08 -0600	[thread overview]
Message-ID: <CAHmME9rREdEAWEDYyHaRWHwkUUWy1MPdrBokSygO8rhyxTJgXg@mail.gmail.com> (raw)
In-Reply-To: <BD9150AA-4F49-416A-A897-A9C4000C354E@gmail.com>

Hi Miguel,

On Wed, Sep 22, 2021 at 8:54 PM Miguel Arroz <miguel.arroz@gmail.com> wrote:
>   If I understand correctly, this ends up being "group.$(APP_ID_IOS)”. I’m a bit surprised this doesn’t need the Team ID before “group”, as it definitely needs that in macOS.

Indeed it's prefixed with the team on macOS, but IIRC that never worked on iOS.

>   - The openReference() function, because it’s not setting the same kSecAttrAccessGroup parameter when reading. The documentation mentions what happens when it’s not set (https://developer.apple.com/documentation/security/ksecattraccessgroup), I wonder if that changed (intentionally or due to a bug in iOS 15):
>
> > If you don’t explicitly set a group, keychain services defaults to the app’s first access group, which is either the first keychain access group, or the app ID when the app has no keychain groups.

For setting, but for reading/updating, that page says:

> By default, the SecItemUpdate, SecItemDelete, and SecItemCopyMatching
> methods search all the app’s access groups. Add the kSecAttrAccessGroup
> attribute to the query to limit the search to a particular group.

So in theory, it should be fine to omit that in openReference().
Adding it in there also doesn't cause any changes, unfortunately.

>   None of these explain why the tunnel keeps working after upgrading to iOS 15 (if the on-demand flag is set

Oh, I didn't realize that was happening. Are you *sure* about that? Is
the tunnel actually working? Or is it on, but crashing? When I go to
enable the tunnel from the system preferences view of it, it starts
and then stops, indicating the network extension couldn't open the
keychain ref either. And in the log, I see the [NET] process indeed
failing in the same spot as the [APP] process.

Jason

  parent reply	other threads:[~2021-09-23  3:12 UTC|newest]

Thread overview: 40+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-22  0:23 WireGuard Configurations Gone After iOS 15 Upgrade Eddie
2021-09-22  0:28 ` Eddie
2021-09-22  0:45   ` Miguel Arroz
2021-09-22  3:14 ` Jason A. Donenfeld
2021-09-22  4:04   ` Anatoli
2021-09-22  4:50     ` Jason A. Donenfeld
2021-09-22  5:17       ` Jason A. Donenfeld
     [not found]         ` <CAMaqUZ2dTaOJ3oPex0pQxBM9njHA7rW5Hb69MvG645n+ya_jhQ@mail.gmail.com>
2021-09-22 13:59           ` Jason A. Donenfeld
2021-09-22 14:47         ` Andrew Fried
2021-09-22 15:23       ` Eddie
2021-09-22 16:50         ` Miguel Arroz
2021-09-22 19:28           ` Jason A. Donenfeld
2021-09-22 19:58             ` Jeffrey Walton
2021-09-22 22:15             ` Jason A. Donenfeld
2021-09-22 22:31               ` Miguel Arroz
2021-09-22 22:35                 ` Jason A. Donenfeld
2021-09-22 22:42                   ` Miguel Arroz
2021-09-22 22:43                     ` Jason A. Donenfeld
2021-09-22 22:45                   ` Eddie
2021-09-22 22:55                     ` Eddie
2021-09-22 22:55                       ` Jason A. Donenfeld
     [not found]                     ` <814501e8-c2c8-1e0a-2f30-fd83fb7769ec@attglobal.net>
     [not found]                       ` <CAHmME9p5C3bGT=gXV6WQ5HNOBTtitXdGwKm7EaOv_bnVVvX5vA@mail.gmail.com>
2021-09-22 22:56                         ` Eddie
2021-09-23  1:34               ` Jason A. Donenfeld
2021-09-23  2:49                 ` Jason A. Donenfeld
2021-09-23  2:54                 ` Miguel Arroz
2021-09-23  3:06                   ` Miguel Arroz
2021-09-23  3:09                   ` Jason A. Donenfeld [this message]
2021-09-23  3:19                     ` Miguel Arroz
2021-09-23  3:22                       ` Jason A. Donenfeld
2021-09-23  3:57                         ` Jason A. Donenfeld
2021-09-23  4:13                           ` Jason A. Donenfeld
2021-09-23  4:21                             ` Miguel Arroz
2021-09-23 14:41                             ` Anatoli
2021-09-23 17:26                               ` Jason A. Donenfeld
2021-09-24  2:17                                 ` Jason A. Donenfeld
2021-09-24  8:05                                   ` Alan Graham
2021-09-22 22:24             ` Anatoli
2021-09-22 22:26               ` Jason A. Donenfeld
2021-09-22 23:12                 ` Anatoli
2021-09-22 23:53                   ` Alan Graham

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAHmME9rREdEAWEDYyHaRWHwkUUWy1MPdrBokSygO8rhyxTJgXg@mail.gmail.com \
    --to=jason@zx2c4.com \
    --cc=alan@meshify.app \
    --cc=me@anatoli.ws \
    --cc=miguel.arroz@gmail.com \
    --cc=oss@jacobwilder.org \
    --cc=roop@roopc.net \
    --cc=stunnel@attglobal.net \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).