guardianproject / orbot-apple

Orbot VPN app for iOS
MIT License
205 stars 34 forks source link

Packet Tunnel exits quietly due to faulty leaf_run #28

Closed edsburke closed 2 years ago

edsburke commented 2 years ago

Hey Orbot community,

Thank you so much for building this canon torified app that uses the Leaf backend. I have faced an issue when I try building a sample iOS VPN using the similar way like orbot.

Problem

The Packet Tunnel provider just exits quietly due to a NULL netif from leaf_run internally.

How to produce

  1. Create a sample iOS VPN that uses Shared/Tunnel/LeafPTProvider and related components under shared directory as an NE extension.
  2. Start the VPN
  3. Packet Tunnel provider will exit quietly because of error from netstack-lwip.

Debugging

Retrieve tunnel FD from iOS

Screen Shot 2022-08-26 at 4 53 26 PM

orbot-ios/Shared/Tunnel/BasePTProvider.swift

leaf conf, for simplicity

[General]
loglevel = info
dns-server = 1.1.1.1
always-real-ip = *
tun-fd = {{tunFd}}

[Proxy]
MyDns = redirect, 1.1.1.1, 53
SocksPoxy = socks, {{socksHost}}, {{socksPort}}
Reject = reject

[Rule]
PORT-RANGE, 53-53, MyDns
NETWORK, tcp, SocksPoxy
FINAL, Reject

This conf is a borrowing work from the upstream work orbot-ios/Shared/template.conf with hardcoded DNS

Packet tunnel provider

Similarly, orbot-ios/Shared/Tunnel/LeafPTProvider.swift is used, leaf.conf is generated with the {{}} placeholders replaced with working SOCKS host and port for sure.

netstack-lwip faults

When the tunnel is started, it quits quietly in a couple of seconds with the fault like:

Screen Shot 2022-08-26 at 4 45 26 PM

At the line 35, netif_first always returns NULL. It seems that the utun device from iOS is not usable.

netstack-lwip/src/stack_impl.rs

Looking for Help

Could you please instruct what extra work we need to do or pay attention to to make it work? I've seen in the orbot-ios main app, there are stuff like Transport and commTunnel, but I don't think they are related.

Your help is greatly appreciated! Some sponsorship will be also be provided in this case.

edsburke commented 2 years ago

Some updates, this has been resolved by recreating a brand new target of network extension. Still many thanks for the work. I will close this.

tladesignz commented 2 years ago

Always happy to help. :-) Good luck and have fun!