This fixes the advisory GHSA-fh82-c53h-gfvf, where technically a
compromised API could be used to serve old metadata after a reinstall.
However, the app never accepted downgrades, and new installs are mostly
installing the latest version, so this is mostly theoretical.
Toggling in-tunnel IPv6 while connected restarts the tunnel, so
the second connect_and_wait in test_wireguard_ipv6_in_ipvx sometimes
observed the old tunnel's Connected state and ran the connection
checks while the new tunnel was still coming up.
This could cause `assert_secure` to fail.
constrain_to_relay rebuilt the relay settings from a singlehop query,
which reset the multihop entry location to Any.
This caused multihop to use any relay as entry if multihop was enabled
afterwards. It should be set to some one of the relays in
the test locations.
On some machines, the app bundle can be replaced by any admin user,
so mullvad-daemon can be replaced with a malicious binary that the
launch daemon runs as root.
This adds a spawn constraint that refuses to run any binary that does
not match the expected cdhash of mullvad-daemon. The hash is disabled
for unsigned builds since they don't have this hash embedded.
The connectivity check relies on an ICMP ping to prod WireGuard into
handshaking and to get some traffic back through the tunnel. If ICMP is
blocked, e.g. by a third-party firewall, no reply is received and the
check times out.
Blocking ICMP was never intentionally supported but it happened to work
because the ephemeral peer exchange used the same tunnel. This hack
makes it work again by connecting a TCP socket when checking the
connection.
The TCP connection itself does not need to succeed. It is enough for
the handshake to succeed. So we don't wait for it.
The settings of the `prod` and `staging` environments used by the
desktop end-to-end workflow, `mullvad_host` and `test_locations`, were
previously only stored in the test-manager config on each runner.
They are now defined in `test/environments.json`, which is embedded in
test-manager at compile-time.
An environment in the config file overrides built-in ones.
Previously, the test-runner had to be mounted at `E:`, but this seems
to cause issues with files appearing corrupted at times. It also
requires building a scheduled task into the OS image.
With this change, the only prerequisite is that the OS image contains
sshd.
The account used by the end-to-end tests now comes from the
`DESKTOP_<ENV>_TEST_ACCOUNT_<OS>` secrets, where <ENV> is `PROD` or
`STAGING` and <OS> is `WINLINUX` or `MACOS`. Previously, it was always
read from the test-manager config on the runner.
Without this, mullvad-exclude could be used to open and write to
cgroup.procs anywhere on the filesystem, as its setuid bit is set.
In reality, this only affected cgroup2, which is feature-gated and
is disabled right now.
This fixes the advisory GHSA-6m4p-ggr4-5f76.
This likely improves performance by halving the number of send/recv
syscalls. This is particularly relevant for LWO if or when iOS supports
batched send/recv.
We no longer need this now as private IPs are pruned from allowed IPs
instead.
Also move `ALLOWED_IN_TUNNEL_LAN_NETS` to `mullvad-daemon`, since it's
specific to Mullvad relays.
This fixes an issue where we blocked all private IPs in custom tunnels.
The source address we report when implementing `UdpRecv` should not
actually matter. Let `talpid-wireguard` take care of it and just set it
to the wireguard endpoint instead.
All types of obfuscation, including the multiplexer/FWT, now support the
`ObfuscatedTransport` trait. So get rid of socket-based obfuscation.
I haven't removed it fully from `tunnel-obfuscation`, as iOS still
depends on it.
It no longer pays the large cost of having a local UDP socket in front
of it. The `ObfuscatedTransport` does do some work on each `recv` to
handle different multiplexer phases. I didn't attempt to optimize this
because the cost was negligible compared to the socket syscalls.
The socket interface is still available by wrapping the multiplexer in a
`LocalSocketRunner`, as with other obfuscation types.
Since both the GotaTun and wireguard-nt adapter survive between
connections, we have to make sure they don't assign the same IP
addresses.
Either adapter is destroyed if its addresses cannot be removed, since
that releases them as well.
Both adapters were named "Mullvad". That was fine while they only
existed for the duration of a connection, but both are now kept alive
between connections, and Windows renames an interface whose name is
already taken. The wintun adapter is therefore named "Mullvad GotaTun",
and wireguard-nt keeps "Mullvad".
This means switching between wireguard-nt and GotaTun no longer costs an
adapter creation.
This creates a wintun adapter only on first use, and reuses it after
that. This saves about ~0.2 s on reconnects, but only if using GotaTun.
The tunnel device is destroyed when the daemon is killed or when reusing
it fails.
Five iterations on a Windows 11 host (`tun_timing` example):
adapter min median max
destroyed 187.9ms 207.5ms 275.1ms
kept alive 16.1ms 17.4ms 21.5ms
David Lönnhager