feat(macos): KillSwitch L0→L3 — NE includeAllNetworks+enforceRoutes+on-demand
macOS 走原生 NE,strict_route 不生效。补齐断网保护到天花板 L3: VpnChannel.swift - 缓存 killSwitchEnabled(默认 true,与 Dart AppSettings.killSwitch 对齐) - setKillSwitch 落地:存标志,manager 已装配则即时重写 NE 配置+保存 - configureKillSwitch:includeAllNetworks+enforceRoutes(L2 OS 强制、扛崩溃) + NEOnDemandRule 常开(L3)+ excludeLocalNetworks 放行 LAN (enforceRoutes/excludeLocalNetworks 为 macOS 11+ API,#available 守卫) - stop() gotcha:on-demand 常开时先关 isOnDemandEnabled+save 再 stop, 否则手动断开被 OS 立刻拉回 - start() options 带 killSwitch 传扩展 PacketTunnelProvider.swift - startTunnel 读 killSwitch 选项(OS on-demand 自启时 nil→默认 true) - libbox 回调 includeAllNetworks() 返回该值,与 NE 层对齐 docs/killswitch-design.html: 新增 §6.5 实现方案,状态表 macOS L0→L3 验证:xcodebuild CODE_SIGNING_ALLOWED=NO 两 target SwiftCompile 通过; 端到端 fail-closed/on-demand 需真机手测(NE 难单测)。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
wangjia
@@ -33,6 +33,10 @@ final class VpnChannel: NSObject {
|
||||
private let statsClient = StatsClient()
|
||||
private var manager: NETunnelProviderManager?
|
||||
private var sysextDelegate: SysExtActivationDelegate?
|
||||
// KillSwitch(断网保护)开关,默认 true 与 Dart AppSettings.killSwitch 默认对齐。
|
||||
// 决定 NE 层是否 fail-closed:includeAllNetworks + enforceRoutes(L2 OS 强制)
|
||||
// + NEOnDemandRule 常开(L3 开机/掉线窗口也堵)。详见 docs/killswitch-design.html §6.5。
|
||||
private var killSwitchEnabled = true
|
||||
|
||||
static func register(with registrar: FlutterPluginRegistrar) {
|
||||
let instance = VpnChannel()
|
||||
@@ -87,8 +91,26 @@ final class VpnChannel: NSObject {
|
||||
case "getActiveOutbound":
|
||||
result("auto")
|
||||
case "setKillSwitch":
|
||||
// includeAllNetworks / on-demand 实现 kill switch(后续)。
|
||||
result(nil)
|
||||
let on = (call.arguments as? Bool) ?? true
|
||||
killSwitchEnabled = on
|
||||
vpnLog("setKillSwitch=\(on)")
|
||||
// 已装配 manager 则即时重写 NE 配置(includeAllNetworks/enforceRoutes/on-demand);
|
||||
// 尚无 manager 时仅缓存,下次 loadOrCreateManager 装配时应用。
|
||||
if let mgr = manager {
|
||||
Task {
|
||||
do {
|
||||
try await self.applyKillSwitchConfig(to: mgr)
|
||||
vpnLog("setKillSwitch: NE 配置已更新并保存 ✓")
|
||||
result(nil)
|
||||
} catch {
|
||||
let ns = error as NSError
|
||||
vpnLog("setKillSwitch: 保存 NE 配置失败 ✗ code=\(ns.code) desc=\(ns.localizedDescription)")
|
||||
result(FlutterError(code: "killswitch_failed", message: error.localizedDescription, details: nil))
|
||||
}
|
||||
}
|
||||
} else {
|
||||
result(nil)
|
||||
}
|
||||
default:
|
||||
result(FlutterMethodNotImplemented)
|
||||
}
|
||||
@@ -109,6 +131,7 @@ final class VpnChannel: NSObject {
|
||||
vpnLog("step③ startVPNTunnel(options: configContent) …")
|
||||
try mgr.connection.startVPNTunnel(options: [
|
||||
"configContent": configJson as NSString,
|
||||
"killSwitch": NSNumber(value: killSwitchEnabled),
|
||||
])
|
||||
vpnLog("step③ startVPNTunnel 调用已返回(实际起停由 NEVPNStatus 流驱动)✓")
|
||||
result(nil)
|
||||
@@ -120,6 +143,19 @@ final class VpnChannel: NSObject {
|
||||
}
|
||||
|
||||
private func stop(_ result: @escaping FlutterResult) async {
|
||||
// on-demand 常开时直接 stopVPNTunnel 会被 OS 立刻拉回 → 手动断开须先关 on-demand 再断。
|
||||
// 下次手动 start() 时 loadOrCreateManager 会按 killSwitchEnabled 重新启用 on-demand。
|
||||
if let mgr = manager, mgr.isOnDemandEnabled {
|
||||
mgr.isOnDemandEnabled = false
|
||||
do {
|
||||
try await mgr.saveToPreferences()
|
||||
try await mgr.loadFromPreferences()
|
||||
vpnLog("stop: 已临时关闭 on-demand(避免手动断开被自动拉回)")
|
||||
} catch {
|
||||
let ns = error as NSError
|
||||
vpnLog("stop: 关闭 on-demand 失败(仍继续断开) code=\(ns.code) desc=\(ns.localizedDescription)")
|
||||
}
|
||||
}
|
||||
manager?.connection.stopVPNTunnel()
|
||||
result(nil)
|
||||
}
|
||||
@@ -135,6 +171,7 @@ final class VpnChannel: NSObject {
|
||||
mgr.protocolConfiguration = proto
|
||||
mgr.localizedDescription = "Pangolin"
|
||||
mgr.isEnabled = true
|
||||
configureKillSwitch(on: mgr) // 按 killSwitchEnabled 写入 NE fail-closed 字段
|
||||
vpnLog(" saveToPreferences(providerBundleId=\(Self.tunnelBundleId)) …")
|
||||
try await mgr.saveToPreferences()
|
||||
try await mgr.loadFromPreferences() // 保存后重载,拿到有效 connection
|
||||
@@ -142,6 +179,40 @@ final class VpnChannel: NSObject {
|
||||
return mgr
|
||||
}
|
||||
|
||||
// ── KillSwitch(断网保护)NE 配置 ────────────────────────────────
|
||||
// 把当前 killSwitchEnabled 写入 manager 的 NE 字段(不保存,由调用方保存):
|
||||
// L2 OS 强制:includeAllNetworks=true 全量入隧道 + enforceRoutes=true 隧道路由优先,
|
||||
// 非隧道流量被 neagent 系统级阻断(扛 app/内核崩溃)。
|
||||
// L3 常开:NEOnDemandRule 让 OS 在掉线/开机窗口自动拉起隧道,全程 fail-closed。
|
||||
// excludeLocalNetworks=true 放行 LAN(打印机/AirPlay 等),不影响防泄漏目标。
|
||||
// enforceRoutes/excludeLocalNetworks 为 macOS 11+ API,Runner 部署目标 10.15 → #available 守卫。
|
||||
private func configureKillSwitch(on mgr: NETunnelProviderManager) {
|
||||
if let proto = mgr.protocolConfiguration as? NETunnelProviderProtocol {
|
||||
proto.includeAllNetworks = killSwitchEnabled
|
||||
if #available(macOS 11.0, *) {
|
||||
proto.enforceRoutes = killSwitchEnabled
|
||||
proto.excludeLocalNetworks = true
|
||||
}
|
||||
}
|
||||
if killSwitchEnabled {
|
||||
let rule = NEOnDemandRuleConnect()
|
||||
rule.interfaceTypeMatch = .any
|
||||
mgr.onDemandRules = [rule]
|
||||
mgr.isOnDemandEnabled = true
|
||||
} else {
|
||||
mgr.onDemandRules = []
|
||||
mgr.isOnDemandEnabled = false
|
||||
}
|
||||
vpnLog(" killSwitch 配置: includeAllNetworks=\(killSwitchEnabled) enforceRoutes=\(killSwitchEnabled) onDemand=\(killSwitchEnabled)")
|
||||
}
|
||||
|
||||
/// 即时应用 killswitch(改字段 + 保存 + 重载)。供 setKillSwitch 在 manager 已装配时调用。
|
||||
private func applyKillSwitchConfig(to mgr: NETunnelProviderManager) async throws {
|
||||
configureKillSwitch(on: mgr)
|
||||
try await mgr.saveToPreferences()
|
||||
try await mgr.loadFromPreferences()
|
||||
}
|
||||
|
||||
// 请求系统加载/更新 PacketTunnel System Extension。首启系统会弹「隐私与安全性」
|
||||
// 让用户允许;允许后 didFinishWithResult 回来。已是最新则快速完成。
|
||||
private func activateSystemExtensionIfNeeded() async throws {
|
||||
|
||||
Reference in New Issue
Block a user