chore: add network extension manager

Author: ethanndickson

Coder Desktop/.swiftlint.yml

@@ -8,3 +8,5 @@ type_name:
 identifier_name:
   allowed_symbols: "_"
   min_length: 1
+cyclomatic_complexity:
+  warning: 15

Coder Desktop/Coder Desktop/Preview Content/PreviewClient.swift

@@ -23,7 +23,7 @@ struct PreviewClient: Client {
                 roles: []
             )
         } catch {
-            throw ClientError.reqError(AFError.explicitlyCancelled)
+            throw .reqError(.explicitlyCancelled)
         }
     }
 }

Coder Desktop/Coder Desktop/SDK/Client.swift

@@ -39,7 +39,7 @@ struct CoderClient: Client {
         case let .success(data):
             return HTTPResponse(resp: out.response!, data: data, req: out.request)
         case let .failure(error):
-            throw ClientError.reqError(error)
+            throw .reqError(error)
         }
     }
 
@@ -58,7 +58,7 @@ struct CoderClient: Client {
         case let .success(data):
             return HTTPResponse(resp: out.response!, data: data, req: out.request)
         case let .failure(error):
-            throw ClientError.reqError(error)
+            throw .reqError(error)
         }
     }
 
@@ -71,9 +71,9 @@ struct CoderClient: Client {
                 method: resp.req?.httpMethod,
                 url: resp.req?.url
             )
-            return ClientError.apiError(out)
+            return .apiError(out)
         } catch {
-            return ClientError.unexpectedResponse(resp.data[...1024])
+            return .unexpectedResponse(resp.data[...1024])
         }
     }
 

Coder Desktop/Coder Desktop/SDK/User.swift

@@ -9,7 +9,7 @@ extension CoderClient {
         do {
             return try CoderClient.decoder.decode(User.self, from: res.data)
         } catch {
-            throw ClientError.unexpectedResponse(res.data[...1024])
+            throw .unexpectedResponse(res.data[...1024])
         }
     }
 }

Coder Desktop/Coder DesktopTests/Util.swift

@@ -68,7 +68,7 @@ struct MockClient: Client {
 struct MockErrorClient: Client {
     init(url _: URL, token _: String?) {}
     func user(_: String) async throws(ClientError) -> Coder_Desktop.User {
-        throw ClientError.reqError(.explicitlyCancelled)
+        throw .reqError(.explicitlyCancelled)
     }
 }
 

Coder Desktop/VPN/Manager.swift

@@ -4,16 +4,200 @@ import VPNLib
 
 actor Manager {
     let ptp: PacketTunnelProvider
+    let cfg: ManagerConfig
 
-    var tunnelHandle: TunnelHandle?
-    var speaker: Speaker<Vpn_ManagerMessage, Vpn_TunnelMessage>?
+    let tunnelHandle: TunnelHandle
+    let speaker: Speaker<Vpn_ManagerMessage, Vpn_TunnelMessage>
+    var readLoop: Task<Void, any Error>!
     // TODO: XPC Speaker
 
     private let dest = FileManager.default.urls(for: .documentDirectory, in: .userDomainMask)
         .first!.appending(path: "coder-vpn.dylib")
     private let logger = Logger(subsystem: Bundle.main.bundleIdentifier!, category: "manager")
 
-    init(with: PacketTunnelProvider) {
+    init(with: PacketTunnelProvider, cfg: ManagerConfig) async throws(ManagerError) {
         ptp = with
+        self.cfg = cfg
+        #if arch(arm64)
+            let dylibPath = cfg.serverUrl.appending(path: "bin/coder-vpn-arm64.dylib")
+        #elseif arch(x86_64)
+            let dylibPath = cfg.serverUrl.appending(path: "bin/coder-vpn-amd64.dylib")
+        #else
+            fatalError("unknown architecture")
+        #endif
+        do {
+            try await download(src: dylibPath, dest: dest)
+        } catch {
+            throw .download(error)
+        }
+        do throws(ValidationError) {
+            try SignatureValidator.validate(path: dest)
+        } catch {
+            throw .validation(error)
+        }
+        do {
+            try tunnelHandle = TunnelHandle(dylibPath: dest)
+        } catch {
+            throw .tunnelSetup(error)
+        }
+        speaker = await Speaker<Vpn_ManagerMessage, Vpn_TunnelMessage>(
+            writeFD: tunnelHandle.writeHandle,
+            readFD: tunnelHandle.readHandle
+        )
+        do throws(HandshakeError) {
+            try await speaker.handshake()
+        } catch {
+            throw .handshake(error)
+        }
+        readLoop = Task { try await run() }
     }
+
+    func run() async throws {
+        do {
+            for try await m in speaker {
+                switch m {
+                case let .message(msg):
+                    handleMessage(msg)
+                case let .RPC(rpc):
+                    handleRPC(rpc)
+                }
+            }
+        } catch {
+            logger.error("tunnel read loop failed: \(error)")
+            try await tunnelHandle.close()
+            // TODO: Notify app over XPC
+            return
+        }
+        logger.info("tunnel read loop exited")
+        try await tunnelHandle.close()
+        // TODO: Notify app over XPC
+    }
+
+    func handleMessage(_ msg: Vpn_TunnelMessage) {
+        guard let msgType = msg.msg else {
+            logger.critical("received message with no type")
+            return
+        }
+        switch msgType {
+        case .peerUpdate:
+            {}() // TODO: Send over XPC
+        case let .log(logMsg):
+            writeVpnLog(logMsg)
+        case .networkSettings, .start, .stop:
+            logger.critical("received unexpected message: `\(String(describing: msgType))`")
+        }
+    }
+
+    func handleRPC(_ rpc: RPCRequest<Vpn_ManagerMessage, Vpn_TunnelMessage>) {
+        guard let msgType = rpc.msg.msg else {
+            logger.critical("received rpc with no type")
+            return
+        }
+        switch msgType {
+        case let .networkSettings(ns):
+            let neSettings = convertNetworkSettingsRequest(ns)
+            ptp.setTunnelNetworkSettings(neSettings)
+        case .log, .peerUpdate, .start, .stop:
+            logger.critical("received unexpected rpc: `\(String(describing: msgType))`")
+        }
+    }
+
+    // TODO: Call via XPC
+    func startVPN(apiToken: String, server: URL) async throws(ManagerError) {
+        logger.info("sending start rpc")
+        let resp: Vpn_TunnelMessage
+        do {
+            resp = try await speaker.unaryRPC(.with { msg in
+                msg.start = .with { req in
+                    // TODO: handle nil FD
+                    req.tunnelFileDescriptor = ptp.tunnelFileDescriptor!
+                    req.apiToken = apiToken
+                    req.coderURL = server.absoluteString
+                }
+            })
+        } catch {
+            throw .failedRPC(error)
+        }
+        guard case let .start(startResp) = resp.msg else {
+            throw .incorrectResponse(resp)
+        }
+        if !startResp.success {
+            throw .errorResponse(msg: startResp.errorMessage)
+        }
+        // TODO: notify app over XPC
+    }
+
+    // TODO: Call via XPC
+    func stopVPN() async throws(ManagerError) {
+        logger.info("sending stop rpc")
+        let resp: Vpn_TunnelMessage
+        do {
+            resp = try await speaker.unaryRPC(.with { msg in
+                msg.stop = .init()
+            })
+        } catch {
+            throw .failedRPC(error)
+        }
+        guard case let .stop(stopResp) = resp.msg else {
+            throw .incorrectResponse(resp)
+        }
+        if !stopResp.success {
+            throw .errorResponse(msg: stopResp.errorMessage)
+        }
+        // TODO: notify app over XPC
+    }
+
+    // TODO: Call via XPC
+    // Retrieves the current state of all peers,
+    // as required when starting the app whilst the network extension is already running
+    func getPeerInfo() async throws(ManagerError) {
+        logger.info("sending peer state request")
+        let resp: Vpn_TunnelMessage
+        do {
+            resp = try await speaker.unaryRPC(.with { msg in
+                msg.getPeerUpdate = .init()
+            })
+        } catch {
+            throw .failedRPC(error)
+        }
+        guard case .peerUpdate = resp.msg else {
+            throw .incorrectResponse(resp)
+        }
+        // TODO: pass to app over XPC
+    }
+}
+
+public struct ManagerConfig {
+    let apiToken: String
+    let serverUrl: URL
+}
+
+enum ManagerError: Error {
+    case download(DownloadError)
+    case tunnelSetup(TunnelHandleError)
+    case handshake(HandshakeError)
+    case validation(ValidationError)
+    case incorrectResponse(Vpn_TunnelMessage)
+    case failedRPC(any Error)
+    case errorResponse(msg: String)
+}
+
+func writeVpnLog(_ log: Vpn_Log) {
+    let level: OSLogType = switch log.level {
+    case .info: .info
+    case .debug: .debug
+    // warn == error
+    case .warn: .error
+    case .error: .error
+    // critical == fatal == fault
+    case .critical: .fault
+    case .fatal: .fault
+    case .UNRECOGNIZED: .info
+    }
+    let logger = Logger(
+        subsystem: "\(Bundle.main.bundleIdentifier!).dylib",
+        category: log.loggerNames.joined(separator: ".")
+    )
+    let fields = log.fields.map { "\($0.name): \($0.value)" }.joined(separator: ", ")
+    logger.log(level: level, "\(log.message): \(fields)")
 }

Coder Desktop/VPN/PacketTunnelProvider.swift

@@ -5,10 +5,10 @@ import os
 let CTLIOCGINFO: UInt = 0xC064_4E03
 
 class PacketTunnelProvider: NEPacketTunnelProvider, @unchecked Sendable {
-    private let logger = Logger(subsystem: Bundle.main.bundleIdentifier!, category: "network-extension")
+    private let logger = Logger(subsystem: Bundle.main.bundleIdentifier!, category: "packet-tunnel-provider")
     private var manager: Manager?
 
-    private var tunnelFileDescriptor: Int32? {
+    public var tunnelFileDescriptor: Int32? {
         var ctlInfo = ctl_info()
         withUnsafeMutablePointer(to: &ctlInfo.ctl_name) {
             $0.withMemoryRebound(to: CChar.self, capacity: MemoryLayout.size(ofValue: $0.pointee)) {
@@ -46,7 +46,13 @@ class PacketTunnelProvider: NEPacketTunnelProvider, @unchecked Sendable {
             completionHandler(nil)
             return
         }
-        manager = Manager(with: self)
+        Task {
+            // TODO: Retrieve access URL & Token via Keychain
+            manager = try await Manager(
+                with: self,
+                cfg: .init(apiToken: "fake-token", serverUrl: .init(string: "https://dev.coder.com")!)
+            )
+        }
         completionHandler(nil)
     }
 

Coder Desktop/VPN/TunnelHandle.swift

@@ -15,22 +15,12 @@ actor TunnelHandle {
 
     init(dylibPath: URL) throws(TunnelHandleError) {
         guard let dylibHandle = dlopen(dylibPath.path, RTLD_NOW | RTLD_LOCAL) else {
-            var errStr = "UNKNOWN"
-            let e = dlerror()
-            if e != nil {
-                errStr = String(cString: e!)
-            }
-            throw .dylib(errStr)
+            throw .dylib(dlerror().flatMap { String(cString: $0) } ?? "UNKNOWN")
         }
         self.dylibHandle = dylibHandle
 
         guard let startSym = dlsym(dylibHandle, startSymbol) else {
-            var errStr = "UNKNOWN"
-            let e = dlerror()
-            if e != nil {
-                errStr = String(cString: e!)
-            }
-            throw .symbol(startSymbol, errStr)
+            throw .symbol(startSymbol, dlerror().flatMap { String(cString: $0) } ?? "UNKNOWN")
         }
         let openTunnelFn = unsafeBitCast(startSym, to: OpenTunnel.self)
         tunnelReadPipe = Pipe()
@@ -42,21 +32,42 @@ actor TunnelHandle {
         }
     }
 
-    func close() throws {
-        dlclose(dylibHandle)
+    // This could be an isolated deinit in Swift 6.1
+    func close() throws(TunnelHandleError) {
+        var errs: [Error] = []
+        if dlclose(dylibHandle) == 0 {
+            errs.append(TunnelHandleError.dylib(dlerror().flatMap { String(cString: $0) } ?? "UNKNOWN"))
+        }
+        do {
+            try writeHandle.close()
+        } catch {
+            errs.append(error)
+        }
+        do {
+            try readHandle.close()
+        } catch {
+            errs.append(error)
+        }
+        if !errs.isEmpty {
+            throw .close(errs)
+        }
     }
 }
 
 enum TunnelHandleError: Error {
     case dylib(String)
     case symbol(String, String)
     case openTunnel(OpenTunnelError)
+    case pipe(any Error)
+    case close([any Error])
 
     var description: String {
         switch self {
+        case let .pipe(err): return "pipe error: \(err)"
         case let .dylib(d): return d
         case let .symbol(symbol, message): return "\(symbol): \(message)"
         case let .openTunnel(error): return "OpenTunnel: \(error.message)"
+        case let .close(errs): return "close tunnel: \(errs.map(\.localizedDescription).joined(separator: ", "))"
         }
     }
 }