From a08a9ba4c4c9d578979583e8c2fe227de93ee4d1 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" Date: Mon, 5 Nov 2018 03:10:52 +0100 Subject: PacketTunnelProvider: clamp v6 addresses to /120 Signed-off-by: Jason A. Donenfeld --- WireGuard/WireGuardNetworkExtension/PacketTunnelProvider.swift | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'WireGuard') diff --git a/WireGuard/WireGuardNetworkExtension/PacketTunnelProvider.swift b/WireGuard/WireGuardNetworkExtension/PacketTunnelProvider.swift index da4372e..ddd2677 100644 --- a/WireGuard/WireGuardNetworkExtension/PacketTunnelProvider.swift +++ b/WireGuard/WireGuardNetworkExtension/PacketTunnelProvider.swift @@ -92,7 +92,13 @@ class PacketTunnelProvider: NEPacketTunnelProvider { networkSettings.ipv4Settings = ipv4Settings // IPv6 settings - let ipv6Settings = NEIPv6Settings(addresses: ipv6Addresses, networkPrefixLengths: ipv6NetworkPrefixLengths) + + /* Big fat ugly hack for broken iOS networking stack: the smallest prefix that will have + * any effect on iOS is a /120, so we clamp everything above to /120. This is potentially + * very bad, if various network parameters were actually relying on that subnet being + * intentionally small. TODO: talk about this with upstream iOS devs. + */ + let ipv6Settings = NEIPv6Settings(addresses: ipv6Addresses, networkPrefixLengths: ipv6NetworkPrefixLengths.map { NSNumber(value: min(120, $0.intValue)) }) assert(ipv6IncludedRouteAddresses.count == ipv6IncludedRouteNetworkPrefixLengths.count) ipv6Settings.includedRoutes = zip(ipv6IncludedRouteAddresses, ipv6IncludedRouteNetworkPrefixLengths).map { NEIPv6Route(destinationAddress: $0.0, networkPrefixLength: $0.1) -- cgit v1.2.3-59-g8ed1b