Enable "split DNS" configurations for an interface

By adding a tilde prefix to a domain name entry in the DNS= line, the domain is interpreted as a "matching domain" for DNS routing instead of a "search domain." This corresponds to setting a non-empty NEDNSSettings.matchDomains property for the network tunnel. Using tilde as a prefix is borrowed from systemd-resolved's equivalent usage. If one or more match domains are specified, then the specified DNS resolvers are only used for those matching domains instead of acting as the first resolver before the system's primary DNS resolvers. Signed-off-by: Stephen Larew <stephen@slarew.net>
slarew · Jun 27, 2021 · 6ebc356 · 6ebc356 · mdriessen · Oct 27, 2021
1 parent 13b7204
commit 6ebc356
Show file tree

Hide file tree

Showing 6 changed files with 29 additions and 4 deletions.
diff --git a/Sources/Shared/Model/TunnelConfiguration+WgQuickConfig.swift b/Sources/Shared/Model/TunnelConfiguration+WgQuickConfig.swift
@@ -136,6 +136,7 @@ extension TunnelConfiguration {
         if !interface.dns.isEmpty || !interface.dnsSearch.isEmpty {
             var dnsLine = interface.dns.map { $0.stringRepresentation }
             dnsLine.append(contentsOf: interface.dnsSearch)
+            dnsLine.append(contentsOf: interface.dnsMatchDomains.map { "~" + $0 })
             let dnsString = dnsLine.joined(separator: ", ")
             output.append("DNS = \(dnsString)\n")
         }
@@ -191,15 +192,19 @@ extension TunnelConfiguration {
         if let dnsString = attributes["dns"] {
             var dnsServers = [DNSServer]()
             var dnsSearch = [String]()
+            var dnsMatchDomains = [String]()
             for dnsServerString in dnsString.splitToArray(trimmingCharacters: .whitespacesAndNewlines) {
                 if let dnsServer = DNSServer(from: dnsServerString) {
                     dnsServers.append(dnsServer)
+                } else if dnsServerString.first == "~" && !dnsServerString.dropFirst().isEmpty {
+                    dnsMatchDomains.append(String(dnsServerString.dropFirst()))
                 } else {
                     dnsSearch.append(dnsServerString)
                 }
             }
             interface.dns = dnsServers
             interface.dnsSearch = dnsSearch
+            interface.dnsMatchDomains = dnsMatchDomains
         }
         if let mtuString = attributes["mtu"] {
             guard let mtu = UInt16(mtuString) else {

diff --git a/Sources/WireGuardApp/Tunnel/TunnelConfiguration+UapiConfig.swift b/Sources/WireGuardApp/Tunnel/TunnelConfiguration+UapiConfig.swift
@@ -75,6 +75,7 @@ extension TunnelConfiguration {
         interfaceConfiguration?.addresses = base?.interface.addresses ?? []
         interfaceConfiguration?.dns = base?.interface.dns ?? []
         interfaceConfiguration?.dnsSearch = base?.interface.dnsSearch ?? []
+        interfaceConfiguration?.dnsMatchDomains = base?.interface.dnsMatchDomains ?? []
         interfaceConfiguration?.mtu = base?.interface.mtu
 
         if let interfaceConfiguration = interfaceConfiguration {

diff --git a/Sources/WireGuardApp/UI/TunnelViewModel.swift b/Sources/WireGuardApp/UI/TunnelViewModel.swift
@@ -139,9 +139,10 @@ class TunnelViewModel {
             if let mtu = config.mtu {
                 scratchpad[.mtu] = String(mtu)
             }
-            if !config.dns.isEmpty || !config.dnsSearch.isEmpty {
+            if !config.dns.isEmpty || !config.dnsSearch.isEmpty || !config.dnsMatchDomains.isEmpty {
                 var dns = config.dns.map { $0.stringRepresentation }
                 dns.append(contentsOf: config.dnsSearch)
+                dns.append(contentsOf: config.dnsMatchDomains.map { "~" + $0 })
                 scratchpad[.dns] = dns.joined(separator: ", ")
             }
             return scratchpad
@@ -197,15 +198,19 @@ class TunnelViewModel {
             if let dnsString = scratchpad[.dns] {
                 var dnsServers = [DNSServer]()
                 var dnsSearch = [String]()
+                var dnsMatchDomains = [String]()
                 for dnsServerString in dnsString.splitToArray(trimmingCharacters: .whitespacesAndNewlines) {
                     if let dnsServer = DNSServer(from: dnsServerString) {
                         dnsServers.append(dnsServer)
+                    } else if dnsServerString.first == "~" && !dnsServerString.dropFirst().isEmpty {
+                        dnsMatchDomains.append(String(dnsServerString.dropFirst()))
                     } else {
                         dnsSearch.append(dnsServerString)
                     }
                 }
                 config.dns = dnsServers
                 config.dnsSearch = dnsSearch
+                config.dnsMatchDomains = dnsMatchDomains
             }
 
             guard errorMessages.isEmpty else { return .error(errorMessages.first!) }

diff --git a/Sources/WireGuardApp/UI/macOS/View/highlighter.c b/Sources/WireGuardApp/UI/macOS/View/highlighter.c
@@ -121,6 +121,13 @@ static bool is_valid_hostname(string_span_t s)
 	return num_digit != num_entity;
 }
 
+static bool is_valid_dns_match_hostname(string_span_t s)
+{
+    if (!s.len || s.s[0] != '~')
+        return false;
+    return is_valid_hostname((string_span_t){ s.s + 1, s.len - 1});
+}
+
 static bool is_valid_ipv4(string_span_t s)
 {
 	for (size_t j, i = 0, pos = 0; i < 4 && pos < s.len; ++i) {
@@ -448,7 +455,7 @@ static void highlight_multivalue_value(struct highlight_span_array *ret, const s
 	case DNS:
 		if (is_valid_ipv4(s) || is_valid_ipv6(s))
 			append_highlight_span(ret, parent.s, s, HighlightIP);
-		else if (is_valid_hostname(s))
+		else if (is_valid_hostname(s) || is_valid_dns_match_hostname(s))
 			append_highlight_span(ret, parent.s, s, HighlightHost);
 		else
 			append_highlight_span(ret, parent.s, s, HighlightError);

diff --git a/Sources/WireGuardKit/InterfaceConfiguration.swift b/Sources/WireGuardKit/InterfaceConfiguration.swift
@@ -11,6 +11,7 @@ public struct InterfaceConfiguration {
     public var mtu: UInt16?
     public var dns = [DNSServer]()
     public var dnsSearch = [String]()
+    public var dnsMatchDomains = [String]()
 
     public init(privateKey: PrivateKey) {
         self.privateKey = privateKey
@@ -27,6 +28,7 @@ extension InterfaceConfiguration: Equatable {
             lhs.listenPort == rhs.listenPort &&
             lhs.mtu == rhs.mtu &&
             lhs.dns == rhs.dns &&
-            lhs.dnsSearch == rhs.dnsSearch
+            lhs.dnsSearch == rhs.dnsSearch &&
+            lhs.dnsMatchDomains == rhs.dnsMatchDomains
     }
 }
diff --git a/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift b/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift
@@ -88,7 +88,12 @@ class PacketTunnelSettingsGenerator {
             let dnsSettings = NEDNSSettings(servers: dnsServerStrings)
             dnsSettings.searchDomains = tunnelConfiguration.interface.dnsSearch
             if !tunnelConfiguration.interface.dns.isEmpty {
-                dnsSettings.matchDomains = [""] // All DNS queries must first go through the tunnel's DNS
+                if tunnelConfiguration.interface.dnsMatchDomains.isEmpty {
+                    // All DNS queries must first go through the tunnel's DNS
+                    dnsSettings.matchDomains = [""]
+                } else {
+                    dnsSettings.matchDomains = tunnelConfiguration.interface.dnsMatchDomains
+                }
             }
             networkSettings.dnsSettings = dnsSettings
         }