feature: road-warrior clients resolve the domains of the new setting p2s.dns_domains with the router's resolver.

2026-10-26 20:58:33 +01:00
1 parent 9ca8fce14e
commit 57e8bbcffe
@@ -1,3 +1,15 @@
+vpn-router (0.33.0-1) unstable; urgency=medium
+
+  feature: road-warrior clients resolve the domains of the new setting p2s.dns_domains with the router's resolver.
+
+  * p2s.dns_domains lists up to 16 domains; setup pushes them to IKEv2
+    clients as INTERNAL_DNS_DOMAIN (RFC 8598, attribute 25) of the
+    road-warrior pool.
+  * The Apple VPN profile names them as match domains of the router's
+    resolver, which macOS and iOS use for those domains.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 27 Oct 2026 18:00:00 +0100
+
 vpn-router (0.32.1-1) unstable; urgency=medium

  fix: a VPN user downloads the own OpenVPN client profile through /account, with the current password and code.
@@ -44,7 +44,7 @@ from vpnrouter import fail, warn
 BEFORE_RULES = pathlib.Path('/etc/ufw/before.rules')
 UFW_DEFAULTS = pathlib.Path('/etc/default/ufw')
 WG_DIR       = pathlib.Path('/etc/wireguard')
-WEB_STATE    = pathlib.Path('/run/vpn-router/web.json')
+WEB_STATE    = vpnrouter.WEB_STATE

 #: The state, the current step and the failure of the last run, which the bootstrap services show.
 SETUP_STATE  = pathlib.Path('/run/vpn-router/setup.json')
@@ -31,6 +31,8 @@ from vpnrouter_net import DEFAULT_LISTEN, LISTEN_CHOICES, LOOPBACK, ConfigError,

 CONFIG_FILE  = pathlib.Path('/etc/vpn-router/vpn-router.json')
 CONFIG_LOCK  = pathlib.Path('/run/vpn-router/config.lock')
+#: What setup resolved and runs, for the web service (setup's refresh_web).
+WEB_STATE    = pathlib.Path('/run/vpn-router/web.json')
 TEMPLATE_DIR = pathlib.Path('/usr/share/vpn-router/templates')

 SWANCTL_CONF_D = pathlib.Path('/etc/swanctl/conf.d')
@@ -56,7 +58,7 @@ SCHEMA = {
    'wan':        {'local_fqdn': ''},
    'local':      {'cidrs': [], 'int_addr': '', 'int_gateway_ip': ''},
    'site_to_site': {},
-    'p2s':        {'enabled': False, 'address_pool': '', 'dns_listen': 'internal'},
+    'p2s':        {'enabled': False, 'address_pool': '', 'dns_listen': 'internal', 'dns_domains': []},
    'wireguard':  {'enabled': False, 'address': '', 'listen_port': 51820},
    'openvpn':    {'enabled': False, 'address_pool': '', 'port': 1194, 'protocol': 'udp'},
    'docker':     {'mode': 'auto', 'exposed_ports': []},
@@ -147,6 +149,10 @@ DNS_TTL_RANGE = (60, 86400)
 #: A DNS name without a wildcard, in lowercase, of dns.zone and dns.nameserver.
 ZONE_NAME = re.compile(r'^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$')

+#: A domain of p2s.dns_domains, one label or more, and the most domains.
+DNS_DOMAIN = re.compile(r'^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$')
+DNS_DOMAINS_MAX = 16
+
 #: The ports of the bootstrap services: the Router Manager's and the router's.
 BOOTSTRAP_PORTS = (17080, 17081)

@@ -584,6 +590,12 @@ def validate(cfg):
        raise ConfigError(f'dns.listen: {dns["listen"]!r} is not one of {", ".join(LISTEN_CHOICES)}')
    if not DNS_TTL_RANGE[0] <= dns['ttl'] <= DNS_TTL_RANGE[1]:
        raise ConfigError(f'dns.ttl: {dns["ttl"]} is not between {DNS_TTL_RANGE[0]} and {DNS_TTL_RANGE[1]} seconds')
+    dns_domains = _get_list(cfg, 'p2s', 'dns_domains')
+    if len(dns_domains) > DNS_DOMAINS_MAX or len(set(dns_domains)) != len(dns_domains):
+        raise ConfigError(f'p2s.dns_domains: at most {DNS_DOMAINS_MAX} different domains')
+    for item in dns_domains:
+        if not DNS_DOMAIN.match(item):
+            raise ConfigError(f'p2s.dns_domains: {item!r} is not a DNS name in lowercase')
    resolver_listen = _get(cfg, 'p2s', 'dns_listen')
    if resolver_listen not in LISTEN_CHOICES:
        raise ConfigError(f'p2s.dns_listen: {resolver_listen!r} is not one of {", ".join(LISTEN_CHOICES)}')
@@ -990,6 +1002,7 @@ def build_context(cfg, public_ip=None):
        'p2s_address_pool': _get(cfg, 'p2s', 'address_pool'),
        'public_ip':       public_ip or '',
        'p2s_resolver_addrs': resolver_addrs,
+        'p2s_dns_domains': _get_list(cfg, 'p2s', 'dns_domains'),
        'p2s_dns':         _join(resolver_addrs, _split_list(extras['EXTRA_P2S_DNS'])),
        'wg_enabled':      _get(cfg, 'wireguard', 'enabled'),
        'wg_address':      _get(cfg, 'wireguard', 'address'),
@@ -819,7 +819,7 @@ def apple_profile(connection, name, password):

    The connection matches road-warrior.conf: the router's wan.local_fqdn as address and identity, the user name, a
    DNS name of the certificate, as the local identity, the certificate over EAP-TLS, and AES-256, SHA2-256 and group 14
-    for IKE and ESP. The PKCS#12 uses 3DES and SHA-1, the only encryption Apple's clients read; they ask for the
+    for IKE and ESP. With p2s.dns_domains, the device resolves those domains with the router's resolver. The PKCS#12 uses 3DES and SHA-1, the only encryption Apple's clients read; they ask for the
    password when the profile is installed.
    """
    entry(connection, name)
@@ -858,7 +858,15 @@ def apple_profile(connection, name, password):
    payloads.append({'PayloadType': 'com.apple.security.pkcs12', 'PayloadVersion': 1,
                     'PayloadIdentifier': f'{identifier}.pkcs12', 'PayloadUUID': ids['pkcs12'],
                     'PayloadDisplayName': f'{name} ({fqdn})', 'PayloadContent': bundle})
+    # The router's resolver, which setup records, answers the names of p2s.dns_domains; the others stay with the device's.
+    try:
+        servers = json.loads(vpnrouter.WEB_STATE.read_text(encoding='utf-8'))['network']['client_dns']
+    except (OSError, ValueError, KeyError, TypeError):
+        servers = []
+    domains = [item.strip() for item in cfg['p2s']['dns_domains'] if item.strip()]
+    dns = {'DNS': {'ServerAddresses': servers, 'SupplementalMatchDomains': domains}} if servers and domains else {}
    payloads.append({
+        **dns,
        'PayloadType': 'com.apple.vpn.managed', 'PayloadVersion': 1, 'PayloadIdentifier': f'{identifier}.vpn',
        'PayloadUUID': ids['vpn'], 'PayloadDisplayName': f'VPN Router {fqdn}', 'UserDefinedName': f'VPN Router {fqdn}',
        'VPNType': 'IKEv2',
@@ -39,5 +39,9 @@ pools {
  rw-pool {
    addrs = {{ p2s_address_pool }}
    dns   = {{ p2s_dns }}
+{%- if p2s_dns_domains %}
+    # INTERNAL_DNS_DOMAIN (RFC 8598): the domains the clients resolve with the DNS servers above.
+    25    = {{ p2s_dns_domains | join(', ') }}
+{%- endif %}
  }
 }