feature: road-warrior clients resolve the domains of the new setting p2s.dns_domains with the router's resolver.

debian-package/src/usr/lib/vpn-router/vpnrouter_users.py

@@ -819,7 +819,7 @@ def apple_profile(connection, name, password):
 
     The connection matches road-warrior.conf: the router's wan.local_fqdn as address and identity, the user name, a
     DNS name of the certificate, as the local identity, the certificate over EAP-TLS, and AES-256, SHA2-256 and group 14
-    for IKE and ESP. The PKCS#12 uses 3DES and SHA-1, the only encryption Apple's clients read; they ask for the
+    for IKE and ESP. With p2s.dns_domains, the device resolves those domains with the router's resolver. The PKCS#12 uses 3DES and SHA-1, the only encryption Apple's clients read; they ask for the
     password when the profile is installed.
     """
     entry(connection, name)
@@ -858,7 +858,15 @@ def apple_profile(connection, name, password):
     payloads.append({'PayloadType': 'com.apple.security.pkcs12', 'PayloadVersion': 1,
                      'PayloadIdentifier': f'{identifier}.pkcs12', 'PayloadUUID': ids['pkcs12'],
                      'PayloadDisplayName': f'{name} ({fqdn})', 'PayloadContent': bundle})
+    # The router's resolver, which setup records, answers the names of p2s.dns_domains; the others stay with the device's.
+    try:
+        servers = json.loads(vpnrouter.WEB_STATE.read_text(encoding='utf-8'))['network']['client_dns']
+    except (OSError, ValueError, KeyError, TypeError):
+        servers = []
+    domains = [item.strip() for item in cfg['p2s']['dns_domains'] if item.strip()]
+    dns = {'DNS': {'ServerAddresses': servers, 'SupplementalMatchDomains': domains}} if servers and domains else {}
     payloads.append({
+        **dns,
         'PayloadType': 'com.apple.vpn.managed', 'PayloadVersion': 1, 'PayloadIdentifier': f'{identifier}.vpn',
         'PayloadUUID': ids['vpn'], 'PayloadDisplayName': f'VPN Router {fqdn}', 'UserDefinedName': f'VPN Router {fqdn}',
         'VPNType': 'IKEv2',