Skip to content

Commit eed65d4

Browse files
stenyastenya
committed
Revert: (macOS) New Firewall option: Bypass Apple Services
Fix is not stable. Commit: c44b9f1 [c44b9f1] #394
1 parent 44d5047 commit eed65d4

File tree

15 files changed

+15
-186
lines changed

15 files changed

+15
-186
lines changed

‎daemon/References/macOS/etc/firewall.sh

-40
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
# sudo pfctl -s rules
66
# Show all rules for "ivpn_firewall" anchor
77
# sudo pfctl -a "ivpn_firewall" -s rules
8-
# sudo pfctl -a "ivpn_firewall/apple_services" -s rules
98
# sudo pfctl -a "ivpn_firewall/tunnel" -s rules
109
# sudo pfctl -a "ivpn_firewall/dns" -s rules
1110
# Show table
@@ -102,7 +101,6 @@ function enable_firewall {
102101
pass out inet proto udp from 0.0.0.0 to 255.255.255.255 port = 67
103102
pass in proto udp from any to any port = 68
104103
105-
anchor apple_services all
106104
anchor tunnel all
107105
anchor dns all
108106
_EOF
@@ -130,8 +128,6 @@ function disable_firewall {
130128
pfctl -a ${ANCHOR_NAME} -t ${EXCEPTIONS_TABLE} -T flush
131129
pfctl -a ${ANCHOR_NAME} -t ${USER_EXCEPTIONS_TABLE} -T flush
132130

133-
# remove all rules in tun anchor
134-
pfctl -a ${ANCHOR_NAME}/apple_services -Fr
135131
# remove all rules in tun anchor
136132
pfctl -a ${ANCHOR_NAME}/tunnel -Fr
137133
# remove all rules in dns anchor
@@ -188,33 +184,6 @@ _EOF
188184
block drop out proto tcp from any to ! ${DNS} port = 53
189185
_EOF
190186
}
191-
####
192-
function allow_apple_services_on {
193-
# Ports: https://support.apple.com/en-us/103229
194-
# 443 TCP - Secure Sockets Layer (SSL or HTTPS): TLS websites, iTunes Store, Software Update, Spotlight Suggestions, Mac App Store, Maps, FaceTime, Game Center, iCloud authentication and DAV Services (Contacts, Calendars, Bookmarks), iCloud backup and apps (Calendars, Contacts, Find My iPhone, Find My Friends, Mail, iMessage, Documents & Photo Stream), iCloud Key Value Store (KVS), AirPlay, macOS Internet Recovery, Dictation, Siri, Xcode Server (hosted and remote Git HTTPS, remote SVN HTTPS, Apple Developer registration), Push notifications (if necessary)
195-
# 2197 TCP - Apple Push Notification Service (APNS)
196-
# 5223 TCP - Apple Push Notification Service (APNS): iCloud DAV Services (Contacts, Calendars, Bookmarks), Push Notifications, FaceTime, iMessage, Game Center, Photo Stream
197-
#
198-
# IP addresses: https://support.apple.com/en-us/HT210060
199-
pfctl -a ${ANCHOR_NAME}/apple_services -f - <<_EOF
200-
pass out quick proto tcp from any to 17.249.0.0/16 port { 443, 2197, 5223 } flags any keep state
201-
pass out quick proto tcp from any to 17.252.0.0/16 port { 443, 2197, 5223 } flags any keep state
202-
pass out quick proto tcp from any to 17.57.144.0/22 port { 443, 2197, 5223 } flags any keep state
203-
pass out quick proto tcp from any to 17.188.128.0/18 port { 443, 2197, 5223 } flags any keep state
204-
pass out quick proto tcp from any to 17.188.20.0/23 port { 443, 2197, 5223 } flags any keep state
205-
206-
pass out quick proto tcp from any to 2620:149:a44::/48 port { 443, 2197, 5223 } flags any keep state
207-
pass out quick proto tcp from any to 2403:300:a42::/48 port { 443, 2197, 5223 } flags any keep state
208-
pass out quick proto tcp from any to 2403:300:a51::/48 port { 443, 2197, 5223 } flags any keep state
209-
pass out quick proto tcp from any to 2a01:b740:a42::/48 port { 443, 2197, 5223 } flags any keep state
210-
_EOF
211-
212-
}
213-
214-
function allow_apple_services_off {
215-
pfctl -a ${ANCHOR_NAME}/apple_services -Fr
216-
}
217-
####
218187

219188
function main {
220189

@@ -274,15 +243,6 @@ function main {
274243
get_firewall_enabled || return 0
275244

276245
set_dns $2
277-
278-
elif [[ $1 = "-allow_apple_services_on" ]]; then
279-
280-
allow_apple_services_on
281-
282-
elif [[ $1 = "-allow_apple_services_off" ]]; then
283-
284-
allow_apple_services_off
285-
286246
else
287247
echo "Unknown command"
288248
return 2

‎daemon/protocol/protocol.go

-15
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,6 @@ type Service interface {
8585
SetKillSwitchAllowLANMulticast(isAllowLanMulticast bool) error
8686
SetKillSwitchAllowLAN(isAllowLan bool) error
8787
SetKillSwitchAllowAPIServers(isAllowAPIServers bool) error
88-
SetKillSwitchAllowAppleServices(isAllowAppleServices bool) error
8988
SetKillSwitchUserExceptions(exceptions string, ignoreParsingErrors bool) error
9089

9190
GetConnectionParams() service_types.ConnectionParams
@@ -705,20 +704,6 @@ func (p *Protocol) processRequest(conn net.Conn, message string) {
705704
p.sendResponse(conn, &types.EmptyResp{}, req.Idx)
706705
// all clients will be notified in case of successful change by OnKillSwitchStateChanged() handler
707706

708-
case "KillSwitchSetAllowAppleServices":
709-
var req types.KillSwitchSetAllowAppleServices
710-
if err := json.Unmarshal(messageData, &req); err != nil {
711-
p.sendErrorResponse(conn, reqCmd, err)
712-
break
713-
}
714-
if err := p._service.SetKillSwitchAllowAppleServices(req.IsAllowAppleServices); err != nil {
715-
p.sendErrorResponse(conn, reqCmd, err)
716-
break
717-
}
718-
// send the response to the requestor
719-
p.sendResponse(conn, &types.EmptyResp{}, req.Idx)
720-
// all clients will be notified in case of successful change by OnKillSwitchStateChanged() handler
721-
722707
// TODO: avoid using raw key as a string
723708
// NOTE: please, use 'SetUserPreferences' for future extensions
724709
case "SetPreference":

‎daemon/protocol/types/requests.go

-5
Original file line numberDiff line numberDiff line change
@@ -119,11 +119,6 @@ type KillSwitchSetAllowApiServers struct {
119119
IsAllowApiServers bool
120120
}
121121

122-
type KillSwitchSetAllowAppleServices struct {
123-
RequestBase
124-
IsAllowAppleServices bool
125-
}
126-
127122
// KillSwitchSetEnabled request to enable\disable kill-switch
128123
type KillSwitchSetEnabled struct {
129124
RequestBase

‎daemon/service/firewall/firewall.go

-6
Original file line numberDiff line numberDiff line change
@@ -235,12 +235,6 @@ func RemoveHostsFromExceptions(IPs []net.IP, onlyForICMP bool, isPersistent bool
235235
return err
236236
}
237237

238-
func AllowAppleServices(isAllowAPIServers bool) error {
239-
mutex.Lock()
240-
defer mutex.Unlock()
241-
return implAllowAppleServices(isAllowAPIServers)
242-
}
243-
244238
// AllowLAN - allow/forbid LAN communication
245239
func AllowLAN(allowLan bool, allowLanMulticast bool) error {
246240
mutex.Lock()

‎daemon/service/firewall/firewall_darwin.go

+1-19
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,7 @@ import (
4141
var (
4242
// key: is a string representation of allowed IP
4343
// value: true - if exception rule is persistant (persistant, means will stay available even client is disconnected)
44-
allowedHosts map[string]bool
45-
allowAppleServices bool
44+
allowedHosts map[string]bool
4645
)
4746

4847
func init() {
@@ -133,15 +132,6 @@ func implClientDisconnected() error {
133132
return shell.Exec(nil, platform.FirewallScript(), "-disconnected")
134133
}
135134

136-
func implAllowAppleServices(isAllowAPIServers bool) error {
137-
allowAppleServices = isAllowAPIServers
138-
if allowAppleServices {
139-
return shell.Exec(log, platform.FirewallScript(), "-allow_apple_services_on")
140-
} else {
141-
return shell.Exec(log, platform.FirewallScript(), "-allow_apple_services_off")
142-
}
143-
}
144-
145135
func implAllowLAN(isAllowLAN bool, isAllowLanMulticast bool) error {
146136
// the rule should stay unchanged independently from VPN connection state
147137
isPersistent := true
@@ -281,14 +271,6 @@ func reApplyExceptions() error {
281271
err = err2
282272
}
283273
}
284-
285-
err3 := implAllowAppleServices(allowAppleServices)
286-
if err3 != nil {
287-
log.Error(err3)
288-
if err == nil {
289-
err = err3
290-
}
291-
}
292274
return err
293275
}
294276

‎daemon/service/firewall/firewall_linux.go

-4
Original file line numberDiff line numberDiff line change
@@ -177,10 +177,6 @@ func implClientDisconnected() error {
177177
return shell.Exec(nil, platform.FirewallScript(), "-disconnected")
178178
}
179179

180-
func implAllowAppleServices(isAllowAPIServers bool) error {
181-
return nil // do nothing for Linux
182-
}
183-
184180
func implAllowLAN(isAllowLAN bool, isAllowLanMulticast bool) error {
185181
return doAllowLAN(isAllowLAN, isAllowLanMulticast)
186182
}

‎daemon/service/firewall/firewall_windows.go

-4
Original file line numberDiff line numberDiff line change
@@ -185,10 +185,6 @@ func implRemoveHostsFromExceptions(IPs []net.IP, onlyForICMP bool, isPersistent
185185
return nil
186186
}
187187

188-
func implAllowAppleServices(isAllowAPIServers bool) error {
189-
return nil // do nothing for Windows
190-
}
191-
192188
// AllowLAN - allow/forbid LAN communication
193189
func implAllowLAN(allowLan bool, allowLanMulticast bool) error {
194190

‎daemon/service/preferences/preferences.go

-1
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,6 @@ type Preferences struct {
8282
IsFwAllowLAN bool
8383
IsFwAllowLANMulticast bool
8484
IsFwAllowApiServers bool
85-
IsFwAllowAppleServices bool // Bypass VPN for Apple Services Traffic. Enabling this option allows traffic from Apple services to bypass the IVPN Firewall, permitting specific Apple IP ranges through, and this traffic may be routed outside the VPN tunnel.
8685
FwUserExceptions string // Firewall exceptions: comma separated list of IP addresses (masks) in format: x.x.x.x[/xx]
8786
IsStopOnClientDisconnect bool
8887

‎daemon/service/service.go

+8-24
Original file line numberDiff line numberDiff line change
@@ -248,10 +248,7 @@ func (s *Service) init() error {
248248
log.Error("Failed to initialize firewall with AllowLAN preference value: ", err)
249249
}
250250

251-
if err := firewall.AllowAppleServices(s._preferences.IsFwAllowAppleServices); err != nil {
252-
log.Error("Failed to initialize firewall with AppleServices preference value: ", err)
253-
}
254-
251+
//log.Info("Applying firewal exceptions (user configuration)")
255252
if err := firewall.SetUserExceptions(s._preferences.FwUserExceptions, true); err != nil {
256253
log.Error("Failed to apply firewall exceptions: ", err)
257254
}
@@ -1082,14 +1079,13 @@ func (s *Service) KillSwitchState() (status types.KillSwitchStatus, err error) {
10821079
enabled, isLanAllowed, _, err := firewall.GetState()
10831080

10841081
return types.KillSwitchStatus{
1085-
IsEnabled: enabled,
1086-
IsPersistent: prefs.IsFwPersistant,
1087-
IsAllowLAN: prefs.IsFwAllowLAN,
1088-
IsAllowMulticast: prefs.IsFwAllowLANMulticast,
1089-
IsAllowApiServers: prefs.IsFwAllowApiServers,
1090-
IsAllowAppleServices: prefs.IsFwAllowAppleServices,
1091-
UserExceptions: prefs.FwUserExceptions,
1092-
StateLanAllowed: isLanAllowed,
1082+
IsEnabled: enabled,
1083+
IsPersistent: prefs.IsFwPersistant,
1084+
IsAllowLAN: prefs.IsFwAllowLAN,
1085+
IsAllowMulticast: prefs.IsFwAllowLANMulticast,
1086+
IsAllowApiServers: prefs.IsFwAllowApiServers,
1087+
UserExceptions: prefs.FwUserExceptions,
1088+
StateLanAllowed: isLanAllowed,
10931089
}, err
10941090
}
10951091

@@ -1167,18 +1163,6 @@ func (s *Service) SetKillSwitchAllowAPIServers(isAllowAPIServers bool) error {
11671163
return nil
11681164
}
11691165

1170-
func (s *Service) SetKillSwitchAllowAppleServices(isAllowAppleServices bool) error {
1171-
prefs := s._preferences
1172-
prefs.IsFwAllowAppleServices = isAllowAppleServices
1173-
s.setPreferences(prefs)
1174-
1175-
err := firewall.AllowAppleServices(isAllowAppleServices)
1176-
if err == nil {
1177-
s.onKillSwitchStateChanged()
1178-
}
1179-
return err
1180-
}
1181-
11821166
// SetKillSwitchUserExceptions set ip/mask to be excluded from FW block
11831167
// Parameters:
11841168
// - exceptions - comma separated list of IP addresses in format: x.x.x.x[/xx]

‎daemon/service/types/types.go

+6-7
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,12 @@
2323
package types
2424

2525
type KillSwitchStatus struct {
26-
IsEnabled bool // FW state
27-
IsPersistent bool // configuration: true - when persistent
28-
IsAllowLAN bool // configuration: 'Allow LAN'
29-
IsAllowMulticast bool // configuration: 'Allow multicast'
30-
IsAllowApiServers bool // configuration: 'Allow API servers'
31-
IsAllowAppleServices bool // configuration: 'Bypass Apple services'
32-
UserExceptions string // configuration: Firewall exceptions: comma separated list of IP addresses (masks) in format: x.x.x.x[/xx]
26+
IsEnabled bool // FW state
27+
IsPersistent bool // configuration: true - when persistent
28+
IsAllowLAN bool // configuration: 'Allow LAN'
29+
IsAllowMulticast bool // configuration: 'Allow multicast'
30+
IsAllowApiServers bool // configuration: 'Allow API servers'
31+
UserExceptions string // configuration: Firewall exceptions: comma separated list of IP addresses (masks) in format: x.x.x.x[/xx]
3332

3433
StateLanAllowed bool // real state of 'Allow LAN'
3534
}

‎ui/src/components/settings/settings-firewall.vue

-40
Original file line numberDiff line numberDiff line change
@@ -53,38 +53,6 @@
5353
>
5454
</div>
5555

56-
<!-- Bypass apple services -->
57-
<div class="param" tabindex="0">
58-
<input
59-
type="checkbox"
60-
id="firewallBypassAppleServices"
61-
v-model="firewallBypassAppleServices"
62-
/>
63-
<label class="defColor" for="firewallBypassAppleServices"
64-
>Bypass VPN for Apple Services Traffic</label
65-
>
66-
<button class="noBordersBtn flexRow" title="Help" v-on:click="$refs.helpBypassAppleServices.showModal()">
67-
<img src="@/assets/question.svg" />
68-
</button>
69-
<ComponentDialog ref="helpBypassAppleServices" header="Info">
70-
<div>
71-
<p>
72-
Since macOS Sequoia (15.0), certain Apple apps (like Messages) may not function correctly
73-
when the IVPN Firewall is enabled because Apple does not respect the system's default routing configuration.
74-
</p>
75-
<p>
76-
Enabling this option allows traffic from Apple services to bypass the IVPN Firewall,
77-
permitting specific Apple IP ranges through, and this traffic may be routed outside the VPN tunnel.
78-
</p>
79-
<div class="settingsGrayLongDescriptionFont">
80-
This is a temporary workaround until Apple resolves the issue.
81-
<br />
82-
Note! This option is applicable only for the WireGuard protocol.
83-
</div>
84-
</div>
85-
</ComponentDialog>
86-
</div>
87-
8856
<!-- On-demand Firewall -->
8957
<div class="settingsBoldFont" tabindex="0">On-demand Firewall:</div>
9058

@@ -320,14 +288,6 @@ export default {
320288
await sender.KillSwitchSetAllowApiServers(value);
321289
},
322290
},
323-
firewallBypassAppleServices: {
324-
get() {
325-
return this.$store.state.vpnState.firewallState.IsAllowAppleServices;
326-
},
327-
async set(value) {
328-
await sender.KillSwitchSetAllowAppleServices(value);
329-
},
330-
},
331291
firewallAllowLan: {
332292
get() {
333293
return this.$store.state.vpnState.firewallState.IsAllowLAN;

‎ui/src/daemon-client/index.js

-8
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,6 @@ const daemonRequests = Object.freeze({
8080
KillSwitchGetStatus: "KillSwitchGetStatus",
8181
KillSwitchSetEnabled: "KillSwitchSetEnabled",
8282
KillSwitchSetAllowApiServers: "KillSwitchSetAllowApiServers",
83-
KillSwitchSetAllowAppleServices: "KillSwitchSetAllowAppleServices",
8483
KillSwitchSetAllowLANMulticast: "KillSwitchSetAllowLANMulticast",
8584
KillSwitchSetAllowLAN: "KillSwitchSetAllowLAN",
8685
KillSwitchSetIsPersistent: "KillSwitchSetIsPersistent",
@@ -1442,12 +1441,6 @@ async function KillSwitchSetAllowApiServers(IsAllowApiServers) {
14421441
IsAllowApiServers,
14431442
});
14441443
}
1445-
async function KillSwitchSetAllowAppleServices(IsAllowAppleServices) {
1446-
await sendRecv({
1447-
Command: daemonRequests.KillSwitchSetAllowAppleServices,
1448-
IsAllowAppleServices,
1449-
});
1450-
}
14511444

14521445
async function KillSwitchSetAllowLANMulticast(AllowLANMulticast) {
14531446
await sendRecv({
@@ -1916,7 +1909,6 @@ export default {
19161909

19171910
EnableFirewall,
19181911
KillSwitchSetAllowApiServers,
1919-
KillSwitchSetAllowAppleServices,
19201912
KillSwitchSetAllowLANMulticast,
19211913
KillSwitchSetAllowLAN,
19221914
KillSwitchSetIsPersistent,

‎ui/src/ipc/main-listener.js

-6
Original file line numberDiff line numberDiff line change
@@ -117,12 +117,6 @@ ipcMain.handle(
117117
return await client.KillSwitchSetAllowApiServers(enable);
118118
}
119119
);
120-
ipcMain.handle(
121-
"renderer-request-KillSwitchSetAllowAppleServices",
122-
async (event, enable) => {
123-
return await client.KillSwitchSetAllowAppleServices(enable);
124-
}
125-
);
126120
ipcMain.handle(
127121
"renderer-request-KillSwitchSetAllowLANMulticast",
128122
async (event, enable) => {

‎ui/src/ipc/renderer-sender.js

-6
Original file line numberDiff line numberDiff line change
@@ -153,12 +153,6 @@ export default {
153153
isEnable
154154
);
155155
},
156-
KillSwitchSetAllowAppleServices: async (isEnable) => {
157-
return await invoke(
158-
"renderer-request-KillSwitchSetAllowAppleServices",
159-
isEnable
160-
);
161-
},
162156
KillSwitchSetAllowLANMulticast: async (isEnable) => {
163157
return await invoke(
164158
"renderer-request-KillSwitchSetAllowLANMulticast",

‎ui/src/store/module-vpn-state.js

-1
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,6 @@ export default {
6767
IsAllowLAN: null,
6868
IsAllowMulticast: null,
6969
IsAllowApiServers: null,
70-
IsAllowAppleServices: null,
7170
UserExceptions: "",
7271
},
7372

0 commit comments

Comments
 (0)