Block all traffic when device is connecting or reconnecting

[buggmagnet]

This PR extend's @pinkisemils's fix for blocking traffic when in error state to the connecting and reconnecting states too.

---

This change is 

[linear]

IOS-406 Stop leaking DNS traffic when connecting or reconnecting

[buggmagnet]

Reviewable status: 0 of 3 files reviewed, 1 unresolved discussion

---

ios/PacketTunnelCore/Actor/PacketTunnelActor+ErrorState.swift line 123 at r1 (raw file):

            config.interfaceAddresses = [IPAddressRange(from: "10.64.0.1/8")!]
            config.peer = TunnelPeer(
                endpoint: .ipv4(IPv4Endpoint(string: "127.0.0.1:9090")!),

What's the likelihood of someone having a socks5 proxy running at that same address @pinkisemils ?
Otherwise we could simply choose a random port instead here, and keep the localhost address.

[buggmagnet]

Reviewable status: 0 of 3 files reviewed, 1 unresolved discussion

---

ios/PacketTunnelCore/Actor/PacketTunnelActor+ErrorState.swift line 123 at r1 (raw file):

Previously, buggmagnet wrote…

What's the likelihood of someone having a socks5 proxy running at that same address @pinkisemils ?
Otherwise we could simply choose a random port instead here, and keep the localhost address.

I'm saying socks5 cause I saw a couple of examples for user ran services on localhost, I think 8080 is also a popular one.

[pinkisemils]

Reviewable status: 0 of 3 files reviewed, 1 unresolved discussion (waiting on @buggmagnet)

---

ios/PacketTunnelCore/Actor/PacketTunnelActor+ErrorState.swift line 123 at r1 (raw file):

Previously, buggmagnet wrote…

I'm saying socks5 cause I saw a couple of examples for user ran services on localhost, I think 8080 is also a popular one.

Picking a random port would be better. You can also specify a random octet for the last part of the address - 127.0.0.123 is also a valid localhost address.

[pinkisemils]

Reviewable status: 0 of 3 files reviewed, 2 unresolved discussions (waiting on @buggmagnet)

---

ios/PacketTunnelCore/Actor/PacketTunnelActor+NetworkReachability.swift line 59 at r1 (raw file):

                state = .connecting(connState)
                Task {
                    await blockAllTrafficUntilDeviceIsConnected()

Setting the tunnel config here is moot - the existing tunnel config should already be blocking traffic. And reconfiguring the tunnel to be blocking is moot too - the tunnel will be reconfigured to connect anyway.

[rablador]

Reviewed 3 of 3 files at r1, all commit messages.
Reviewable status: all files reviewed, 2 unresolved discussions (waiting on @buggmagnet)

[buggmagnet]

Reviewable status: all files reviewed, 1 unresolved discussion (waiting on @pinkisemils)

---

ios/PacketTunnelCore/Actor/PacketTunnelActor+ErrorState.swift line 123 at r1 (raw file):

Previously, pinkisemils (Emīls Piņķis) wrote…

Picking a random port would be better. You can also specify a random octet for the last part of the address - 127.0.0.123 is also a valid localhost address.

Done

---

ios/PacketTunnelCore/Actor/PacketTunnelActor+NetworkReachability.swift line 59 at r1 (raw file):

Previously, pinkisemils (Emīls Piņķis) wrote…

Setting the tunnel config here is moot - the existing tunnel config should already be blocking traffic. And reconfiguring the tunnel to be blocking is moot too - the tunnel will be reconfigured to connect anyway.

Done.

[pinkisemils]

Reviewable status: 1 of 3 files reviewed, 2 unresolved discussions (waiting on @buggmagnet and @rablador)

---

ios/PacketTunnelCore/Actor/PacketTunnelActor+KeyPolicy.swift line 137 at r2 (raw file):

                state = .connecting(connState)
                Task {
                    await blockAllTrafficUntilDeviceIsConnected()

When in the connecting state, the app will end up calling adapter.start(realWireGuardConfiguration) soon after anyway - I don't think this matters much. The point of this change would be to change the DNS config to the config that's passed to WireGuard before we've received a ping back from the relay and then only set the DNS config.

[rablador]

Reviewed 2 of 2 files at r2, all commit messages.
Reviewable status: all files reviewed, 2 unresolved discussions (waiting on @buggmagnet and @pinkisemils)