[iOS] Add an explicit "Block connections without VPN" setting to VPN (VPN Kill Switch Toggle) #24663
+318
−166
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves brave/brave-browser#38057
Design: https://www.figma.com/design/J4LKBMftiWhqromRWfUQLG/VPN-design?node-id=113-12449&t=PYj40XUIRVEX2lF6-0
Security Ticket: https://github.com/brave/reviews/issues/1689
This PR is adding the toggle for VPN kill switch which is an security feature designed to protect your digital data from accidental exposure.
The idea is when the VPN connection drops, the VPN kill switch will block your internet access until the connection to the VPN server is restored.
To build a VPN client that implements a packet-oriented, custom VPN protocol, a packet tunnel provider should be implemented.
To configure this an tunnel provider object should be created and this will manage the tunnel provider’s VPN configuration.
For IKEv2 this is NEVPNManager https://developer.apple.com/documentation/networkextension/nevpnmanager/
Usage in https://github.com/GuardianFirewall/GuardianConnect/blob/3c828f38094debd22d217ee61c0ecf05d76cd741/GuardianConnect/Classes/GRDVPNHelper.m#L728C2-L728C14
For WireGuard this is NETunnelProviderManager https://developer.apple.com/documentation/networkextension/netunnelprovidermanager
Usage in Guardian: https://github.com/GuardianFirewall/GuardianConnect/blob/3c828f38094debd22d217ee61c0ecf05d76cd741/GuardianConnect/Classes/GRDVPNHelper.m#L1001C72-L1001C95
And after that the protocol object needs to be created and set as protocol configuration for tunnel manager.
For WireGuard: NETunnelProviderProtocol https://developer.apple.com/documentation/networkextension/netunnelproviderprotocol
Usage in Guardian: https://github.com/GuardianFirewall/GuardianConnect/blob/3c828f38094debd22d217ee61c0ecf05d76cd741/GuardianConnect/Classes/GRDVPNHelper.m#L881C3-L881C27
And for IKEv2: NEVPNManager will assign the protocol configuration
Usage in Guardian:
https://github.com/GuardianFirewall/GuardianConnect/blob/3c828f38094debd22d217ee61c0ecf05d76cd741/GuardianConnect/Classes/GRDVPNHelper.m#L676
Finally to achieve the Kill Switch "Block connections without VPN" setting, the includeAllNetworks property should be set on protocol config.
NEVPNProtocol
includeAllNetworks
https://developer.apple.com/documentation/networkextension/nevpnprotocol/3131931-includeallnetworks
The definition of
includeAllNetworks
isIf this property is true, the system routes network traffic through the tunnel except traffic for designated system services necessary for maintaining expected device functionality.
Guardian Side
IKEv2: https://github.com/GuardianFirewall/GuardianConnect/blob/3c828f38094debd22d217ee61c0ecf05d76cd741/GuardianConnect/Classes/GRDVPNHelper.m#L801
Wireguard: https://github.com/GuardianFirewall/GuardianConnect/blob/3c828f38094debd22d217ee61c0ecf05d76cd741/GuardianConnect/Classes/GRDVPNHelper.m#L1021
For
Brave iOS
implementation we can not just enable the includeAllNetworks and actually expect it will perform as requested.After enabling key part is to establish a new connection entirely with this setting disabled or enabled.
Security Review: TBD
Submitter Checklist:
QA/Yes
orQA/No
;release-notes/include
orrelease-notes/exclude
;OS/...
) to the associated issuenpm run test -- brave_browser_tests
,npm run test -- brave_unit_tests
wikinpm run presubmit
wiki,npm run gn_check
,npm run tslint
git rebase master
(if needed)Reviewer Checklist:
gn
After-merge Checklist:
changes has landed on
Screenshots:
RPReplay_Final1720729393.MP4
Test Plan:
So the plans on QA side is to be related about being sure if the VPN can be switched on or off properly after enabling toggle