Add macOS support #11

gmacon · 2018-10-12T16:48:08Z

This adds support for macOS as discussed in #5.

dlenski · 2018-11-24T20:59:15Z

It seems fine to me, although I have no way to test the MacOS functionality. (A test suite will be useful here sooner or later…)

But please fix the unnecessary code formatting changes, as discussed in #5.

gmacon · 2018-11-25T15:07:12Z

Sure. I thought I'd fixed them all, and I'm apparently too close to this code to see whatever is left. Can you point me to them (really just one of each type; knowing exactly what to look for will make them easier to find)?

kalvinwang · 2019-01-02T19:08:46Z

@dlenski I looked at the latest diff here and don't see any code formatting changes remaining of the type you mentioned (apostrophes and multiline arguments), would you mind merging this branch? It's really helpful for Mac users. Thanks! (and thanks to @gmacon as well!)

XL64 · 2019-02-12T13:17:28Z

I would like to have a look and maybe resolve the conflicts from another fork but I don't know how to build it correctly.
I did python3 setup.py build but it only builds a build/lib/vpn_slice with no vpn_slice python file. And when I try to run the main.py it says : "main.py: error: Must be called as vpnc-script, with $reason set".
What did I miss ?

EDIT : OK I didn't use the -s option of openconnect but --script-tun --script instead as for ocproxy.
EDIT2 : SSHing a machine behind the VPN works with the branch from gmacon., Accessing a Lync server failed :s. Neither do kinit login@server.
EDIT3 : I don't know if it's link but for those link/kerberos servers URL I got several IPs populated in /etc/hosts, as far as I understand the first one will be used. correct ?

gmacon · 2019-02-14T01:21:08Z

I've rebased my branch on top of the current master.

@XL64: I don't think your error is related to this PR. I think your issue is that vpn-slice does not expect the --script-tun option (which routes all traffic through the command provided by --script). Try it without that option.

XL64 · 2019-02-14T08:31:16Z

@gmacon Indeed I had to remove this option, thanks for rebasing :)

modib · 2019-02-23T22:51:36Z

Tested this on macOS Mojave 10.14.3 and it seems to be working fine so far with basic testing. Will be testing more throughout the week.

cmd used:
sudo openconnect <host> -b -l -q -u <user> --authgroup=<authgroup> -s '/usr/local/bin/vpn-slice x.x.x.x/22'

modib · 2019-02-23T23:29:47Z

Connection is active but got this exception after macbook went to sleep while it was locked.

Exception while setting reason from environment variable reason='attempt-reconnect'
Traceback (most recent call last):
  File "/usr/local/bin/vpn-slice", line 11, in <module>
    load_entry_point('vpn-slice==0.1', 'console_scripts', 'vpn-slice')()
  File "/usr/local/lib/python3.7/site-packages/vpn_slice-0.1-py3.7.egg/vpn_slice/main.py", line 331, in main
  File "/usr/local/lib/python3.7/site-packages/vpn_slice-0.1-py3.7.egg/vpn_slice/main.py", line 245, in parse_env
  File "/usr/local/lib/python3.7/site-packages/vpn_slice-0.1-py3.7.egg/vpn_slice/main.py", line 218, in <lambda>
  File "/usr/local/Cellar/python/3.7.2_2/Frameworks/Python.framework/Versions/3.7/lib/python3.7/enum.py", line 351, in __getitem__
    return cls._member_map_[name]
KeyError: 'attempt_reconnect'

gmacon · 2019-02-24T19:24:59Z

@modib, I believe the attempt-reconnect error is a separate issue, so I created #13 to discuss it.

doomedraven · 2019-03-06T11:30:22Z

confirmed, works on osx 10.14.3 with openconnect 8.02.
@gmacon thanks a lot

michaelblyons · 2019-03-06T16:50:01Z

What are the odds that this could be a Homebrew formula?

doomedraven · 2019-03-06T17:01:14Z

You can install it with pip if that would be merged

XL64 · 2019-03-06T17:03:54Z

Toi can even install the branch directly if toi don't want tout wait for the merge. Le mer. 6 mars 2019 à 18:01, doomedraven <notifications@github.com> a écrit :

…

You can install it with pip if that would be merged — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#11 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABfOMkdKiknSAqsWExDczhrGvalKgs3cks5vT_RbgaJpZM4XZ0tz> .

doomedraven · 2019-03-06T17:08:03Z

Yes is what i have done, but merge would be better for all of us :) El mié., 6 mar. 2019 18:03, Xavier Lacoste <notifications@github.com> escribió:

…

Toi can even install the branch directly if toi don't want tout wait for the merge. Le mer. 6 mars 2019 à 18:01, doomedraven ***@***.***> a écrit : > You can install it with pip if that would be merged > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > <#11 (comment)>, or mute > the thread > < https://github.com/notifications/unsubscribe-auth/ABfOMkdKiknSAqsWExDczhrGvalKgs3cks5vT_RbgaJpZM4XZ0tz > > . > — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#11 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABxT70JLBYK4hf_Lr0pj0qWGXo7G_wQnks5vT_T6gaJpZM4XZ0tz> .

doomedraven · 2019-03-07T20:39:27Z

if that would be useful for someone, vpn-slice + unbound dns server in local
https://github.com/doomedraven/Tools/blob/master/Mac/VPN_split.sh

XL64 · 2019-03-08T09:01:59Z

@doomedraven In your script didn’t you mean sudo cat >> /usr/local/etc/unbound/unbound.conf << EOF$ Instead of cat >> /usr/local/etc/unbound/unbound.conf <<< EOL I suppose after that you don’t need to give a list of adresses to resolve to vpn-slice juste a range of IP to pass via the tunnel ?

doomedraven · 2019-03-08T09:03:14Z

you are correct, fixing, yes the dns will handle that dynamically for you, and you don't need use hosts or pass list of domains

XL64 · 2019-03-08T09:26:08Z

Hello again, I must have missed something. I did copy your configuration at the end of ubound.conf and changed yourcompany.com by something like my company.corp.local and started ubound and set the DNS to 127.0.0.1. I then started openconnect with vpn-slice and a list of subnets to route. DNS resolution of internet domains works but not for « something.mycompany.corp.local » . Did I miss something ? Do you have documentation I should read ? Regards, XL.

…

Le 8 mars 2019 à 10:03, doomedraven ***@***.***> a écrit : you are correct, fixing, yes the dns will handle that dynamically for you, and you don't need use hosts or pass list of domains — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#11 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABfOMreDrPTqaHPfjMtwmqFcaLgMFOy8ks5vUidSgaJpZM4XZ0tz>.

doomedraven · 2019-03-08T09:31:05Z

you don't need to put .local at the end, just yourcompany.com. <- dot at the end :)

i just updated it as i forgot what i had updated it here so 1 more thing
local-data: "vpn.yourcomapy.com. IN A VPN_IP" <- required to be able to connect to vpn gw as if no, dns will not able to connect to that VPN , see "company.net.", you will need real IP in local-data

    private-domain: "company.net."
    local-data: "vpn.company.net.     IN A IP"
remote-control:
    control-enable: yes
    control-interface: 127.0.0.1
    server-key-file: "/usr/local/etc/unbound/unbound_server.key"
    server-cert-file: "/usr/local/etc/unbound/unbound_server.pem"
    control-key-file: "/usr/local/etc/unbound/unbound_control.key"
    control-cert-file: "/usr/local/etc/unbound/unbound_control.pem"

forward-zone:
   name: "company.net."
   forward-addr: IP
   forward-addr: IP 

forward-zone:
   name: "."
   # forward-ssl-upstream: yes
   forward-addr: 1.1.1.1@53#one.one.one.one
   forward-addr: 8.8.8.8@53#dns.google
   forward-addr: 9.9.9.9@53#dns.quad9.net
   forward-addr: 1.0.0.1@53#one.one.one.one
   forward-addr: 8.8.4.4@53#dns.google
   forward-addr: 149.112.112.112@53#dns.quad9.net

doomedraven · 2019-03-08T09:47:13Z

ayway let me know if you need help, so i can maybe better explain it

XL64 · 2019-03-08T13:13:41Z

Hello again, I think I understood what’s still wrong with my config, I need to replace dns1/dns2 by the IP of my internal DNS in the VPN network, right ? I then have to figure out what it is :) Thanks, XL.

…

Le 8 mars 2019 à 10:47, doomedraven ***@***.***> a écrit : ayway let me know if you need help, so i can maybe better explain it — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#11 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABfOMjwZvJUpd6nUaqJK_RRSYFvZ8DhIks5vUjGhgaJpZM4XZ0tz>.

doomedraven · 2019-03-08T13:20:33Z

yes correct, that is the easier one, you was need just to check vpn-slice --help, just add to vpn-slice --dump --verbose

and it will give you all info

XL64 · 2019-03-08T13:48:47Z

Thanks, I retrieved the IP but the DNS resolution is still broken. I think I took too much of your time and will keep with the openconnect/ocproxy/foxyproxy solution I have in place. Regards, XL.

…

Le 8 mars 2019 à 14:20, doomedraven ***@***.***> a écrit : yes correct, that is the easier one, you was need just to check vpn-slice --help, just add to vpn-slice --dump --verbose and it will give you all info — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#11 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABfOMrLxjQEt4jOhdxYBcKWOvFRPPLBWks5vUmOhgaJpZM4XZ0tz>.

doomedraven · 2019-03-08T13:51:12Z

to check your dns do few things

dig @dns_IP some_corp_domain
dig @localhost some_corp_domain

to simplify debug of issue in unbound.conf uncomment

# logfile: "/tmp/unbound.log"
# log-queries: yes
# log-time-ascii: yes

and do tail -f /tmp/unbound.log in another terminal, and exec dig command to see whats going on

XL64 · 2019-03-08T14:07:11Z

Thanks lot, I’ll try that !

…

Le 8 mars 2019 à 14:51, doomedraven ***@***.***> a écrit : to check your dns do few things dig @dns_IP some_corp_domain dig @localhost some_corp_domain to simplify debug of issue in unbound.conf uncomment # logfile: "/tmp/unbound.log" # log-queries: yes # log-time-ascii: yes and do tail -f /tmp/unbound.log in another terminal, and exec dig command to see whats going on — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#11 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABfOMoj5p_QmJ7ZNOmq6_TgzCaA3VQySks5vUmrRgaJpZM4XZ0tz>.

XL64 · 2019-03-11T12:21:21Z

Hello Doomedrave, I fixed some issues : - some files where missing : I was listing the sudo in front of unbound-anchor -a /usr/local/etc/unbound/root.key and unbound-control-setup -d /usr/local/etc/unbound - The service couldn’t start correctly with brew services start unbound (user agent) because I also started it as daemon (with sudo). Now my dig is correct but resolution within firefox/safari is not good. Regards, XL

…

Le 8 mars 2019 à 15:07, Xavier Lacoste ***@***.***> a écrit : Thanks lot, I’ll try that ! > Le 8 mars 2019 à 14:51, doomedraven ***@***.*** ***@***.***>> a écrit : > > to check your dns do few things > > dig @dns_IP some_corp_domain > dig @localhost some_corp_domain > > to simplify debug of issue in unbound.conf uncomment > > # logfile: "/tmp/unbound.log" > # log-queries: yes > # log-time-ascii: yes > and do tail -f /tmp/unbound.log in another terminal, and exec dig command to see whats going on > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub <#11 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABfOMoj5p_QmJ7ZNOmq6_TgzCaA3VQySks5vUmrRgaJpZM4XZ0tz>. >

doomedraven · 2019-03-11T14:20:31Z

hm, i just do this sudo openconnect vpn.company.com -u my_user -s 'vpn-slice 10.0.0.0/8 --verbose --dump'

and it works fine, try maybe cidr 8 instead of 9

XL64 · 2019-03-16T19:52:23Z

Finally my kinit issue was not link with that at all, I just had to copy my company krb5.conf in /etc/, all is fine now !

doomedraven · 2019-03-16T19:53:31Z

glad that works :)

sjuxax · 2019-04-26T20:09:18Z

Works great for me at gmacon@eb4f7e3. Thanks!

emulated24 · 2019-05-22T09:26:57Z

Hi gmacon, great job, thanks a lot for the mac port. ;)
Works fine on macOS Mojave 10.14.4 with OpenConnect for Juniper VPN.

1. Missing `destination` parameter. 2. Inconsistently named `output_start` vs. `start_output`. 3. Parsing the output of iproute is finicky and there's no guarantee that a words occur in sensible pairs.

While the BSD `route add` may simply ignore re-addition of existing routes, `ip route add` does NOT behave in this way. `ip route replace` needs to be used in this case. I prefer to keep `RouteProvider.add_route` and `RouteProvider.replace_route` distinct on platforms where it's easy to do so, since this stricter behavior helps catch other mistakes in the routing configuration.

…nnel device So restore that behavior of `reason=pre-init` by creating a new `TunnelPrepProvider` class.

This leaves `os.environ`, `os.path`, and `os.fork` as the three OS-specific bits which are not abstracted out into providers. The first two are essentially universal, while `os.fork` will need to be rethought if anyone ever tries to make this work on Windows.

dlenski · 2019-05-26T00:53:51Z

Sorry for the long delay… and many thanks to @gmacon for the excellent, excellent work of abstracting and porting to macOS. 👍 👍 👍

I fixed several bits of ip route handling that were broken in 5ff39ee, a couple things that were made more sloppy than necessary in fd571e7 and b6bea08, and a couple cosmetic nickpicks in ca0e574 and d932ba0. Then I also factored out a couple more OS-specific bits into ProcessProvider in f47a35c.

macOS users, please test and let me know if this is still working for you guys. (It should be… I really didn't change anything of consequence in mac.py.)

With this we should be in a very good position to port to other BSDs, if anyone's interested.

Unfortunately, dig does not correctly handle the specification of multiple `+domain` arguments, discarding all but the last one. Therefore we need to run it multiple times and combine the results if multiple `search_domains` are specified. This is a very important use case for me, and several other known users.

dlenski · 2019-05-26T01:41:21Z

Turns out the DigProvider was also oversimplified, mishandling the case of multiple search domains. Fixed in 3266a8a.

Being able to do vpn-slice -d corp.com -d alternate.corp.com shorthostname1 shorthostname2 shorthostname3 and have all the hostnames found correctly is a very important use case for me.

dlenski · 2019-05-26T01:51:32Z

One last thing for @gmacon: is there a known minimum version of macOS required for this to work?

doomedraven · 2019-05-26T11:20:57Z

hey @dlenski thanks for start lookin on this, so now with all your changes

Traceback (most recent call last):
  File "/usr/local/bin/vpn-slice", line 11, in <module>
    load_entry_point('vpn-slice', 'console_scripts', 'vpn-slice')()
  File "/private/tmp/vpn-slice/vpn_slice/main.py", line 341, in main
    providers = get_default_providers()
  File "/private/tmp/vpn-slice/vpn_slice/main.py", line 29, in get_default_providers
    from .generic import NoFirewallProvider, NoTunnelPrepProvider
ImportError: cannot import name 'NoTunnelPrepProvider' from 'vpn_slice.generic' (/private/tmp/vpn-slice/vpn_slice/generic.py)

dlenski · 2019-05-26T20:59:03Z

@doomedraven, derp derp derp 🤦‍♂️. Fixed in edfa341. Thanks for testing.

doomedraven · 2019-05-26T21:07:10Z

now works just fine :) thanks a lot

dlenski · 2019-05-26T22:07:21Z

I'm gonna merge and assume we can clean up any other leftover bits later as needed. Thanks again to @gmacon for the great work and others, in particular @doomedraven, for testing and refinement.

doomedraven · 2019-05-26T22:09:54Z

amazing, thanks a lot @dlenski and @gmacon . I have updated my script https://github.com/doomedraven/Tools/blob/master/Mac/VPN_split.sh

gmacon · 2019-05-27T15:37:07Z

One last thing for @gmacon: is there a known minimum version of macOS required for this to work?

I don't know what the minimum required version is, but I suspect that it would work on any version of macOS because the tools we're interacting with here were all inherited from FreeBSD.

dlenski · 2019-05-28T16:00:22Z

I don't know what the minimum required version is, but I suspect that it would work on any version of macOS because the tools we're interacting with here were all inherited from FreeBSD.

Thanks. I googled around some, and that was my impression… the userland interface for routing on macOS doesn't seem to have changed much in the last ~20 years. So I'll just leave the docs as-is unless we find a clear counterexample.

kalvinwang · 2019-05-30T18:02:56Z

Thank you @dlenski @gmacon @doomedraven et al!!!

drewclauson · 2019-05-30T18:07:14Z

Thanks all, I've got this pulled down and working! 👏🏻👏🏻

dlenski · 2019-05-31T00:17:54Z

I'm going to lock this issue, so that if any new issues with Mac support are found… people will open new issues rather than be tempted to pile on this one. 😎

gmacon added 2 commits February 13, 2019 20:10

Factor out higher-level actions into providers

ce96a5e

Add providers for macos

00186bb

gmacon force-pushed the feature/macos branch from e2d5d3f to 00186bb Compare February 14, 2019 01:14

Update BSDRouteProvider to support IPv6

eb4f7e3

dlenski added 6 commits May 25, 2019 17:00

Fix three mistakes in converting linux.py to use RouteProvider

5ff39ee

1. Missing `destination` parameter. 2. Inconsistently named `output_start` vs. `start_output`. 3. Parsing the output of iproute is finicky and there's no guarantee that a words occur in sensible pairs.

Restore my belove duck-themed comment on slurpy

ca0e574

Some operating systems (including Linux) need to check/prepare the tu…

b6bea08

…nnel device So restore that behavior of `reason=pre-init` by creating a new `TunnelPrepProvider` class.

PEP 8 be damned; this hurts my eyes

d932ba0

Fix conflicts by merging branch 'master' into feature/macos

4fe644c

Underp NoTunnelPrepProvider

edfa341

dlenski merged commit 8a061f8 into dlenski:master May 26, 2019

gmacon deleted the feature/macos branch May 27, 2019 15:37

Repository owner locked as resolved and limited conversation to collaborators May 31, 2019

Add macOS support #11

Add macOS support #11

Conversation

gmacon commented Oct 12, 2018

dlenski commented Nov 24, 2018

gmacon commented Nov 25, 2018

kalvinwang commented Jan 2, 2019

XL64 commented Feb 12, 2019 • edited Loading

gmacon commented Feb 14, 2019

XL64 commented Feb 14, 2019

modib commented Feb 23, 2019 • edited Loading

modib commented Feb 23, 2019 • edited by dlenski Loading

gmacon commented Feb 24, 2019 • edited Loading

doomedraven commented Mar 6, 2019

michaelblyons commented Mar 6, 2019

doomedraven commented Mar 6, 2019

XL64 commented Mar 6, 2019 via email

doomedraven commented Mar 6, 2019 via email

doomedraven commented Mar 7, 2019

XL64 commented Mar 8, 2019 via email • edited by dlenski Loading

doomedraven commented Mar 8, 2019

XL64 commented Mar 8, 2019 via email

doomedraven commented Mar 8, 2019 • edited Loading

doomedraven commented Mar 8, 2019

XL64 commented Mar 8, 2019 via email

doomedraven commented Mar 8, 2019

XL64 commented Mar 8, 2019 via email

doomedraven commented Mar 8, 2019

XL64 commented Mar 8, 2019 via email

XL64 commented Mar 11, 2019 via email

doomedraven commented Mar 11, 2019

XL64 commented Mar 16, 2019

doomedraven commented Mar 16, 2019

sjuxax commented Apr 26, 2019

emulated24 commented May 22, 2019

dlenski commented May 26, 2019

dlenski commented May 26, 2019

dlenski commented May 26, 2019

doomedraven commented May 26, 2019

dlenski commented May 26, 2019

doomedraven commented May 26, 2019

dlenski commented May 26, 2019

doomedraven commented May 26, 2019

gmacon commented May 27, 2019

dlenski commented May 28, 2019

kalvinwang commented May 30, 2019

drewclauson commented May 30, 2019

dlenski commented May 31, 2019

XL64 commented Feb 12, 2019 •

edited

Loading

modib commented Feb 23, 2019 •

edited

Loading

modib commented Feb 23, 2019 •

edited by dlenski

Loading

gmacon commented Feb 24, 2019 •

edited

Loading

XL64 commented Mar 8, 2019 via email •

edited by dlenski

Loading

doomedraven commented Mar 8, 2019 •

edited

Loading