Skip to content

Commit 0e5dc9d

Browse files
lixmallixmal
authored
[client] Add more Android advanced settings (#4001)
1 parent 91f7ee6 commit 0e5dc9d

File tree

6 files changed

+149
-18
lines changed

6 files changed

+149
-18
lines changed

‎client/android/preferences.go‎

Lines changed: 125 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,20 @@ import (
44
"github.com/netbirdio/netbird/client/internal"
55
)
66

7-
// Preferences export a subset of the internal config for gomobile
7+
// Preferences exports a subset of the internal config for gomobile
88
type Preferences struct {
99
configInput internal.ConfigInput
1010
}
1111

12-
// NewPreferences create new Preferences instance
12+
// NewPreferences creates a new Preferences instance
1313
func NewPreferences(configPath string) *Preferences {
1414
ci := internal.ConfigInput{
1515
ConfigPath: configPath,
1616
}
1717
return &Preferences{ci}
1818
}
1919

20-
// GetManagementURL read url from config file
20+
// GetManagementURL reads URL from config file
2121
func (p *Preferences) GetManagementURL() (string, error) {
2222
if p.configInput.ManagementURL != "" {
2323
return p.configInput.ManagementURL, nil
@@ -30,12 +30,12 @@ func (p *Preferences) GetManagementURL() (string, error) {
3030
return cfg.ManagementURL.String(), err
3131
}
3232

33-
// SetManagementURL store the given url and wait for commit
33+
// SetManagementURL stores the given URL and waits for commit
3434
func (p *Preferences) SetManagementURL(url string) {
3535
p.configInput.ManagementURL = url
3636
}
3737

38-
// GetAdminURL read url from config file
38+
// GetAdminURL reads URL from config file
3939
func (p *Preferences) GetAdminURL() (string, error) {
4040
if p.configInput.AdminURL != "" {
4141
return p.configInput.AdminURL, nil
@@ -48,12 +48,12 @@ func (p *Preferences) GetAdminURL() (string, error) {
4848
return cfg.AdminURL.String(), err
4949
}
5050

51-
// SetAdminURL store the given url and wait for commit
51+
// SetAdminURL stores the given URL and waits for commit
5252
func (p *Preferences) SetAdminURL(url string) {
5353
p.configInput.AdminURL = url
5454
}
5555

56-
// GetPreSharedKey read preshared key from config file
56+
// GetPreSharedKey reads pre-shared key from config file
5757
func (p *Preferences) GetPreSharedKey() (string, error) {
5858
if p.configInput.PreSharedKey != nil {
5959
return *p.configInput.PreSharedKey, nil
@@ -66,17 +66,17 @@ func (p *Preferences) GetPreSharedKey() (string, error) {
6666
return cfg.PreSharedKey, err
6767
}
6868

69-
// SetPreSharedKey store the given key and wait for commit
69+
// SetPreSharedKey stores the given key and waits for commit
7070
func (p *Preferences) SetPreSharedKey(key string) {
7171
p.configInput.PreSharedKey = &key
7272
}
7373

74-
// SetRosenpassEnabled store if rosenpass is enabled
74+
// SetRosenpassEnabled stores whether Rosenpass is enabled
7575
func (p *Preferences) SetRosenpassEnabled(enabled bool) {
7676
p.configInput.RosenpassEnabled = &enabled
7777
}
7878

79-
// GetRosenpassEnabled read rosenpass enabled from config file
79+
// GetRosenpassEnabled reads Rosenpass enabled status from config file
8080
func (p *Preferences) GetRosenpassEnabled() (bool, error) {
8181
if p.configInput.RosenpassEnabled != nil {
8282
return *p.configInput.RosenpassEnabled, nil
@@ -89,12 +89,12 @@ func (p *Preferences) GetRosenpassEnabled() (bool, error) {
8989
return cfg.RosenpassEnabled, err
9090
}
9191

92-
// SetRosenpassPermissive store the given permissive and wait for commit
92+
// SetRosenpassPermissive stores the given permissive setting and waits for commit
9393
func (p *Preferences) SetRosenpassPermissive(permissive bool) {
9494
p.configInput.RosenpassPermissive = &permissive
9595
}
9696

97-
// GetRosenpassPermissive read rosenpass permissive from config file
97+
// GetRosenpassPermissive reads Rosenpass permissive setting from config file
9898
func (p *Preferences) GetRosenpassPermissive() (bool, error) {
9999
if p.configInput.RosenpassPermissive != nil {
100100
return *p.configInput.RosenpassPermissive, nil
@@ -107,7 +107,119 @@ func (p *Preferences) GetRosenpassPermissive() (bool, error) {
107107
return cfg.RosenpassPermissive, err
108108
}
109109

110-
// Commit write out the changes into config file
110+
// GetDisableClientRoutes reads disable client routes setting from config file
111+
func (p *Preferences) GetDisableClientRoutes() (bool, error) {
112+
if p.configInput.DisableClientRoutes != nil {
113+
return *p.configInput.DisableClientRoutes, nil
114+
}
115+
116+
cfg, err := internal.ReadConfig(p.configInput.ConfigPath)
117+
if err != nil {
118+
return false, err
119+
}
120+
return cfg.DisableClientRoutes, err
121+
}
122+
123+
// SetDisableClientRoutes stores the given value and waits for commit
124+
func (p *Preferences) SetDisableClientRoutes(disable bool) {
125+
p.configInput.DisableClientRoutes = &disable
126+
}
127+
128+
// GetDisableServerRoutes reads disable server routes setting from config file
129+
func (p *Preferences) GetDisableServerRoutes() (bool, error) {
130+
if p.configInput.DisableServerRoutes != nil {
131+
return *p.configInput.DisableServerRoutes, nil
132+
}
133+
134+
cfg, err := internal.ReadConfig(p.configInput.ConfigPath)
135+
if err != nil {
136+
return false, err
137+
}
138+
return cfg.DisableServerRoutes, err
139+
}
140+
141+
// SetDisableServerRoutes stores the given value and waits for commit
142+
func (p *Preferences) SetDisableServerRoutes(disable bool) {
143+
p.configInput.DisableServerRoutes = &disable
144+
}
145+
146+
// GetDisableDNS reads disable DNS setting from config file
147+
func (p *Preferences) GetDisableDNS() (bool, error) {
148+
if p.configInput.DisableDNS != nil {
149+
return *p.configInput.DisableDNS, nil
150+
}
151+
152+
cfg, err := internal.ReadConfig(p.configInput.ConfigPath)
153+
if err != nil {
154+
return false, err
155+
}
156+
return cfg.DisableDNS, err
157+
}
158+
159+
// SetDisableDNS stores the given value and waits for commit
160+
func (p *Preferences) SetDisableDNS(disable bool) {
161+
p.configInput.DisableDNS = &disable
162+
}
163+
164+
// GetDisableFirewall reads disable firewall setting from config file
165+
func (p *Preferences) GetDisableFirewall() (bool, error) {
166+
if p.configInput.DisableFirewall != nil {
167+
return *p.configInput.DisableFirewall, nil
168+
}
169+
170+
cfg, err := internal.ReadConfig(p.configInput.ConfigPath)
171+
if err != nil {
172+
return false, err
173+
}
174+
return cfg.DisableFirewall, err
175+
}
176+
177+
// SetDisableFirewall stores the given value and waits for commit
178+
func (p *Preferences) SetDisableFirewall(disable bool) {
179+
p.configInput.DisableFirewall = &disable
180+
}
181+
182+
// GetServerSSHAllowed reads server SSH allowed setting from config file
183+
func (p *Preferences) GetServerSSHAllowed() (bool, error) {
184+
if p.configInput.ServerSSHAllowed != nil {
185+
return *p.configInput.ServerSSHAllowed, nil
186+
}
187+
188+
cfg, err := internal.ReadConfig(p.configInput.ConfigPath)
189+
if err != nil {
190+
return false, err
191+
}
192+
if cfg.ServerSSHAllowed == nil {
193+
// Default to false for security on Android
194+
return false, nil
195+
}
196+
return *cfg.ServerSSHAllowed, err
197+
}
198+
199+
// SetServerSSHAllowed stores the given value and waits for commit
200+
func (p *Preferences) SetServerSSHAllowed(allowed bool) {
201+
p.configInput.ServerSSHAllowed = &allowed
202+
}
203+
204+
// GetBlockInbound reads block inbound setting from config file
205+
func (p *Preferences) GetBlockInbound() (bool, error) {
206+
if p.configInput.BlockInbound != nil {
207+
return *p.configInput.BlockInbound, nil
208+
}
209+
210+
cfg, err := internal.ReadConfig(p.configInput.ConfigPath)
211+
if err != nil {
212+
return false, err
213+
}
214+
return cfg.BlockInbound, err
215+
}
216+
217+
// SetBlockInbound stores the given value and waits for commit
218+
func (p *Preferences) SetBlockInbound(block bool) {
219+
p.configInput.BlockInbound = &block
220+
}
221+
222+
// Commit writes out the changes to the config file
111223
func (p *Preferences) Commit() error {
112224
_, err := internal.UpdateOrCreateConfig(p.configInput)
113225
return err

‎client/iface/device/device_android.go‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ type WGTunDevice struct {
2424
mtu int
2525
iceBind *bind.ICEBind
2626
tunAdapter TunAdapter
27+
disableDNS bool
2728

2829
name string
2930
device *device.Device
@@ -32,14 +33,15 @@ type WGTunDevice struct {
3233
configurer WGConfigurer
3334
}
3435

35-
func NewTunDevice(address wgaddr.Address, port int, key string, mtu int, iceBind *bind.ICEBind, tunAdapter TunAdapter) *WGTunDevice {
36+
func NewTunDevice(address wgaddr.Address, port int, key string, mtu int, iceBind *bind.ICEBind, tunAdapter TunAdapter, disableDNS bool) *WGTunDevice {
3637
return &WGTunDevice{
3738
address: address,
3839
port: port,
3940
key: key,
4041
mtu: mtu,
4142
iceBind: iceBind,
4243
tunAdapter: tunAdapter,
44+
disableDNS: disableDNS,
4345
}
4446
}
4547

@@ -49,6 +51,13 @@ func (t *WGTunDevice) Create(routes []string, dns string, searchDomains []string
4951
routesString := routesToString(routes)
5052
searchDomainsToString := searchDomainsToString(searchDomains)
5153

54+
// Skip DNS configuration when DisableDNS is enabled
55+
if t.disableDNS {
56+
log.Info("DNS is disabled, skipping DNS and search domain configuration")
57+
dns = ""
58+
searchDomainsToString = ""
59+
}
60+
5261
fd, err := t.tunAdapter.ConfigureInterface(t.address.String(), t.mtu, dns, searchDomainsToString, routesString)
5362
if err != nil {
5463
log.Errorf("failed to create Android interface: %s", err)

‎client/iface/iface.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ type WGIFaceOpts struct {
4343
MobileArgs *device.MobileIFaceArguments
4444
TransportNet transport.Net
4545
FilterFn bind.FilterFn
46+
DisableDNS bool
4647
}
4748

4849
// WGIface represents an interface instance

‎client/iface/iface_new_android.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ func NewWGIFace(opts WGIFaceOpts) (*WGIface, error) {
1818

1919
wgIFace := &WGIface{
2020
userspaceBind: true,
21-
tun: device.NewTunDevice(wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, opts.MobileArgs.TunAdapter),
21+
tun: device.NewTunDevice(wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, opts.MobileArgs.TunAdapter, opts.DisableDNS),
2222
wgProxyFactory: wgproxy.NewUSPFactory(iceBind),
2323
}
2424
return wgIFace, nil

‎client/internal/config.go‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,8 @@ func createNewConfig(input ConfigInput) (*Config, error) {
223223
config := &Config{
224224
// defaults to false only for new (post 0.26) configurations
225225
ServerSSHAllowed: util.False(),
226+
// default to disabling server routes on Android for security
227+
DisableServerRoutes: runtime.GOOS == "android",
226228
}
227229

228230
if _, err := config.apply(input); err != nil {
@@ -416,9 +418,15 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
416418
config.ServerSSHAllowed = input.ServerSSHAllowed
417419
updated = true
418420
} else if config.ServerSSHAllowed == nil {
419-
// enables SSH for configs from old versions to preserve backwards compatibility
420-
log.Infof("falling back to enabled SSH server for pre-existing configuration")
421-
config.ServerSSHAllowed = util.True()
421+
if runtime.GOOS == "android" {
422+
// default to disabled SSH on Android for security
423+
log.Infof("setting SSH server to false by default on Android")
424+
config.ServerSSHAllowed = util.False()
425+
} else {
426+
// enables SSH for configs from old versions to preserve backwards compatibility
427+
log.Infof("falling back to enabled SSH server for pre-existing configuration")
428+
config.ServerSSHAllowed = util.True()
429+
}
422430
updated = true
423431
}
424432

‎client/internal/engine.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1527,6 +1527,7 @@ func (e *Engine) newWgIface() (*iface.WGIface, error) {
15271527
MTU: iface.DefaultMTU,
15281528
TransportNet: transportNet,
15291529
FilterFn: e.addrViaRoutes,
1530+
DisableDNS: e.config.DisableDNS,
15301531
}
15311532

15321533
switch runtime.GOOS {

0 commit comments

Comments
 (0)