feat(apple): pass-through search domain to VPN resolver config - #8421
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
thomaseizinger
enabled auto-merge
March 13, 2025 00:48
jamilbk
approved these changes
Mar 13, 2025
jamilbk
left a comment
jamilbk
left a comment
Member
There was a problem hiding this comment.
Whoops missed a couple semicolons
Co-authored-by: Jamil <jamilbk@users.noreply.github.com> Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Mar 13, 2025
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Mar 14, 2025
On Android, we can use [`addSearchDomain`](https://developer.android.com/reference/android/net/VpnService.Builder#addSearchDomain(java.lang.String)) to configure the search domain list for our VPN tunnel. Thankfully, this gets applied to the system resolver without any other hackery involved (unlike for Apple in #8421), and most apps use the system resolver for queries. The one exception to this are some network utilities like AndroDNS and Fing. Tested to work fine in Termux using `github.io` as the search domain, which responds to ICMP echoes to any subdomain: <img width="420" alt="Screenshot 2025-03-13 at 10 19 41 PM" src="https://github.com/user-attachments/assets/e156e644-08a8-4ab6-b49a-91ef92aabafd" /> Related #8410 --------- Co-authored-by: Thomas Eizinger <thomas@eizinger.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In order to have the system expand search domains for us, we need to set a very peculiar combination of configuration options in the
NEDNSSettingsof the VPN configuration:matchDomainsmatchDomainsNoSearch = falsesearchDomainsfieldTechnically, we don't even need to set
searchDomainsby itself. Reading the docs in more detail for thematchDomainsNoSearchflag explains why:The double-negative here is confusing but essentially, what this says is:
That is exactly what we want. We want a search domain of e.g.
example.comto append to the list of search domains for the primary resolver of non-scoped DNS queries.I tested without setting
searchDomainsand it does still work: The system will still expand the domain for us und send us a FQDN query of e.g.foo.example.com. However, I figured not settingsearchDomainsat all is quite confusing so I left it in there.Related: #8410 (Fixes it for MacOS)