Re: [PATCH 00/46] VPN association state, dual IP support and WG fixes

Hello all

On 7/11/25 17:26, Jussi Laakkonen wrote:
> This patch set (1) adds the association state also for the VPNs, (2) implements
> dual IP support for VPNs and (3) contains fixes for Wireguard address,
> especially for FQDN handling. This is a combination of all three improvements
> for the sake of testing them together.
> 
> (1): association state for VPNs
> The association state is to indicate that the VPN is waiting for VPN agent to
> provide input given by user. In this state service.c must not do connect
> timeout checks as the timers for both differ in length, default being 120s for
> connect timeout and 300s for VPN agent dialog timeout.
> 
> In order to facilitate this change the association state had to be implemented
> also for VPNs. It is common state for services and like with services the
> association state for VPNs preceeds the configuration state (on VPN side
> connect state). Both vpn.c plugins on connmand and vpnd side require changes
> to accommodate this state. When the VPN agent succeeds in getting the input
> from the user the state transitions from association to connect (configuration)
> state and, thus, requires no specific changes to VPN plugins.
> 
> On connmand side the association state is the initial state when VPN is getting
> connected and the state needs to be accounted as a connecting state in
> plugins/vpn.c to not to lose transport ident for it and in provider.c as a
> pre-configuration state to not to start the connect timeout for the VPN before
> the VPN is in configuration state. The reason for the latter is that the
> connect timeout should be exact and start from the point when
> connect/configuration state is entered.
> 
> On vpnd side association state is, like on connmand side, the initial state for
> the VPN getting connected. After the VPN agent succeeds getting the information
> from the user (credentials) the state transitions to connect (configuratioin).
> There may be a possibility for a VPN plugin to run without VPN agent and thus
> in these cases it is ensured that the vpn/plugins/vpn.c:vpn_notify() does
> the state transition in such cases. It is allowed go back to association state
> from connect state but not from other states.
> 
> (2): dual IP support for VPNs
> 
> Dual IP support for VPNs is implemented by adding an family extension that
> simply uses a boolean array of 2. With this IPv4 and IPv6 can be both defined
> on a VPN such as WireGuard and provider.c will setup the addresses correctly in
> connmand.
> 
> (3): WireGuard fixes
> 
> This improves the WireGuard plugin and adds better error case support for the
> vpn/plugins/vpn.c. This allows also to propagate the errors upward and with
> other changes, allows the shutdown to follow the same process as the other
> VPNs. Also fix the PrefixLength use in the WireGuard plugin by tokenizing the
> host before getaddrinfo() check. One of the key fixes here is to make FQDN
> work with WireGuard. Also a new option is added for using the transport
> nameservers with WireGuard reresolve queries, which by default is off (false).
> 
> First, the basic saving of the WireGuard configuration is done similarly to
> other plugins, as well as to what wg-quick is utilizing.
> 
> Second, the handling of errors is improved within the plugin and vpn.c as well.
> This will make it possible to pass the errors upwards from the plugin  In
> addition to this there is a limit for reresolve errors (5 by default) after
> which WireGuard plugin dies in case the configuration is wrong, or network is
> broken.
> 
> Third, the use of getaddrinfo() will block with invalid configuration when
> doing the reresolve for the endpoint. This is now replaced with GResolv by
> adding a wrapper for it in vpn-util.c so it can be used within VPN plugins as
> well. This avoids the blocking of the non-existent address resolve that made
> vpnd unresponsive for the time being, for example, disconnects did not work.
> 
> Fourth, the shutdown is now simulated in a same way other daemon utilizing VPNs
> do, by calling the vpn_died() with a slight delay. This makes daemonless VPNs
> work in the same way as the rest of the plugins to do the same cleanup steps.
> 
> Fifth, the host given in the configuration as an IP-address should contain
> CIDR notation but as getaddrinfo() uses inet_pton(), which is relying on the
> address to not to have the notation, the host is tokenized first for this use.
> 
> Sixth, there is an option added, "WireGuard.ReresolveUseTransportDNS" that can
> be set to boolean values, "true" indicating that the nameservers of the
> transport are used for the DNS reresolve queries. This may become useful in
> cases where user cannot affect their network setup outside their devices. By
> default this option is set off, and is saved among other options.
> 
> Seventh, the FQDN server use is fixed by using the resolved IP of the server as
> the gateway. The reason this broke networking was that the FQDN name was sent
> to connmand "as is" and it was used as gateway, which could not be resolved
> when routing packets.
> 

Forgot to add:

Tested by: Christian Hewitt & LibreELEC community


BR,
  Jussi