Add setting to leak traffic to apple networks

Co-authored-by: David Lönnhager <david.l@mullvad.net>

2 files changed, 66 insertions, 0 deletions

diff --git a/mullvad-daemon/src/lib.rs b/mullvad-daemon/src/lib.rs
index b0e9ea7d58..c2e38f11b6 100644
--- a/mullvad-daemon/src/lib.rs
+++ b/mullvad-daemon/src/lib.rs
@@ -380,6 +380,9 @@ pub enum DaemonCommand {
     ExportJsonSettings(ResponseTx<String, settings::patch::Error>),
     /// Request the current feature indicators.
     GetFeatureIndicators(oneshot::Sender<FeatureIndicators>),
+    /// Set if we should leak traffic to Apple services.
+    #[cfg(target_os = "macos")]
+    SetAppleServicesBypass(ResponseTx<(), settings::Error>, bool),
 }
 
 /// All events that can happen in the daemon. Sent from various threads and exposed interfaces.
@@ -767,6 +770,8 @@ impl Daemon {
                 reset_firewall: *target_state != TargetState::Secured,
                 #[cfg(any(windows, target_os = "android", target_os = "macos"))]
                 exclude_paths,
+                #[cfg(target_os = "macos")]
+                apple_services_bypass: settings.apple_services_bypass,
             },
             parameters_generator.clone(),
             log_dir,
@@ -1334,6 +1339,10 @@ impl Daemon {
             ApplyJsonSettings(tx, blob) => self.on_apply_json_settings(tx, blob).await,
             ExportJsonSettings(tx) => self.on_export_json_settings(tx),
             GetFeatureIndicators(tx) => self.on_get_feature_indicators(tx),
+            #[cfg(target_os = "macos")]
+            SetAppleServicesBypass(tx, enabled) => {
+                self.on_set_apple_services_bypass(tx, enabled).await
+            }
         }
     }
 
@@ -2799,6 +2808,12 @@ impl Daemon {
         let (tx, _rx) = oneshot::channel();
         self.send_tunnel_command(TunnelCommand::AllowLan(self.settings.allow_lan, tx));
 
+        #[cfg(target_os = "macos")]
+        self.send_tunnel_command(TunnelCommand::AppleServicesBypass(
+            oneshot::channel().0,
+            self.settings.apple_services_bypass,
+        ));
+
         let (tx, _rx) = oneshot::channel();
         let dns = dns::addresses_from_options(&self.settings.tunnel_options.dns_options);
         self.send_tunnel_command(TunnelCommand::Dns(dns, tx));
@@ -2943,6 +2958,37 @@ impl Daemon {
         Self::oneshot_send(tx, feature_indicators, "get_feature_indicators response");
     }
 
+    #[cfg(target_os = "macos")]
+    async fn on_set_apple_services_bypass(
+        &mut self,
+        tx: ResponseTx<(), settings::Error>,
+        enabled: bool,
+    ) {
+        let result = self
+            .settings
+            .update(|settings| settings.apple_services_bypass = enabled)
+            .await;
+
+        match result {
+            Ok(settings_changed) => {
+                if settings_changed {
+                    self.send_tunnel_command(TunnelCommand::AppleServicesBypass(
+                        oneshot_map(tx, |tx, ()| {
+                            Self::oneshot_send(tx, Ok(()), "set_apple_services_bypass response");
+                        }),
+                        enabled,
+                    ));
+                } else {
+                    Self::oneshot_send(tx, Ok(()), "set_apple_services_bypass response");
+                }
+            }
+            Err(e) => {
+                log::error!("{}", e.display_chain_with_msg("Unable to save settings"));
+                Self::oneshot_send(tx, Err(e), "set_apple_services_bypass response");
+            }
+        }
+    }
+
     /// Set the target state of the client. If it changed trigger the operations needed to
     /// progress towards that state.
     /// Returns a bool representing whether a state change was initiated.
diff --git a/mullvad-daemon/src/management_interface.rs b/mullvad-daemon/src/management_interface.rs
index 331754d1f2..2d2c81ff89 100644
--- a/mullvad-daemon/src/management_interface.rs
+++ b/mullvad-daemon/src/management_interface.rs
@@ -1070,6 +1070,26 @@ impl ManagementService for ManagementServiceImpl {
 
         Ok(Response::new(feature_indicators))
     }
+
+    #[cfg(not(daita))]
+    async fn set_enable_daita(&self, _: Request<bool>) -> ServiceResult<()> {
+        Ok(Response::new(()))
+    }
+
+    #[cfg(not(target_os = "macos"))]
+    async fn set_apple_services_bypass(&self, _: Request<bool>) -> ServiceResult<()> {
+        Ok(Response::new(()))
+    }
+
+    #[cfg(target_os = "macos")]
+    async fn set_apple_services_bypass(&self, request: Request<bool>) -> ServiceResult<()> {
+        log::debug!("set_apple_services_bypass");
+        let enabled = request.into_inner();
+        let (tx, rx) = oneshot::channel();
+        self.send_command_to_daemon(DaemonCommand::SetAppleServicesBypass(tx, enabled))?;
+        self.wait_for_result(rx).await??;
+        Ok(Response::new(()))
+    }
 }
 
 impl ManagementServiceImpl {