| 60 | |
| 61 | |
| 62 | bool SplitTunneling::updateState() |
| 63 | { |
| 64 | if (connectStatus_.isConnected && isSplitTunnelActive_) { |
| 65 | if (!apps_.empty()) { |
| 66 | bool ret = CGroups::instance().enable(connectStatus_, isAllowLanTraffic_, isExclude_); |
| 67 | if (!ret) { |
| 68 | return ret; |
| 69 | } |
| 70 | ret = ProcessMonitor::instance().enable(); |
| 71 | if (!ret) { |
| 72 | return ret; |
| 73 | } |
| 74 | } |
| 75 | |
| 76 | if (isExclude_) { |
| 77 | // Exclude mode: host pins for excluded apps route via the default adapter. |
| 78 | hostnamesManager_.enable(connectStatus_.defaultAdapter.gatewayIp, |
| 79 | connectStatus_.defaultAdapter.gatewayIpV6, |
| 80 | connectStatus_.defaultAdapter.adapterIp, |
| 81 | connectStatus_.defaultAdapter.adapterIpV6, |
| 82 | connectStatus_.defaultAdapter.adapterName, |
| 83 | connectStatus_.defaultAdapter.adapterNameV6); |
| 84 | } else { |
| 85 | // Inclusive mode: host pins for included apps route via the VPN adapter. |
| 86 | // The adapter IPs are also forwarded so HostnamesManager/IpRoutes can |
| 87 | // detect the WireGuard point-to-point case (gatewayIp == adapterIp, |
| 88 | // see wireguardconnection_posix.cpp) and emit `dev <iface>` instead |
| 89 | // of `via <our-own-addr>`, which the kernel rejects. |
| 90 | hostnamesManager_.enable(connectStatus_.vpnAdapter.gatewayIp, |
| 91 | connectStatus_.vpnAdapter.gatewayIpV6, |
| 92 | connectStatus_.vpnAdapter.adapterIp, |
| 93 | connectStatus_.vpnAdapter.adapterIpV6, |
| 94 | connectStatus_.vpnAdapter.adapterName, |
| 95 | connectStatus_.vpnAdapter.adapterNameV6); |
| 96 | } |
| 97 | } else { |
| 98 | CGroups::instance().disable(); |
| 99 | ProcessMonitor::instance().disable(); |
| 100 | hostnamesManager_.disable(); |
| 101 | } |
| 102 | |
| 103 | // Pass both families' default-adapter addresses; the firewall layer dispatches the |
| 104 | // ingress-connmark path per-family. adapterIpV6.toString() returns "" for an invalid |
| 105 | // IpAddress (no v6 detected), which the firewall layer treats as "skip the v6 path". |
| 106 | FirewallController::instance().setSplitTunnelingEnabled( |
| 107 | connectStatus_.isConnected, |
| 108 | isSplitTunnelActive_, |
| 109 | isExclude_, |
| 110 | connectStatus_.defaultAdapter.adapterName, |
| 111 | connectStatus_.defaultAdapter.adapterIp.toString(), |
| 112 | connectStatus_.defaultAdapter.adapterIpV6.toString()); |
| 113 | return true; |
| 114 | } |
no test coverage detected