Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

chore: run coder connect networking from launchdaemon#203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
ethanndickson merged 2 commits intomainfromethan/networking-in-launchdaemon
Aug 6, 2025

Conversation

ethanndickson
Copy link
Member

@ethanndicksonethanndickson commentedJul 23, 2025•
edited
Loading

Continues to address#201.

This PR reworks all XPC connections, such that the networking code runs within the privileged helper, instead of the network extension.

The XPC interfaces are described inXPC.swift, and roughly follow this sequence diagram:
(One difference is that we don't posix spawn the tunnel in this PR)

sequenceDiagram    note left of App: User requests to start VPN:    App->>+NetExt: Start VPN    NetExt->>+PrivHelper: Request start VPN with TUN FD    note right of PrivHelper: Privileged helper downloads and verifies binary.    PrivHelper->>Tunnel: posix_spawn child process with FDs    PrivHelper->>+Tunnel: Send proto start request    Tunnel-->>-PrivHelper: Send proto start response    PrivHelper->>+NetExt: Request for network config change    NetExt-->>-PrivHelper: Response for network config change    PrivHelper-->>-NetExt: Start VPN respons    NetExt-->>-App: VPN started    App->>PrivHelper: Request peer state    PrivHelper->>Tunnel: Request peer state    Tunnel-->>PrivHelper: Peer state response    PrivHelper-->>App: Peer state response    note left of App: Tunnel updates (bypass NetExt):    Tunnel->>PrivHelper: Tunnel update proto message    PrivHelper->>App: Tunnel update proto message    note left of App: User requests to stop VPN:    App->>+NetExt: Stop VPN    NetExt->>+PrivHelper: Request stop VPN    PrivHelper->>+Tunnel: Request stop VPN    Tunnel-->>-PrivHelper: Stop VPN response    note right of Tunnel: Tunnel binary exits    PrivHelper-->>-NetExt: Stop VPN response    NetExt-->>-App: VPN stopped
Loading

Of note is that the network extension starts and stops the daemon running within the privileged helper.
This is to support starting and stopping the VPN from the toggle in System Settings, and to ensure the "Connecting" and "Disconnecting" phase of the system VPN is indicative of the time the VPN is actually setting itself up and tearing itself down.

To accomplish this, the privileged helper listens on two different service names. One is connected to by the app, the other the network extension. (Once an XPC listener is connected to, communication is bidirectional)

@ethanndicksonGraphite App
Copy link
MemberAuthor

ethanndickson commentedJul 23, 2025•
edited
Loading

@ethanndicksonethanndickson self-assigned thisJul 23, 2025
@ethanndicksonethanndickson changed the base branch frommain tographite-base/203July 24, 2025 07:06
@ethanndicksonethanndicksonforce-pushed theethan/networking-in-launchdaemon branch from49d5c99 to72071e5CompareJuly 24, 2025 07:06
@ethanndicksonethanndickson changed the base branch fromgraphite-base/203 toethan/mandatory-helperJuly 24, 2025 07:07
@ethanndicksonethanndicksonforce-pushed theethan/networking-in-launchdaemon branch from72071e5 toc7dbde8CompareJuly 24, 2025 09:07
@ethanndicksonethanndicksonforce-pushed theethan/networking-in-launchdaemon branch fromc7dbde8 toef8832aCompareJuly 28, 2025 07:50
@ethanndicksonethanndicksonforce-pushed theethan/networking-in-launchdaemon branch fromef8832a toe32d7deCompareJuly 30, 2025 09:31
Comment on lines 66 to 77
guardlet proxy= conn.remoteObjectProxyWithErrorHandler({ errin
self.logger.error("failed to connect to HelperXPC\(err.localizedDescription, privacy:.public)")
continuation.resume(throwing: err)
})as?HelperAppXPCInterfaceelse{
self.logger.error("failed to get proxy for HelperXPC")
continuation.resume(throwing:XPCError.wrongProxyType)
return
}
proxy.ping{
self.logger.info("Connected to Helper over XPC")
continuation.resume()
}
Copy link
MemberAuthor

@ethanndicksonethanndicksonJul 30, 2025•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Important to note that I've refactored all the XPC connections to use this pattern. With this, you're guaranteed that either the the XPC reply will be run (proxy.ping { reply } in this case) or the[...]WithErrorHandler callback.

Comment on lines +14 to +15
// /var/root/Downloads
privateletdest=FileManager.default.urls(for:.downloadsDirectory, in:.userDomainMask)
Copy link
MemberAuthor

@ethanndicksonethanndicksonJul 30, 2025•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Temporary. I've put it in/var/root/Library/Application\ Support/com.coder.Coder-Desktop/ as part of the PR that downloads the slim binary.

@ethanndicksonethanndickson marked this pull request as ready for reviewJuly 30, 2025 13:09
Copy link
Member

@deansheatherdeansheather left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The XPC code seems a lot nicer but the type names and directions of the XPC types are hard to understand

@ethanndicksonethanndicksonforce-pushed theethan/networking-in-launchdaemon branch fromeebf562 to291e5a1CompareJuly 31, 2025 07:26
@ethanndicksonethanndicksonforce-pushed theethan/networking-in-launchdaemon branch 2 times, most recently fromb0c196f tob81afc9CompareAugust 4, 2025 03:00
@ethanndicksonethanndicksonforce-pushed theethan/networking-in-launchdaemon branch fromb81afc9 toe96075eCompareAugust 4, 2025 03:03
Copy link
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The class is calledHelperXPCClient, but you can't have multiple Swift files with the same name. So, I've prependedNE, since this is theHelperXPCClient that runs within the network extension.

@ethanndicksonethanndicksonforce-pushed theethan/networking-in-launchdaemon branch 2 times, most recently froma4b58e5 tobd905aeCompareAugust 4, 2025 08:05
Copy link

@CopilotCopilotAI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Pull Request Overview

This PR reworks the XPC architecture to move VPN networking functionality from the network extension to a privileged helper daemon. The helper now manages the VPN tunnel and communicates with both the GUI app and network extension via separate XPC interfaces, implementing a more secure and maintainable design.

Key changes:

  • Moved VPN networking code from network extension to privileged helper daemon
  • Established bidirectional XPC communication between helper, app, and network extension
  • Updated project configuration to support the new architecture

Reviewed Changes

Copilot reviewed 18 out of 20 changed files in this pull request and generated 7 comments.

Show a summary per file
FileDescription
project.ymlUpdated build configuration to support helper dependencies and framework loading
XPC.swiftDefined new XPC interfaces for helper-app and helper-network extension communication
Download.swiftRenamed SignatureValidator class to Validator
main.swiftSimplified network extension entry point, removed XPC listener setup
PacketTunnelProvider.swiftRefactored to delegate VPN operations to helper via XPC
NEHelperXPCClient.swiftNew XPC client for network extension to communicate with helper
Manager.swiftMoved to helper, updated to work without direct PacketTunnelProvider dependency
HelperXPCListeners.swiftNew XPC server implementations for helper to handle app and network extension connections
AppHelperXPCClient.swiftNew XPC client for GUI app to communicate with helper

@ethanndicksonethanndicksonforce-pushed theethan/networking-in-launchdaemon branch fromd09250b tod286679CompareAugust 6, 2025 03:38
@ethanndicksonGraphite App
Copy link
MemberAuthor

ethanndickson commentedAug 6, 2025•
edited
Loading

Merge activity

  • Aug 6, 3:39 AM UTC: A user started a stack merge that includes this pull request viaGraphite.
  • Aug 6, 3:43 AM UTC:Graphite rebased this pull request as part of a merge.
  • Aug 6, 3:44 AM UTC:@ethanndickson merged this pull request withGraphite.

@ethanndicksonethanndickson changed the base branch fromethan/mandatory-helper tographite-base/203August 6, 2025 03:39
@ethanndicksonethanndickson changed the base branch fromgraphite-base/203 tomainAugust 6, 2025 03:41
@ethanndicksonethanndicksonforce-pushed theethan/networking-in-launchdaemon branch fromd286679 tod9c0210CompareAugust 6, 2025 03:42
@ethanndicksonethanndickson merged commit8533b31 intomainAug 6, 2025
4 checks passed
@ethanndicksonethanndickson deleted the ethan/networking-in-launchdaemon branchAugust 6, 2025 03:44
ethanndickson added a commit that referenced this pull requestAug 6, 2025
With the changes made in#203, it now takes a moment longer to receive the first progress update, when we either start the download (if not already downloaded), or validate the dylib. To address this, the progress indicator will immediately start making progress towards 25%. This prevents it from appearing stuck in what is an expected situation.https://github.com/user-attachments/assets/da57270d-a50b-49ab-9e53-ae02368c71dc
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

Copilot code reviewCopilotCopilot left review comments

@deansheatherdeansheatherdeansheather approved these changes

@spikecurtisspikecurtisAwaiting requested review from spikecurtis

Assignees

@ethanndicksonethanndickson

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

2 participants
@ethanndickson@deansheather
[8]ページ先頭
©2009-2025 Movatter.jp