Problem reconnecting a VPN Tunnel after changing the path for multiple times

Hello!


So we've discovered an issue with our VPN app, and after testing and research for a week, we don't really know if it's a problem with iPhone X's firmware, or the implementation of OpenVPN on iPhone X. The issue isn't specific to our app, and can be found on other VPN apps on OpenVPN. It appears on iOS 12, 12.1 and 11.4, but so far we've only been able to reproduce on iPhone X.


To trigger:

1. Connect wifi

2. Connect your VPN app configured over OpenVPN

3. Ensure OnDemand is on

4. Toggle wifi using Control Center on the device quickly, 3 or 4 times.

5. Attempt to browse or send data using Safari for example.

Repeat this process for between a minute or 10 minutes until:

* The VPN app will say it's connected, but no data will be allowed through the tunnel.


From our own testing of our App, we discovered that when the app reach this state we could still send ping from the tunnel and receive response, but that any other form of traffic from any other apps (eg. Web browsing) would not work.


More details:

- The VPN icon appears in the status bar even when the app reaches this state.

- It happens under TCP and/or UDP.

- The reasserting property is false after the tunnel is up.

- The property isViable for NWTCPConnection/NWUDPSession value is YES.

- The property state for NWTCPConnection/NWUDPSession is ready/connected.


I attach a link to download a txt with the log from the console filtered for the process com.apple.WebKit.Networking when the app reaches this state.


https://1drv.ms/t/s!AtIkZx-Osy8C51jbW69QXa_dJRvu


Do you have any idea what could is causing this effect?


Thank you,

Jose Blaya

Up vote post of joseblaya Down vote post of joseblaya
2.1k views
Posted by
joseblaya
Reply
Add a Comment

Replies

I’d like to clarify your relationship with OpenVPN here. Are you working for OpenVPN? Or just building a VPN app using their SDK?

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware 

let myEmail = "eskimo" + "1" + "@apple.com"
Posted by
eskimo
Up vote reply of eskimo Down vote reply of eskimo
Add a Comment

Hello eskimo, thank you for your answer.


Sorry if I didn't explain the situation correctly, I am just building a VPN app with a custom implementation of the OpenVPN protocol for the Apple platforms, I am not using their SDK.


Regards,

Jose Blaya.

Posted by
joseblaya
Up vote reply of joseblaya Down vote reply of joseblaya
Add a Comment

Thanks for the clarification.

So, if you create a simple test app that opens a TCP connection that should go via the VPN, and then get the VPN in this state, what happens with your test app? Does the connection go through? If not, does your packet tunnel even see the SYN packets generated by your test app’s connection attempt?

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware 

let myEmail = "eskimo" + "1" + "@apple.com"
Posted by
eskimo
Up vote reply of eskimo Down vote reply of eskimo
Add a Comment

Yes, the connection is established and everything works as expected.


The problem is when I start to play with the WiFi toggle from the Control Center to simulate a scenario of a very bad network signal environment. After 5,10 or 20 changes of network, from inside the tunnel I can make pings and I can reach internet, but from the device (Safari, Whatsapp, etc) I can't.


I can debug the tunnel and the only packets I see are the generated by the pings I am doing, but if I try to open a website nothing happens. While debugging, the values of the vars 'isViable' and 'state' are true and ready.


Thank you,

Jose Blaya

Posted by
joseblaya
Up vote reply of joseblaya Down vote reply of joseblaya
Add a Comment

but if I try to open a website nothing happens.

Right, but opening a web site is a hugely complicated operation involved a vast swathe of frameworks up and down the system. What I was suggestion is that, when you get the system into this state, run a test app that creates a simple TCP connection to a server (maybe even to the same web server that isn’t responding in Safari) and see whether the SYN packets from that connection make it to your packet flow.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware 

let myEmail = "eskimo" + "1" + "@apple.com"
Posted by
eskimo
Up vote reply of eskimo Down vote reply of eskimo
Add a Comment