WireGuard is broken on iOS 15 beta

[David Crawshaw]

I finally managed to get a device running iPadOS 15 and an Xcode 13
beta. This technique works. Some modified code with logging:

func tunnelFD(provider: NEPacketTunnelProvider) -> Int32 {
    os_log("tunnelFD searching")
    var buf = [CChar](repeating: 0, count: Int(IFNAMSIZ))
    for fd: Int32 in 4...64 {
        var len = socklen_t(buf.count)
        if getsockopt(fd, 2 /* SYSPROTO_CONTROL */, 2, &buf, &len) == 0 {
            let str = String(cString: buf)
            os_log("%{public}@", "tunnelFD \(fd): \(str)")
            if str.starts(with: "utun") {
                os_log("tunnelFD found likely fd")
                return fd
            }
        }
    }
    os_log("tunnelFD found nothing")
    return -1
}

produces the logs:

    tunnelFD searching
    tunnelFD 7: utun3
    tunnelFD found likely fd

Note that the current technique of calling
provider.packetFlow.value(forKeyPath: "socket.fileDescriptor") causes
the NetworkExtension to crash under iOS 15. The logs say the kernel
sandbox killed it:

    Sandbox: process(525) deny(2) file-test-existence /private/etc/.mdns_debug

On Thu, Jun 10, 2021 at 8:44 AM Jason A. Donenfeld <Jason at zx2c4.com> wrote:
>
> I won't have an updated OS to test this out in until next week at the
> earliest, but perhaps this hack will work?
> https://git.zx2c4.com/wireguard-apple/commit/?h=jd/fd-search-hack
> Let me know if that is successful, or if it blows up.
>
> Jason