IVPN

Recent Commits

• Alexandr Stelnykovych(06 Oct 26)

  v3.16.1

• Alexandr Stelnykovych(06 Oct 26)

  macOS Split Tunnel: fix changing ST settings while WireGuard is paused Toggling Split Tunnel during a WireGuard pause failed with "failed to get local interface by IP": the pause stops the tunnel process, so the VPN interface the firewall still tracks no longer exists. The daemon then rolled the preferences back, leaving the user unable to disable Split Tunnel until resume. The same error was logged on every pause. applyConnectedRules() now tolerates the missing interface while paused: the rules are reapplied by ClientConnected() when the connection comes back on resume. OpenVPN, whose interface survives a pause, is unaffected.

• Alexandr Stelnykovych(06 Oct 26)

  macOS Split Tunnel: show in the main view when ST is enabled but not active Until now the only hint that the Split Tunnel system extension still needs approval (or is switched off, failed, or waits for a reboot) was the banner on the Settings page. A user could enable Split Tunnel, connect and assume excluded apps bypass the VPN while nothing was running. The extension-state-to-message mapping moves from the Settings page into a uiState getter, and the main view reuses the inverse mode warning slot to show "Split Tunnel is not active", which opens the Split Tunnel settings. One slot, so two Split Tunnel warnings never show at the same time; the issue message takes precedence over the inverse mode text.

• Alexandr Stelnykovych(06 Oct 26)

  Merge pull request #647 from ivpn/dependabot/github_actions/github/codeql-action/upload-sarif-4.38.2 build(deps): bump github/codeql-action/upload-sarif from 4.37.7 to 4.38.2

• Alexandr Stelnykovych(06 Oct 26)

  Merge pull request #646 from ivpn/dependabot/github_actions/ruby/setup-ruby-1.327.0 build(deps): bump ruby/setup-ruby from 1.321.0 to 1.327.0

• Alexandr Stelnykovych(06 Oct 26)

  Merge pull request #645 from ivpn/dependabot/github_actions/github/codeql-action/init-4.38.2 build(deps): bump github/codeql-action/init from 4.37.7 to 4.38.2

• Alexandr Stelnykovych(06 Oct 26)

  Merge pull request #644 from ivpn/dependabot/github_actions/github/codeql-action/analyze-4.38.2 build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.38.2

• Alexandr Stelnykovych(06 Oct 26)

  Merge pull request #643 from ivpn/dependabot/github_actions/github/codeql-action/autobuild-4.38.2 build(deps): bump github/codeql-action/autobuild from 4.37.7 to 4.38.2

• Alexandr Stelnykovych(06 Oct 26)

  Merge pull request #648 from ivpn/feature/macos_splittunnel Feature/macos splittunnel

• dependabot[bot](28 Sept 26)

  build(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.7 to 4.38.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot](28 Sept 26)

  build(deps): bump ruby/setup-ruby from 1.321.0 to 1.327.0 Bumps [ruby/setup-ruby](https://github.com/ruby/setup-ruby) from 1.321.0 to 1.327.0. - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/95ef2b042f9d7a56d8268cba8559e2842e2ad01b...14594264cd68ce8a2345dd349bc3d138a4ef85c8) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.327.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot](28 Sept 26)

  build(deps): bump github/codeql-action/init from 4.37.7 to 4.38.2 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.7 to 4.38.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot](28 Sept 26)

  build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.38.2 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.7 to 4.38.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot](28 Sept 26)

  build(deps): bump github/codeql-action/autobuild from 4.37.7 to 4.38.2 Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.37.7 to 4.38.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2) --- updated-dependencies: - dependency-name: github/codeql-action/autobuild dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• Alexandr Stelnykovych(24 Sept 26)

  macOS Split Tunnel: bypass the endpoint the tunnel really uses The bypass rule was built from ConnectedResp's ServerIP/ServerPort. For V2Ray connections those hold the VPN server's host with the V2Ray port, an endpoint that never appears on the wire, so the rule did not match and V2Ray QUIC connections still lost connectivity on macOS 12 and 13. The daemon already announces the physical remote endpoint (the server, or the obfuscation proxy in front of it) with ConnectionStarting before every connection and clears it with ConnectionStopped. The UI now handles both messages, keeps the endpoint in vpnState.remoteEndpoint and requests it on Hello (GetActiveRemoteEndpoint) for a UI started while the VPN is already connected. The Split Tunnel helper builds the bypass rule from that endpoint. If it is missing the session still starts, without the rule and with a warning, since the rule is only needed on macOS 12 and 13 (14/15?).

• Alexandr Stelnykovych(24 Sept 26)

  macOS Split Tunnel: exclude the VPN endpoint from the proxy by rule On macOS 12 the kernel cannot return a declined UDP flow to normal delivery when the socket is a dual-stack IPv6 socket sending to an IPv4 address, the socket type V2Ray's QUIC client uses: the second datagram fails with EINVAL and the tunnel dies. The extension now excludes the VPN's own endpoint by network rule, so those flows are never attached to the proxy. Later macOS versions handle the declined flow correctly; there the rule only saves the per-flow round trip. The session starts only once the connection details carrying the endpoint have arrived. Also: ignore NEVPN status notifications from other connection objects and report extension readiness to the daemon only on change; together they turned one status change into dozens of daemon requests.

• Alexandr Stelnykovych(24 Sept 26)

  CLI: hide Inverse Split Tunnel options on macOS Inverse mode is not implemented on macOS and the daemon rejects it, but the CLI help still listed its four options and described the feature as able to restrict VPN usage to selected apps. Register them only on platforms that support inverse mode, matching the GUI.

• Alexandr Stelnykovych(24 Sept 26)

  macOS Split Tunnel: open Privacy & Security for extension approval on macOS 12-14 Login Items & Extensions exists only from macOS 15; the settings link used it from macOS 13 on, sending users to a pane where nothing could be approved. The approval banner now says the feature is enabled but inactive until approved, and that it starts automatically afterwards.

• Alexandr Stelnykovych(23 Sept 26)

  macOS Split Tunnel: opt-in extension debug logging via st-debug-logging argument `open -a IVPN --args st-debug-logging` makes every session the app starts log at debug level to the extension's unified-log subsystem: one line per new flow on the machine with its executable path, and the destinations of excluded apps. Off by default; the coupling to the app's logging setting is removed.

• Alexandr Stelnykovych(23 Sept 26)

  macOS Split Tunnel: log app-closed flows at debug level, close UDP flow on open failure An excluded browser closes the losers of every connection race and opens many one-shot UDP sockets, so "peer reset" and "not connected" flow errors are routine. Log them at debug level at the four relay sites and keep error level for anything else. A UDP flow whose open fails is now closed, not only unregistered.

• Alexandr Stelnykovych(22 Sept 26)

  macOS Split Tunnel: README.md

• Alexandr Stelnykovych(22 Sept 26)

  macOS: keep only allow-jit in the host app entitlements AMFI refuses to launch a process that carries system-extension.install together with allow-unsigned-executable-memory, disable-library-validation or disable-executable-page-protection ("Hardened Runtime relaxation entitlements disallowed on System Extensions"). Electron needs allow-jit only. Verified on macOS 15.5 (Intel) and 26 (Apple silicon) with SIP on; the development machine had SIP disabled, which masked this.

• Alexandr Stelnykovych(22 Sept 26)

  Move AppInfo into oshelpers/apptypes; build the CLI without cgo protocol/types referenced oshelpers.AppInfo, which pulled the whole platform helper package - on macOS a cgo/AppKit implementation - into every protocol client. The CLI cross-build (no cgo) failed to link, and the native CLI linked AppKit for nothing. The type now lives in a leaf package with no imports; the daemon is unchanged. The CLI is built with CGO_ENABLED=0 on both architectures.

• Alexandr Stelnykovych(22 Sept 26)

  macOS build: require -P and -E together and verify the profile files exist

• Alexandr Stelnykovych(22 Sept 26)

  macOS Split Tunnel: relay flow control, start retry, opt-in debug logging, -O2 - UDP: issue the next receive from the write-to-app completion, as TCP does. - TCP: the connect deadline is a cancellable timer, released once the connection is ready, instead of a block that held every torn-down flow for 30 s. - Addon: retry a failed session start (3 attempts, 2 s apart) and bind the stop-timeout safety net to its command, so an earlier timer cannot start a later command's options. - Extension logs at info by default; debug can be enabled by debugLogging start option. - Build the extension with -O2. - Daemon: compare the Darwin kernel major against 21 (macOS 12), not 12.

• Alexandr Stelnykovych(22 Sept 26)

  macOS Split Tunnel: bound UDP send queues, stop relaying after app close, fix peer and icon leaks - UDP: cap unsent datagrams per peer connection (64); a peer stuck in "waiting" no longer buffers every datagram the app sends, and a peer that never becomes ready is evicted by the idle watchdog. - UDP: remove a peer entry only if it still holds the same connection, so a failed peer's late callback cannot orphan its replacement; cancel failed peers explicitly. - TCP: a write error toward the app tears the flow down instead of pulling the rest of the server's data over the physical interface. - Daemon: compile the icon renderer with ARC; the bitmap was never released.

• Alexandr Stelnykovych(22 Sept 26)

  macOS Split Tunnel: detect the default-route interface on IPv6-only networks The physical-interface auto-detection read only the IPv4 routing table, so on an IPv6-only network it found nothing and fell back to interface-type detection. Scan the IPv6 table when the IPv4 one has no physical default; IPv4 behaviour is unchanged. The table scan is exposed for the tests, which feed it hand-built tables for both families.

• Alexandr Stelnykovych(22 Sept 26)

  macOS Split Tunnel: resolve symlinked apps so Safari can be excluded On recent macOS, some system apps (e.g. Safari) are only symlinks in /Applications, pointing into the system cryptex. Two places assumed a real directory: - App picker (apps_darwin.go): e.IsDir() ignores symlinks, so these apps never showed up as exclusion candidates. Use os.Stat, which follows the link, to confirm the target is a directory. - Extension (STPathMatching): a configured excluded path that is itself a symlink never matched, since the kernel reports a process's executable path already resolved. STPathsWithResolvedSymlinks adds each entry's realpath(3) alongside the literal path, resolved once when the excluded-app list changes. UI: drop the "Safari can't be excluded" limitation (no longer true) and rewrite the limitations section to describe what's still accurate - open connections keep their route until restart, inherited child processes, system-service DNS attribution, raw sockets, and the brief restart interruption.

• Alexandr Stelnykovych(22 Sept 26)

  macOS Split Tunnel: fix extension re-activation after manual removal After the extension was removed with systemextensionsctl, re-activation failed with OSSystemExtensionErrorDomain error 1 and the settings page flashed "Split Tunnel Disabled". Two causes, both ours: - A properties probe submitted just before the activation answered after it with a stale "not installed", so a second activation was submitted while the first was still validating; sysextd treated that as a same-version replacement conflict and failed both. - While the activation waited for the user's approval, every window focus submitted a probe, which the OS used to cancel the activation as superseded; that was reported as an extension error. Addon: track the pending activation request; refuse probes and further activations while it is pending; ignore probe results that arrive meanwhile; treat "superseded" as a non-error. Probes in flight are kept in a set so one that never completes cannot block later probes. Log state changes and request failures. UI: probe on Settings window focus too and on every real config change; do not start or register the proxy configuration until the extension is installed (the "add proxy configurations" prompt appeared while the extension still awaited approval); open Login Items & Extensions rather than Privacy & Security on macOS 13 and later.

• Alexandr Stelnykovych(22 Sept 26)

  macOS Split Tunnel: actionable status only, react to extension changes made in System Settings UI status: - Show a banner only when the user has to act: approval pending, extension switched off, restart needed, activation error, or the session could not start (e.g. proxy configuration not allowed, which was stuck on "starting..."). Drop the progress banners and the kill switch note. Extension state: - Report a distinct "disabled" state from the properties probe and tell the user to enable the extension in System Settings. Probe on every window focus once activation was requested and when the session dies with a config applied, so a change made in System Settings is noticed. - Re-activate the extension when the probe reports it gone after we had activated it (e.g. removed with systemextensionsctl), which brings the approval prompt back instead of silently doing nothing. Prompts: - Register the proxy configuration as soon as the extension is installed, once per enable cycle, so the system's "add proxy configurations" prompt appears while the user is enabling Split Tunnel, not on the first VPN connect.