Windows support

[bersbersbers]

This package looks great - I would like to use it on Windows 10. However, ...

C:\Users\bers>vpn-slice
WARNING: Couldn't configure platform provider: 'OSError' object is not callable
Traceback (most recent call last):
  File "c:\users\bers\appdata\local\programs\python\python38\lib\site-packages\vpn_slice\util.py", line 17, in __getattr__
    return self[k]
KeyError: 'process'

Is Windows support planned?

[dlenski]

However, ...

Error message should be clearer here. Just fixed, thanks.

Is Windows support planned?

I don't use Windows for software development myself, and very little interest in starting 😅

That said, contributions would be most welcome and I'd be glad to give advice on how to do it:

• Use Add macOS support #11 (adding macOS support) as a model for how to construct the various provider classes
• Use the the “standard” vpnc-script.js used with OpenConnect on Windows to get an idea for how to do the various routing and DNS manipulations.

[bersbersbers]

Thanks for the feedback! The diff of #11 looks worse than it is, as it does both refactor and add macOS support at the same time. I'll see if I find the time to do anything with this, although I doubt it in the short term. Whoever wants to take this, it's all yours :)

[bersbersbers]

So I did a little digging. It seems that this can be ported without too much effort, especially if one is OK with relying on WSL for ip and dig. However, two bigger road blocks that I have identified:

1. Unable to pass script taking parameters on Windows, https://gitlab.com/openconnect/openconnect/-/issues/114 (with a potential workaround)
2. os.fork() not being available on Windows, https://docs.python.org/3/library/os.html#os.fork
   

   vpn-slice/vpn_slice/__main__.py

   Lines 466 to 469 in ff460a4

   	# we continue running in a new child process, so the VPN can actually
   	# start in the background, because we need to actually send traffic to it
   	if args.fork and os.fork():
   	raise SystemExit

[dlenski]

1. Unable to pass script taking parameters on Windows, https://gitlab.com/openconnect/openconnect/-/issues/114 (with a potential workaround)

It's super ugly, but one workaround for now would be for you to pass a --script argument of vpn-slice.js" param1 param2 param3, which will "trick" OpenConnect into executing:

cscript.exe "vpn-slice.js" param1 param2 param3""

… which should do the right thing. One of the issues here is that Windows hasn't had a historically consistent and standardized way to split/parse/quote command-line arguments, which makes it a bit of a trial-and-error mess to pass the above into OpenConnect. 🤷‍♂️

2. os.fork() not being available on Windows, https://docs.python.org/3/library/os.html#os.fork

Yes, this is important. I've thought about adding a reason=post-connect script invocation to OpenConnect itself, so that vpn-slice doesn't have to fork.

This would also help with timing issues on POSIX, where sometimes creating the tunnel takes too long and vpn-slice tries to use it too soon.

[bersbersbers]

Good points!

I do have to be honest, though: I was aiming at using vpn-slice to get split tunneling up and running, since I had no idea how to interpret routes, metrics and interfaces. In researching a bunch of stuff trying to understand the Windows vpnc scripts, I have, as a side-product, solved my original problems without having to use vpn-slice at all. This means I would not even benefit myself from implementing a Windows provider for vpn-slice, and it would cost me considerable time as well (also considering that I am currently not even able to build openconnect for Windows myself.) Further assuming that issues such as the lack of fork() will not be the last OS-specific issue I would be facing, I am inclined to summarize my efforts so far so other people can pick it up, but not go ahead with the actual implementation and, most importantly, thorough testing.

[dlenski]

That seems reasonable. If you can summarize how you've set up split-tunneling on Windows, it may indeed help others to implement this more cleanly later.

[bersbersbers]

Alright, this is 1/2, summarizing what I tried in vpn-slice before finding a solution without. I did settle on using WSL to be able to reuse DigProvider.

__main__.py: Add

    elif platform.startswith("win32"):
        from .crossos import DigProvider
        from .win import (
            Win32ProcessProvider,
            WinRouteProvider,
            WinHostsFileProvider,
        )
        DigProvider.dig = "wsl.exe dig"

        return dict(
            process=Win32ProcessProvider,
            route=WinRouteProvider,
            dns=DigProvider,
            hosts=WinHostsFileProvider,
        )

So I moved the DigProvider from posix.py into a new crossos.py; it should run the same if one simple overwrites DigProvider.dig. (Obviously, this adds from .crossos import DigProvider wherever else required.)

I did the same with the HostsFileProvider, calling it CrossOsHostsFileProvider and adding an abstract method lock_hosts_file (to offer fcntl.flock on POSIX, which is not available on Windows).

Also, I noticed that the PosixProcessProvider is completely OS-independent (os.kill, os.getpid), so I moved that one, too, making it a CrossOsProcessProvider.

The main work is in win.py. The Win32ProcessProvider seems to work fine based on PowerShell, as does the WinHostsFileProvider (which is basically the CrossOsHostsFileProvider with no locking). The WinRouteProvider is incomplete - I struggled until I figured out that BSD route is not what I get in wsl.exe route, so I wanted to switch a part to ip route, but ran out of time. It's a non-working hybrid between the RouteProvider and the Iproute2Provider now. Btw, it seems that routes cannot be added from within wsl.exe (or maybe wsl.exe needs to be run elevated), so maybe route.exe is also needed.

Attached is a patch, maybe someone wants to continue what I started.
0001-First-steps-towards-windows-support.patch.txt

[bersbersbers]

2/2, how I am doing this without vpn-slice.

Basically, I installed the TAP driver from OpenVPN (the "OpenConnect GUI" installer does that, too). I renamed my ethernet connection "Ethernet", and the TAP one "OpenConnect". Also, I have set the DNS suffix "mycompany.org" on the OpenConnect interface.

Then I use an elevated batch file like this:

rem Set default route to "Ethernet" (not sure if that's required)
netsh int ipv4 add route 0.0.0.0/0 "Ethernet" store=active

rem Now call OpenConnect without any `-s` parameter (it probably still uses the default one).

rem Wait for connection to be established
:Wait
ping -n 1 -w 1 intranet | find "mycompany"
if errorlevel 1 goto Wait

rem Lower the OpenConnect interface metric and delete the default route
netsh interface ipv4 set interface "OpenConnect" metric=100 store=active
netsh int ipv4 delete route 0.0.0.0/0 "OpenConnect" store=active

rem set a route to find my company's name servers n1.company.org and n2.company.org
netsh int ipv4 add route xx.yy.zz.0/24 "OpenConnect" store=active

rem set a route for each subnet that I need to connect to at work
netsh int ipv4 add route xx.yy.0.0/16 "OpenConnect" store=active

For split DNS, I have used something like this:
https://github.com/thngkaiyuan/simple-dns-proxy/blob/master/dns_proxy.py
My version runs locally and uses ns1.mycompany.org only to resolve *.mycompany.org, otherwise, it asks 8.8.8.8 for a result. Then,

netsh int ipv4 set dns name="OpenConnect" source=static addr=127.0.0.1

This way, my network traffic is 100% split: The company nameserver sees requests only for *.mycompany.org, and the network only ever sees traffic to the configured subsets.

The part up to here, I would love to do using VPNC env variables to be less fixed on correct naming of interfaces and stuff like this. BUT:

I addition, I also configure SSH tunnels for SAMBA using additional loopback devices and additional HOSTS entries and set a proxy PAC script to route some web traffic through the companies proxy server for IP-based subscription access: in summary, as set of highly company-specific changes that would be a pain to integrate and maintain in vpn-slice - sorry!

Still, I'll be happy to help with the above integration and/or answer questions regarding my specific setup!

[Welsige]

Hi @bersbersbers , could you clarify better the DNS part, perhaps posting your DNS version script, edited to mask your data but with commentaries as to where to do changes inside it?

[bersbersbers]

@Welsige sure, find attached. It's a bit reduced from my full version and I hope I didn't introduce any mistakes. Hard to test with "IP.OF.CMP.NS" :)

split_dns_anon.py.txt

There's three places you need to do changes, lines 16/17 for the company nameserver IP and their suffix; and optionally line 107 to select a different resolver. I experimented a bit with different options:

• ExternalFirstCompanySecondResolver: for every request, try the external nameserver. Only if that does not give a valid answer, try the company nameserver.
• ExternalCompanySplitResolver: if name ends with company suffix, use the company nameserver, else use the external nameserver. My current choice.
• CompanyOnlyResolver: if name ends with company suffix, use the company nameserver, else do not resolve.

If, like me, you use this nameserver only on the VPN interface, what you chose to return has to be somewhat compatible with what the unmodified nameserver returns for the same IPs, as Windows pretty much queries different nameservers on different interfaces simultaneously.

[reicheltp]

If you have access to powershell you can use Windows build in ability to split the DNS and use it only for company domains:

Add-DnsClientNrptRule -Namespace "mycompany.org" -NameServers "xx.yy.zz.1"

[michkot]

If, like me, you use this nameserver only on the VPN interface, what you chose to return has to be somewhat compatible with what the unmodified nameserver returns for the same IPs, as Windows pretty much queries different nameservers on different interfaces simultaneously.

are you referssing to multihomed dns resolution @bersbersbers ?
https://www.ghacks.net/2017/08/14/turn-off-smart-multi-homed-name-resolution-in-windows/
https://superuser.com/questions/969171/multihomed-windows-10-dns-resolution-timeouts
etc. ? I tried switching it off today and my company's DNS server set by OpenVPN stoped being used at all (and behind-the-VPN services ceased to function shortly after)...

[bersbersbers]

are you referssing to multihomed dns resolution @bersbersbers ?
https://www.ghacks.net/2017/08/14/turn-off-smart-multi-homed-name-resolution-in-windows/
https://superuser.com/questions/969171/multihomed-windows-10-dns-resolution-timeouts

According to the links you posted, yes - this is exactly what I meant.

I tried switching it off today and my company's DNS server set by OpenVPN stoped being used at all (and behind-the-VPN services ceased to function shortly after)...

I never tried that, but assuming that your native connection has a lower metric, what you observe is what I would expect. Great to know that this is another option (as well as DnsClientNrptRule by @reicheltp).

[michkot]

I have taken upon me to hold the torch of Windows support hopes (for a while) https://github.com/michkot/vpn-slice/compare/feature-windows_support michkot@8568cf7

Here is a small bridge app to "fit" vpn-slice into to Windows cscript-fixed binary build of openconnect:
https://github.com/michkot/vpnc-script-win--vpn-slice--bridge

[bersbersbers]

If you have access to powershell you can use Windows build in ability to split the DNS and use it only for company domains:

Add-DnsClientNrptRule -Namespace "mycompany.org" -NameServers "xx.yy.zz.1"

This is great. I had to use

Add-DnsClientNrptRule -Namespace ".mycompany.org" -NameServers "xx.yy.zz.1"

though - note the extra . at the beginning of the namespace.

[bersbersbers]

If, like me, you use this nameserver only on the VPN interface, what you chose to return has to be somewhat compatible with what the unmodified nameserver returns for the same IPs, as Windows pretty much queries different nameservers on different interfaces simultaneously.

are you referssing to multihomed dns resolution @bersbersbers ?
https://www.ghacks.net/2017/08/14/turn-off-smart-multi-homed-name-resolution-in-windows/
https://superuser.com/questions/969171/multihomed-windows-10-dns-resolution-timeouts

This might have been helpful, too, but it seems the Add-DnsClientNrptRule takes care of that as well. Thanks nonetheless!

[maurerr]

alright so this is my take on this subject https://pastebin.com/80Thw5H2 - static subnets and masks lists and dns handled by additional commands as suggested by @reicheltp (thank you very much !) .Saved in the openconnect folder and using it as -s split-script-win.js

[jpfleischer]

alright so this is my take on this subject https://pastebin.com/80Thw5H2 - static subnets and masks lists and dns handled by additional commands as suggested by @reicheltp (thank you very much !) .Saved in the openconnect folder and using it as -s split-script-win.js

Hi @maurerr this works really well for one of my organizations but not the other. In both cases my public IP never changes to the company, so i know the split is working, but for only one of them i can connect to organization resources. Do you happen to have an updated version of this?

I thought about using the powershell command but i dont know what NameServers is supposed to be?

[lukas-shawford]

If it helps anyone, here is another vpnc-script based solution that consolidates the various tips above (does not require vpn-slice):

https://pastebin.com/gnEUvB4n

Explanation of changes:

Starting with the default vpnc-script.js provided by the OpenConnect GUI installation, add the following section to configure the split tunnel (I put it between the Initial setup and Utilities sections):

// --------------------------------------------------------------
// Split Tunnel Configuration
// --------------------------------------------------------------
 
// Domain of the VPN network (used for split DNS configuration)
var VPN_DOMAIN = "company.com";
 
// Number of split-include rules to add to the routing table (these will be routed via VPN)
env("CISCO_SPLIT_INC") = 2;
 
// Rule 1: 10.x.x.x
env("CISCO_SPLIT_INC_0_ADDR") = '10.0.0.0';
env("CISCO_SPLIT_INC_0_MASK") = '255.0.0.0';
env("CISCO_SPLIT_INC_0_MASKLEN") = 8;
 
// Rule 2: 172.16.x.x through 172.31.x.x
env("CISCO_SPLIT_INC_1_ADDR") = '172.16.0.0';
env("CISCO_SPLIT_INC_1_MASK") = '255.240.0.0';
env("CISCO_SPLIT_INC_1_MASKLEN") = 12;
 
// Number of split-exclude rules to add to the routing table (these will be routed via default outbound internet connection).
// Setting this to 0 ignores any routes pushed by the VPN.
env("CISCO_SPLIT_EXC") = 0;

The above configuration will route everything in 10.0.0.0/8 and 172.16.0.0/12 via the VPN, and also ignore any routes pushed by the VPN. Adjust this as needed for your corporate network.

Next, in the Utilities section, add the following helper method to run a PowerShell command (this will be used for adding / removing split DNS):

function run_pwsh(cmd)
{
    var fullCmd = "powershell.exe -Command \"" + cmd + "\" 2>&1";
    echo(DEBUG, "-> " + fullCmd);
    var oExec = ws.Exec(fullCmd);
    oExec.StdIn.Close();

    var s = oExec.StdOut.ReadAll();

    var exitCode = oExec.ExitCode;
    if (exitCode != 0)
        echo(ERROR, "\"" + cmd + "\" returned non-zero exit status: " + exitCode);
    echo((exitCode != 0 ? ERROR : TRACE), "   stdout+stderr dump: " + s);
    accumulatedExitCode += exitCode;

    return s;
}

Next, you are going to want to REMOVE this section:

    if (env("INTERNAL_IP4_DNS")) {
        var dns = env("INTERNAL_IP4_DNS").split(/ /);
        for (var i = 0; i < dns.length; i++) {
            var protocol = dns[i].indexOf(":") !== -1 ? "ipv6" : "ipv4";
            // With 'validate=yes' (the default on newer Windows versions), Windows will try to
            // connect to the DNS server, time out after ~10 seconds, and print a warning, but
            // nevertheless add the specified server. Adding 'validate=no' is thus NECESSARY.
            // We know that Windows 7 supports/requires the 'validate=no' flag (see #52). If
            // someone using an older version of Windows that errors out on the unknown flag
            // really wants us to support it, we'll need to figure out how to distinguish it.
            run("netsh interface " + protocol + " add dnsservers " + env("TUNIDX") + " " + dns[i]
               + " validate=no");
        }
        echo(INFO, "Configured " + dns.length + " DNS servers: " + dns.join(" "));
    }
    echo(INFO, "done.");

And replace it with:

// Configure split DNS
    if (env("INTERNAL_IP4_DNS")) {
        var dns = env("INTERNAL_IP4_DNS").split(/ /);
        if (dns.length > 0) {
            echo(INFO, "Adding split DNS configuration (*." + VPN_DOMAIN + " -> " + env("INTERNAL_IP4_DNS") + ")");
            run_pwsh("Add-DnsClientNrptRule -Namespace \"." + VPN_DOMAIN + "\" -NameServers " + dns.join(","));
            echo(INFO, "done.");
        }
    }

This will run a PowerShell command to route any DNS queries for *.company.com to the private name servers advertised by the VPN. Doing it this way (rather than setting the DNS servers on the interface, as it was doing before) also ensures that any other DNS queries outside the *.company.com domain will not be sent over the VPN.

Finally, you may want to clean up the split DNS configuration when disconnecting from the VPN. In case "disconnect": near the bottom, add the following:

    // Remove split DNS configuration
    echo(INFO, "Removing split DNS configuration");
    run_pwsh("Get-DnsClientNrptRule | Where { $_.Namespace -eq '." + VPN_DOMAIN + "' } | Remove-DnsClientNrptRule -Force");

This is especially important if there are any public subdomains that are supposed to be reachable outside the VPN (e.g., public.company.com), so it doesn't try to resolve those over the private name servers (which it won't be able to reach if you are disconnected from VPN).