Add mullvad-ios crate, disable sandboxing for scripts

Cargo.toml

@@ -9,13 +9,12 @@ rust-version = "1.77.0"
 resolver = "2"
 members = [
     "android/translations-converter",
-    "ios/MullvadREST/Transport/Shadowsocks/shadowsocks-proxy",
-    "ios/TunnelObfuscation/tunnel-obfuscator-proxy",
     "mullvad-api",
     "mullvad-cli",
     "mullvad-daemon",
     "mullvad-exclude",
     "mullvad-fs",
+    "mullvad-ios",
     "mullvad-jni",
     "mullvad-management-interface",
     "mullvad-nsis",
@@ -39,7 +38,7 @@ members = [
     "talpid-windows",
     "talpid-wireguard",
     "tunnel-obfuscation",
-    "wireguard-go-rs"
+    "wireguard-go-rs",
 ]
 
 # Keep all lints in sync with `test/Cargo.toml`
@@ -81,7 +80,7 @@ shadowsocks-service = { version = "1.16" }
 
 windows-sys = "0.52.0"
 
-chrono = { version = "0.4.26", default-features = false}
+chrono = { version = "0.4.26", default-features = false }
 clap = { version = "4.4.18", features = ["cargo", "derive"] }
 once_cell = "1.13"
 

ios/MullvadPostQuantum/talpid-tunnel-config-client/include/talpid_tunnel_config_client.h

@@ -7,92 +7,3 @@
  * Port used by the tunnel config service.
  */
 #define CONFIG_SERVICE_PORT 1337
-
-typedef struct PostQuantumCancelToken {
-  void *context;
-} PostQuantumCancelToken;
-
-/**
- * Called by the Swift side to signal that the quantum-secure key exchange should be cancelled.
- *
- * # Safety
- * `sender` must be pointing to a valid instance of a `PostQuantumCancelToken` created by the
- * `PacketTunnelProvider`.
- */
-void cancel_post_quantum_key_exchange(const struct PostQuantumCancelToken *sender);
-
-/**
- * Called by the Swift side to signal that the Rust `PostQuantumCancelToken` can be safely dropped
- * from memory.
- *
- * # Safety
- * `sender` must be pointing to a valid instance of a `PostQuantumCancelToken` created by the
- * `PacketTunnelProvider`.
- */
-void drop_post_quantum_key_exchange_token(const struct PostQuantumCancelToken *sender);
-
-/**
- * Called by Swift whenever data has been written to the in-tunnel TCP connection when exchanging
- * quantum-resistant pre shared keys.
- *
- * If `bytes_sent` is 0, this indicates that the connection was closed or that an error occurred.
- *
- * # Safety
- * `sender` must be pointing to a valid instance of a `write_tx` created by the `IosTcpProvider`
- * Callback to call when the TCP connection has written data.
- */
-void handle_sent(uintptr_t bytes_sent, const void *sender);
-
-/**
- * Called by Swift whenever data has been read from the in-tunnel TCP connection when exchanging
- * quantum-resistant pre shared keys.
- *
- * If `data` is null or empty, this indicates that the connection was closed or that an error
- * occurred. An empty buffer is sent to the underlying reader to signal EOF.
- *
- * # Safety
- * `sender` must be pointing to a valid instance of a `read_tx` created by the `IosTcpProvider`
- *
- * Callback to call when the TCP connection has received data.
- */
-void handle_recv(const uint8_t *data, uintptr_t data_len, const void *sender);
-
-/**
- * Entry point for exchanging post quantum keys on iOS.
- * The TCP connection must be created to go through the tunnel.
- * # Safety
- * `public_key` and `ephemeral_key` must be valid respective `PublicKey` and `PrivateKey` types.
- * They will not be valid after this function is called, and thus must be copied here.
- * `packet_tunnel` and `tcp_connection` must be valid pointers to a packet tunnel and a TCP
- * connection instances.
- * `cancel_token` should be owned by the caller of this function.
- */
-int32_t negotiate_post_quantum_key(const uint8_t *public_key,
-                                   const uint8_t *ephemeral_key,
-                                   const void *packet_tunnel,
-                                   const void *tcp_connection,
-                                   struct PostQuantumCancelToken *cancel_token,
-                                   uint64_t post_quantum_key_exchange_timeout);
-
-/**
- * Called when there is data to send on the TCP connection.
- * The TCP connection must write data on the wire, then call the `handle_sent` function.
- */
-extern void swift_nw_tcp_connection_send(const void *connection,
-                                         const void *data,
-                                         uintptr_t data_len,
-                                         const void *sender);
-
-/**
- * Called when there is data to read on the TCP connection.
- * The TCP connection must read data from the wire, then call the `handle_read` function.
- */
-extern void swift_nw_tcp_connection_read(const void *connection, const void *sender);
-
-/**
- * Called when the preshared post quantum key is ready.
- * `raw_preshared_key` might be NULL if the key negotiation failed.
- */
-extern void swift_post_quantum_key_ready(const void *raw_packet_tunnel,
-                                         const uint8_t *raw_preshared_key,
-                                         const uint8_t *raw_ephemeral_private_key);

ios/MullvadREST/Transport/Shadowsocks/ShadowsocksTransport.swift

@@ -7,6 +7,7 @@
 //
 
 import Foundation
+import MullvadRustRuntime
 import MullvadTypes
 
 public final class ShadowsocksTransport: RESTTransport {

ios/MullvadRustRuntime/MullvadRustRuntime.h

@@ -0,0 +1,10 @@
+//
+//  MullvadRustRuntime.h
+//  MullvadRustRuntime
+//
+//  Created by Marco Nikic on 2024-06-20.
+//  Copyright © 2024 Mullvad VPN AB. All rights reserved.
+//
+
+#import <Foundation/Foundation.h>
+#import "mullvad_rust_runtime.h"

ios/MullvadPostQuantum/PacketTunnelProvider+TCPConnection.swift → ios/MullvadRustRuntime/PacketTunnelProvider+TCPConnection.swift

@@ -7,9 +7,9 @@
 //
 
 import Foundation
+import MullvadRustRuntimeProxy
 import MullvadTypes
 import NetworkExtension
-import TalpidTunnelConfigClientProxy
 import WireGuardKitTypes
 
 /// Writes data to the in-tunnel TCP connection
@@ -90,15 +90,13 @@ func tcpConnectionReceive(
 ///   - rawEphemeralKey: A raw pointer to the ephemeral private key of the device
 @_cdecl("swift_post_quantum_key_ready")
 func receivePostQuantumKey(
-    rawPacketTunnel: UnsafeMutableRawPointer?,
+    rawPostQuantumKeyReceiver: UnsafeMutableRawPointer?,
     rawPresharedKey: UnsafeMutableRawPointer?,
     rawEphemeralKey: UnsafeMutableRawPointer?
 ) {
-    guard
-        let rawPacketTunnel,
-        let postQuantumKeyReceiver = Unmanaged<NEPacketTunnelProvider>.fromOpaque(rawPacketTunnel)
-        .takeUnretainedValue() as? PostQuantumKeyReceiving
-    else { return }
+    guard let rawPostQuantumKeyReceiver else { return }
+    let postQuantumKeyReceiver = Unmanaged<PostQuantumKeyReceiver>.fromOpaque(rawPostQuantumKeyReceiver)
+        .takeUnretainedValue()
 
     guard
         let rawPresharedKey,