wg-quick: fix dns cleaning on MacOS

[nesstord]

I found out that sometimes on MacOS calling wg-quick to shut down Wireguard doesn't return the original DNS servers that are specified in the network services.

To see why that happens, I added a file output on the line 327 in the function monitor_daemon and wrote a little script that tries to detect and log the problem.

# wireguard-tools/src/wg-quick/darwin.bash # ... monitor_daemon() { echo "[+] Backgrounding route monitor" >&2	(trap 'del_routes; del_dns; exit 0' INT TERM EXIT #exec >/dev/null 2>&1 exec >> /Users/user/wg-quick.log 2>&1 exec 19< <(exec route -n monitor) local event bpid=$BASHPID mpid=$!	[[ ${#DNS[@]} -gt 0 ]] && trap set_dns ALRM # ... }

# test_dns.bash #!/usr/bin/env bash LOG_FILE=/Users/user/wg-quick.log echo "[$(date -u)] start test" >> $LOG_FILE declare -A found_services get_response="" { read -r _ && while read -r service; do	[[ $service == "*"* ]] && service="${service:1}"	get_response="$(networksetup -getdnsservers "$service")"	[[ $get_response == *" "* ]] && get_response="Empty"	[[ -n $get_response ]] && found_services["$service"]="$get_response" echo "[$(date -u)] $service: $get_response" >> $LOG_FILE done; } < <(networksetup -listallnetworkservices) for (( i = 0; ; i++ )); do echo "[$(date -u)] loop $i" >> $LOG_FILE echo "[$(date -u)] up" >> $LOG_FILE wg-quick up "$1" > /dev/null 2>&1 sleep $(( RANDOM % 30 )) echo "[$(date -u)] down" >> $LOG_FILE wg-quick down "$1" > /dev/null 2>&1 sleep 3 # wait for graceful shutdown for service in "${!found_services[@]}"; do get_response="$(networksetup -getdnsservers "$service")" [[ $get_response == *" "* ]] && get_response="Empty" [[ $get_response != "${found_services["$service"]}" ]] || continue msg="dns error on loop $i, service $service, expected ${found_services["$service"]}, got $get_response" echo "$msg" osascript -e "display notification \"$msg\" with title \"Found\"" exit done done

I ran the script using
sudo ./test_dns.bash ~/wg0.conf

In this case, the problem occurred on the 82 try.

// /Users/user/wg-quick.log [Mon Nov 13 11:08:09 UTC 2023] start test [Mon Nov 13 11:08:09 UTC 2023] Thunderbolt Bridge: Empty [Mon Nov 13 11:08:09 UTC 2023] Wi-Fi: Empty [Mon Nov 13 11:08:09 UTC 2023] iPhone USB: Empty [Mon Nov 13 11:08:09 UTC 2023] loop 0 [Mon Nov 13 11:08:09 UTC 2023] up ... [Mon Nov 13 11:36:23 UTC 2023] loop 81 [Mon Nov 13 11:36:23 UTC 2023] up [#] networksetup -setdnsservers iPhone USB 8.8.8.8 8.8.4.4 [#] networksetup -setsearchdomains iPhone USB Empty [#] networksetup -setdnsservers Wi-Fi 8.8.8.8 8.8.4.4 [#] networksetup -setsearchdomains Wi-Fi Empty [#] networksetup -setdnsservers Thunderbolt Bridge 8.8.8.8 8.8.4.4 [#] networksetup -setsearchdomains Thunderbolt Bridge Empty [#] networksetup -setdnsservers iPhone USB 8.8.8.8 8.8.4.4 [#] networksetup -setsearchdomains iPhone USB Empty [#] networksetup -setdnsservers Wi-Fi 8.8.8.8 8.8.4.4 [#] networksetup -setsearchdomains Wi-Fi Empty [#] networksetup -setdnsservers Thunderbolt Bridge 8.8.8.8 8.8.4.4 [#] networksetup -setsearchdomains Thunderbolt Bridge Empty [Mon Nov 13 11:36:48 UTC 2023] down [#] networksetup -setdnsservers iPhone USB Empty [#] networksetup -setsearchdomains iPhone USB Empty [#] networksetup -setdnsservers Wi-Fi Empty [#] networksetup -setsearchdomains Wi-Fi Empty [#] networksetup -setdnsservers Thunderbolt Bridge Empty [#] networksetup -setsearchdomains Thunderbolt Bridge Empty [Mon Nov 13 11:36:51 UTC 2023] loop 82 [Mon Nov 13 11:36:51 UTC 2023] up [#] networksetup -setdnsservers iPhone USB 8.8.8.8 8.8.4.4 [#] networksetup -setsearchdomains iPhone USB Empty [#] networksetup -setdnsservers Wi-Fi 8.8.8.8 8.8.4.4 [#] networksetup -setsearchdomains Wi-Fi Empty [#] networksetup -setdnsservers Thunderbolt Bridge 8.8.8.8 8.8.4.4 [#] networksetup -setsearchdomains Thunderbolt Bridge Empty [Mon Nov 13 11:36:55 UTC 2023] down [#] networksetup -setdnsservers iPhone USB Empty [#] networksetup -setsearchdomains iPhone USB Empty [#] networksetup -setdnsservers Wi-Fi Empty [#] networksetup -setsearchdomains Wi-Fi Empty [#] networksetup -setdnsservers Thunderbolt Bridge Empty [#] networksetup -setsearchdomains Thunderbolt Bridge Empty [#] networksetup -setdnsservers iPhone USB 8.8.8.8 8.8.4.4 // !!! set_dns is called after del_dns !!! [#] networksetup -setsearchdomains iPhone USB Empty [#] networksetup -setdnsservers Wi-Fi 8.8.8.8 8.8.4.4 [#] networksetup -setsearchdomains Wi-Fi Empty [#] networksetup -setdnsservers Thunderbolt Bridge 8.8.8.8 8.8.4.4 [#] networksetup -setsearchdomains Thunderbolt Bridge Empty 

As you see, sometimes set_dns is called after del_dns. I decided to implement a very simple fix that doesn't change the original logic: I added a flag that will stop the execution of set_dns if the monitor_daemon subprocess has finished. You can check out the changes in the commit.

I've been using this fix for about a week, and the bug hasn't occurred since then.
It could be used as a temporary solution until the proper fix is implemented.