Migrate profiles routing policies

- Providers: enforce all (IPv4 + IPv6)
- Hosts: re-read .ovpn on app update, fall back to all (safer)

Reload hosts in order to re-interpret "redirect-gateway".

Passepartout/Sources/Model/ConnectionService.swift

@@ -265,12 +265,12 @@ public class ConnectionService: Codable {
                 case .provider:
                     let providerProfile = try decoder.decode(ProviderConnectionProfile.self, from: data)
                     
-                    // fix renamed presets, fall back to default
+                    // XXX: fix renamed presets, fall back to default
                     if providerProfile.preset == nil {
                         providerProfile.presetId = providerProfile.infrastructure.defaults.preset
                     }
                     
-                    // fix renamed pool, fall back to default
+                    // XXX: fix renamed pool, fall back to default
                     if providerProfile.pool == nil, let fallbackPool = providerProfile.infrastructure.defaultPool() {
                         providerProfile.poolId = fallbackPool.id
                     }
@@ -280,7 +280,7 @@ public class ConnectionService: Codable {
                 case .host:
                     let hostProfile = try decoder.decode(HostConnectionProfile.self, from: data)
 
-                    // migrate old endpointProtocols
+                    // XXX: migrate old endpointProtocols
                     if hostProfile.parameters.sessionConfiguration.endpointProtocols == nil {
                         var sessionBuilder = hostProfile.parameters.sessionConfiguration.builder()
                         sessionBuilder.endpointProtocols = hostProfile.parameters.endpointProtocols
@@ -289,6 +289,8 @@ public class ConnectionService: Codable {
                         hostProfile.parameters = parametersBuilder.build()
                     }
                     
+                    // XXX: re-read routing policies for 
+
                     profile = hostProfile
                 }
                 cache[key] = profile
@@ -329,6 +331,37 @@ public class ConnectionService: Codable {
         return url.deletingPathExtension().lastPathComponent
     }
     
+    func reloadHostProfilesFromConfigurationFiles() -> Bool {
+        var anyReloaded = false
+        for entry in cache {
+            guard entry.value.context == .host else {
+                continue
+            }
+            guard let host = profile(withKey: entry.key) as? HostConnectionProfile else {
+                log.warning("Host context but not a HostConnectionProfile?")
+                continue
+            }
+            guard let url = configurationURL(for: entry.key) else {
+                continue
+            }
+
+            // can fail due to passphrase (migration is non-interactive)
+            if let result = try? ConfigurationParser.parsed(fromURL: url) {
+                host.parameters = TunnelKitProvider.ConfigurationBuilder(sessionConfiguration: result.configuration).build()
+            } else {
+
+                // fall back to the safer option
+                var builder = host.parameters.builder()
+                builder.sessionConfiguration.routingPolicies = [.IPv4, .IPv6]
+                host.parameters = builder.build()
+            }
+            cache[entry.key] = host
+
+            anyReloaded = true
+        }
+        return anyReloaded
+    }
+    
     // MARK: Profiles
 
     public func hasProfiles() -> Bool {

Passepartout/Sources/Model/TransientStore.swift

@@ -34,6 +34,10 @@ public class TransientStore {
         static let didHandleSubreddit = "DidHandleSubreddit"
         
         static let masksPrivateData = "MasksPrivateData"
+
+        // migrations
+        
+        static let didMigrateHostsRoutingPolicies = "DidMigrateHostsRoutingPolicies"
     }
     
     public static let shared = TransientStore()
@@ -62,6 +66,15 @@ public class TransientStore {
         }
     }
     
+    public static var didMigrateHostsRoutingPolicies: Bool {
+        get {
+            return UserDefaults.standard.bool(forKey: Keys.didMigrateHostsRoutingPolicies)
+        }
+        set {
+            UserDefaults.standard.set(newValue, forKey: Keys.didMigrateHostsRoutingPolicies)
+        }
+    }
+    
     public static var baseVPNConfiguration: TunnelKitProvider.ConfigurationBuilder {
         let sessionBuilder = SessionProxy.ConfigurationBuilder()
         var builder = TunnelKitProvider.ConfigurationBuilder(sessionConfiguration: sessionBuilder.build())
@@ -95,6 +108,14 @@ public class TransientStore {
             service = try JSONDecoder().decode(ConnectionService.self, from: data)
             service.baseConfiguration = cfg
             service.loadProfiles()
+
+            // do migrations
+            if !TransientStore.didMigrateHostsRoutingPolicies {
+                if service.reloadHostProfilesFromConfigurationFiles() {
+                    service.saveProfiles()
+                }
+                TransientStore.didMigrateHostsRoutingPolicies = true
+            }
         } catch let e {
             log.error("Could not decode service: \(e)")
             service = ConnectionService(

Passepartout/Sources/Services/InfrastructurePreset.swift

@@ -162,6 +162,9 @@ public struct InfrastructurePreset: Codable {
         sessionBuilder.randomizeEndpoint = try cfgContainer.decodeIfPresent(Bool.self, forKey: .randomizeEndpoint) ?? false
         sessionBuilder.usesPIAPatches = try cfgContainer.decodeIfPresent(Bool.self, forKey: .usesPIAPatches) ?? false
 
+        // XXX: redirect everything through the VPN for providers
+        sessionBuilder.routingPolicies = [.IPv4, .IPv6]
+        
         let builder = TunnelKitProvider.ConfigurationBuilder(sessionConfiguration: sessionBuilder.build())
         configuration = builder.build()
     }