feat: add additional VPN routes and domains (#98)

* feat: add additional VPN routes and domains

* refactor: clarify additional VPN route semantics

Author: kfxhjz

README.md

@@ -197,11 +197,21 @@ RUST_LOG=debug ./corplink-rs config.json
   // - full:  use full-tunnel routes from server
   //          often combined with "auto_setup_routes": false in container/gateway setups
   "route_mode": "split",
+  // optional CIDRs added to the server-provided routes before filtering. unlike
+  // vpn_allowed_routes, this can introduce networks not covered by server routes.
+  // the combined routes are still subject to the allowlist and denylist below.
+  "vpn_additional_routes": ["20.205.243.160/28"],
+  // optional exact hostnames resolved on every VPN connection/reconnection.
+  // each IPv4 result is appended as a /32 route; IPv6 results are appended as
+  // /128 routes only when the server assigns an IPv6 tunnel address.
+  "vpn_additional_domains": ["github.com", "api.github.com"],
   // optional strict CIDR whitelist. each entry is intersected with the routes
-  // returned by the server, so it can only narrow the VPN routes. an empty list
-  // allows no routes; missing/null preserves the server routes. when both lists
-  // are set, vpn_disallowed_routes is subtracted after this whitelist.
-  "vpn_allowed_routes": ["192.168.2.0/24"],
+  // returned by the server plus the additional routes above. an empty list allows
+  // no routes; missing/null preserves all routes. when both lists are set,
+  // vpn_disallowed_routes is subtracted after this whitelist. the allowlist must
+  // also cover every additional route that should be retained, so leave it unset
+  // when using domain routes whose resolved addresses are not known in advance.
+  // "vpn_allowed_routes": ["192.168.2.0/24"],
   // optional: list of CIDRs to carve out of AllowedIPs (and system routes).
   // applied as CIDR subtraction: each entry is subtracted from every route
   // returned by the server, so listing a smaller range like "10.68.0.0/16"

src/client.rs

@@ -31,6 +31,88 @@ use crate::utils;
 const COOKIE_FILE_SUFFIX: &str = "cookies.json";
 const USER_AGENT: &str = "CorpLink/201000 (GooglePixel; Android 10; en)";
 
+fn merge_additional_routes(
+    mut routes: Vec<String>,
+    additional_routes: &[String],
+    has_ipv6_address: bool,
+) -> Vec<String> {
+    for route in additional_routes {
+        if !crate::utils::is_valid_cidr(route) {
+            log::warn!("ignoring invalid vpn_additional_routes CIDR: {:?}", route);
+            continue;
+        }
+        if !has_ipv6_address && route.contains(':') {
+            log::info!(
+                "ignoring additional IPv6 route {:?} because the server did not assign an IPv6 address",
+                route
+            );
+            continue;
+        }
+        if !routes.contains(route) {
+            routes.push(route.clone());
+        }
+    }
+    routes
+}
+
+async fn resolve_additional_domains(
+    domains: &[String],
+    has_ipv6_address: bool,
+) -> Vec<String> {
+    let mut routes = Vec::new();
+    for configured_domain in domains {
+        let domain = configured_domain.trim();
+        if domain.is_empty() {
+            log::warn!("ignoring empty vpn_additional_domains entry");
+            continue;
+        }
+
+        match tokio::net::lookup_host((domain, 0)).await {
+            Ok(addresses) => {
+                let mut domain_routes = Vec::new();
+                for address in addresses {
+                    let ip = address.ip();
+                    if ip.is_ipv6() && !has_ipv6_address {
+                        continue;
+                    }
+                    let route = match ip {
+                        std::net::IpAddr::V4(_) => format!("{ip}/32"),
+                        std::net::IpAddr::V6(_) => format!("{ip}/128"),
+                    };
+                    if !domain_routes.contains(&route) {
+                        domain_routes.push(route);
+                    }
+                }
+                if domain_routes.is_empty() {
+                    log::warn!(
+                        "vpn_additional_domains entry {:?} returned no usable addresses",
+                        domain
+                    );
+                } else {
+                    log::info!(
+                        "resolved additional VPN domain {:?} to {:?}",
+                        domain,
+                        domain_routes
+                    );
+                }
+                for route in domain_routes {
+                    if !routes.contains(&route) {
+                        routes.push(route);
+                    }
+                }
+            }
+            Err(err) => {
+                log::warn!(
+                    "failed to resolve vpn_additional_domains entry {:?}: {}",
+                    domain,
+                    err
+                );
+            }
+        }
+    }
+    routes
+}
+
 #[derive(Clone)]
 pub struct Client {
     conf: Config,
@@ -919,6 +1001,7 @@ impl Client {
         let address6 = (!wg_info.ipv6.is_empty())
             .then_some(format!("{}/128", wg_info.ipv6))
             .unwrap_or("".into());
+        let has_ipv6_address = !address6.is_empty();
         let mut allowed_ips = match self.conf.route_mode.clone().unwrap_or_default() {
             crate::config::RouteMode::Split => {
                 log::info!("route_mode = split");
@@ -952,9 +1035,32 @@ impl Client {
             }
         };
 
-        // Restrict server routes to the optional whitelist, then carve out the
-        // optional denylist. A configured empty whitelist intentionally yields
-        // no AllowedIPs/routes; invalid whitelist entries fail closed.
+        let mut additional_routes = self
+            .conf
+            .vpn_additional_routes
+            .clone()
+            .unwrap_or_default();
+        if let Some(domains) = self.conf.vpn_additional_domains.as_deref() {
+            additional_routes
+                .extend(resolve_additional_domains(domains, has_ipv6_address).await);
+        }
+        if !additional_routes.is_empty() {
+            let before = allowed_ips.len();
+            allowed_ips = merge_additional_routes(
+                allowed_ips,
+                &additional_routes,
+                has_ipv6_address,
+            );
+            log::info!(
+                "additional VPN routes merged: {} -> {} entries",
+                before,
+                allowed_ips.len()
+            );
+        }
+
+        // Restrict server and user-added routes to the optional whitelist, then
+        // carve out the optional denylist. A configured empty whitelist
+        // intentionally yields no AllowedIPs/routes; invalid entries fail closed.
         if let Some(allowed) = self.conf.vpn_allowed_routes.as_deref() {
             for route in allowed {
                 if !crate::utils::is_valid_cidr(route) {
@@ -1151,3 +1257,58 @@ impl Client {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{merge_additional_routes, resolve_additional_domains};
+    use crate::utils::apply_route_filters;
+
+    #[test]
+    fn additional_routes_are_validated_deduplicated_and_merged() {
+        let routes = merge_additional_routes(
+            vec!["10.0.0.0/8".to_string()],
+            &[
+                "10.0.0.0/8".to_string(),
+                "20.205.243.160/28".to_string(),
+                "invalid".to_string(),
+                "2001:db8::/32".to_string(),
+            ],
+            false,
+        );
+
+        assert_eq!(routes, vec!["10.0.0.0/8", "20.205.243.160/28"]);
+    }
+
+    #[test]
+    fn additional_ipv6_routes_are_kept_with_an_ipv6_address() {
+        let routes = merge_additional_routes(
+            Vec::new(),
+            &["2001:db8::/32".to_string()],
+            true,
+        );
+
+        assert_eq!(routes, vec!["2001:db8::/32"]);
+    }
+
+    #[test]
+    fn additional_routes_are_merged_before_route_filters() {
+        let routes = merge_additional_routes(
+            vec!["10.0.0.0/8".to_string()],
+            &["20.205.243.160/28".to_string()],
+            false,
+        );
+        let allowed = ["20.205.243.160/28".to_string()];
+
+        assert_eq!(
+            apply_route_filters(&routes, Some(&allowed), None),
+            vec!["20.205.243.160/28"]
+        );
+    }
+
+    #[tokio::test]
+    async fn additional_domains_are_resolved_to_host_routes() {
+        let routes = resolve_additional_domains(&["127.0.0.1".to_string()], false).await;
+
+        assert_eq!(routes, vec!["127.0.0.1/32"]);
+    }
+}

src/config.rs

@@ -73,8 +73,15 @@ pub struct Config {
     pub auto_setup_routes: Option<bool>,
     /// "split" (default) or "full". Selects which route list from the server to apply.
     pub route_mode: Option<RouteMode>,
-    /// Optional CIDR whitelist intersected with server routes.
-    /// Missing/null preserves server routes; an empty list allows no routes.
+    /// Optional CIDRs added to the server-provided routes before route filters.
+    /// Unlike `vpn_allowed_routes`, this expands the route set. The combined routes
+    /// are then restricted by `vpn_allowed_routes` and `vpn_disallowed_routes`.
+    pub vpn_additional_routes: Option<Vec<String>>,
+    /// Optional hostnames resolved on every connection. Resolved addresses are appended
+    /// as host routes before route filters.
+    pub vpn_additional_domains: Option<Vec<String>>,
+    /// Optional CIDR whitelist intersected with the server and additional routes.
+    /// Missing/null preserves the combined routes; an empty list allows no routes.
     pub vpn_allowed_routes: Option<Vec<String>>,
     /// Optional list of CIDR routes to exclude from AllowedIPs / system routes.
     /// Useful in full mode to punch holes for local LAN or the VPN peer IP itself,