Kit: Adapter: ignore error when updating tunnel settings in offline

Since around iOS 15.1, calling `setNetworkSettings()` when in
airplane mode, throws an unknown error:

Error Domain=NEAgentErrorDomain Code=1

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

Sources/WireGuardApp/Tunnel/ActivateOnDemandOption.swift

@@ -42,7 +42,7 @@ extension ActivateOnDemandOption {
             }
         }
         tunnelProviderManager.onDemandRules = rules
-        tunnelProviderManager.isOnDemandEnabled = false
+        tunnelProviderManager.isOnDemandEnabled = (rules != nil) && tunnelProviderManager.isOnDemandEnabled
     }
 
     init(from tunnelProviderManager: NETunnelProviderManager) {

Sources/WireGuardApp/Tunnel/TunnelsManager.swift

@@ -206,7 +206,10 @@ class TunnelsManager {
         }
     }
 
-    func modify(tunnel: TunnelContainer, tunnelConfiguration: TunnelConfiguration, onDemandOption: ActivateOnDemandOption, completionHandler: @escaping (TunnelsManagerError?) -> Void) {
+    func modify(tunnel: TunnelContainer, tunnelConfiguration: TunnelConfiguration,
+                onDemandOption: ActivateOnDemandOption,
+                shouldEnsureOnDemandEnabled: Bool = false,
+                completionHandler: @escaping (TunnelsManagerError?) -> Void) {
         let tunnelName = tunnelConfiguration.name ?? ""
         if tunnelName.isEmpty {
             completionHandler(TunnelsManagerError.tunnelNameEmpty)
@@ -214,6 +217,20 @@ class TunnelsManager {
         }
 
         let tunnelProviderManager = tunnel.tunnelProvider
+
+        let isIntroducingOnDemandRules = (tunnelProviderManager.onDemandRules ?? []).isEmpty && onDemandOption != .off
+        if isIntroducingOnDemandRules && tunnel.status != .inactive && tunnel.status != .deactivating {
+            tunnel.onDeactivated = { [weak self] in
+                self?.modify(tunnel: tunnel, tunnelConfiguration: tunnelConfiguration,
+                             onDemandOption: onDemandOption, shouldEnsureOnDemandEnabled: true,
+                             completionHandler: completionHandler)
+            }
+            self.startDeactivation(of: tunnel)
+            return
+        } else {
+            tunnel.onDeactivated = nil
+        }
+
         let oldName = tunnelProviderManager.localizedDescription ?? ""
         let isNameChanged = tunnelName != oldName
         if isNameChanged {
@@ -231,8 +248,11 @@ class TunnelsManager {
         }
         tunnelProviderManager.isEnabled = true
 
-        let isActivatingOnDemand = !tunnelProviderManager.isOnDemandEnabled && onDemandOption != .off
+        let isActivatingOnDemand = !tunnelProviderManager.isOnDemandEnabled && shouldEnsureOnDemandEnabled
         onDemandOption.apply(on: tunnelProviderManager)
+        if shouldEnsureOnDemandEnabled {
+            tunnelProviderManager.isOnDemandEnabled = true
+        }
 
         tunnelProviderManager.saveToPreferences { [weak self] error in
             if let error = error {
@@ -499,6 +519,11 @@ class TunnelsManager {
                 }
             }
 
+            if session.status == .disconnected {
+                tunnel.onDeactivated?()
+                tunnel.onDeactivated = nil
+            }
+
             if tunnel.status == .restarting && session.status == .disconnected {
                 tunnel.startActivation(activationDelegate: self.activationDelegate)
                 return
@@ -569,6 +594,7 @@ class TunnelContainer: NSObject {
     var activationAttemptId: String?
     var activationTimer: Timer?
     var deactivationTimer: Timer?
+    var onDeactivated: (() -> Void)?
 
     fileprivate var tunnelProvider: NETunnelProviderManager {
         didSet {

Sources/WireGuardKit/WireGuardAdapter.swift

@@ -253,12 +253,27 @@ public class WireGuardAdapter {
                 self.packetTunnelProvider?.reasserting = false
             }
 
+            let settingsGenerator: PacketTunnelSettingsGenerator
             do {
-                let settingsGenerator = try self.makeSettingsGenerator(with: tunnelConfiguration)
+                settingsGenerator = try self.makeSettingsGenerator(with: tunnelConfiguration)
-                try self.setNetworkSettings(settingsGenerator.generateNetworkSettings())
+            } catch let error as WireGuardAdapterError {
+                completionHandler(error)
+                return
+            } catch {
+                fatalError()
+            }
 
             switch self.state {
             case .started(let handle, _):
+                do {
+                    try self.setNetworkSettings(settingsGenerator.generateNetworkSettings())
+                } catch let error as WireGuardAdapterError {
+                    completionHandler(error)
+                    return
+                } catch {
+                    fatalError()
+                }
+
                 let (wgConfig, resolutionResults) = settingsGenerator.uapiConfiguration()
                 self.logEndpointResolutionResults(resolutionResults)
 
@@ -270,6 +285,19 @@ public class WireGuardAdapter {
                 self.state = .started(handle, settingsGenerator)
 
             case .temporaryShutdown:
+                // On iOS 15.1 or newer, updating network settings may fail when in airplane mode.
+                // Network path monitor will retry updating settings later when connectivity is
+                // back online.
+                do {
+                    try self.setNetworkSettings(settingsGenerator.generateNetworkSettings())
+                } catch let error as WireGuardAdapterError {
+                    if case .setNetworkSettings(let systemError) = error {
+                        self.logHandler(.verbose, "Failed to set network settings while offline. Will retry when connectivity is back online. Error: \(systemError.localizedDescription)")
+                    }
+                } catch {
+                    fatalError()
+                }
+
                 self.state = .temporaryShutdown(settingsGenerator)
 
             case .stopped:
@@ -277,11 +305,6 @@ public class WireGuardAdapter {
             }
 
             completionHandler(nil)
-            } catch let error as WireGuardAdapterError {
-                completionHandler(error)
-            } catch {
-                fatalError()
-            }
         }
     }