psiphon 2.0.2__tar.gz → 2.0.3__tar.gz

{psiphon-2.0.2 → psiphon-2.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: psiphon
-Version: 2.0.2
+Version: 2.0.3
 Summary: Foreground native Psiphon packet tunnel and explicit local proxy for Linux
 Author: KpihX
 Author-email: KpihX <kapoivha@gmail.com>
@@ -132,6 +132,22 @@ Tailscale/campus DNS present. Sixteen produced verified packet-tunnel downloads;
 all sessions restored the original routes and per-link DNS domains. See
 `BENCHMARKS.md` for failures and qualifications.
 
+### 2.0.3: local container/VM bridge exception
+
+The broad nonlocal IPv4 statement above now has one explicit exception: existing
+directly connected IPv4 prefixes on Linux bridges stay on those bridges. Their
+routes are copied into the temporary VPN table, not changed in the main table,
+and removed in reverse rollback. This keeps Docker/VM local APIs reachable while
+Internet traffic still selects the TUN. It is not a blanket RFC1918, WiFi LAN or
+physical-uplink bypass. New bridges created after connection are not automatically
+watched; reconnect when adding network topology during a session.
+
+The failure was reproduced with Docker traffic selecting psiphon0. After the fix,
+a live Germany session kept the container path local and returned the xsearch
+engine inventory and real search results over both Unix IPC and TCP. iproute2
+omits the `scope` field in some filtered JSON results; the regression fixture
+uses this observed shape, not an assumed schema.
+
 Each successful mutation has an inverse. The supervisor owns the engine and
 observes a private pipe: normal exit, startup failure, SIGTERM, Ctrl-C or controller
 SIGKILL closes it, stops/reaps the engine, and rolls back in reverse order. Cleanup

{psiphon-2.0.2 → psiphon-2.0.3}/README.md

@@ -115,6 +115,22 @@ Tailscale/campus DNS present. Sixteen produced verified packet-tunnel downloads;
 all sessions restored the original routes and per-link DNS domains. See
 `BENCHMARKS.md` for failures and qualifications.
 
+### 2.0.3: local container/VM bridge exception
+
+The broad nonlocal IPv4 statement above now has one explicit exception: existing
+directly connected IPv4 prefixes on Linux bridges stay on those bridges. Their
+routes are copied into the temporary VPN table, not changed in the main table,
+and removed in reverse rollback. This keeps Docker/VM local APIs reachable while
+Internet traffic still selects the TUN. It is not a blanket RFC1918, WiFi LAN or
+physical-uplink bypass. New bridges created after connection are not automatically
+watched; reconnect when adding network topology during a session.
+
+The failure was reproduced with Docker traffic selecting psiphon0. After the fix,
+a live Germany session kept the container path local and returned the xsearch
+engine inventory and real search results over both Unix IPC and TCP. iproute2
+omits the `scope` field in some filtered JSON results; the regression fixture
+uses this observed shape, not an assumed schema.
+
 Each successful mutation has an inverse. The supervisor owns the engine and
 observes a private pipe: normal exit, startup failure, SIGTERM, Ctrl-C or controller
 SIGKILL closes it, stops/reaps the engine, and rolls back in reverse order. Cleanup

{psiphon-2.0.2 → psiphon-2.0.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "psiphon"
-version = "2.0.2"
+version = "2.0.3"
 description = "Foreground native Psiphon packet tunnel and explicit local proxy for Linux"
 readme = "README.md"
 license = "BUSL-1.1"

{psiphon-2.0.2 → psiphon-2.0.3}/src/psiphon/routing.py

@@ -1,5 +1,6 @@
 """Conservative native TUN routing, with only session-scoped owned resources."""
 
+import ipaddress
 import json
 import os
 import re
@@ -87,6 +88,37 @@ def check_user_binding(interface: str) -> None:
         ) from exc
 
 
+def connected_bridge_routes() -> list[dict]:
+    """Keep directly-connected container/VM bridges local, not RFC1918 at large.
+
+    Only existing unicast scope-link IPv4 routes on actual Linux bridges qualify.
+    Never copy a default route, gateway, physical uplink or arbitrary policy table.
+    """
+    links = json.loads(run(["ip", "-j", "-d", "link", "show"]))
+    bridges = {
+        link["ifname"]
+        for link in links
+        if link.get("linkinfo", {}).get("info_kind") == "bridge"
+    }
+    routes = json.loads(
+        run(["ip", "-j", "-4", "route", "show", "table", "main", "scope", "link"])
+    )
+    selected = []
+    for route in routes:
+        if (
+            route.get("dev") not in bridges
+            or route.get("gateway")
+            or route.get("type", "unicast") != "unicast"
+            # iproute2 omits "scope" in JSON when the scope=link filter is used.
+            or route.get("scope", "link") != "link"
+        ):
+            continue
+        network = ipaddress.ip_network(route.get("dst", "0.0.0.0/0"), strict=False)
+        if network.version == 4 and network.prefixlen:
+            selected.append({"dst": str(network), "dev": route["dev"]})
+    return selected
+
+
 def configure(owner, uplink: str, uid: int | None = None) -> None:
     tun = config.TUN_NAME
     owner.apply(
@@ -124,6 +156,21 @@ def configure(owner, uplink: str, uid: int | None = None) -> None:
             ["ip", family, "route", "add", *route, "table", config.ROUTE_TABLE],
             ["ip", family, "route", "del", *route, "table", config.ROUTE_TABLE],
         )
+        if family == "-4":
+            for local in connected_bridge_routes():
+                direct = [
+                    local["dst"],
+                    "dev",
+                    local["dev"],
+                    "scope",
+                    "link",
+                    "table",
+                    config.ROUTE_TABLE,
+                ]
+                owner.apply(
+                    ["ip", "-4", "route", "add", *direct],
+                    ["ip", "-4", "route", "del", *direct],
+                )
         # Explicitly uplink-bound IPv4 sockets bypass (required by ConsoleClient).
         # IPv6 is blocked for all nonlocal traffic for this session.
         if family == "-4":