Deliver block untunneled traffic prefs to tunnel service

Author: simonhong

browser/brave_vpn/win/brave_vpn_wireguard_service/service/brave_wireguard_manager.cc

@@ -20,6 +20,7 @@ HRESULT BraveWireguardManager::EnableVpn(const BSTR public_key,
                                          const BSTR private_key,
                                          const BSTR address,
                                          const BSTR endpoint,
+                                         BOOL block_untunneled_traffic,
                                          DWORD* last_error) {
   // if all params are empty, reconnect using last known good config.
   // browser/brave_vpn/win/brave_vpn_wireguard_service/service/wireguard_tunnel_service.cc
@@ -81,7 +82,8 @@ HRESULT BraveWireguardManager::EnableVpn(const BSTR public_key,
 
   auto config = brave_vpn::wireguard::CreateWireguardConfig(
       validated_private_key.value(), validated_public_key.value(),
-      validated_endpoint.value(), validated_address.value());
+      validated_endpoint.value(), validated_address.value(),
+      block_untunneled_traffic);
   if (!config.has_value()) {
     VLOG(1) << __func__ << " : failed to get correct credentials";
     return E_INVALIDARG;

browser/brave_vpn/win/brave_vpn_wireguard_service/service/brave_wireguard_manager.h

@@ -28,6 +28,7 @@ class BraveWireguardManager
                            BSTR private_key,
                            BSTR address,
                            BSTR endpoint,
+                           BOOL block_untunneled_traffic,
                            DWORD* last_error) override;
   IFACEMETHODIMP DisableVpn(DWORD* last_error) override;
 

browser/brave_vpn/win/brave_vpn_wireguard_service/status_tray/status_tray_runner.cc

@@ -121,7 +121,7 @@ void StatusTrayRunner::ConnectVPN() {
         // passing empty params will reconnect using last known good config.
         // TODO(https://github.com/brave/brave-browser/issues/47115): fetch
         // actual server details. See issue for more info.
-        "", "", "", "", std::nullopt,
+        "", "", "", "", false, std::nullopt,
         base::BindOnce(&StatusTrayRunner::OnConnected,
                        weak_factory_.GetWeakPtr()));
   } else {

browser/brave_vpn/win/wireguard_connection_api_impl_win.cc

@@ -14,6 +14,7 @@
 #include "base/memory/scoped_refptr.h"
 #include "brave/browser/brave_vpn/win/service_details.h"
 #include "brave/browser/brave_vpn/win/wireguard_utils_win.h"
+#include "brave/components/brave_vpn/browser/connection/brave_vpn_connection_manager.h"
 #include "brave/components/brave_vpn/common/brave_vpn_constants.h"
 #include "brave/components/brave_vpn/common/win/utils.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
@@ -65,7 +66,7 @@ void WireguardConnectionAPIImplWin::PlatformConnectImpl(
   brave_vpn::wireguard::EnableBraveVpnWireguardService(
       credentials.server_public_key, credentials.client_private_key,
       credentials.mapped_ip4_address, vpn_server_hostname,
-      std::move(smart_proxy_url),
+      manager_->ShouldBlockUntunneledTraffic(), std::move(smart_proxy_url),
       base::BindOnce(&WireguardConnectionAPIImplWin::OnWireguardServiceLaunched,
                      weak_factory_.GetWeakPtr()));
 }

browser/brave_vpn/win/wireguard_utils_win.cc

@@ -149,11 +149,11 @@ bool IsBraveVPNWireguardTunnelServiceRunning() {
          status.value() == SERVICE_START_PENDING;
 }
 
-bool EnableBraveVpnWireguardServiceImpl(
-    const std::string& server_public_key,
-    const std::string& client_private_key,
-    const std::string& mapped_ip4_address,
-    const std::string& vpn_server_hostname) {
+bool EnableBraveVpnWireguardServiceImpl(const std::string& server_public_key,
+                                        const std::string& client_private_key,
+                                        const std::string& mapped_ip4_address,
+                                        const std::string& vpn_server_hostname,
+                                        const bool block_untunneled_traffic) {
   base::win::AssertComInitialized();
   MaybeEnableSystemProxy();
 
@@ -184,10 +184,10 @@ bool EnableBraveVpnWireguardServiceImpl(
       base::UTF8ToWide(vpn_server_hostname));
 
   DWORD last_error = ERROR_SUCCESS;
-  HRESULT res = service->EnableVpn(server_public_key_data.Get(),
-                                   client_private_key_data.Get(),
-                                   mapped_ip4_address_data.Get(),
-                                   vpn_server_hostname_data.Get(), &last_error);
+  HRESULT res = service->EnableVpn(
+      server_public_key_data.Get(), client_private_key_data.Get(),
+      mapped_ip4_address_data.Get(), vpn_server_hostname_data.Get(),
+      block_untunneled_traffic, &last_error);
 
   if (!SUCCEEDED(res)) {
     VLOG(1) << "Failure calling EnableVpn. Result: "
@@ -203,6 +203,7 @@ void EnableBraveVpnWireguardService(const std::string& server_public_key,
                                     const std::string& client_private_key,
                                     const std::string& mapped_ip4_address,
                                     const std::string& vpn_server_hostname,
+                                    const bool block_untunneled_traffic,
                                     std::optional<std::string> smart_proxy_url,
                                     wireguard::BooleanCallback callback) {
   // If all params are empty this is a reconnect (using last known good config).
@@ -226,7 +227,7 @@ void EnableBraveVpnWireguardService(const std::string& server_public_key,
           FROM_HERE,
           base::BindOnce(&EnableBraveVpnWireguardServiceImpl, server_public_key,
                          client_private_key, mapped_ip4_address,
-                         vpn_server_hostname),
+                         vpn_server_hostname, block_untunneled_traffic),
           std::move(callback));
 }
 

browser/brave_vpn/win/wireguard_utils_win.h

@@ -23,6 +23,7 @@ void EnableBraveVpnWireguardService(const std::string& server_public_key,
                                     const std::string& client_private_key,
                                     const std::string& mapped_ip4_address,
                                     const std::string& vpn_server_hostname,
+                                    const bool block_untunneled_traffic,
                                     std::optional<std::string> smart_proxy_url,
                                     BooleanCallback callback);
 void DisableBraveVpnWireguardService(BooleanCallback callback);

components/brave_vpn/browser/connection/brave_vpn_connection_manager.cc

@@ -178,6 +178,16 @@ void BraveVPNConnectionManager::SetSelectedRegion(const std::string& name) {
   }
 }
 
+bool BraveVPNConnectionManager::ShouldBlockUntunneledTraffic() {
+#if BUILDFLAG(ENABLE_BRAVE_VPN_WIREGUARD)
+  return local_prefs_->GetBoolean(
+             prefs::kBraveVPNWireguardBlockUntunneledTraffic) &&
+         local_prefs_->GetBoolean(prefs::kBraveVPNWireguardEnabled);
+#else
+  NOTREACHED();
+#endif
+}
+
 std::string BraveVPNConnectionManager::GetHostname() const {
   if (connection_api_impl_) {
     return connection_api_impl_->GetHostname();

components/brave_vpn/browser/connection/brave_vpn_connection_manager.h

@@ -82,6 +82,7 @@ class BraveVPNConnectionManager {
   void CheckConnection();
 
   void SetSelectedRegion(const std::string& name);
+  bool ShouldBlockUntunneledTraffic();
 
   // Returns user friendly error string if existed.
   // Otherwise returns empty.

components/brave_vpn/common/wireguard/win/brave_wireguard_manager_idl.idl

@@ -14,6 +14,7 @@ interface IBraveVpnWireguardManager : IUnknown
                     [in] BSTR private_key,
                     [in] BSTR address,
                     [in] BSTR endpoint,
+                    [in] BOOL block_untunneled_traffic,
                     [out] DWORD* last_error);
 
   HRESULT DisableVpn([out] DWORD* last_error);

components/brave_vpn/common/wireguard/wireguard_utils.cc

@@ -60,7 +60,8 @@ std::optional<std::string> CreateWireguardConfig(
     const std::string& client_private_key,
     const std::string& server_public_key,
     const std::string& vpn_server_hostname,
-    const std::string& mapped_ipv4_address) {
+    const std::string& mapped_ipv4_address,
+    const bool block_untunneled_traffic) {
   if (client_private_key.empty() || server_public_key.empty() ||
       vpn_server_hostname.empty() || mapped_ipv4_address.empty()) {
     return std::nullopt;