Fixes an issue where the connection can go into and endless connectin…

…g / disconnecting loop (#1300) Task/Issue URL: https://app.asana.com/0/1203137811378537/1204911260872194/f Tech Design URL: CC: ## Description: A fresh NetP install can result in a connection getting into a weird state where it connects and disconnects in and endless loop (or just look like it's "Connecting..." forever). https://github.com/duckduckgo/macos-browser/assets/1836005/0b10eb6e-b257-4e52-a404-1d1289c3ecd6
duckduckgo · Jun 28, 2023 · e3c6bba · e3c6bba
1 parent 11f0610
commit e3c6bba
Show file tree

Hide file tree

Showing 12 changed files with 150 additions and 15 deletions.
diff --git a/.github/workflows/build_notarized.yml b/.github/workflows/build_notarized.yml
@@ -65,6 +65,8 @@ on:
         required: true
       NETP_STOP_VPN_PROVISION_PROFILE_BASE64:
         required: true
+      NETP_ENABLE_ON_DEMAND_PROVISION_PROFILE_BASE64:
+        required: true
       SSH_PRIVATE_KEY_FIND_IN_PAGE:
         required: true
       APPLE_API_KEY_BASE64:
@@ -112,6 +114,7 @@ jobs:
         NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64 }}
         NETP_START_VPN_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_START_VPN_PROVISION_PROFILE_BASE64 }}
         NETP_STOP_VPN_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_STOP_VPN_PROVISION_PROFILE_BASE64 }}
+        NETP_ENABLE_ON_DEMAND_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_ENABLE_ON_DEMAND_PROVISION_PROFILE_BASE64 }}
       run: |
         # create variables
         CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
@@ -126,6 +129,7 @@ jobs:
         NETP_NOTIFICATIONS_REVIEW_PP_PATH=$RUNNER_TEMP/netp_notifications_review_pp.provisionprofile
         NETP_START_VPN_PP_PATH=$RUNNER_TEMP/netp_start_vpn_pp.provisionprofile
         NETP_STOP_VPN_PP_PATH=$RUNNER_TEMP/netp_stop_vpn_pp.provisionprofile
+        NETP_ENABLE_ON_DEMAND_PP_PATH=$RUNNER_TEMP/netp_enable_on_demand_pp.provisionprofile
 
         # import certificate from secrets
         echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
@@ -139,6 +143,7 @@ jobs:
         echo -n "$NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64" | base64 --decode -o $NETP_NOTIFICATIONS_REVIEW_PP_PATH
         echo -n "$NETP_START_VPN_PROVISION_PROFILE_BASE64" | base64 --decode -o $NETP_START_VPN_PP_PATH
         echo -n "$NETP_STOP_VPN_PROVISION_PROFILE_BASE64" | base64 --decode -o $NETP_STOP_VPN_PP_PATH
+        echo -n "$NETP_ENABLE_ON_DEMAND_PROVISION_PROFILE_BASE64" | base64 --decode -o $NETP_ENABLE_ON_DEMAND_PP_PATH
 
         # create temporary keychain
         security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
@@ -161,6 +166,7 @@ jobs:
             $NETP_NOTIFICATIONS_REVIEW_PP_PATH \
             $NETP_START_VPN_PP_PATH \
             $NETP_STOP_VPN_PP_PATH \
+            $NETP_ENABLE_ON_DEMAND_PP_PATH \
             ~/Library/MobileDevice/Provisioning\ Profiles
 
     - name: Register SSH keys for submodules access

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -31,6 +31,7 @@ jobs:
       NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64 }}
       NETP_START_VPN_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_START_VPN_PROVISION_PROFILE_BASE64 }}
       NETP_STOP_VPN_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_STOP_VPN_PROVISION_PROFILE_BASE64 }}
+      NETP_ENABLE_ON_DEMAND_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_ENABLE_ON_DEMAND_PROVISION_PROFILE_BASE64 }}
       SSH_PRIVATE_KEY_FIND_IN_PAGE: ${{ secrets.SSH_PRIVATE_KEY_FIND_IN_PAGE }}
       APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }}
       APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}

diff --git a/Configuration/App/NetworkProtection/NetworkProtectionEnableOnDemand.xcconfig b/Configuration/App/NetworkProtection/NetworkProtectionEnableOnDemand.xcconfig
@@ -0,0 +1,23 @@
+//  Copyright © 2023 DuckDuckGo. All rights reserved.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//  http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//
+
+#include "NetworkProtectionVPNHelpersBase.xcconfig"
+
+PRODUCT_BUNDLE_IDENTIFIER=com.duckduckgo.macos.browser.network-protection.enable-on-demand
+
+PROVISIONING_PROFILE_SPECIFIER[config=Debug][sdk=macosx*] =
+PROVISIONING_PROFILE_SPECIFIER[config=CI][sdk=macosx*] =
+PROVISIONING_PROFILE_SPECIFIER[config=Release][sdk=macosx*] = MacOS Browser NetP - Enable On-Demand
+PROVISIONING_PROFILE_SPECIFIER[config=Review][sdk=macosx*] = MacOS Browser NetP - Enable On-Demand
diff --git a/Configuration/App/NetworkProtection/NetworkProtectionStartVPN.xcconfig b/Configuration/App/NetworkProtection/NetworkProtectionStartVPN.xcconfig
@@ -13,7 +13,7 @@
 //  limitations under the License.
 //
 
-#include "NetworkProtectionStartStopVPNBase.xcconfig"
+#include "NetworkProtectionVPNHelpersBase.xcconfig"
 
 PRODUCT_BUNDLE_IDENTIFIER=com.duckduckgo.macos.browser.network-protection.start-vpn
 

diff --git a/Configuration/App/NetworkProtection/NetworkProtectionStopVPN.xcconfig b/Configuration/App/NetworkProtection/NetworkProtectionStopVPN.xcconfig
@@ -13,7 +13,7 @@
 //  limitations under the License.
 //
 
-#include "NetworkProtectionStartStopVPNBase.xcconfig"
+#include "NetworkProtectionVPNHelpersBase.xcconfig"
 
 PRODUCT_BUNDLE_IDENTIFIER=com.duckduckgo.macos.browser.network-protection.stop-vpn
 

diff --git a/...etworkProtectionStartStopVPNBase.xcconfig → .../NetworkProtectionVPNHelpersBase.xcconfig b/...etworkProtectionStartStopVPNBase.xcconfig → .../NetworkProtectionVPNHelpersBase.xcconfig
diff --git a/DuckDuckGo.xcodeproj/project.pbxproj b/DuckDuckGo.xcodeproj/project.pbxproj
@@ -1331,6 +1331,8 @@
 		7B1E819F27C8874900FF0E60 /* ContentOverlay.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 7B1E819C27C8874900FF0E60 /* ContentOverlay.storyboard */; };
 		7B1E81A027C8874900FF0E60 /* ContentOverlayViewController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7B1E819D27C8874900FF0E60 /* ContentOverlayViewController.swift */; };
 		7B4CE8E726F02135009134B1 /* TabBarTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7B4CE8E626F02134009134B1 /* TabBarTests.swift */; };
+		7B736E582A4A22B700F9922A /* Main.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4B5F14C52A145D6A0060320F /* Main.swift */; };
+		7B736E6A2A4A22FC00F9922A /* enableOnDemand.app in Embed NetP Controller Apps */ = {isa = PBXBuildFile; fileRef = 7B736E5F2A4A22B700F9922A /* enableOnDemand.app */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		7B838C382A1DD8DD00E05A13 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 4B2D06522A11D19B00DE1F49 /* Assets.xcassets */; };
 		7BA4727D26F01BC400EAA165 /* CoreDataTestUtilities.swift in Sources */ = {isa = PBXBuildFile; fileRef = 4B9292C42667104B00AD2C21 /* CoreDataTestUtilities.swift */; };
 		7BB108592A43375D000AB95F /* PFMoveApplication.m in Sources */ = {isa = PBXBuildFile; fileRef = 7BB108582A43375D000AB95F /* PFMoveApplication.m */; settings = {COMPILER_FLAGS = "-fno-objc-arc"; }; };
@@ -2054,6 +2056,7 @@
 			dstPath = "";
 			dstSubfolderSpec = 7;
 			files = (
+				7B736E6A2A4A22FC00F9922A /* enableOnDemand.app in Embed NetP Controller Apps */,
 				4B5F14F52A1482530060320F /* stopVPN.app in Embed NetP Controller Apps */,
 				4B5F14F42A14824F0060320F /* startVPN.app in Embed NetP Controller Apps */,
 			);
@@ -2272,7 +2275,7 @@
 		4B17E2D3287380390003BD39 /* PersistentAppInterfaceSettings.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PersistentAppInterfaceSettings.swift; sourceTree = "<group>"; };
 		4B18E3232A1D32B1005D0AAA /* NetworkProtectionStartVPN.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; name = NetworkProtectionStartVPN.xcconfig; path = Configuration/App/NetworkProtection/NetworkProtectionStartVPN.xcconfig; sourceTree = SOURCE_ROOT; };
 		4B18E3252A1D3581005D0AAA /* NetworkProtectionStopVPN.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; name = NetworkProtectionStopVPN.xcconfig; path = Configuration/App/NetworkProtection/NetworkProtectionStopVPN.xcconfig; sourceTree = SOURCE_ROOT; };
-		4B18E3272A1D3896005D0AAA /* NetworkProtectionStartStopVPNBase.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = NetworkProtectionStartStopVPNBase.xcconfig; sourceTree = "<group>"; };
+		4B18E3272A1D3896005D0AAA /* NetworkProtectionVPNHelpersBase.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = NetworkProtectionVPNHelpersBase.xcconfig; sourceTree = "<group>"; };
 		4B1AD89D25FC27E200261379 /* Integration Tests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = "Integration Tests.xctest"; sourceTree = BUILT_PRODUCTS_DIR; };
 		4B1AD8A125FC27E200261379 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		4B1AD91625FC46FB00261379 /* CoreDataEncryptionTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = CoreDataEncryptionTests.swift; sourceTree = "<group>"; };
@@ -2535,6 +2538,8 @@
 		7B4CE8E626F02134009134B1 /* TabBarTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = TabBarTests.swift; sourceTree = "<group>"; };
 		7B5291882A1697680022E406 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		7B5291892A169BC90022E406 /* NetworkProtectionDeveloperID.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = NetworkProtectionDeveloperID.xcconfig; sourceTree = "<group>"; };
+		7B736E5F2A4A22B700F9922A /* enableOnDemand.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = enableOnDemand.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		7B9459632A4A5BAF0012535A /* NetworkProtectionEnableOnDemand.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = NetworkProtectionEnableOnDemand.xcconfig; sourceTree = "<group>"; };
 		7BB108572A43375D000AB95F /* PFMoveApplication.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PFMoveApplication.h; sourceTree = "<group>"; };
 		7BB108582A43375D000AB95F /* PFMoveApplication.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = PFMoveApplication.m; sourceTree = "<group>"; };
 		85012B0129133F9F003D0DCC /* NavigationBarPopovers.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NavigationBarPopovers.swift; sourceTree = "<group>"; };
@@ -3214,6 +3219,13 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		7B736E592A4A22B700F9922A /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		AA585D7B248FD31100E9A3E2 /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
@@ -3759,7 +3771,8 @@
 				4B2D064B2A11D04000DE1F49 /* DuckDuckGoAgent.xcconfig */,
 				4B2D064D2A11D04000DE1F49 /* DuckDuckGoAgentAppStore.xcconfig */,
 				4B4BEC182A11B3EA001D9AC5 /* DuckDuckGoNotifications.xcconfig */,
-				4B18E3272A1D3896005D0AAA /* NetworkProtectionStartStopVPNBase.xcconfig */,
+				7B9459632A4A5BAF0012535A /* NetworkProtectionEnableOnDemand.xcconfig */,
+				4B18E3272A1D3896005D0AAA /* NetworkProtectionVPNHelpersBase.xcconfig */,
 				4B18E3232A1D32B1005D0AAA /* NetworkProtectionStartVPN.xcconfig */,
 				4B18E3252A1D3581005D0AAA /* NetworkProtectionStopVPN.xcconfig */,
 			);
@@ -4928,6 +4941,7 @@
 				4B2D06692A13318400DE1F49 /* DuckDuckGo Agent App Store.app */,
 				4B5F14CB2A14702C0060320F /* startVPN.app */,
 				4B5F14E12A1476BD0060320F /* stopVPN.app */,
+				7B736E5F2A4A22B700F9922A /* enableOnDemand.app */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -6674,6 +6688,22 @@
 			productReference = 7B4CE8DA26F02108009134B1 /* UI Tests.xctest */;
 			productType = "com.apple.product-type.bundle.ui-testing";
 		};
+		7B736E562A4A22B700F9922A /* enableOnDemand */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 7B736E5A2A4A22B700F9922A /* Build configuration list for PBXNativeTarget "enableOnDemand" */;
+			buildPhases = (
+				7B736E572A4A22B700F9922A /* Sources */,
+				7B736E592A4A22B700F9922A /* Frameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = enableOnDemand;
+			productName = stopVPN;
+			productReference = 7B736E5F2A4A22B700F9922A /* enableOnDemand.app */;
+			productType = "com.apple.product-type.application";
+		};
 		AA585D7D248FD31100E9A3E2 /* DuckDuckGo Privacy Browser */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = AA585DA4248FD31500E9A3E2 /* Build configuration list for PBXNativeTarget "DuckDuckGo Privacy Browser" */;
@@ -6858,6 +6888,7 @@
 				4B2D06682A13318400DE1F49 /* DuckDuckGoAgentAppStore */,
 				4B5F14CA2A14702C0060320F /* startVPN */,
 				4B5F14E02A1476BC0060320F /* stopVPN */,
+				7B736E562A4A22B700F9922A /* enableOnDemand */,
 			);
 		};
 /* End PBXProject section */
@@ -7224,7 +7255,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "echo \"Replace and Sign\" # for easier build log search\n\n# startVPN\n\npushd \"${CONFIGURATION_BUILD_DIR}/${WRAPPER_NAME}/Contents/Resources/startVPN.app/Contents/MacOS\"\nrm ./startVPN\nln -s \"../../../../MacOS/${PRODUCT_NAME}\" ./startVPN\npopd\n\n# stopVPN\n\npushd \"${CONFIGURATION_BUILD_DIR}/${WRAPPER_NAME}/Contents/Resources/stopVPN.app/Contents/MacOS\"\nrm ./stopVPN\nln -s \"../../../../MacOS/${PRODUCT_NAME}\" ./stopVPN\ncd ../../.. \npopd\n";
+			shellScript = "echo \"Replace and Sign\" # for easier build log search\n\n# startVPN\n\npushd \"${CONFIGURATION_BUILD_DIR}/${WRAPPER_NAME}/Contents/Resources/startVPN.app/Contents/MacOS\"\nrm ./startVPN\nln -s \"../../../../MacOS/${PRODUCT_NAME}\" ./startVPN\npopd\n\n# stopVPN\n\npushd \"${CONFIGURATION_BUILD_DIR}/${WRAPPER_NAME}/Contents/Resources/stopVPN.app/Contents/MacOS\"\nrm ./stopVPN\nln -s \"../../../../MacOS/${PRODUCT_NAME}\" ./stopVPN\ncd ../../.. \npopd\n\n# enableOnDemand\n\npushd \"${CONFIGURATION_BUILD_DIR}/${WRAPPER_NAME}/Contents/Resources/enableOnDemand.app/Contents/MacOS\"\nrm ./enableOnDemand\nln -s \"../../../../MacOS/${PRODUCT_NAME}\" ./enableOnDemand\ncd ../../.. \npopd\n";
 		};
 		7B6469992A165AE00095095A /* Embed System Network Extension */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -8336,6 +8367,14 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		7B736E572A4A22B700F9922A /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				7B736E582A4A22B700F9922A /* Main.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		AA585D7A248FD31100E9A3E2 /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -9624,6 +9663,34 @@
 			};
 			name = Release;
 		};
+		7B736E5B2A4A22B700F9922A /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 7B9459632A4A5BAF0012535A /* NetworkProtectionEnableOnDemand.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		7B736E5C2A4A22B700F9922A /* CI */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 7B9459632A4A5BAF0012535A /* NetworkProtectionEnableOnDemand.xcconfig */;
+			buildSettings = {
+			};
+			name = CI;
+		};
+		7B736E5D2A4A22B700F9922A /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 7B9459632A4A5BAF0012535A /* NetworkProtectionEnableOnDemand.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		7B736E5E2A4A22B700F9922A /* Review */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 7B9459632A4A5BAF0012535A /* NetworkProtectionEnableOnDemand.xcconfig */;
+			buildSettings = {
+			};
+			name = Review;
+		};
 		AA585DA2248FD31500E9A3E2 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = 37717E66296B5A20002FAEDF /* Global.xcconfig */;
@@ -9864,6 +9931,17 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
+		7B736E5A2A4A22B700F9922A /* Build configuration list for PBXNativeTarget "enableOnDemand" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				7B736E5B2A4A22B700F9922A /* Debug */,
+				7B736E5C2A4A22B700F9922A /* CI */,
+				7B736E5D2A4A22B700F9922A /* Release */,
+				7B736E5E2A4A22B700F9922A /* Review */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
 		AA585D79248FD31100E9A3E2 /* Build configuration list for PBXProject "DuckDuckGo" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (

diff --git a/DuckDuckGo/Main/Main.swift b/DuckDuckGo/Main/Main.swift
@@ -61,6 +61,19 @@ final class AppMain {
                 exit(0)
             }
 
+            dispatchMain()
+        case "enableOnDemand":
+            swizzleMainBundle()
+
+            Task {
+                do {
+                    try await NetworkProtectionTunnelController().enableOnDemand()
+                    exit(0)
+                } catch {
+                    fatalError("Could not enable on demand due to error: \(String(describing: error))")
+                }
+            }
+
             dispatchMain()
         default:
             break

diff --git a/...uckGo/NetworkProtection/AppTargets/BothAppTargets/NetworkProtectionTunnelController.swift b/...uckGo/NetworkProtection/AppTargets/BothAppTargets/NetworkProtectionTunnelController.swift
@@ -162,7 +162,6 @@ final class NetworkProtectionTunnelController: NetworkProtection.TunnelControlle
         }()
 
         // reconnect on reboot
-        tunnelManager.isOnDemandEnabled = true
         tunnelManager.onDemandRules = [NEOnDemandRuleConnect(interfaceType: .any)]
     }
 
@@ -374,6 +373,15 @@ final class NetworkProtectionTunnelController: NetworkProtection.TunnelControlle
         }
     }
 
+    // MARK: - On Demand
+
+    func enableOnDemand() async throws {
+        let manager = try await loadOrMakeTunnelManager()
+
+        manager.isOnDemandEnabled = true
+        try await manager.saveToPreferences()
+    }
+
     // MARK: - Debug commands for the extension
 
     static func resetAllState() async throws {

diff --git a/...workProtection/NetworkExtensionTargets/NetworkExtensionTargets/PacketTunnelProvider.swift b/...workProtection/NetworkExtensionTargets/NetworkExtensionTargets/PacketTunnelProvider.swift
@@ -454,16 +454,18 @@ final class PacketTunnelProvider: NEPacketTunnelProvider {
                 }
             }
 
-            completionHandler(error)
-        }
+            if !isOnDemand {
+                Task {
+                    // This completion handler signals a coorect connection.  We want to signal this before turning
+                    // on-demand ON so that it won't interfere with the current connection.
+                    completionHandler(error)
 
-        if isActivatedFromSystemSettings {
-            // ask the Main App to reconfigure & restart with on-demand rule “on” - when connection triggered from System Settings
-            Task {
-                await AppLauncher(appBundleURL: .mainAppBundleURL).launchApp(withCommand: .startVPN)
-                internalCompletionHandler(NEVPNError(.configurationStale))
+                    await AppLauncher(appBundleURL: .mainAppBundleURL).launchApp(withCommand: .enableOnDemand)
+                    return
+                }
             }
-            return
+
+            completionHandler(error)
         }
 
         tunnelHealth.isHavingConnectivityIssues = false

diff --git a/LocalPackages/BuildToolPlugins/Plugins/InputFilesChecker/InputFilesChecker.swift b/LocalPackages/BuildToolPlugins/Plugins/InputFilesChecker/InputFilesChecker.swift
@@ -44,6 +44,7 @@ let extraInputFiles: [TargetName: Set<InputFile>] = [
         .init("DuckDuckGo Notifications.app", .unknown),
         .init("startVPN.app", .unknown),
         .init("stopVPN.app", .unknown),
+        .init("enableOnDemand.app", .unknown),
         .init("PFMoveApplication.m", .source)
     ],
 

diff --git a/LocalPackages/NetworkProtection/Sources/NetworkProtection/Controllers/AppLauncher.swift b/LocalPackages/NetworkProtection/Sources/NetworkProtection/Controllers/AppLauncher.swift
@@ -30,6 +30,7 @@ public final class AppLauncher {
         case showStatus
         case startVPN
         case stopVPN
+        case enableOnDemand
 
         var commandURL: String? {
             switch self {
@@ -50,6 +51,8 @@ public final class AppLauncher {
                 return "./Contents/Resources/startVPN.app"
             case .stopVPN:
                 return "./Contents/Resources/stopVPN.app"
+            case .enableOnDemand:
+                return "./Contents/Resources/enableOnDemand.app"
             default:
                 return nil
             }
@@ -103,7 +106,7 @@ public final class AppLauncher {
                 try await NSWorkspace.shared.openApplication(at: launchURL, configuration: configuration)
             }
         } catch {
-            os_log("🔵 Open Application failed: %{public}@", type: .error, error.localizedDescription)
+            os_log("🔵 Open Application failed: %{public}@", log: .networkProtection, type: .error, error.localizedDescription)
         }
     }