diff options
author | Jason A. Donenfeld <Jason@zx2c4.com> | 2020-11-23 20:25:34 +0100 |
---|---|---|
committer | Jason A. Donenfeld <Jason@zx2c4.com> | 2020-11-23 20:31:23 +0100 |
commit | fc1c72658f6f264e8983cb09ceee258309b78461 (patch) | |
tree | d4070da577f10afda50a7931d91c75b13eab5e8f /tunnel/firewall/blocker.go | |
parent | mod: bump (diff) | |
download | wireguard-windows-fc1c72658f6f264e8983cb09ceee258309b78461.tar.xz wireguard-windows-fc1c72658f6f264e8983cb09ceee258309b78461.zip |
firewall: add allow rule for tunnel service process even when no blocking is required
This is essential for allowing incoming connections.
Reported-by: /u/Julien_Madagascar on Reddit
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Diffstat (limited to '')
-rw-r--r-- | tunnel/firewall/blocker.go | 72 |
1 files changed, 37 insertions, 35 deletions
diff --git a/tunnel/firewall/blocker.go b/tunnel/firewall/blocker.go index eb3c149d..b32a90e1 100644 --- a/tunnel/firewall/blocker.go +++ b/tunnel/firewall/blocker.go @@ -101,7 +101,7 @@ func registerBaseObjects(session uintptr) (*baseObjects, error) { return bo, nil } -func EnableFirewall(luid uint64, restrictToDNSServers []net.IP) error { +func EnableFirewall(luid uint64, doNotRestrict bool, restrictToDNSServers []net.IP) error { if wfpSession != 0 { return errors.New("The firewall has already been enabled") } @@ -122,49 +122,51 @@ func EnableFirewall(luid uint64, restrictToDNSServers []net.IP) error { return wrapErr(err) } - if len(restrictToDNSServers) > 0 { - err = blockDNS(restrictToDNSServers, session, baseObjects, 15, 14) + if !doNotRestrict { + if len(restrictToDNSServers) > 0 { + err = blockDNS(restrictToDNSServers, session, baseObjects, 15, 14) + if err != nil { + return wrapErr(err) + } + } + + err = permitLoopback(session, baseObjects, 13) if err != nil { return wrapErr(err) } - } - err = permitLoopback(session, baseObjects, 13) - if err != nil { - return wrapErr(err) - } - - err = permitTunInterface(session, baseObjects, 12, luid) - if err != nil { - return wrapErr(err) - } + err = permitTunInterface(session, baseObjects, 12, luid) + if err != nil { + return wrapErr(err) + } - err = permitDHCPIPv4(session, baseObjects, 12) - if err != nil { - return wrapErr(err) - } + err = permitDHCPIPv4(session, baseObjects, 12) + if err != nil { + return wrapErr(err) + } - err = permitDHCPIPv6(session, baseObjects, 12) - if err != nil { - return wrapErr(err) - } + err = permitDHCPIPv6(session, baseObjects, 12) + if err != nil { + return wrapErr(err) + } - err = permitNdp(session, baseObjects, 12) - if err != nil { - return wrapErr(err) - } + err = permitNdp(session, baseObjects, 12) + if err != nil { + return wrapErr(err) + } - /* TODO: actually evaluate if this does anything and if we need this. It's layer 2; our other rules are layer 3. - * In other words, if somebody complains, try enabling it. For now, keep it off. - err = permitHyperV(session, baseObjects, 12) - if err != nil { - return wrapErr(err) - } - */ + /* TODO: actually evaluate if this does anything and if we need this. It's layer 2; our other rules are layer 3. + * In other words, if somebody complains, try enabling it. For now, keep it off. + err = permitHyperV(session, baseObjects, 12) + if err != nil { + return wrapErr(err) + } + */ - err = blockAll(session, baseObjects, 0) - if err != nil { - return wrapErr(err) + err = blockAll(session, baseObjects, 0) + if err != nil { + return wrapErr(err) + } } return nil |