tunnel: blackhole sockets when there's going to be a sure routing loop

This prevents against common mishaps when changing from a wifi network
that supports v6 to one that doesn't.

Reported-by: Jonathan Tooker <jonathan.tooker@netprotect.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

2 files changed, 49 insertions, 9 deletions

diff --git a/tunnel/defaultroutemonitor.go b/tunnel/defaultroutemonitor.go
index 2d63e5db..72bab135 100644
--- a/tunnel/defaultroutemonitor.go
+++ b/tunnel/defaultroutemonitor.go
@@ -17,7 +17,7 @@ import (
 	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 )
 
-func bindSocketRoute(family winipcfg.AddressFamily, device *device.Device, ourLUID winipcfg.LUID, lastLUID *winipcfg.LUID, lastIndex *uint32) error {
+func bindSocketRoute(family winipcfg.AddressFamily, device *device.Device, ourLUID winipcfg.LUID, lastLUID *winipcfg.LUID, lastIndex *uint32, blackholeWhenLoop bool) error {
 	r, err := winipcfg.GetIPForwardTable2(family)
 	if err != nil {
 		return err
@@ -44,17 +44,18 @@ func bindSocketRoute(family winipcfg.AddressFamily, device *device.Device, ourLU
 	}
 	*lastLUID = luid
 	*lastIndex = index
+	blackhole := blackholeWhenLoop && index == 0
 	if family == windows.AF_INET {
-		log.Printf("Binding v4 socket to interface %d", index)
-		return device.BindSocketToInterface4(index)
+		log.Printf("Binding v4 socket to interface %d (blackhole=%v)", index, blackhole)
+		return device.BindSocketToInterface4(index, blackhole)
 	} else if family == windows.AF_INET6 {
-		log.Printf("Binding v6 socket to interface %d", index)
-		return device.BindSocketToInterface6(index)
+		log.Printf("Binding v6 socket to interface %d (blackhole=%v)", index, blackhole)
+		return device.BindSocketToInterface6(index, blackhole)
 	}
 	return nil
 }
 
-func monitorDefaultRoutes(family winipcfg.AddressFamily, device *device.Device, autoMTU bool, tun *tun.NativeTun) ([]winipcfg.ChangeCallback, error) {
+func monitorDefaultRoutes(family winipcfg.AddressFamily, device *device.Device, autoMTU bool, blackholeWhenLoop bool, tun *tun.NativeTun) ([]winipcfg.ChangeCallback, error) {
 	var minMTU uint32
 	if family == windows.AF_INET {
 		minMTU = 576
@@ -63,10 +64,10 @@ func monitorDefaultRoutes(family winipcfg.AddressFamily, device *device.Device,
 	}
 	ourLUID := winipcfg.LUID(tun.LUID())
 	lastLUID := winipcfg.LUID(0)
-	lastIndex := uint32(0)
+	lastIndex := ^uint32(0)
 	lastMTU := uint32(0)
 	doIt := func() error {
-		err := bindSocketRoute(family, device, ourLUID, &lastLUID, &lastIndex)
+		err := bindSocketRoute(family, device, ourLUID, &lastLUID, &lastIndex, blackholeWhenLoop)
 		if err != nil {
 			return err
 		}
diff --git a/tunnel/interfacewatcher.go b/tunnel/interfacewatcher.go
index 92d08e90..1f632725 100644
--- a/tunnel/interfacewatcher.go
+++ b/tunnel/interfacewatcher.go
@@ -10,6 +10,7 @@ import (
 	"sync"
 
 	"golang.org/x/sys/windows"
+
 	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/tun"
 
@@ -41,6 +42,44 @@ type interfaceWatcher struct {
 	storedEvents            []interfaceWatcherEvent
 }
 
+func hasDefaultRoute(family winipcfg.AddressFamily, peers []conf.Peer) bool {
+	var (
+		foundV401    bool
+		foundV41281  bool
+		foundV600001 bool
+		foundV680001 bool
+		foundV400    bool
+		foundV600    bool
+		v40          = [4]byte{}
+		v60          = [16]byte{}
+		v48          = [4]byte{0x80}
+		v68          = [16]byte{0x80}
+	)
+	for _, peer := range peers {
+		for _, allowedip := range peer.AllowedIPs {
+			if allowedip.Cidr == 1 && len(allowedip.IP) == 16 && allowedip.IP.Equal(v60[:]) {
+				foundV600001 = true
+			} else if allowedip.Cidr == 1 && len(allowedip.IP) == 16 && allowedip.IP.Equal(v68[:]) {
+				foundV680001 = true
+			} else if allowedip.Cidr == 1 && len(allowedip.IP) == 4 && allowedip.IP.Equal(v40[:]) {
+				foundV401 = true
+			} else if allowedip.Cidr == 1 && len(allowedip.IP) == 4 && allowedip.IP.Equal(v48[:]) {
+				foundV41281 = true
+			} else if allowedip.Cidr == 0 && len(allowedip.IP) == 16 && allowedip.IP.Equal(v60[:]) {
+				foundV600 = true
+			} else if allowedip.Cidr == 0 && len(allowedip.IP) == 4 && allowedip.IP.Equal(v40[:]) {
+				foundV400 = true
+			}
+		}
+	}
+	if family == windows.AF_INET {
+		return foundV400 || (foundV401 && foundV41281)
+	} else if family == windows.AF_INET6 {
+		return foundV600 || (foundV600001 && foundV680001)
+	}
+	return false
+}
+
 func (iw *interfaceWatcher) setup(family winipcfg.AddressFamily) {
 	var changeCallbacks *[]winipcfg.ChangeCallback
 	var ipversion string
@@ -62,7 +101,7 @@ func (iw *interfaceWatcher) setup(family winipcfg.AddressFamily) {
 	var err error
 
 	log.Printf("Monitoring default %s routes", ipversion)
-	*changeCallbacks, err = monitorDefaultRoutes(family, iw.device, iw.conf.Interface.MTU == 0, iw.tun)
+	*changeCallbacks, err = monitorDefaultRoutes(family, iw.device, iw.conf.Interface.MTU == 0, hasDefaultRoute(family, iw.conf.Peers), iw.tun)
 	if err != nil {
 		iw.errors <- interfaceWatcherError{services.ErrorBindSocketsToDefaultRoutes, err}
 		return