From 1dc1028a5eb94d3518727a73bcbdbe4f1a095372 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" Date: Mon, 21 Oct 2019 13:32:13 +0200 Subject: tunnel: blackhole sockets when there's going to be a sure routing loop This prevents against common mishaps when changing from a wifi network that supports v6 to one that doesn't. Reported-by: Jonathan Tooker Signed-off-by: Jason A. Donenfeld --- tunnel/defaultroutemonitor.go | 17 +++++++++-------- tunnel/interfacewatcher.go | 41 ++++++++++++++++++++++++++++++++++++++++- 2 files changed, 49 insertions(+), 9 deletions(-) (limited to 'tunnel') diff --git a/tunnel/defaultroutemonitor.go b/tunnel/defaultroutemonitor.go index 2d63e5db..72bab135 100644 --- a/tunnel/defaultroutemonitor.go +++ b/tunnel/defaultroutemonitor.go @@ -17,7 +17,7 @@ import ( "golang.zx2c4.com/wireguard/windows/tunnel/winipcfg" ) -func bindSocketRoute(family winipcfg.AddressFamily, device *device.Device, ourLUID winipcfg.LUID, lastLUID *winipcfg.LUID, lastIndex *uint32) error { +func bindSocketRoute(family winipcfg.AddressFamily, device *device.Device, ourLUID winipcfg.LUID, lastLUID *winipcfg.LUID, lastIndex *uint32, blackholeWhenLoop bool) error { r, err := winipcfg.GetIPForwardTable2(family) if err != nil { return err @@ -44,17 +44,18 @@ func bindSocketRoute(family winipcfg.AddressFamily, device *device.Device, ourLU } *lastLUID = luid *lastIndex = index + blackhole := blackholeWhenLoop && index == 0 if family == windows.AF_INET { - log.Printf("Binding v4 socket to interface %d", index) - return device.BindSocketToInterface4(index) + log.Printf("Binding v4 socket to interface %d (blackhole=%v)", index, blackhole) + return device.BindSocketToInterface4(index, blackhole) } else if family == windows.AF_INET6 { - log.Printf("Binding v6 socket to interface %d", index) - return device.BindSocketToInterface6(index) + log.Printf("Binding v6 socket to interface %d (blackhole=%v)", index, blackhole) + return device.BindSocketToInterface6(index, blackhole) } return nil } -func monitorDefaultRoutes(family winipcfg.AddressFamily, device *device.Device, autoMTU bool, tun *tun.NativeTun) ([]winipcfg.ChangeCallback, error) { +func monitorDefaultRoutes(family winipcfg.AddressFamily, device *device.Device, autoMTU bool, blackholeWhenLoop bool, tun *tun.NativeTun) ([]winipcfg.ChangeCallback, error) { var minMTU uint32 if family == windows.AF_INET { minMTU = 576 @@ -63,10 +64,10 @@ func monitorDefaultRoutes(family winipcfg.AddressFamily, device *device.Device, } ourLUID := winipcfg.LUID(tun.LUID()) lastLUID := winipcfg.LUID(0) - lastIndex := uint32(0) + lastIndex := ^uint32(0) lastMTU := uint32(0) doIt := func() error { - err := bindSocketRoute(family, device, ourLUID, &lastLUID, &lastIndex) + err := bindSocketRoute(family, device, ourLUID, &lastLUID, &lastIndex, blackholeWhenLoop) if err != nil { return err } diff --git a/tunnel/interfacewatcher.go b/tunnel/interfacewatcher.go index 92d08e90..1f632725 100644 --- a/tunnel/interfacewatcher.go +++ b/tunnel/interfacewatcher.go @@ -10,6 +10,7 @@ import ( "sync" "golang.org/x/sys/windows" + "golang.zx2c4.com/wireguard/device" "golang.zx2c4.com/wireguard/tun" @@ -41,6 +42,44 @@ type interfaceWatcher struct { storedEvents []interfaceWatcherEvent } +func hasDefaultRoute(family winipcfg.AddressFamily, peers []conf.Peer) bool { + var ( + foundV401 bool + foundV41281 bool + foundV600001 bool + foundV680001 bool + foundV400 bool + foundV600 bool + v40 = [4]byte{} + v60 = [16]byte{} + v48 = [4]byte{0x80} + v68 = [16]byte{0x80} + ) + for _, peer := range peers { + for _, allowedip := range peer.AllowedIPs { + if allowedip.Cidr == 1 && len(allowedip.IP) == 16 && allowedip.IP.Equal(v60[:]) { + foundV600001 = true + } else if allowedip.Cidr == 1 && len(allowedip.IP) == 16 && allowedip.IP.Equal(v68[:]) { + foundV680001 = true + } else if allowedip.Cidr == 1 && len(allowedip.IP) == 4 && allowedip.IP.Equal(v40[:]) { + foundV401 = true + } else if allowedip.Cidr == 1 && len(allowedip.IP) == 4 && allowedip.IP.Equal(v48[:]) { + foundV41281 = true + } else if allowedip.Cidr == 0 && len(allowedip.IP) == 16 && allowedip.IP.Equal(v60[:]) { + foundV600 = true + } else if allowedip.Cidr == 0 && len(allowedip.IP) == 4 && allowedip.IP.Equal(v40[:]) { + foundV400 = true + } + } + } + if family == windows.AF_INET { + return foundV400 || (foundV401 && foundV41281) + } else if family == windows.AF_INET6 { + return foundV600 || (foundV600001 && foundV680001) + } + return false +} + func (iw *interfaceWatcher) setup(family winipcfg.AddressFamily) { var changeCallbacks *[]winipcfg.ChangeCallback var ipversion string @@ -62,7 +101,7 @@ func (iw *interfaceWatcher) setup(family winipcfg.AddressFamily) { var err error log.Printf("Monitoring default %s routes", ipversion) - *changeCallbacks, err = monitorDefaultRoutes(family, iw.device, iw.conf.Interface.MTU == 0, iw.tun) + *changeCallbacks, err = monitorDefaultRoutes(family, iw.device, iw.conf.Interface.MTU == 0, hasDefaultRoute(family, iw.conf.Peers), iw.tun) if err != nil { iw.errors <- interfaceWatcherError{services.ErrorBindSocketsToDefaultRoutes, err} return -- cgit v1.2.3-59-g8ed1b