Bypass tunnel sockets out of the VPN tunnel

2 files changed, 26 insertions, 1 deletions

diff --git a/talpid-core/src/tunnel/wireguard/mod.rs b/talpid-core/src/tunnel/wireguard/mod.rs
index 36d0f9d61b..810aadff49 100644
--- a/talpid-core/src/tunnel/wireguard/mod.rs
+++ b/talpid-core/src/tunnel/wireguard/mod.rs
@@ -44,6 +44,11 @@ pub enum Error {
     #[error(display = "Invalid tunnel interface name")]
     InterfaceNameError(#[error(cause)] std::ffi::NulError),
 
+    /// Failed to configure Wireguard sockets to bypass the tunnel.
+    #[cfg(target_os = "android")]
+    #[error(display = "Failed to configure Wireguard sockets to bypass the tunnel")]
+    BypassError(#[error(cause)] BoxedError),
+
     /// Pinging timed out.
     #[error(display = "Ping timed out")]
     PingTimeoutError,
diff --git a/talpid-core/src/tunnel/wireguard/wireguard_go.rs b/talpid-core/src/tunnel/wireguard/wireguard_go.rs
index 0f918b4e9b..f72371eb11 100644
--- a/talpid-core/src/tunnel/wireguard/wireguard_go.rs
+++ b/talpid-core/src/tunnel/wireguard/wireguard_go.rs
@@ -2,6 +2,8 @@ use super::{Config, Error, Result, Tunnel};
 use crate::tunnel::tun_provider::{Tun, TunConfig, TunProvider};
 use ipnetwork::IpNetwork;
 use std::{ffi::CString, fs, net::IpAddr, os::unix::io::AsRawFd, path::Path};
+#[cfg(target_os = "android")]
+use talpid_types::BoxedError;
 
 pub struct WgGoTunnel {
     interface_name: String,
@@ -19,7 +21,8 @@ impl WgGoTunnel {
         tun_provider: &dyn TunProvider,
         routes: impl Iterator<Item = IpNetwork>,
     ) -> Result<Self> {
-        let tunnel_device = tun_provider
+        #[cfg_attr(not(target_os = "android"), allow(unused_mut))]
+        let mut tunnel_device = tun_provider
             .create_tun(Self::create_tunnel_config(config, routes))
             .map_err(Error::SetupTunnelDeviceError)?;
 
@@ -45,6 +48,9 @@ impl WgGoTunnel {
             return Err(Error::StartWireguardError { status: handle });
         }
 
+        #[cfg(target_os = "android")]
+        Self::bypass_tunnel_sockets(&mut tunnel_device, handle).map_err(Error::BypassError)?;
+
         Ok(WgGoTunnel {
             interface_name,
             handle: Some(handle),
@@ -65,6 +71,20 @@ impl WgGoTunnel {
         }
     }
 
+    #[cfg(target_os = "android")]
+    fn bypass_tunnel_sockets(
+        tunnel_device: &mut Box<dyn Tun>,
+        handle: i32,
+    ) -> std::result::Result<(), BoxedError> {
+        let socket_v4 = unsafe { wgGetSocketV4(handle) };
+        let socket_v6 = unsafe { wgGetSocketV6(handle) };
+
+        tunnel_device.bypass(socket_v4)?;
+        tunnel_device.bypass(socket_v6)?;
+
+        Ok(())
+    }
+
     fn stop_tunnel(&mut self) -> Result<()> {
         if let Some(handle) = self.handle.take() {
             let status = unsafe { wgTurnOff(handle) };