Merge branch 'win-custom-dns'

5 files changed, 117 insertions, 18 deletions

diff --git a/windows/libwfp b/windows/libwfp
-Subproject c56a9b2d02c6b09539192bd017169a811337058
+Subproject c73a1773046ce5c044d44ef362a3c4274c17d4f
diff --git a/windows/winfw/src/winfw/fwcontext.cpp b/windows/winfw/src/winfw/fwcontext.cpp
index 65b5762500..b8959cfc01 100644
--- a/windows/winfw/src/winfw/fwcontext.cpp
+++ b/windows/winfw/src/winfw/fwcontext.cpp
@@ -17,6 +17,7 @@
 #include "rules/baseline/permitdns.h"
 #include "rules/dns/blockall.h"
 #include "rules/dns/permittunnel.h"
+#include "rules/dns/permitnontunnel.h"
 #include "rules/multi/permitvpnrelay.h"
 #include <libwfp/transaction.h>
 #include <libwfp/filterengine.h>
@@ -210,7 +211,8 @@ bool FwContext::applyPolicyConnected
 	const WinFwRelay &relay,
 	const std::wstring &relayClient,
 	const std::wstring &tunnelInterfaceAlias,
-	const std::vector<wfp::IpAddress> &tunnelDnsServers
+	const std::vector<wfp::IpAddress> &tunnelDnsServers,
+	const std::vector<wfp::IpAddress> &nonTunnelDnsServers
 )
 {
 	Ruleset ruleset;
@@ -219,9 +221,18 @@ bool FwContext::applyPolicyConnected
 	AppendSettingsRules(ruleset, settings);
 	AppendRelayRules(ruleset, relay, relayClient);
 
-	ruleset.emplace_back(std::make_unique<dns::PermitTunnel>(
-		tunnelInterfaceAlias, tunnelDnsServers
-	));
+	if (!tunnelDnsServers.empty())
+	{
+		ruleset.emplace_back(std::make_unique<dns::PermitTunnel>(
+			tunnelInterfaceAlias, tunnelDnsServers
+		));
+	}
+	if (!nonTunnelDnsServers.empty())
+	{
+		ruleset.emplace_back(std::make_unique<dns::PermitNonTunnel>(
+			tunnelInterfaceAlias, nonTunnelDnsServers
+		));
+	}
 
 	ruleset.emplace_back(std::make_unique<baseline::PermitVpnTunnel>(
 		tunnelInterfaceAlias
diff --git a/windows/winfw/src/winfw/fwcontext.h b/windows/winfw/src/winfw/fwcontext.h
index e342f52fe5..100672073a 100644
--- a/windows/winfw/src/winfw/fwcontext.h
+++ b/windows/winfw/src/winfw/fwcontext.h
@@ -43,7 +43,8 @@ public:
 		const WinFwRelay &relay,
 		const std::wstring &relayClient,
 		const std::wstring &tunnelInterfaceAlias,
-		const std::vector<wfp::IpAddress> &tunnelDnsServers
+		const std::vector<wfp::IpAddress> &tunnelDnsServers,
+		const std::vector<wfp::IpAddress> &nonTunnelDnsServers
 	);
 
 	bool applyPolicyBlocked(const WinFwSettings &settings);
diff --git a/windows/winfw/src/winfw/winfw.cpp b/windows/winfw/src/winfw/winfw.cpp
index 4998feef7f..080713b742 100644
--- a/windows/winfw/src/winfw/winfw.cpp
+++ b/windows/winfw/src/winfw/winfw.cpp
@@ -4,8 +4,10 @@
 #include "objectpurger.h"
 #include "mullvadobjects.h"
 #include "rules/persistent/blockall.h"
+#include "libwfp/ipnetwork.h"
 #include <windows.h>
 #include <libcommon/error.h>
+#include <libcommon/string.h>
 #include <optional>
 
 namespace
@@ -63,6 +65,23 @@ HandlePolicyException(const common::error::WindowsException &err)
 	return WINFW_POLICY_STATUS_GENERAL_FAILURE;
 }
 
+//
+// Networks for which DNS requests can be made on all network adapters.
+//
+// This should be synchronized with `ALLOWED_LAN_NETS` in talpid-core,
+// but it also includes loopback addresses.
+//
+wfp::IpNetwork g_privateIpRanges[] = {
+	wfp::IpNetwork(wfp::IpAddress::Literal{127, 0, 0, 0}, 8),
+	wfp::IpNetwork(wfp::IpAddress::Literal{10, 0, 0, 0}, 8),
+	wfp::IpNetwork(wfp::IpAddress::Literal{176, 16, 0, 0}, 12),
+	wfp::IpNetwork(wfp::IpAddress::Literal{192, 168, 0, 0}, 16),
+	wfp::IpNetwork(wfp::IpAddress::Literal{169, 254, 0, 0}, 16),
+	wfp::IpNetwork(wfp::IpAddress::Literal6{0, 0, 0, 0, 0, 0, 0, 1}, 128),
+	wfp::IpNetwork(wfp::IpAddress::Literal6{0xfe80, 0, 0, 0, 0, 0, 0, 0}, 10),
+	wfp::IpNetwork(wfp::IpAddress::Literal6{0xfc80, 0, 0, 0, 0, 0, 0, 0}, 7)
+};
+
 } // anonymous namespace
 
 WINFW_LINKAGE
@@ -289,8 +308,10 @@ WinFw_ApplyPolicyConnected(
 	const WinFwRelay *relay,
 	const wchar_t *relayClient,
 	const wchar_t *tunnelInterfaceAlias,
-	const wchar_t *v4DnsHost,
-	const wchar_t *v6DnsHost
+	const wchar_t *v4Gateway,
+	const wchar_t *v6Gateway,
+	const wchar_t **dnsServers,
+	size_t numDnsServers
 )
 {
 	if (nullptr == g_fwContext)
@@ -320,16 +341,78 @@ WinFw_ApplyPolicyConnected(
 			THROW_ERROR("Invalid argument: tunnelInterfaceAlias");
 		}
 
-		if (nullptr == v4DnsHost)
+		if (nullptr == v4Gateway)
+		{
+			THROW_ERROR("Invalid argument: v4Gateway");
+		}
+
+		if (nullptr == dnsServers || 0 == numDnsServers)
 		{
-			THROW_ERROR("Invalid argument: v4DnsHost");
+			THROW_ERROR("Invalid argument: dnsServers");
 		}
 
-		std::vector<wfp::IpAddress> tunnelDnsServers = { wfp::IpAddress(v4DnsHost) };
+		std::vector<wfp::IpAddress> tunnelDnsServers;
+		std::vector<wfp::IpAddress> nonTunnelDnsServers;
+
+		const auto v4GatewayIp = wfp::IpAddress(v4Gateway);
+		const auto v6GatewayIp = (nullptr != v6Gateway)
+			? std::make_optional(wfp::IpAddress(v6Gateway))
+			: std::nullopt;
 
-		if (nullptr != v6DnsHost)
+		const auto addToDnsCollection = [&](const std::optional<wfp::IpAddress> &gatewayIp, wfp::IpAddress &&ip)
 		{
-			tunnelDnsServers.emplace_back(wfp::IpAddress(v6DnsHost));
+			if (gatewayIp.has_value() && *gatewayIp == ip)
+			{
+				// Requests to the gateway IP of the tunnel are only allowed on the tunnel interface.
+				tunnelDnsServers.emplace_back(ip);
+				return;
+			}
+
+			for (const auto &network : g_privateIpRanges)
+			{
+				if (network.includes(ip))
+				{
+					//
+					// Resolvers on the LAN must be accessible outside the tunnel.
+					//
+
+					nonTunnelDnsServers.emplace_back(ip);
+					return;
+				}
+			}
+
+			tunnelDnsServers.emplace_back(ip);
+		};
+
+		for (size_t i = 0; i < numDnsServers; i++)
+		{
+			auto ip = wfp::IpAddress(dnsServers[i]);
+			addToDnsCollection(ip.type() == wfp::IpAddress::Type::Ipv4 ? v4GatewayIp : v6GatewayIp, std::move(ip));
+		}
+
+		if (nullptr != g_logSink)
+		{
+			std::stringstream ss;
+			ss << "Non-tunnel DNS servers: ";
+			for (size_t i = 0; i < nonTunnelDnsServers.size(); i++) {
+				if (i > 0)
+				{
+					ss << ", ";
+				}
+				ss << common::string::ToAnsi(nonTunnelDnsServers[i].toString());
+			}
+			g_logSink(MULLVAD_LOG_LEVEL_DEBUG, ss.str().c_str(), g_logSinkContext);
+
+			ss.str(std::string());
+			ss << "Tunnel DNS servers: ";
+			for (size_t i = 0; i < tunnelDnsServers.size(); i++) {
+				if (i > 0)
+				{
+					ss << ", ";
+				}
+				ss << common::string::ToAnsi(tunnelDnsServers[i].toString());
+			}
+			g_logSink(MULLVAD_LOG_LEVEL_DEBUG, ss.str().c_str(), g_logSinkContext);
 		}
 
 		return g_fwContext->applyPolicyConnected(
@@ -337,7 +420,8 @@ WinFw_ApplyPolicyConnected(
 			*relay,
 			relayClient,
 			tunnelInterfaceAlias,
-			tunnelDnsServers
+			tunnelDnsServers,
+			nonTunnelDnsServers
 		) ? WINFW_POLICY_STATUS_SUCCESS : WINFW_POLICY_STATUS_GENERAL_FAILURE;
 	}
 	catch (common::error::WindowsException &err)
diff --git a/windows/winfw/src/winfw/winfw.h b/windows/winfw/src/winfw/winfw.h
index b3f95a2cbf..f0a487cb12 100644
--- a/windows/winfw/src/winfw/winfw.h
+++ b/windows/winfw/src/winfw/winfw.h
@@ -167,14 +167,15 @@ WinFw_ApplyPolicyConnecting(
 // - What is specified by settings
 // - Communication with the relay server
 // - Non-DNS traffic inside the VPN tunnel
-// - DNS requests inside the VPN tunnel, to the specified DNS server
+// - DNS requests inside the VPN tunnel to any specified remote DNS server
+// - DNS requests outside the VPN tunnel to any specified local DNS servers
 //
 // Parameters:
 //
 // tunnelInterfaceAlias:
 //   Friendly name of VPN tunnel interface
-// v4DnsHost/v6DnsHost:
-//   String encoded IP address of DNS to use inside tunnel
+// dnsServers:
+//   Array of string-encoded IP addresses of DNS servers to use
 //
 extern "C"
 WINFW_LINKAGE
@@ -185,8 +186,10 @@ WinFw_ApplyPolicyConnected(
 	const WinFwRelay *relay,
 	const wchar_t *relayClient,
 	const wchar_t *tunnelInterfaceAlias,
-	const wchar_t *v4DnsHost,
-	const wchar_t *v6DnsHost
+	const wchar_t *v4Gateway,
+	const wchar_t *v6Gateway,
+	const wchar_t **dnsServers,
+	size_t numDnsServers
 );
 
 //