diff options
Diffstat (limited to 'windows')
| -rw-r--r-- | windows/winfw/src/winfw/rules/baseline/permitlan.cpp | 41 | ||||
| -rw-r--r-- | windows/winfw/src/winfw/rules/baseline/permitlanservice.cpp | 16 | ||||
| -rw-r--r-- | windows/winfw/src/winfw/winfw.vcxproj | 18 |
3 files changed, 32 insertions, 43 deletions
diff --git a/windows/winfw/src/winfw/rules/baseline/permitlan.cpp b/windows/winfw/src/winfw/rules/baseline/permitlan.cpp index 197b19f06a..91211f1f0a 100644 --- a/windows/winfw/src/winfw/rules/baseline/permitlan.cpp +++ b/windows/winfw/src/winfw/rules/baseline/permitlan.cpp @@ -6,6 +6,7 @@ #include <libwfp/ipaddress.h> #include <libwfp/ipnetwork.h> #include <libwfp/conditions/conditionip.h> +#include <winfw/lannetworks.h> using namespace wfp::conditions; @@ -37,10 +38,9 @@ bool PermitLan::applyIpv4(IObjectInstaller &objectInstaller) const wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V4); - conditionBuilder.add_condition(ConditionIp::Remote(wfp::IpNetwork(wfp::IpAddress::Literal({ 10, 0, 0, 0 }), 8))); - conditionBuilder.add_condition(ConditionIp::Remote(wfp::IpNetwork(wfp::IpAddress::Literal({ 172, 16, 0, 0 }), 12))); - conditionBuilder.add_condition(ConditionIp::Remote(wfp::IpNetwork(wfp::IpAddress::Literal({ 192, 168, 0, 0 }), 16))); - conditionBuilder.add_condition(ConditionIp::Remote(wfp::IpNetwork(wfp::IpAddress::Literal({ 169, 254, 0, 0 }), 16))); + for (const auto &network : g_ipv4LanNets) { + conditionBuilder.add_condition(ConditionIp::Remote(network)); + } if (!objectInstaller.addFilter(filterBuilder, conditionBuilder)) { @@ -57,14 +57,9 @@ bool PermitLan::applyIpv4(IObjectInstaller &objectInstaller) const conditionBuilder.reset(); - // Local network broadcast. - conditionBuilder.add_condition(ConditionIp::Remote(wfp::IpNetwork(wfp::IpAddress::Literal({ 255, 255, 255, 255 }), 32))); - - // Local subnet multicast. - conditionBuilder.add_condition(ConditionIp::Remote(wfp::IpNetwork(wfp::IpAddress::Literal({ 224, 0, 0, 0 }), 24))); - - // Admin-local scope (e.g., SSDP and mDNS) - conditionBuilder.add_condition(ConditionIp::Remote(wfp::IpNetwork(wfp::IpAddress::Literal({ 239, 0, 0, 0 }), 8))); + for (const auto &network : g_ipv4MulticastNets) { + conditionBuilder.add_condition(ConditionIp::Remote(network)); + } return objectInstaller.addFilter(filterBuilder, conditionBuilder); } @@ -89,11 +84,9 @@ bool PermitLan::applyIpv6(IObjectInstaller &objectInstaller) const wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V6); - const wfp::IpNetwork linkLocal(wfp::IpAddress::Literal6({ 0xFE80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }), 10); - const wfp::IpNetwork uniqueLocal(wfp::IpAddress::Literal6({ 0xFC00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }), 7); - - conditionBuilder.add_condition(ConditionIp::Remote(linkLocal)); - conditionBuilder.add_condition(ConditionIp::Remote(uniqueLocal)); + for (const auto &network : g_ipv6LanNets) { + conditionBuilder.add_condition(ConditionIp::Remote(network)); + } if (!objectInstaller.addFilter(filterBuilder, conditionBuilder)) { @@ -110,17 +103,9 @@ bool PermitLan::applyIpv6(IObjectInstaller &objectInstaller) const conditionBuilder.reset(); - const wfp::IpNetwork interfaceLocalMulticast(wfp::IpAddress::Literal6({ 0xFF01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }), 16); - const wfp::IpNetwork linkLocalMulticast(wfp::IpAddress::Literal6({ 0xFF02, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }), 16); - const wfp::IpNetwork realmLocalMulticast(wfp::IpAddress::Literal6({ 0xFF03, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }), 16); - const wfp::IpNetwork adminLocalMulticast(wfp::IpAddress::Literal6({ 0xFF04, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }), 16); - const wfp::IpNetwork siteLocalMulticast(wfp::IpAddress::Literal6({ 0xFF05, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }), 16); - - conditionBuilder.add_condition(ConditionIp::Remote(interfaceLocalMulticast)); - conditionBuilder.add_condition(ConditionIp::Remote(linkLocalMulticast)); - conditionBuilder.add_condition(ConditionIp::Remote(realmLocalMulticast)); - conditionBuilder.add_condition(ConditionIp::Remote(adminLocalMulticast)); - conditionBuilder.add_condition(ConditionIp::Remote(siteLocalMulticast)); + for (const auto &network : g_ipv6MulticastNets) { + conditionBuilder.add_condition(ConditionIp::Remote(network)); + } return objectInstaller.addFilter(filterBuilder, conditionBuilder); } diff --git a/windows/winfw/src/winfw/rules/baseline/permitlanservice.cpp b/windows/winfw/src/winfw/rules/baseline/permitlanservice.cpp index 61aae2851c..b6901b7f82 100644 --- a/windows/winfw/src/winfw/rules/baseline/permitlanservice.cpp +++ b/windows/winfw/src/winfw/rules/baseline/permitlanservice.cpp @@ -6,6 +6,7 @@ #include <libwfp/ipaddress.h> #include <libwfp/ipnetwork.h> #include <libwfp/conditions/conditionip.h> +#include <winfw/lannetworks.h> using namespace wfp::conditions; @@ -37,10 +38,9 @@ bool PermitLanService::applyIpv4(IObjectInstaller &objectInstaller) const wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4); - conditionBuilder.add_condition(ConditionIp::Remote(wfp::IpNetwork(wfp::IpAddress::Literal({ 10, 0, 0, 0 }), 8))); - conditionBuilder.add_condition(ConditionIp::Remote(wfp::IpNetwork(wfp::IpAddress::Literal({ 172, 16, 0, 0 }), 12))); - conditionBuilder.add_condition(ConditionIp::Remote(wfp::IpNetwork(wfp::IpAddress::Literal({ 192, 168, 0, 0 }), 16))); - conditionBuilder.add_condition(ConditionIp::Remote(wfp::IpNetwork(wfp::IpAddress::Literal({ 169, 254, 0, 0 }), 16))); + for (const auto &network : g_ipv4LanNets) { + conditionBuilder.add_condition(ConditionIp::Remote(network)); + } return objectInstaller.addFilter(filterBuilder, conditionBuilder); } @@ -65,11 +65,9 @@ bool PermitLanService::applyIpv6(IObjectInstaller &objectInstaller) const wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6); - const wfp::IpNetwork linkLocal(wfp::IpAddress::Literal6{ 0xFE80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }, 10); - const wfp::IpNetwork uniqueLocal(wfp::IpAddress::Literal6({ 0xFC00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }), 7); - - conditionBuilder.add_condition(ConditionIp::Remote(linkLocal)); - conditionBuilder.add_condition(ConditionIp::Remote(uniqueLocal)); + for (const auto &network : g_ipv6LanNets) { + conditionBuilder.add_condition(ConditionIp::Remote(network)); + } return objectInstaller.addFilter(filterBuilder, conditionBuilder); } diff --git a/windows/winfw/src/winfw/winfw.vcxproj b/windows/winfw/src/winfw/winfw.vcxproj index 1753c722e2..eb14e0332d 100644 --- a/windows/winfw/src/winfw/winfw.vcxproj +++ b/windows/winfw/src/winfw/winfw.vcxproj @@ -223,7 +223,8 @@ <ModuleDefinitionFile>winfw.def</ModuleDefinitionFile> </Link> <PreBuildEvent> - <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h</Command> + <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h +cargo run -q -p talpid-types --bin generate-cpp-lannetworks > $(ProjectDir)lannetworks.h</Command> </PreBuildEvent> </ItemDefinitionGroup> <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> @@ -246,7 +247,8 @@ <ModuleDefinitionFile>winfw.def</ModuleDefinitionFile> </Link> <PreBuildEvent> - <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h</Command> + <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h +cargo run -q -p talpid-types --bin generate-cpp-lannetworks > $(ProjectDir)lannetworks.h</Command> </PreBuildEvent> </ItemDefinitionGroup> <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'"> @@ -269,7 +271,8 @@ <ModuleDefinitionFile>winfw.def</ModuleDefinitionFile> </Link> <PreBuildEvent> - <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h</Command> + <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h +cargo run -q -p talpid-types --bin generate-cpp-lannetworks > $(ProjectDir)lannetworks.h</Command> </PreBuildEvent> </ItemDefinitionGroup> <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> @@ -297,7 +300,8 @@ <ModuleDefinitionFile>winfw.def</ModuleDefinitionFile> </Link> <PreBuildEvent> - <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h</Command> + <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h +cargo run -q -p talpid-types --bin generate-cpp-lannetworks > $(ProjectDir)lannetworks.h</Command> </PreBuildEvent> </ItemDefinitionGroup> <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> @@ -325,7 +329,8 @@ <ModuleDefinitionFile>winfw.def</ModuleDefinitionFile> </Link> <PreBuildEvent> - <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h</Command> + <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h +cargo run -q -p talpid-types --bin generate-cpp-lannetworks > $(ProjectDir)lannetworks.h</Command> </PreBuildEvent> </ItemDefinitionGroup> <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'"> @@ -353,7 +358,8 @@ <ModuleDefinitionFile>winfw.def</ModuleDefinitionFile> </Link> <PreBuildEvent> - <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h</Command> + <Command>cargo run -q --bin mullvad-version version.h > $(ProjectDir)..\..\..\version.h +cargo run -q -p talpid-types --bin generate-cpp-lannetworks > $(ProjectDir)lannetworks.h</Command> </PreBuildEvent> </ItemDefinitionGroup> <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> |