summaryrefslogtreecommitdiffhomepage
path: root/windows
diff options
context:
space:
mode:
Diffstat (limited to 'windows')
-rw-r--r--windows/winfw/src/winfw/fwcontext.cpp19
-rw-r--r--windows/winfw/src/winfw/fwcontext.h3
-rw-r--r--windows/winfw/src/winfw/winfw.cpp74
-rw-r--r--windows/winfw/src/winfw/winfw.h13
4 files changed, 91 insertions, 18 deletions
diff --git a/windows/winfw/src/winfw/fwcontext.cpp b/windows/winfw/src/winfw/fwcontext.cpp
index 65b5762500..b8959cfc01 100644
--- a/windows/winfw/src/winfw/fwcontext.cpp
+++ b/windows/winfw/src/winfw/fwcontext.cpp
@@ -17,6 +17,7 @@
#include "rules/baseline/permitdns.h"
#include "rules/dns/blockall.h"
#include "rules/dns/permittunnel.h"
+#include "rules/dns/permitnontunnel.h"
#include "rules/multi/permitvpnrelay.h"
#include <libwfp/transaction.h>
#include <libwfp/filterengine.h>
@@ -210,7 +211,8 @@ bool FwContext::applyPolicyConnected
const WinFwRelay &relay,
const std::wstring &relayClient,
const std::wstring &tunnelInterfaceAlias,
- const std::vector<wfp::IpAddress> &tunnelDnsServers
+ const std::vector<wfp::IpAddress> &tunnelDnsServers,
+ const std::vector<wfp::IpAddress> &nonTunnelDnsServers
)
{
Ruleset ruleset;
@@ -219,9 +221,18 @@ bool FwContext::applyPolicyConnected
AppendSettingsRules(ruleset, settings);
AppendRelayRules(ruleset, relay, relayClient);
- ruleset.emplace_back(std::make_unique<dns::PermitTunnel>(
- tunnelInterfaceAlias, tunnelDnsServers
- ));
+ if (!tunnelDnsServers.empty())
+ {
+ ruleset.emplace_back(std::make_unique<dns::PermitTunnel>(
+ tunnelInterfaceAlias, tunnelDnsServers
+ ));
+ }
+ if (!nonTunnelDnsServers.empty())
+ {
+ ruleset.emplace_back(std::make_unique<dns::PermitNonTunnel>(
+ tunnelInterfaceAlias, nonTunnelDnsServers
+ ));
+ }
ruleset.emplace_back(std::make_unique<baseline::PermitVpnTunnel>(
tunnelInterfaceAlias
diff --git a/windows/winfw/src/winfw/fwcontext.h b/windows/winfw/src/winfw/fwcontext.h
index e342f52fe5..100672073a 100644
--- a/windows/winfw/src/winfw/fwcontext.h
+++ b/windows/winfw/src/winfw/fwcontext.h
@@ -43,7 +43,8 @@ public:
const WinFwRelay &relay,
const std::wstring &relayClient,
const std::wstring &tunnelInterfaceAlias,
- const std::vector<wfp::IpAddress> &tunnelDnsServers
+ const std::vector<wfp::IpAddress> &tunnelDnsServers,
+ const std::vector<wfp::IpAddress> &nonTunnelDnsServers
);
bool applyPolicyBlocked(const WinFwSettings &settings);
diff --git a/windows/winfw/src/winfw/winfw.cpp b/windows/winfw/src/winfw/winfw.cpp
index 4998feef7f..705ee689c8 100644
--- a/windows/winfw/src/winfw/winfw.cpp
+++ b/windows/winfw/src/winfw/winfw.cpp
@@ -4,6 +4,7 @@
#include "objectpurger.h"
#include "mullvadobjects.h"
#include "rules/persistent/blockall.h"
+#include "libwfp/ipnetwork.h"
#include <windows.h>
#include <libcommon/error.h>
#include <optional>
@@ -63,6 +64,23 @@ HandlePolicyException(const common::error::WindowsException &err)
return WINFW_POLICY_STATUS_GENERAL_FAILURE;
}
+//
+// Networks for which DNS requests can be made on all network adapters.
+//
+// This should be synchronized with `ALLOWED_LAN_NETS` in talpid-core,
+// but it also includes loopback addresses.
+//
+wfp::IpNetwork g_privateIpRanges[] = {
+ wfp::IpNetwork(wfp::IpAddress::Literal{127, 0, 0, 0}, 8),
+ wfp::IpNetwork(wfp::IpAddress::Literal{10, 0, 0, 0}, 8),
+ wfp::IpNetwork(wfp::IpAddress::Literal{176, 16, 0, 0}, 12),
+ wfp::IpNetwork(wfp::IpAddress::Literal{192, 168, 0, 0}, 16),
+ wfp::IpNetwork(wfp::IpAddress::Literal{169, 254, 0, 0}, 16),
+ wfp::IpNetwork(wfp::IpAddress::Literal6{0, 0, 0, 0, 0, 0, 0, 1}, 128),
+ wfp::IpNetwork(wfp::IpAddress::Literal6{0xfe80, 0, 0, 0, 0, 0, 0, 0}, 10),
+ wfp::IpNetwork(wfp::IpAddress::Literal6{0xfc80, 0, 0, 0, 0, 0, 0, 0}, 7)
+};
+
} // anonymous namespace
WINFW_LINKAGE
@@ -289,8 +307,10 @@ WinFw_ApplyPolicyConnected(
const WinFwRelay *relay,
const wchar_t *relayClient,
const wchar_t *tunnelInterfaceAlias,
- const wchar_t *v4DnsHost,
- const wchar_t *v6DnsHost
+ const wchar_t *v4Gateway,
+ const wchar_t *v6Gateway,
+ const wchar_t **dnsServers,
+ size_t numDnsServers
)
{
if (nullptr == g_fwContext)
@@ -320,16 +340,53 @@ WinFw_ApplyPolicyConnected(
THROW_ERROR("Invalid argument: tunnelInterfaceAlias");
}
- if (nullptr == v4DnsHost)
+ if (nullptr == v4Gateway)
+ {
+ THROW_ERROR("Invalid argument: v4Gateway");
+ }
+
+ if (nullptr == dnsServers || 0 == numDnsServers)
{
- THROW_ERROR("Invalid argument: v4DnsHost");
+ THROW_ERROR("Invalid argument: dnsServers");
}
- std::vector<wfp::IpAddress> tunnelDnsServers = { wfp::IpAddress(v4DnsHost) };
+ std::vector<wfp::IpAddress> tunnelDnsServers;
+ std::vector<wfp::IpAddress> nonTunnelDnsServers;
+
+ const auto v4GatewayIp = wfp::IpAddress(v4Gateway);
+ const auto v6GatewayIp = (nullptr != v6Gateway)
+ ? std::make_optional(wfp::IpAddress(v6Gateway))
+ : std::nullopt;
+
+ const auto addToDnsCollection = [&](const std::optional<wfp::IpAddress> &gatewayIp, wfp::IpAddress &&ip)
+ {
+ if (gatewayIp.has_value() && *gatewayIp == ip)
+ {
+ // Requests to the gateway IP of the tunnel are only allowed on the tunnel interface.
+ tunnelDnsServers.emplace_back(ip);
+ return;
+ }
+
+ for (const auto &network : g_privateIpRanges)
+ {
+ if (network.includes(ip))
+ {
+ //
+ // Resolvers on the LAN must be accessible outside the tunnel.
+ //
+
+ nonTunnelDnsServers.emplace_back(ip);
+ return;
+ }
+ }
+
+ tunnelDnsServers.emplace_back(ip);
+ };
- if (nullptr != v6DnsHost)
+ for (size_t i = 0; i < numDnsServers; i++)
{
- tunnelDnsServers.emplace_back(wfp::IpAddress(v6DnsHost));
+ auto ip = wfp::IpAddress(dnsServers[i]);
+ addToDnsCollection(ip.type() == wfp::IpAddress::Type::Ipv4 ? v4GatewayIp : v6GatewayIp, std::move(ip));
}
return g_fwContext->applyPolicyConnected(
@@ -337,7 +394,8 @@ WinFw_ApplyPolicyConnected(
*relay,
relayClient,
tunnelInterfaceAlias,
- tunnelDnsServers
+ tunnelDnsServers,
+ nonTunnelDnsServers
) ? WINFW_POLICY_STATUS_SUCCESS : WINFW_POLICY_STATUS_GENERAL_FAILURE;
}
catch (common::error::WindowsException &err)
diff --git a/windows/winfw/src/winfw/winfw.h b/windows/winfw/src/winfw/winfw.h
index b3f95a2cbf..f0a487cb12 100644
--- a/windows/winfw/src/winfw/winfw.h
+++ b/windows/winfw/src/winfw/winfw.h
@@ -167,14 +167,15 @@ WinFw_ApplyPolicyConnecting(
// - What is specified by settings
// - Communication with the relay server
// - Non-DNS traffic inside the VPN tunnel
-// - DNS requests inside the VPN tunnel, to the specified DNS server
+// - DNS requests inside the VPN tunnel to any specified remote DNS server
+// - DNS requests outside the VPN tunnel to any specified local DNS servers
//
// Parameters:
//
// tunnelInterfaceAlias:
// Friendly name of VPN tunnel interface
-// v4DnsHost/v6DnsHost:
-// String encoded IP address of DNS to use inside tunnel
+// dnsServers:
+// Array of string-encoded IP addresses of DNS servers to use
//
extern "C"
WINFW_LINKAGE
@@ -185,8 +186,10 @@ WinFw_ApplyPolicyConnected(
const WinFwRelay *relay,
const wchar_t *relayClient,
const wchar_t *tunnelInterfaceAlias,
- const wchar_t *v4DnsHost,
- const wchar_t *v6DnsHost
+ const wchar_t *v4Gateway,
+ const wchar_t *v6Gateway,
+ const wchar_t **dnsServers,
+ size_t numDnsServers
);
//
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.