hesoyam/Xray-core
1
0
Fork 0
mirror of https://github.com/XTLS/Xray-core.git synced 2026-11-05 18:07:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

TUN inbound's autoSystemWfpBlockLeak: Add "allexceptlan"

Browse Source 
"allexceptlan" is "all" but for the local network: traffic to and from
private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7), link-local
(169.254.0.0/16, fe80::/10), multicast (224.0.0.0/4, ff00::/8) and broadcast
(255.255.255.255) addresses stays allowed, so that printers, the router's
settings page, or casting to a TV keep working while nothing else leaves
outside the TUN.

It includes "dns": a resolver on the local network, like the router's,
would forward the queries outside the TUN, so DNS stays blocked there. The
LAN permit sits below the other values, like the permit through the TUN, so
they still apply on the local network, e.g. "tcp/445" blocks Windows file
sharing with it. The DNS Client service keeps mDNS and LLMNR, to the local
network's addresses only. "all" overrides it.

The addresses are matched with FWP_V4_ADDR_MASK and FWP_V6_ADDR_MASK
conditions on the remote address, which match when any of them does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
patterniha
2026-11-02 11:50:18 +03:30
co-authored by Claude Opus 5.5
parent 468f745fc2
commit bb4cd4b6d3
8 changed files with 150 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/tun/tun_windows_wfp_test.go
+30
View File
@@ -45,6 +45,16 @@ func TestWFPStructLayout(t *testing.T) {
[]uintptr{unsafe.Sizeof(ports), unsafe.Offsetof(ports.high)},
[]uintptr{32, 16}, []uintptr{16, 8})
var v4 fwpV4AddrAndMask
check("FWP_V4_ADDR_AND_MASK",
[]uintptr{unsafe.Sizeof(v4), unsafe.Offsetof(v4.mask)},
[]uintptr{8, 4}, []uintptr{8, 4})
var v6 fwpV6AddrAndMask
check("FWP_V6_ADDR_AND_MASK",
[]uintptr{unsafe.Sizeof(v6), unsafe.Offsetof(v6.prefixLength)},
[]uintptr{17, 16}, []uintptr{17, 16})
var display fwpmDisplayData0
check("FWPM_DISPLAY_DATA0",
[]uintptr{unsafe.Sizeof(display), unsafe.Offsetof(display.description)},
@@ -128,6 +138,18 @@ func TestLeakFiltersAccepted(t *testing.T) {
if err := addLeakFilters(engine, loopback, block); err != nil {
skipUnlessElevated(err)
}
// The local network's addresses, with another sublayer.
if leaks, err = ExpandWfpBlockLeak([]string{"allexceptlan", "udp/1000-2000", "icmp"}); err != nil {
t.Fatal(err)
}
block = newLeakFilters(leaks, true, false)
block.dnsClient = true
if !block.lan {
t.Fatal("allexceptlan left the local network blocked")
}
if err := addLeakFilters(engine, loopback, block); err != nil {
skipUnlessElevated(err)
}
}
func TestNewLeakFilters(t *testing.T) {
@@ -148,6 +170,9 @@ func TestNewLeakFilters(t *testing.T) {
{[]string{"misconfigtun"}, true, false, "IPv6", false},
{[]string{"tcp/10-20", "udp", "icmp"}, true, true, "tcp/10-20, udp, icmp", true},
{[]string{"tcp/54-60", "icmp"}, true, true, "tcp/54-60, icmp", false},
{[]string{"allexceptlan"}, true, true, "udp/53, tcp/53, tcp/853, udp/853" + windnsclient + ", IPv4 except LAN, IPv6 except LAN", true},
{[]string{"allexceptlan", "all"}, true, true, "udp/53, tcp/53, tcp/853, udp/853" + windnsclient + ", IPv4, IPv6", true},
{[]string{"misconfigtun", "allexceptlan"}, true, false, "udp/53, tcp/53, tcp/853, udp/853" + windnsclient + ", IPv4 except LAN, IPv6 except LAN", true},
} {
leaks, err := ExpandWfpBlockLeak(c.values)
if err != nil {
@@ -161,6 +186,11 @@ func TestNewLeakFilters(t *testing.T) {
t.Errorf("%v: systemDNS() = %v", c.values, got)
}
}
// Without the port 53 values "allexceptlan" brings along, a resolver on
// the local network, like the router's, stays reachable.
if (leakFilters{ipv4: true, ipv6: true, lan: true}).systemDNS() {
t.Error("systemDNS() = true with the local network open")
}
}
func TestDNSClientSID(t *testing.T) {