hesoyam/Xray-core
1
0
Fork 0
mirror of https://github.com/XTLS/Xray-core.git synced 2026-10-29 14:37:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

TUN inbound: Block IPv4 too when it is not routed to the TUN on Windows

Browse Source 
autoSystemWfpBlockLeak blocked IPv6 when the TUN had no IPv6 address or
no IPv6 route, and IPv4 never: with only IPv6 routed to the TUN, IPv4
went around it. Now each IP version is blocked when no route of it leads
to the TUN, except for loopback, DHCP, IPv6 neighbor and multicast
listener discovery, and Xray itself.

Addresses no longer count: without one of a version in gateway, Windows
gives the TUN a link-local one itself (fe80:: at once, 169.254.x.x after
some seconds), and what is routed to the TUN goes through it with that,
so a TUN with IPv6 routes but no IPv6 address had its IPv6 blocked for
nothing.

Tested on Windows 11, elevated: with only IPv6 routed, other programs'
IPv4 is denied, while loopback, a DHCP renew of Wi-Fi and Xray still
work; without gateway, IPv4 and IPv6 routed to the TUN enter it from
169.254.x.x and fe80::.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
patterniha
2026-09-30 03:07:14 +03:30
co-authored by Claude Opus 5.5
parent 4ec4fb8aab
commit de02da553a
4 changed files with 60 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/tun/tun_windows.go
+16 -11
View File
@@ -247,17 +247,22 @@ startOver:
}
// With autoSystemWfpBlockLeak, once the system routes lead to the TUN,
// keep DNS if dns is set, and IPv6 if the TUN cannot carry it (no IPv6
// address, or no IPv6 route to it), from leaving through the other
// interfaces.
if blockDNS, blockIPv6 := len(dns) > 0, !address6 || !route6; t.options.AutoSystemWfpBlockLeak && (route4 || route6) && (blockDNS || blockIPv6) {
if t.wfp, err = blockLeaks(t.luid, blockDNS, blockIPv6); err != nil {
what := "DNS and IPv6"
if !blockIPv6 {
what = "DNS"
} else if !blockDNS {
what = "IPv6"
// keep DNS if dns is set, and an IP version no route of which leads to
// the TUN, from leaving through the other interfaces. Addresses do not
// matter: without one of a version in gateway, Windows gives the TUN a
// link-local one.
if blockDNS, blockIPv4, blockIPv6 := len(dns) > 0, !route4, !route6; t.options.AutoSystemWfpBlockLeak && (route4 || route6) && (blockDNS || blockIPv4 || blockIPv6) {
if t.wfp, err = blockLeaks(t.luid, blockDNS, blockIPv4, blockIPv6); err != nil {
var blocked []string
for _, b := range []struct {
on bool
what string
}{{blockDNS, "DNS"}, {blockIPv4, "IPv4"}, {blockIPv6, "IPv6"}} {
if b.on {
blocked = append(blocked, b.what)
}
}
what := strings.Join(blocked, " and ")
// Rather no TUN than a leaking one. Before Windows 10 the filters are
// untested, and sing-box's broke its TUN there (SagerNet/sing-box#3659),
// so older versions only get a warning.
@@ -266,7 +271,7 @@ startOver:
}
errors.LogWarningInner(context.Background(), err, "[tun] unable to block ", what, " outside the TUN, leaks are possible")
} else {
errors.LogInfo(context.Background(), "[tun] outside the TUN, blocked DNS: ", blockDNS, ", blocked IPv6: ", blockIPv6)
errors.LogInfo(context.Background(), "[tun] outside the TUN, blocked DNS: ", blockDNS, ", blocked IPv4: ", blockIPv4, ", blocked IPv6: ", blockIPv6)
if blockDNS {
covered := slices.Clone(addresses)
for _, route := range routesData {