net: if: Add special handling for IPv4/6 address check for VPN

This is a hack that is used until we have proper IP routing
in place. The code has now special check that makes sure that
we only route IP packets to VPN interface when the packet is
destined to that subnet. So if destination IP address does
not belong to VPN interface subnet, it is not routed there.

Signed-off-by: Jukka Rissanen <[email protected]>

Author: jukkar

subsys/net/ip/net_if.c

@@ -3130,6 +3130,29 @@ static struct in6_addr *net_if_ipv6_get_best_match(struct net_if *iface,
 			continue;
 		}
 
+		/* This is a dirty hack until we have proper IPv6 routing.
+		 * Without this the IPv6 packets might go to VPN interface for
+		 * subnets that are not on the same subnet as the VPN interface
+		 * which typically is not desired.
+		 * TODO: Implement IPv6 routing support and remove this hack.
+		 */
+		if (IS_ENABLED(CONFIG_WIREGUARD)) {
+			/* For Wireguard VPN interface, we need to check if
+			 * address matches exactly the address of the interface.
+			 */
+			if (net_if_l2(iface) == &NET_L2_GET_NAME(VIRTUAL) &&
+			    net_virtual_get_iface_capabilities(iface) == VIRTUAL_INTERFACE_VPN) {
+				/* FIXME: Do not hard code the prefix length */
+				if (!net_ipv6_is_prefix(
+					    (const uint8_t *)&ipv6->unicast[i].address.in6_addr,
+					    (const uint8_t *)dst,
+					    64)) {
+					/* Skip this address as it is no match */
+					continue;
+				}
+			}
+		}
+
 		len = get_diff_ipv6(dst, &ipv6->unicast[i].address.in6_addr);
 		if (len >= prefix_len) {
 			len = prefix_len;
@@ -3679,6 +3702,29 @@ static struct in_addr *net_if_ipv4_get_best_match(struct net_if *iface,
 			continue;
 		}
 
+		/* This is a dirty hack until we have proper IPv4 routing.
+		 * Without this the IPv4 packets might go to VPN interface for
+		 * subnets that are not on the same subnet as the VPN interface
+		 * which typically is not desired.
+		 * TODO: Implement IPv4 routing support and remove this hack.
+		 */
+		if (IS_ENABLED(CONFIG_WIREGUARD)) {
+			/* For Wireguard VPN interface, we need to check if
+			 * address matches exactly the address of the interface.
+			 */
+			if (net_if_l2(iface) == &NET_L2_GET_NAME(VIRTUAL) &&
+			    net_virtual_get_iface_capabilities(iface) == VIRTUAL_INTERFACE_VPN) {
+				subnet.s_addr = ipv4->unicast[i].ipv4.address.in_addr.s_addr &
+					ipv4->unicast[i].netmask.s_addr;
+
+				if (subnet.s_addr !=
+				    (dst->s_addr & ipv4->unicast[i].netmask.s_addr)) {
+					/* Skip this address as it is no match */
+					continue;
+				}
+			}
+		}
+
 		subnet.s_addr = ipv4->unicast[i].ipv4.address.in_addr.s_addr &
 				ipv4->unicast[i].netmask.s_addr;
 		len = get_diff_ipv4(dst, &subnet);