fix(routing): never route multicast or broadcast off-box - #16
Open
wighawag wants to merge 1 commit into
Open
Conversation
Contributor
Author
`is_mesh_or_link_local` checks loopback, link-local, broadcast and unspecified, but not multicast. With an exit node configured, multicast therefore passes the internet catch-all in `lookup_ip` and is tunneled to the exit peer. Broadcast leaks by a different path: an exit node contributes `0.0.0.0/0` to the subnet table, and that entry matches before the catch-all is reached. LAN discovery protocols (mDNS, SSDP, Ableton Link) beacon on every interface including the mesh interface, continuously. On one host that was a steady 8 packets/s of local service announcements, which on any machine with an exit node would be pushed through the tunnel and out of the exit. Reject both before the subnet lookup and before the catch-all. Placing the check earlier is what closes the broadcast path; adding `is_multicast` to `is_mesh_or_link_local` alone would not have. The mDNS relay is unaffected: it republishes discovered services over its own mesh topic rather than tunneling raw multicast frames. Both new tests fail without the fix and pass with it, and an existing assertion that ordinary internet traffic still reaches the exit node is kept alongside them.
wighawag
force-pushed
the
fix/multicast-exit-node-leak
branch
from
September 6, 2026 14:55
2e6a426 to
61964ab
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
is_mesh_or_link_localchecks loopback, link-local, broadcast and unspecified, but not multicast. With an exit node configured, multicast therefore passed the internet catch-all inroute_onceand was tunneled to the exit peer. Broadcast leaked by a different path: an exit node contributes0.0.0.0/0to the subnet table, and that LPM entry matched before the catch-all was reached.LAN discovery protocols (mDNS, SSDP, Ableton Link) beacon on every interface including the mesh interface, continuously and forever. On one host that was a steady 8 packets/s of local service announcements, which on any machine with an exit node would have been pushed through the tunnel and out of the exit node.
Reject both before the subnet lookup and before the catch-all. Placing the check earlier is what closes the broadcast path; adding
is_multicasttois_mesh_or_link_localalone would not have.The mDNS relay is unaffected: it republishes discovered services over its own mesh topic rather than tunneling raw multicast frames.
Both tests fail without the fix and pass with it, and an existing assertion that ordinary internet traffic still reaches the exit node is kept alongside them.