check inner packet srcIP against server-verified srcIP, Windows support

client/os_windows.go

@@ -0,0 +1,76 @@
+//go:build windows
+
+package main
+
+import (
+	"os"
+	"os/exec"
+
+	"golang.org/x/sys/windows"
+	"golang.zx2c4.com/wintun"
+)
+
+var session wintun.Session
+var readWait windows.Handle
+
+func isAdmin() bool {
+	f, err := os.Open("\\\\.\\PHYSICALDRIVE0")
+	if err != nil {
+		return false
+	}
+	f.Close()
+	return true
+}
+
+func setupInterface() {
+	adapter, err := wintun.CreateAdapter("baalvpn", "Wintun", nil)
+	if err != nil {
+		panic(err)
+	}
+
+	session, err = adapter.StartSession(0x800000)
+	if err != nil {
+		panic(err)
+	}
+	readWait = session.ReadWaitEvent()
+
+	if err := exec.Command("netsh", "interface", "ipv6", "add", "address", "interface=baalvpn", "address="+internalIP.String()).Run(); err != nil {
+		panic(err)
+	}
+	if err := exec.Command("netsh", "interface", "ipv6", "set", "interface", "interface=baalvpn", "forwarding=disabled").Run(); err != nil {
+		panic(err)
+	}
+	if err := exec.Command("netsh", "interface", "ipv6", "add", "route", "fd00:baa1::/32", "interface=baalvpn").Run(); err != nil {
+		panic(err)
+	}
+	if err := exec.Command("netsh", "advfirewall", "firewall", "add", "rule", "name=BaalVPN In", "dir=in", "action=allow", "remoteip=fd00:baa1::/32").Run(); err != nil {
+		panic(err)
+	}
+	if err := exec.Command("netsh", "advfirewall", "firewall", "add", "rule", "name=BaalVPN Out", "dir=out", "action=allow", "remoteip=fd00:baa1::/32").Run(); err != nil {
+		panic(err)
+	}
+}
+
+func writePkt(pkt []byte) error {
+	sp, err := session.AllocateSendPacket(len(pkt))
+	if err != nil {
+		return err
+	}
+	copy(sp, pkt)
+	session.SendPacket(sp)
+	return nil
+}
+
+func readPkt() ([]byte, error) {
+	for {
+		pkt, err := session.ReceivePacket()
+		if err == nil {
+			return pkt, nil
+		}
+		windows.WaitForSingleObject(readWait, windows.INFINITE)
+	}
+}
+
+func releasePkt(pkt []byte) {
+	session.ReleaseReceivePacket(pkt)
+}