In Kubernetes environments using Cilium or similar CNI plugins, pod
CIDR addresses (e.g. 100.65.x.x) from the RFC 6598 CGNAT range
(100.64.0.0/10) were being gathered as valid ICE host candidates.
This caused WireGuard endpoints to resolve to non-routable pod IPs,
producing overlay-routed connections with degraded latency instead of
true P2P paths between hosts.
Add three layers of defense:
- Expand the default interface blacklist with common Kubernetes CNI
interface prefixes (cilium_, lxc, cali, flannel, cni, weave)
- Filter local and remote ICE candidates whose addresses fall within
the CGNAT range but outside the NetBird WireGuard network
- Reject UDP mux writes to CGNAT addresses as a defense-in-depth
fallback
- Move `util/grpc` and `util/net` to `client` so `internal` packages can be accessed
- Add methods to return the next best interface after the NetBird interface.
- Use `IP_UNICAST_IF` sock opt to force the outgoing interface for the NetBird `net.Dialer` and `net.ListenerConfig` to avoid routing loops. The interface is picked by the new route lookup method.
- Some refactoring to avoid import cycles
- Old behavior is available through `NB_USE_LEGACY_ROUTING=true` env var
Deduplicate STUN package sending.
Originally, because every peer shared the same UDP address, the library could not distinguish which STUN message was associated with which candidate. As a result, the Pion library responded from all candidates for every STUN message.
Zoltán Papp