fix: replace string-based tunnel route filter with proper CIDR containment check

The old TunnelNetworkPrefix string match was fragile and matched by
accident. Replace it with IsTunnelRoute which derives the tunnel
network prefix from the device IP and checks CIDR containment.

Also update the smoke test to use the production IP range (10.255.240.x)
and verify the tunnel network route is present.

Author: sechmann

cmd/smoke-test/main.go

@@ -28,6 +28,7 @@ import (
 const ifaceName = "utun69"
 
 var wantRoutes = []netip.Prefix{
+	netip.MustParsePrefix("10.255.240.0/21"),
 	netip.MustParsePrefix("10.123.0.0/24"),
 	netip.MustParsePrefix("10.124.0.0/16"),
 }
@@ -76,13 +77,13 @@ func run() error {
 
 	cfg := &pb.Configuration{
 		PrivateKey: privateKey.String(),
-		DeviceIPv4: "10.255.24.100",
+		DeviceIPv4: "10.255.240.100",
 		Gateways: []*pb.Gateway{
 			{
 				Name:       "smoke-gw",
 				PublicKey:  gwPublicKey.String(),
 				Endpoint:   "127.0.0.1:51820",
-				Ipv4:       "10.255.24.1",
+				Ipv4:       "10.255.240.1",
 				RoutesIPv4: []string{"10.123.0.0/24", "10.124.0.0/16"},
 			},
 		},

internal/helper/helper_darwin.go

@@ -5,9 +5,9 @@ import (
 	"errors"
 	"fmt"
 	"net"
+	"net/netip"
 	"os"
 	"os/exec"
-	"strings"
 	"sync"
 	"syscall"
 	"time"
@@ -32,6 +32,7 @@ type DarwinConfigurator struct {
 	tunDev    tun.Device
 	uapi      net.Listener
 	ifaceName string // actual interface name assigned by macOS (may differ from requested)
+	tunnelNet netip.Prefix
 }
 
 var _ OSConfigurator = &DarwinConfigurator{}
@@ -78,7 +79,7 @@ func (c *DarwinConfigurator) SetupRoutes(ctx context.Context, gateways []*pb.Gat
 	routesAdded := 0
 	for _, gw := range gateways {
 		for _, cidr := range gw.GetRoutesIPv4() {
-			if strings.HasPrefix(cidr, TunnelNetworkPrefix) {
+			if IsTunnelRoute(c.tunnelNet, cidr) {
 				continue
 			}
 			if err := addRouteViaInterface(fd, cidr, iface); err != nil {
@@ -88,10 +89,7 @@ func (c *DarwinConfigurator) SetupRoutes(ctx context.Context, gateways []*pb.Gat
 		}
 
 		for _, cidr := range gw.GetRoutesIPv6() {
-			// TunnelNetworkPrefix is an IPv4 prefix ("10.255.24.") so this check
-			// is a no-op for IPv6 CIDRs. It's kept for consistency with the IPv4
-			// loop and as a safeguard in case the prefix changes in the future.
-			if strings.HasPrefix(cidr, TunnelNetworkPrefix) {
+			if IsTunnelRoute(c.tunnelNet, cidr) {
 				continue
 			}
 			if err := addRouteViaInterface(fd, cidr, iface); err != nil {
@@ -108,6 +106,12 @@ func (c *DarwinConfigurator) SetupInterface(ctx context.Context, cfg *pb.Configu
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
+	tunnelNet, err := TunnelNetworkFromIP(cfg.GetDeviceIPv4())
+	if err != nil {
+		return fmt.Errorf("derive tunnel network: %w", err)
+	}
+	c.tunnelNet = tunnelNet
+
 	if c.wgDevice != nil {
 		return nil
 	}

internal/helper/helper_linux.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"net"
+	"net/netip"
 	"strings"
 	"syscall"
 
@@ -23,6 +24,7 @@ func New(helperConfig Config) *LinuxConfigurator {
 
 type LinuxConfigurator struct {
 	helperConfig Config
+	tunnelNet    netip.Prefix
 }
 
 var _ OSConfigurator = &LinuxConfigurator{}
@@ -44,7 +46,7 @@ func (c *LinuxConfigurator) SetupRoutes(ctx context.Context, gateways []*pb.Gate
 	routesAdded := 0
 	for _, gw := range gateways {
 		for _, cidr := range append(gw.GetRoutesIPv4(), gw.GetRoutesIPv6()...) {
-			if strings.HasPrefix(cidr, TunnelNetworkPrefix) {
+			if IsTunnelRoute(c.tunnelNet, cidr) {
 				continue
 			}
 
@@ -86,6 +88,12 @@ func (c *LinuxConfigurator) SetupRoutes(ctx context.Context, gateways []*pb.Gate
 }
 
 func (c *LinuxConfigurator) SetupInterface(ctx context.Context, cfg *pb.Configuration) error {
+	tunnelNet, err := TunnelNetworkFromIP(cfg.DeviceIPv4)
+	if err != nil {
+		return fmt.Errorf("derive tunnel network: %w", err)
+	}
+	c.tunnelNet = tunnelNet
+
 	if c.interfaceExists(ctx) {
 		return nil
 	}

internal/helper/helper_windows.go

@@ -25,10 +25,11 @@ import (
 type WindowsConfigurator struct {
 	helperConfig Config
 
-	mu       sync.Mutex
-	wgDevice *device.Device
-	tunDev   tun.Device
-	uapi     net.Listener
+	mu        sync.Mutex
+	wgDevice  *device.Device
+	tunDev    tun.Device
+	uapi      net.Listener
+	tunnelNet netip.Prefix
 }
 
 var _ OSConfigurator = &WindowsConfigurator{}
@@ -64,7 +65,7 @@ func (c *WindowsConfigurator) SetupRoutes(ctx context.Context, gateways []*pb.Ga
 	routesAdded := 0
 	for _, gw := range gateways {
 		for _, cidr := range append(gw.GetRoutesIPv4(), gw.GetRoutesIPv6()...) {
-			if strings.HasPrefix(cidr, TunnelNetworkPrefix) {
+			if IsTunnelRoute(c.tunnelNet, cidr) {
 				continue
 			}
 
@@ -97,6 +98,12 @@ func (c *WindowsConfigurator) SetupInterface(ctx context.Context, cfg *pb.Config
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
+	tunnelNet, err := TunnelNetworkFromIP(cfg.DeviceIPv4)
+	if err != nil {
+		return fmt.Errorf("derive tunnel network: %w", err)
+	}
+	c.tunnelNet = tunnelNet
+
 	if c.wgDevice != nil {
 		return nil
 	}

internal/helper/util.go

@@ -5,20 +5,41 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/netip"
 	"os"
 	"path/filepath"
 
 	"github.com/nais/device/internal/ioconvenience"
+	"github.com/nais/device/internal/iputil"
 	"github.com/sirupsen/logrus"
 )
 
 const (
-	TunnelNetworkPrefix = "10.255.24."
-
 	// wireguardMTU is the MTU used for WireGuard tunnel interfaces across all platforms.
 	wireguardMTU = 1360
+
+	// tunnelIPv4PrefixLen is the prefix length used for the IPv4 tunnel network.
+	tunnelIPv4PrefixLen = 21
 )
 
+// TunnelNetworkFromIP derives the tunnel network prefix from the device's IPv4 address.
+func TunnelNetworkFromIP(deviceIPv4 string) (netip.Prefix, error) {
+	addr, err := netip.ParseAddr(deviceIPv4)
+	if err != nil {
+		return netip.Prefix{}, fmt.Errorf("parse device IPv4 %q: %w", deviceIPv4, err)
+	}
+	return netip.PrefixFrom(addr, tunnelIPv4PrefixLen).Masked(), nil
+}
+
+// IsTunnelRoute reports whether cidr falls within the tunnel network.
+func IsTunnelRoute(tunnelNet netip.Prefix, cidr string) bool {
+	prefix, err := iputil.ParsePrefix(cidr)
+	if err != nil {
+		return false
+	}
+	return tunnelNet.Contains(prefix.Addr()) && prefix.Bits() >= tunnelNet.Bits()
+}
+
 func ZipLogFiles(files []string, log logrus.FieldLogger) (string, error) {
 	if len(files) == 0 {
 		return "nil", errors.New("can't be bothered to zip nothing")