Block WSL/Hyper-V traffic in secured states (except connected state)

[dlon]

This PR adds a rule for blocking Hyper-V traffic in select states using WMI. This is more or less equivalent to running the PowerShell command New-NetFirewallHyperVRule -Direction Outbound -Action Block -DisplayName "Mullvad VPN block-all rule". Previously, WSL instances would leak while in the blocked (or connecting) state, or while lockdown mode was active.

Close DES-1365.

Fixes #6997.

---

This change is 

[linear]

DES-1365 Block WSL traffic in connecting, error, and lockdown states

[Serock3]

Reviewed 2 of 6 files at r1, 1 of 2 files at r2, all commit messages.
Reviewable status: 3 of 8 files reviewed, 1 unresolved discussion (waiting on @dlon)

---

docs/known-issues.md line 193 at r2 (raw file):

Windows host that Mullvad use to prevent leaks). This means that if there is a VPN tunnel
up and running, the Linux guest’s traffic will be sent via the VPN with no leaks!
In the other states, the mitigation above is used to prevent leaks.

You should maybe mention that the fix requires the firewall setting for WSL to be enabled https://learn.microsoft.com/en-us/windows/wsl/wsl-config#main-wsl-settings. It should be be on by default for Windows 11 version 22H2. But with an older version of Windows, or if the setting is explicitly disabled, the app will leak.

[dlon]

Reviewable status: 2 of 8 files reviewed, 1 unresolved discussion (waiting on @Serock3)

---

docs/known-issues.md line 193 at r2 (raw file):

Previously, Serock3 (Sebastian Holmin) wrote…

You should maybe mention that the fix requires the firewall setting for WSL to be enabled https://learn.microsoft.com/en-us/windows/wsl/wsl-config#main-wsl-settings. It should be be on by default for Windows 11 version 22H2. But with an older version of Windows, or if the setting is explicitly disabled, the app will leak.

Done. I've clarified that the mitigation doesn't work at all on earlier versions.

[Serock3]

Reviewed 2 of 6 files at r1, 1 of 2 files at r2, 3 of 3 files at r3, all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved