Protect against rogue routes by adversarial nodes

Do not blindly trust routes announced by other nodes.
This first step simply checks that announced routes are
inside the configured routed network.

wg/wireguard.go

@@ -144,6 +144,9 @@ func (s *State) SetUpInterface(nodes []common.Node, routedNet *net.IPNet) error
 		})
 		// via routes
 		for _, route := range node.Routes {
+			if !routedNet.Contains(route.IP) {
+				continue
+			}
 			routes = append(routes, netlink.Route{
 				LinkIndex: link.Attrs().Index,
 				Dst:       &route,