Add DeleteUnmarkedConnections() to purge conntrack entries with mark=0
when firewall is activated. This forces applications with existing
connections to reconnect, allowing DNAT rules (like SPN) to apply.
Without this, connections established while Portmaster was paused or
stopped would bypass DNAT because netfilter's nat table is only
traversed for new connections.
Loopback connections are excluded from deletion to avoid disconnecting
local services.
https://github.com/safing/portmaster-shadow/issues/42
Introduces mark 1719 for split-tunnel rerouting, mirroring the existing SPN mark (1717).
Adds FILTER RETURN and NAT DNAT rules for both IPv4 and IPv6 targeting port 719.
Add a new verdict (value 8) for routing connections through the split
tunnel. This prepares the infrastructure for the upcoming split-tunneling
feature without implementing the full feature yet.
Changes:
- Define VerdictRerouteToSplitTun in network/status.go with String() and Verb()
- Add RerouteToSplitTun() to the Packet interface and InfoPacket stub
- Implement RerouteToSplitTun() for windowskext (v1) and windowskext2 (v2) packets
- Map VerdictRerouteToSplitTun to KextVerdict 11 in kextinterface and kext2
- Handle the verdict in packet_handler.go dispatch, connection.go, api.go,
metrics.go and nameserver.go
- Add VerdictRerouteToSplitTun = 8 to Angular Verdict enum and update
stats counting, filter queries and verdict CSS class
(WIP) Note: Linux (nfq) implementation not updated yet. Therefore Linux build will fail.
Introduce mark 1709 (MarkAcceptFinal) and a corresponding
PermanentAcceptFinal() method that sets this mark on packets belonging
to Portmaster-owned outbound connections.
Add iptables rules (both IPv4 and IPv6, filter and mangle chains) to
ACCEPT packets/connections carrying mark 1709, so further OUTPUT rules from
third-party software (e.g. iVPN) cannot override the allow decision.
https://github.com/safing/portmaster-shadow/issues/34
Add a synchronous HookMgr[T] that lets callers register pre-connect
hooks before SPN dials a home hub. The IVPN interop layer subscribes
to this hook and uses Linux ip-rule/ip-route to steer SPN hub IPs
through a dedicated routing table (717) pointing to the non-VPN default
gateway, preventing SPN control traffic from being tunnelled into IVPN.
- service/mgr: add generic HookMgr[T] (synchronous, cancellable)
- spn/captain: expose HookSPNConnecting; invoke it in connectToHomeHub
- service/netenv: add GatewayInfo + GatewaysInfo() with interface/mask
- service/interop/ivpn: add ensureSpnHubBypassVpnRoutes managing policy
routing; call it from the SPN pre-connect hook and on VPN stop/connect
- nfq/packet: add hex comments next to mark constants
https://github.com/safing/portmaster-shadow/issues/34
Add ensureJumpRulesAtTop and reinsertDisplacedRules to detect and fix
iptables jump rules that have been displaced by other services during
boot. A background worker runs checks at 5s, 15s, and 45s after nfqueue
interception starts, reinserting any out-of-position rules.
Add EventStartStopState event manager and IsStarted() method
to the Interception module so other modules can react to start/stop state changes.
Update IVPN interop to subscribe to interception start/stop events
and skip applying custom DNS settings when interception is inactive,
ensuring correct behavior when Portmaster is in the Paused state.
- Add GroupModule to wrap interception, dnsmonitor, and compat modules
- Simplify pause/resume operations by grouping related modules
- Update worker info collection to handle nested module groups
- Remove deprecated flags and improve module lifecycle management
- Add proper atomic state tracking for nfqueue interception
https://github.com/safing/portmaster/issues/2050
* [service] Add reading of PID in ETW DNS event
* [service] Use PID of the ETW DNS events
* [service] Fix use of nil pointer
* [service] Fix compiler error
* [service] Subscribe to systemd-resolver events
* [service] Add disabled state to the resolver
* [service] Add ETW DNS event listener
* [service] DNS listener refactoring
* [service] Add windows core dll project
* [service] DNSListener refactoring, small bugfixes
* [service] Change dns bypass rule
* [service] Update gitignore
* [service] Remove shim from integration module
* [service] Add DNS packet analyzer
* [service] Add self-check in dns monitor
* [service] Fix go linter errors
* [CI] Add github workflow for the windows core dll
* [service] Minor fixes to the dns monitor
* Move portbase into monorepo
* Add new simple module mgr
* [WIP] Switch to new simple module mgr
* Add StateMgr and more worker variants
* [WIP] Switch more modules
* [WIP] Switch more modules
* [WIP] swtich more modules
* [WIP] switch all SPN modules
* [WIP] switch all service modules
* [WIP] Convert all workers to the new module system
* [WIP] add new task system to module manager
* [WIP] Add second take for scheduling workers
* [WIP] Add FIXME for bugs in new scheduler
* [WIP] Add minor improvements to scheduler
* [WIP] Add new worker scheduler
* [WIP] Fix more bug related to new module system
* [WIP] Fix start handing of the new module system
* [WIP] Improve startup process
* [WIP] Fix minor issues
* [WIP] Fix missing subsystem in settings
* [WIP] Initialize managers in constructor
* [WIP] Move module event initialization to constrictors
* [WIP] Fix setting for enabling and disabling the SPN module
* [WIP] Move API registeration into module construction
* [WIP] Update states mgr for all modules
* [WIP] Add CmdLine operation support
* Add state helper methods to module group and instance
* Add notification and module status handling to status package
* Fix starting issues
* Remove pilot widget and update security lock to new status data
* Remove debug logs
* Improve http server shutdown
* Add workaround for cleanly shutting down firewall+netquery
* Improve logging
* Add syncing states with notifications for new module system
* Improve starting, stopping, shutdown; resolve FIXMEs/TODOs
* [WIP] Fix most unit tests
* Review new module system and fix minor issues
* Push shutdown and restart events again via API
* Set sleep mode via interface
* Update example/template module
* [WIP] Fix spn/cabin unit test
* Remove deprecated UI elements
* Make log output more similar for the logging transition phase
* Switch spn hub and observer cmds to new module system
* Fix log sources
* Make worker mgr less error prone
* Fix tests and minor issues
* Fix observation hub
* Improve shutdown and restart handling
* Split up big connection.go source file
* Move varint and dsd packages to structures repo
* Improve expansion test
* Fix linter warnings
* Fix interception module on windows
* Fix linter errors
---------
Co-authored-by: Vladimir Stoilov <vladimir@safing.io>
Alexandr Stelnykovych
Alexandr Stelnykovych
Alexandr Stelnykovych
Vladimir Stoilov
Vladimir Stoilov
Daniel
Patrick Pacher