Reset connection PoC

firewall/interception.go

@@ -23,6 +23,7 @@ import (
 	"github.com/safing/portmaster/network"
 	"github.com/safing/portmaster/network/netutils"
 	"github.com/safing/portmaster/network/packet"
+	"github.com/safing/spn/captain"
 )
 
 var (
@@ -48,6 +49,10 @@ func init() {
 	interceptionModule = modules.Register("interception", interceptionPrep, interceptionStart, interceptionStop, "base", "updates", "network", "notifications")
 
 	network.SetDefaultFirewallHandler(defaultHandler)
+	captain.PreConnect = func(ctx context.Context) {
+		interception.CloseAllConnections()
+	}
+	captain.ResetConnections = resetAllConnectionsVerdict
 }
 
 func interceptionPrep() error {
@@ -116,6 +121,8 @@ func handlePacket(ctx context.Context, pkt packet.Packet) {
 		return
 	}
 
+	//log.Errorf("%s -> %s", pkt, conn.Verdict)
+
 	// handle packet
 	conn.HandlePacket(pkt)
 }
@@ -161,7 +168,37 @@ func getConnection(pkt packet.Packet) (*network.Connection, error) {
 	return conn, nil
 }
 
-// fastTrackedPermit quickly permits certain network criticial or internal connections.
+func resetAllConnectionsVerdict(ctx context.Context) {
+	// interception.CloseAllConnections()
+	network.ClearConnections()
+	log.Critical("Clearing connections")
+	// interception.CloseAllConnections()
+	// ids := network.GetAllIDs()
+	// for _, id := range ids {
+	// 	connI, err, _ := getConnectionSingleInflight.Do(id, func() (interface{}, error) {
+	// 		// First, check for an existing connection.
+	// 		conn, ok := network.GetConnection(id)
+	// 		if ok {
+	// 			return conn, nil
+	// 		}
+
+	// 		return nil, nil
+	// 	})
+
+	// 	if err != nil || connI == nil {
+	// 		log.Errorf("Null connection with id %s", id)
+	// 		continue
+	// 	}
+
+	// 	conn := connI.(*network.Connection) //nolint:forcetypeassert // Can only be a *network.Connection.
+	// 	log.Errorf("Resetting connection for %s:%d", conn.LocalIP, conn.Entity.Port)
+	// 	// conn.Reset("Initialling SPN", "")
+	// 	checkTunneling(ctx, conn, nil)
+	// 	DecideOnConnection(ctx, conn, nil)
+	// }
+}
+
+// fastTrackedPermit quickly permits certain network critical or internal connections.
 func fastTrackedPermit(pkt packet.Packet) (handled bool) {
 	meta := pkt.Info()
 

firewall/interception/interception.go

@@ -2,6 +2,9 @@ package interception
 
 import (
 	"flag"
+	"fmt"
+
+	ct "github.com/florianl/go-conntrack"
 
 	"github.com/safing/portbase/log"
 	"github.com/safing/portmaster/network/packet"
@@ -49,3 +52,24 @@ func Stop() error {
 
 	return stop()
 }
+
+func CloseAllConnections() error {
+	nfct, err := ct.Open(&ct.Config{})
+	if err != nil {
+		return err
+	}
+	defer func() { _ = nfct.Close() }()
+
+	connections, err := nfct.Dump(ct.Conntrack, ct.IPv4)
+	if err != nil {
+		return err
+	}
+	log.Criticalf("Number of connections: %d", len(connections))
+	for _, connection := range connections {
+		fmt.Printf("[%2d] %s - %s\n", connection.Origin.Proto.Number, connection.Origin.Src, connection.Origin.Dst)
+		err := nfct.Delete(ct.Conntrack, ct.IPv4, connection)
+		log.Errorf("Error deleting connection %q", err)
+	}
+
+	return nil
+}

firewall/interception/interception_linux.go

@@ -1,6 +1,8 @@
 package interception
 
-import "github.com/safing/portmaster/network/packet"
+import (
+	"github.com/safing/portmaster/network/packet"
+)
 
 // start starts the interception.
 func start(ch chan packet.Packet) error {

firewall/tunnel.go

@@ -77,7 +77,7 @@ func checkTunneling(ctx context.Context, conn *network.Connection, pkt packet.Pa
 		}
 	}
 
-	// Check if tunneling is enabeld for this app at all.
+	// Check if tunneling is enabled for this app at all.
 	if !layeredProfile.UseSPN() {
 		return
 	}
@@ -101,7 +101,7 @@ func checkTunneling(ctx context.Context, conn *network.Connection, pkt packet.Pa
 	// Check if ready.
 	if !captain.ClientReady() {
 		// Block connection as SPN is not ready yet.
-		log.Tracer(pkt.Ctx()).Trace("SPN not ready for tunneling")
+		//log.Tracer(pkt.Ctx()).Trace("SPN not ready for tunneling")
 		conn.Failed("SPN not ready for tunneling", "")
 		return
 	}
@@ -152,10 +152,10 @@ func checkTunneling(ctx context.Context, conn *network.Connection, pkt packet.Pa
 	// Queue request in sluice.
 	err = sluice.AwaitRequest(conn, crew.HandleSluiceRequest)
 	if err != nil {
-		log.Tracer(pkt.Ctx()).Warningf("failed to request tunneling: %s", err)
+		//log.Tracer(pkt.Ctx()).Warningf("failed to request tunneling: %s", err)
 		conn.Failed("failed to request tunneling", "")
 	} else {
-		log.Tracer(pkt.Ctx()).Trace("filter: tunneling requested")
+		//log.Tracer(pkt.Ctx()).Trace("filter: tunneling requested")
 		conn.Verdict = network.VerdictRerouteToTunnel
 		conn.Tunneled = true
 	}