Fixes

firewall/interception/interception_linux.go

@@ -15,7 +15,7 @@ func stop() error {
 	return StopNfqueueInterception()
 }
 
-// ResetAllConnections resets all connections so they are forced to go thought the firewall again.
-func ResetAllConnections() error {
+// ResetVerdictOfAllConnections resets all connections so they are forced to go thought the firewall again.
+func ResetVerdictOfAllConnections() error {
 	return nfq.DeleteAllMarkedConnection()
 }

firewall/interception/interception_windows.go

@@ -39,7 +39,7 @@ func stop() error {
 	return windowskext.Stop()
 }
 
-// ResetAllConnections resets all connections so they are forced to go thought the firewall again
-func ResetAllConnections() error {
+// ResetVerdictOfAllConnections resets all connections so they are forced to go thought the firewall again.
+func ResetVerdictOfAllConnections() error {
 	return windowskext.ClearCache()
 }

firewall/interception/nfq/conntrack.go

@@ -6,6 +6,8 @@ import (
 	"encoding/binary"
 
 	ct "github.com/florianl/go-conntrack"
+	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/netenv"
 )
 
 // DeleteAllMarkedConnection deletes all marked entries from the conntrack table.
@@ -17,37 +19,42 @@ func DeleteAllMarkedConnection() error {
 	defer func() { _ = nfct.Close() }()
 
 	// Delete all ipv4 marked connections
-	connections := getAllMarkedConnections(nfct, ct.IPv4)
-	for _, connection := range connections {
-		_ = nfct.Delete(ct.Conntrack, ct.IPv4, connection)
-	}
+	deleteMarkedConnections(nfct, ct.IPv4)
 
-	// Delete all ipv6 marked connections
-	connections = getAllMarkedConnections(nfct, ct.IPv6)
-	for _, connection := range connections {
-		_ = nfct.Delete(ct.Conntrack, ct.IPv6, connection)
+	if netenv.IPv6Enabled() {
+		// Delete all ipv6 marked connections
+		deleteMarkedConnections(nfct, ct.IPv6)
 	}
 
 	return nil
 }
 
-func getAllMarkedConnections(nfct *ct.Nfct, f ct.Family) []ct.Con {
+func deleteMarkedConnections(nfct *ct.Nfct, f ct.Family) {
 	// initialize variables
 	permanentFlags := [...]uint32{MarkAccept, MarkBlock, MarkDrop, MarkAcceptAlways, MarkBlockAlways, MarkDropAlways, MarkRerouteNS, MarkRerouteSPN}
 	filter := ct.FilterAttr{}
 	filter.MarkMask = []byte{0xFF, 0xFF, 0xFF, 0xFF}
 	filter.Mark = []byte{0x00, 0x00, 0x00, 0x00} // 4 zeros starting value
-	connections := make([]ct.Con, 0)
 
 	// get all connections from the specified family (ipv4 or ipv6)
 	for _, mark := range permanentFlags {
 		binary.BigEndian.PutUint32(filter.Mark, mark) // Little endian is in reverse not sure why. BigEndian makes it in correct order.
 		currentConnections, err := nfct.Query(ct.Conntrack, f, filter)
 		if err != nil {
+			log.Warningf("nfq: error on conntrack query: %s", err)
 			continue
 		}
-		connections = append(connections, currentConnections...)
-	}
 
-	return connections
+		numberOfErrors := 0
+		for _, connection := range currentConnections {
+			err = nfct.Delete(ct.Conntrack, ct.IPv4, connection)
+			if err != nil {
+				numberOfErrors++
+			}
+		}
+
+		if numberOfErrors > 0 {
+			log.Warningf("nfq: failed to delete %d conntrack entries last error is: %s", numberOfErrors, err)
+		}
+	}
 }

firewall/interception/windowskext/kext.go

@@ -95,8 +95,7 @@ func Init(dllPath, driverPath string) error {
 	new.clearCache, err = new.dll.FindProc("PortmasterClearCache")
 	if err != nil {
 		// the loaded dll is an old version
-		log.Errorf("could not find proc PortmasterClearCache in dll: %s", err)
-		log.Warning("are you using the latest kext version?")
+		log.Errorf("could not find proc PortmasterClearCache (v0.x.x+) in dll: %s", err)
 	}
 
 	// initialize dll/kext