Tunnel flag bugfix and refactoring

firewall/interception/connection_manager_linux.go

@@ -1,95 +0,0 @@
-package interception
-
-import (
-	"encoding/binary"
-	"fmt"
-	"net"
-
-	ct "github.com/florianl/go-conntrack"
-
-	"github.com/safing/portbase/log"
-	"github.com/safing/portmaster/firewall/interception/nfq"
-)
-
-// CloseAllConnections closes all active connection on conntrack.
-func CloseAllConnections() error {
-	nfct, err := ct.Open(&ct.Config{})
-	if err != nil {
-		return err
-	}
-	defer func() { _ = nfct.Close() }()
-
-	connections, err := nfct.Dump(ct.Conntrack, ct.IPv4)
-	if err != nil {
-		return err
-	}
-	log.Criticalf("Number of connections: %d", len(connections))
-	for _, connection := range connections {
-		fmt.Printf("[%2d] %s - %s\n", connection.Origin.Proto.Number, connection.Origin.Src, connection.Origin.Dst)
-		err := nfct.Delete(ct.Conntrack, ct.IPv4, connection)
-		log.Errorf("Error deleting connection %q", err)
-	}
-
-	return nil
-}
-
-// DeleteAllConnections deletes all entries from conntrack table.
-func DeleteAllConnections() error {
-	nfct, err := ct.Open(&ct.Config{})
-	if err != nil {
-		return err
-	}
-	defer func() { _ = nfct.Close() }()
-
-	connections, err := getAllPermanentConnections(nfct)
-
-	for _, connection := range connections {
-		_ = nfct.Delete(ct.Conntrack, ct.IPv4, connection)
-	}
-
-	return err
-}
-
-// DeleteConnection deletes a specific connection.
-func DeleteConnection(sourceIP net.IP, sourcePort uint16, destinationIP net.IP, destinationPort uint16) error {
-	nfct, err := ct.Open(&ct.Config{})
-	if err != nil {
-		return err
-	}
-	defer func() { _ = nfct.Close() }()
-
-	filter := &ct.IPTuple{Src: &sourceIP, Dst: &destinationIP, Proto: &ct.ProtoTuple{SrcPort: &sourcePort, DstPort: &destinationPort}}
-	connectionFilter := ct.Con{
-		Origin: filter,
-	}
-
-	connections, _ := nfct.Get(ct.Conntrack, ct.IPv4, connectionFilter)
-	for _, connection := range connections {
-		_ = nfct.Delete(ct.Conntrack, ct.IPv4, connection)
-	}
-
-	connectionFilter.Origin = nil
-	connectionFilter.Reply = filter
-	connections, err = nfct.Get(ct.Conntrack, ct.IPv4, connectionFilter)
-	for _, connection := range connections {
-		_ = nfct.Delete(ct.Conntrack, ct.IPv4, connection)
-	}
-	return err
-}
-
-func getAllPermanentConnections(nfct *ct.Nfct) ([]ct.Con, error) {
-	permanentFlags := []uint32{nfq.MarkAccept, nfq.MarkBlock, nfq.MarkDrop, nfq.MarkAcceptAlways, nfq.MarkBlockAlways, nfq.MarkDropAlways, nfq.MarkRerouteSPN}
-	filter := ct.FilterAttr{}
-	filter.MarkMask = []byte{0xFF, 0xFF, 0xFF, 0xFF}
-	filter.Mark = []byte{0x00, 0x00, 0x00, 0x00} // 4 zeros starting value
-	connections := make([]ct.Con, 0)
-	for _, mark := range permanentFlags {
-		binary.BigEndian.PutUint32(filter.Mark, mark) // Little endian is in reverse not sure why. BigEndian makes it in correct order.
-		currentConnections, err := nfct.Query(ct.Conntrack, ct.IPv4, filter)
-		if err != nil {
-			return nil, err
-		}
-		connections = append(connections, currentConnections...)
-	}
-	return connections, nil
-}

firewall/interception/nfq/conntrack.go

@@ -0,0 +1,53 @@
+//go:build linux
+
+package nfq
+
+import (
+	"encoding/binary"
+
+	ct "github.com/florianl/go-conntrack"
+)
+
+// DeleteAllMarkedConnection deletes all marked entries from the conntrack table.
+func DeleteAllMarkedConnection() error {
+	nfct, err := ct.Open(&ct.Config{})
+	if err != nil {
+		return err
+	}
+	defer func() { _ = nfct.Close() }()
+
+	// Delete all ipv4 marked connections
+	connections := getAllMarkedConnections(nfct, ct.IPv4)
+	for _, connection := range connections {
+		_ = nfct.Delete(ct.Conntrack, ct.IPv4, connection)
+	}
+
+	// Delete all ipv6 marked connections
+	connections = getAllMarkedConnections(nfct, ct.IPv6)
+	for _, connection := range connections {
+		_ = nfct.Delete(ct.Conntrack, ct.IPv6, connection)
+	}
+
+	return nil
+}
+
+func getAllMarkedConnections(nfct *ct.Nfct, f ct.Family) []ct.Con {
+	// initialize variables
+	permanentFlags := [...]uint32{MarkAccept, MarkBlock, MarkDrop, MarkAcceptAlways, MarkBlockAlways, MarkDropAlways, MarkRerouteNS, MarkRerouteSPN}
+	filter := ct.FilterAttr{}
+	filter.MarkMask = []byte{0xFF, 0xFF, 0xFF, 0xFF}
+	filter.Mark = []byte{0x00, 0x00, 0x00, 0x00} // 4 zeros starting value
+	connections := make([]ct.Con, 0)
+
+	// get all connections from the specified family (ipv4 or ipv6)
+	for _, mark := range permanentFlags {
+		binary.BigEndian.PutUint32(filter.Mark, mark) // Little endian is in reverse not sure why. BigEndian makes it in correct order.
+		currentConnections, err := nfct.Query(ct.Conntrack, f, filter)
+		if err != nil {
+			continue
+		}
+		connections = append(connections, currentConnections...)
+	}
+
+	return connections
+}

firewall/interception/nfqueue_linux.go

@@ -341,3 +341,8 @@ func (dnfq *disabledNfQueue) PacketChannel() <-chan packet.Packet {
 }
 
 func (dnfq *disabledNfQueue) Destroy() {}
+
+// ResetAllConnections resets all connections so they are forced to go thought the firewall again
+func ResetAllConnections() error {
+	return nfq.DeleteAllMarkedConnection()
+}