Reset connection PoC

firewall/interception.go

@@ -23,6 +23,7 @@ import (
 	"github.com/safing/portmaster/network"
 	"github.com/safing/portmaster/network/netutils"
 	"github.com/safing/portmaster/network/packet"
+	"github.com/safing/spn/captain"
 )
 
 var (
@@ -48,6 +49,10 @@ func init() {
 	interceptionModule = modules.Register("interception", interceptionPrep, interceptionStart, interceptionStop, "base", "updates", "network", "notifications")
 
 	network.SetDefaultFirewallHandler(defaultHandler)
+	captain.PreConnect = func(ctx context.Context) {
+		interception.CloseAllConnections()
+	}
+	captain.ResetConnections = resetAllConnectionsVerdict
 }
 
 func interceptionPrep() error {
@@ -116,6 +121,8 @@ func handlePacket(ctx context.Context, pkt packet.Packet) {
 		return
 	}
 
+	//log.Errorf("%s -> %s", pkt, conn.Verdict)
+
 	// handle packet
 	conn.HandlePacket(pkt)
 }
@@ -161,7 +168,37 @@ func getConnection(pkt packet.Packet) (*network.Connection, error) {
 	return conn, nil
 }
 
-// fastTrackedPermit quickly permits certain network criticial or internal connections.
+func resetAllConnectionsVerdict(ctx context.Context) {
+	// interception.CloseAllConnections()
+	network.ClearConnections()
+	log.Critical("Clearing connections")
+	// interception.CloseAllConnections()
+	// ids := network.GetAllIDs()
+	// for _, id := range ids {
+	// 	connI, err, _ := getConnectionSingleInflight.Do(id, func() (interface{}, error) {
+	// 		// First, check for an existing connection.
+	// 		conn, ok := network.GetConnection(id)
+	// 		if ok {
+	// 			return conn, nil
+	// 		}
+
+	// 		return nil, nil
+	// 	})
+
+	// 	if err != nil || connI == nil {
+	// 		log.Errorf("Null connection with id %s", id)
+	// 		continue
+	// 	}
+
+	// 	conn := connI.(*network.Connection) //nolint:forcetypeassert // Can only be a *network.Connection.
+	// 	log.Errorf("Resetting connection for %s:%d", conn.LocalIP, conn.Entity.Port)
+	// 	// conn.Reset("Initialling SPN", "")
+	// 	checkTunneling(ctx, conn, nil)
+	// 	DecideOnConnection(ctx, conn, nil)
+	// }
+}
+
+// fastTrackedPermit quickly permits certain network critical or internal connections.
 func fastTrackedPermit(pkt packet.Packet) (handled bool) {
 	meta := pkt.Info()
 

firewall/interception/interception.go

@@ -2,6 +2,9 @@ package interception
 
 import (
 	"flag"
+	"fmt"
+
+	ct "github.com/florianl/go-conntrack"
 
 	"github.com/safing/portbase/log"
 	"github.com/safing/portmaster/network/packet"
@@ -49,3 +52,24 @@ func Stop() error {
 
 	return stop()
 }
+
+func CloseAllConnections() error {
+	nfct, err := ct.Open(&ct.Config{})
+	if err != nil {
+		return err
+	}
+	defer func() { _ = nfct.Close() }()
+
+	connections, err := nfct.Dump(ct.Conntrack, ct.IPv4)
+	if err != nil {
+		return err
+	}
+	log.Criticalf("Number of connections: %d", len(connections))
+	for _, connection := range connections {
+		fmt.Printf("[%2d] %s - %s\n", connection.Origin.Proto.Number, connection.Origin.Src, connection.Origin.Dst)
+		err := nfct.Delete(ct.Conntrack, ct.IPv4, connection)
+		log.Errorf("Error deleting connection %q", err)
+	}
+
+	return nil
+}

firewall/interception/interception_linux.go

@@ -1,6 +1,8 @@
 package interception
 
-import "github.com/safing/portmaster/network/packet"
+import (
+	"github.com/safing/portmaster/network/packet"
+)
 
 // start starts the interception.
 func start(ch chan packet.Packet) error {

firewall/tunnel.go

@@ -77,7 +77,7 @@ func checkTunneling(ctx context.Context, conn *network.Connection, pkt packet.Pa
 		}
 	}
 
-	// Check if tunneling is enabeld for this app at all.
+	// Check if tunneling is enabled for this app at all.
 	if !layeredProfile.UseSPN() {
 		return
 	}
@@ -101,7 +101,7 @@ func checkTunneling(ctx context.Context, conn *network.Connection, pkt packet.Pa
 	// Check if ready.
 	if !captain.ClientReady() {
 		// Block connection as SPN is not ready yet.
-		log.Tracer(pkt.Ctx()).Trace("SPN not ready for tunneling")
+		//log.Tracer(pkt.Ctx()).Trace("SPN not ready for tunneling")
 		conn.Failed("SPN not ready for tunneling", "")
 		return
 	}
@@ -152,10 +152,10 @@ func checkTunneling(ctx context.Context, conn *network.Connection, pkt packet.Pa
 	// Queue request in sluice.
 	err = sluice.AwaitRequest(conn, crew.HandleSluiceRequest)
 	if err != nil {
-		log.Tracer(pkt.Ctx()).Warningf("failed to request tunneling: %s", err)
+		//log.Tracer(pkt.Ctx()).Warningf("failed to request tunneling: %s", err)
 		conn.Failed("failed to request tunneling", "")
 	} else {
-		log.Tracer(pkt.Ctx()).Trace("filter: tunneling requested")
+		//log.Tracer(pkt.Ctx()).Trace("filter: tunneling requested")
 		conn.Verdict = network.VerdictRerouteToTunnel
 		conn.Tunneled = true
 	}

go.mod

@@ -40,6 +40,7 @@ require (
 	github.com/bluele/gcache v0.0.2 // indirect
 	github.com/danieljoos/wincred v1.1.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/florianl/go-conntrack v0.3.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.4.0 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/gofrs/uuid v4.3.0+incompatible // indirect

network/connection.go

@@ -439,6 +439,17 @@ func GetConnection(id string) (*Connection, bool) {
 	return conns.get(id)
 }
 
+// GetAllIDs Get all connection IDs.
+func GetAllIDs() []string {
+	return append(conns.keys(), dnsConns.keys()...)
+}
+
+// ClearConnections Clear all connections.
+func ClearConnections() {
+	dnsConns = newConnectionStore()
+	conns = newConnectionStore()
+}
+
 // SetLocalIP sets the local IP address together with its network scope. The
 // connection is not locked for this.
 func (conn *Connection) SetLocalIP(ip net.IP) {
@@ -508,6 +519,19 @@ func (conn *Connection) Failed(reason, reasonOptionKey string) {
 	conn.FailedWithContext(reason, reasonOptionKey, nil)
 }
 
+func (conn *Connection) Reset(reason, reasonOptionKey string) {
+	conn.Verdict = VerdictUndecided
+	conn.Reason.Msg = reason
+	conn.Reason.Context = nil
+
+	conn.Reason.OptionKey = ""
+	conn.Reason.Profile = ""
+	if reasonOptionKey != "" && conn.Process() != nil {
+		conn.Reason.OptionKey = reasonOptionKey
+		conn.Reason.Profile = conn.Process().Profile().GetProfileSource(conn.Reason.OptionKey)
+	}
+}
+
 // SetVerdict sets a new verdict for the connection, making sure it does not interfere with previous verdicts.
 func (conn *Connection) SetVerdict(newVerdict Verdict, reason, reasonOptionKey string, reasonCtx interface{}) (ok bool) {
 	if newVerdict >= conn.Verdict {

network/connection_store.go

@@ -48,6 +48,20 @@ func (cs *connectionStore) clone() map[string]*Connection {
 	return m
 }
 
+func (cs *connectionStore) keys() []string {
+	cs.rw.RLock()
+	defer cs.rw.RUnlock()
+
+	keys := make([]string, len(cs.items))
+	i := 0
+	for key := range cs.items {
+		keys[i] = key
+		i++
+	}
+
+	return keys
+}
+
 func (cs *connectionStore) len() int { //nolint:unused // TODO: Clean up if still unused.
 	cs.rw.RLock()
 	defer cs.rw.RUnlock()