CalvinBackup/ctrld
1
0
Fork 0
mirror of https://github.com/Control-D-Inc/ctrld.git synced 2026-07-16 13:17:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: flush pf states after forced DNS intercept reload

Browse Source
This commit is contained in:
Codescribe
2026-06-04 15:49:22 -04:00
committed by Cuong Manh Le
parent 723c7827ba
commit 18f01baa01
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/cli/dns_intercept_darwin.go
+8 -1
View File
@@ -1823,7 +1823,14 @@ func (p *prog) forceReloadPFMainRuleset() {
mainLog.Load().Error().Err(err).Msgf("DNS intercept: force reload — failed to load anchor (output: %s)", strings.TrimSpace(string(out)))
}
// Reset upstream transports — pf reload flushes state table, killing DoH connections.
// Flush stale rdr/reply states after the forced ruleset + anchor reload.
// Without this, macOS can keep using pre-reload state and try to send
// redirected DNS replies directly from loopback to tunnel client addresses
// (for example, 127.0.0.1:<listener> -> 100.64.0.0/10), which fails with
// "sendmsg: can't assign requested address".
flushPFStates()
// Reset upstream transports — pf reload/state flush kills existing DoH connections.
p.resetUpstreamTransports()
mainLog.Load().Info().Msg("DNS intercept: force reload — pf ruleset and anchor reloaded successfully")