feat: add macOS pf DNS interception

Browse Source

Implement DNS interception on macOS using pf (packet filter):
- Anchor injection into running ruleset (not /etc/pf.conf)
- route-to lo0 + rdr rules for locally-originated DNS capture
- _ctrld group exemption so ctrld's own queries bypass interception
- Watchdog to detect and restore wiped anchor rules
- Probe-based auto-heal for Parallels VM pf corruption
- IPv6 DNS blocking and block-return for clean timeouts
- Interface-specific tunnel detection for VPN coexistence
- Port 5354 fallback in intercept mode

Includes pf technical reference docs and test scripts.

Squashed from intercept mode development on v1.0 branch (#497).

...

This commit is contained in:

Codescribe

2026-03-03 02:07:11 -05:00

committed by Cuong Manh Le

parent 1e8240bd1c

commit 289a46dc2c

13 changed files with 4820 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

cmd/cli/dns_intercept_darwin.go

+1872

File diff suppressed because it is too large Load Diff