From 7a8450cc402b09e2ff119249dec39777d793417a Mon Sep 17 00:00:00 2001 From: Codescribe Date: Thu, 4 Jun 2026 15:49:22 -0400 Subject: [PATCH] fix: flush pf states after forced DNS intercept reload --- cmd/cli/dns_intercept_darwin.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/cmd/cli/dns_intercept_darwin.go b/cmd/cli/dns_intercept_darwin.go index 96fc7e9..586ea42 100644 --- a/cmd/cli/dns_intercept_darwin.go +++ b/cmd/cli/dns_intercept_darwin.go @@ -1737,7 +1737,14 @@ func (p *prog) forceReloadPFMainRuleset() { mainLog.Load().Error().Err(err).Msgf("DNS intercept: force reload — failed to load anchor (output: %s)", strings.TrimSpace(string(out))) } - // Reset upstream transports — pf reload flushes state table, killing DoH connections. + // Flush stale rdr/reply states after the forced ruleset + anchor reload. + // Without this, macOS can keep using pre-reload state and try to send + // redirected DNS replies directly from loopback to tunnel client addresses + // (for example, 127.0.0.1: -> 100.64.0.0/10), which fails with + // "sendmsg: can't assign requested address". + flushPFStates() + + // Reset upstream transports — pf reload/state flush kills existing DoH connections. p.resetUpstreamTransports() mainLog.Load().Info().Msg("DNS intercept: force reload — pf ruleset and anchor reloaded successfully")