CalvinBackup/ctrld
1
0
Fork 0
mirror of https://github.com/Control-D-Inc/ctrld.git synced 2026-09-17 01:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: add firewall mode DNS-resolved IP allowlist

Browse Source
This commit is contained in:
Codescribe
2026-07-08 15:31:54 +07:00
committed by Cuong Manh Le
parent 9eb7067fbe
commit 8330049b66
25 changed files with 2618 additions and 335 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config.go
+8 -2
View File
@@ -247,8 +247,14 @@ type ServiceConfig struct {
ForceRefetchWaitTime *int `mapstructure:"force_refetch_wait_time" toml:"force_refetch_wait_time,omitempty"`
LeakOnUpstreamFailure *bool `mapstructure:"leak_on_upstream_failure" toml:"leak_on_upstream_failure,omitempty"`
InterceptMode string `mapstructure:"intercept_mode" toml:"intercept_mode,omitempty" validate:"omitempty,oneof=off dns hard"`
Daemon bool `mapstructure:"-" toml:"-"`
AllocateIP bool `mapstructure:"-" toml:"-"`
// FirewallMode controls the DNS-resolved IP allowlist. When "on", only IPs
// that were successfully resolved by ctrld are allowed for outbound connections.
// This closes the "DNS gap" where apps bypass DNS policy using hardcoded IPs.
// Requires intercept mode to be active for enforcement on desktop platforms.
// On mobile, the netstack layer uses the allowlist directly.
FirewallMode string `mapstructure:"firewall_mode" toml:"firewall_mode,omitempty" validate:"omitempty,oneof=off on"`
Daemon bool `mapstructure:"-" toml:"-"`
AllocateIP bool `mapstructure:"-" toml:"-"`
}
// NetworkConfig specifies configuration for networks where ctrld will handle requests.