CodeScribe 8cb383d87e dns_intercept: add WFP loopback protect for VPN block-outside-dns ...

When third-party VPN software (e.g., OpenVPN) installs WFP block filters via
block-outside-dns, all DNS traffic to non-tunnel interfaces is blocked —
including DNS to 127.0.0.1 (ctrld's NRPT target). This breaks DNS mode
interception because the NRPT catch-all rule routes queries to loopback,
but WFP blocks the connection before it reaches ctrld's listener.

Fix: after exhausting all NRPT recovery attempts, activate a minimal WFP
session with "hard permit" filters (FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT)
for DNS to localhost in a max-priority sublayer (weight 0xFFFF). This
overrides the VPN's block for loopback DNS only, while preserving the
VPN's DNS leak protection for all other (non-loopback) DNS traffic.

The loopback protect is:
- Only activated when NRPT probes fail (not preemptively)
- Harmless when no conflicting WFP blocks exist (permit-only, no blocks)
- Persistent until ctrld shutdown (survives VPN reconnect cycles)
- Cleaned up by the existing cleanupWFPFilters path on shutdown

2026-04-29 15:21:38 +07:00

..

cli

dns_intercept: add WFP loopback protect for VPN block-outside-dns

2026-04-29 15:21:38 +07:00

ctrld

debugging save/restore staticinterface settings

2025-02-21 20:44:34 +07:00

ctrld_library

start mobile library with provision id and custom hostname.

2025-09-25 16:44:39 +07:00