fix(firewall;interop/ivpn): apply external verdict handler in all connection filtering paths

Previously, the external verdict handler was placed in filterHandler,
which is only called for new packets. This meant it was silently
bypassed when connections were re-evaluated via resetConnectionVerdict.

Move the handler into FilterConnection so it is consistently applied
for all filtering paths, including verdict resets.

https://github.com/safing/portmaster-shadow/issues/34

Author: Alexandr Stelnykovych

service/firewall/packet_handler.go

@@ -464,7 +464,6 @@ func filterHandler(conn *network.Connection, pkt packet.Packet) {
 	}
 
 	filterConnection := true
-	checkTunnel := true
 
 	// Check for special (internal) connection cases.
 	switch {
@@ -503,24 +502,10 @@ func filterHandler(conn *network.Connection, pkt packet.Packet) {
 
 		issueVerdict(conn, pkt, 0, true)
 		return
-
-	default:
-		// Check if external verdict handler is set, and if so, run it.
-		if extHandler := externalVerdictHandler.Load(); extHandler != nil {
-			verdict, reason, skipTunnel := (*extHandler)(conn)
-			switch verdict {
-			// Accept and Block - only these verdicts are supported to be returned by the external handler.
-			case network.VerdictAccept, network.VerdictBlock:
-				conn.SetVerdict(verdict, reason, "", nil)
-				filterConnection = false
-				checkTunnel = !skipTunnel
-				log.Tracer(pkt.Ctx()).Infof("filter: special verdict %s %q %s for connection", verdict, reason, conn)
-			}
-		}
 	}
 
 	// Apply privacy filter and check tunneling.
-	FilterConnection(pkt.Ctx(), conn, pkt, filterConnection, checkTunnel)
+	FilterConnection(pkt.Ctx(), conn, pkt, filterConnection, true)
 
 	// Decide how to continue handling connection.
 	switch {
@@ -544,6 +529,20 @@ func FilterConnection(ctx context.Context, conn *network.Connection, pkt packet.
 		return
 	}
 
+	// Check if external verdict handler is set, and if so, run it.
+	// Note! This block can override the filter and tunnel check flags!
+	if extHandler := externalVerdictHandler.Load(); extHandler != nil {
+		verdict, reason, skipTunnel := (*extHandler)(conn)
+		switch verdict {
+		// Accept and Block - only these verdicts are supported to be returned by the external handler.
+		case network.VerdictAccept, network.VerdictBlock:
+			conn.SetVerdict(verdict, reason, "", nil)
+			checkFilter = false
+			checkTunnel = !skipTunnel
+			log.Tracer(ctx).Infof("filter: special verdict %s %q %s for connection", verdict, reason, conn)
+		}
+	}
+
 	if checkFilter {
 		if filterEnabled() {
 			log.Tracer(ctx).Trace("filter: starting decision process")