pf: potentially problematic order of route-to rule

[pronebird]

Is it a bug?

• I know this is an issue with the app, and contacting Mullvad support is not relevant.

I have checked if others have reported this already

• I have checked the issue tracker to see if others have reported similar issues.

Current Behavior

It's probably worth to report that pass out quick route-to (utun any) is applied before pass quick on utun on macOS 14.7.4 firewall implementation:

pass out quick route-to (utun4 any) all flags S/SA keep state
pass quick on utun4 all flags S/SA keep state

The relevant code: https://github.com/mullvad/mullvadvpn-app/blob/main/talpid-core/src/firewall/macos.rs#L450-L456

PF seems to be smart enough to avoid a loop in here, however it could be more logical to inverse the order of firewall rules. This is not particularly a bug so please adjust the github label.

Expected Behavior

I'd expect all traffic on utun to be quickly passed through before using heavier machinery such as route-to rules.

Steps to Reproduce

1. Connect
2. Execute sudo pfctl -sa -a mullvad
3. Inspect the rules

Failure Logs

Operating system version

No response

Mullvad VPN app version

No response

Additional Information

No response