(tap_device: &str, host_ip: &str, gateway_port: u16)
| 400 | } |
| 401 | |
| 402 | fn setup_tap_networking(tap_device: &str, host_ip: &str, gateway_port: u16) -> Result<(), String> { |
| 403 | run_cmd("ip", &["tuntap", "add", "dev", tap_device, "mode", "tap"])?; |
| 404 | run_cmd( |
| 405 | "ip", |
| 406 | &["addr", "add", &format!("{host_ip}/30"), "dev", tap_device], |
| 407 | )?; |
| 408 | run_cmd("ip", &["link", "set", tap_device, "up"])?; |
| 409 | |
| 410 | // Deprioritize routes through down interfaces so a stale vmtap-* |
| 411 | // that somehow survives cleanup cannot shadow the active one. |
| 412 | let _ = std::fs::write( |
| 413 | format!("/proc/sys/net/ipv4/conf/{tap_device}/ignore_routes_with_linkdown"), |
| 414 | "1", |
| 415 | ); |
| 416 | |
| 417 | enable_ip_forwarding()?; |
| 418 | |
| 419 | let subnet = tap_subnet_from_host_ip(host_ip); |
| 420 | let table_name = nft_ruleset::teardown_table_name(tap_device); |
| 421 | |
| 422 | // Delete any stale nftables table from a previous driver run. |
| 423 | let _ = run_cmd("nft", &["delete", "table", "ip", &table_name]); |
| 424 | |
| 425 | // Clean up legacy iptables rules from older driver versions. |
| 426 | let _ = run_cmd( |
| 427 | "iptables", |
| 428 | &[ |
| 429 | "-t", |
| 430 | "nat", |
| 431 | "-D", |
| 432 | "POSTROUTING", |
| 433 | "-s", |
| 434 | &subnet, |
| 435 | "-j", |
| 436 | "MASQUERADE", |
| 437 | ], |
| 438 | ); |
| 439 | let _ = run_cmd( |
| 440 | "iptables", |
| 441 | &["-D", "FORWARD", "-i", tap_device, "-j", "ACCEPT"], |
| 442 | ); |
| 443 | let _ = run_cmd( |
| 444 | "iptables", |
| 445 | &[ |
| 446 | "-D", |
| 447 | "FORWARD", |
| 448 | "-o", |
| 449 | tap_device, |
| 450 | "-m", |
| 451 | "state", |
| 452 | "--state", |
| 453 | "RELATED,ESTABLISHED", |
| 454 | "-j", |
| 455 | "ACCEPT", |
| 456 | ], |
| 457 | ); |
| 458 | let port_str = gateway_port.to_string(); |
| 459 | let _ = run_cmd( |
no test coverage detected