installRules adds narrowly-scoped iptables rules redirecting only the target flow into our NFQUEUE.
(scope platform.Scope)
| 259 | // installRules adds narrowly-scoped iptables rules redirecting only the |
| 260 | // target flow into our NFQUEUE. |
| 261 | func (b *Backend) installRules(scope platform.Scope) error { |
| 262 | port := fmt.Sprintf("%d", scope.RemotePort) |
| 263 | qn := fmt.Sprintf("%d", b.cfg.QueueNum) |
| 264 | ruleSpecs := [][]string{ |
| 265 | // Outbound SYN/ACK/data to the remote server. |
| 266 | {"-t", "mangle", "-A", "OUTPUT", "-p", "tcp", |
| 267 | "-d", scope.RemoteIP.String(), "--dport", port, |
| 268 | "-j", "NFQUEUE", "--queue-num", qn, "--queue-bypass"}, |
| 269 | // Inbound SYN-ACK/ACK from the remote server. |
| 270 | {"-t", "mangle", "-A", "INPUT", "-p", "tcp", |
| 271 | "-s", scope.RemoteIP.String(), "--sport", port, |
| 272 | "-j", "NFQUEUE", "--queue-num", qn, "--queue-bypass"}, |
| 273 | } |
| 274 | for _, spec := range ruleSpecs { |
| 275 | if err := runIptables(spec...); err != nil { |
| 276 | // Best-effort rollback of any partially installed rules. |
| 277 | _ = b.removeRulesLocked() |
| 278 | return fmt.Errorf("iptables %v: %w", spec, err) |
| 279 | } |
| 280 | b.addedRules = append(b.addedRules, spec) |
| 281 | } |
| 282 | return nil |
| 283 | } |
| 284 | |
| 285 | // removeRulesLocked deletes every rule we successfully added, converting |
| 286 | // each `-A` into `-D`. Missing rules (already removed) are ignored. |
no test coverage detected