vikarti.anatra/safing-portmaster
1
0
Fork 0
mirror of https://github.com/safing/portmaster synced 2025-09-02 02:29:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Try as hard as possible to remove the nfqueue rules

Browse source
This commit is contained in:
Patrick Pacher 2020-07-17 11:21:09 +02:00
parent 6d69039c20
commit 9eb7195bd8
No known key found for this signature in database
GPG key ID: E8CD2DA160925A6D
2 changed files with 42 additions and 86 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
cmds/portmaster-start/recover_linux.go
View file

@ -5,17 +5,15 @@ import (
"github.com/spf13/cobra" "github.com/spf13/cobra"
) )
var recoverForceFlag bool
var recoverIPTablesCmd = &cobra.Command{ var recoverIPTablesCmd = &cobra.Command{
Use: "recover-iptables", Use: "recover-iptables",
Short: "Removes obsolete IP tables rules in case of an unclean shutdown", Short: "Removes obsolete IP tables rules in case of an unclean shutdown",
RunE: func(*cobra.Command, []string) error { RunE: func(*cobra.Command, []string) error {
return interception.DeactivateNfqueueFirewall(recoverForceFlag) return interception.DeactivateNfqueueFirewall()
}, },
SilenceUsage: true, SilenceUsage: true,
} }
func init() { func init() {
recoverIPTablesCmd.Flags().BoolVarP(&recoverForceFlag, "force", "f", false, "Force removal ignoring errors")
rootCmd.AddCommand(recoverIPTablesCmd) rootCmd.AddCommand(recoverIPTablesCmd)
} }

132
firewall/interception/nfqueue_linux.go
View file

@ -108,69 +108,58 @@ func init() {
} }
func activateNfqueueFirewall() error { func activateNfqueueFirewall() error {
if err := activateIPTables(iptables.ProtocolIPv4, v4rules, v4once, v4chains); err != nil {
return err
}
if err := activateIPTables(iptables.ProtocolIPv6, v6rules, v6once, v6chains); err != nil {
return err
}
return nil
}
// DeactivateNfqueueFirewall drops portmaster related IP tables rules.
func DeactivateNfqueueFirewall() error {
// IPv4 // IPv4
ip4tables, err := iptables.NewWithProtocol(iptables.ProtocolIPv4) errV4 := deactivateIPTables(iptables.ProtocolIPv4, v4once, v4chains)
if err != nil {
return err
}
for _, chain := range v4chains {
splittedRule := strings.Split(chain, " ")
if err = ip4tables.ClearChain(splittedRule[0], splittedRule[1]); err != nil {
return err
}
}
for _, rule := range v4rules {
splittedRule := strings.Split(rule, " ")
if err = ip4tables.Append(splittedRule[0], splittedRule[1], splittedRule[2:]...); err != nil {
return err
}
}
var ok bool
for _, rule := range v4once {
splittedRule := strings.Split(rule, " ")
ok, err = ip4tables.Exists(splittedRule[0], splittedRule[1], splittedRule[2:]...)
if err != nil {
return err
}
if !ok {
if err = ip4tables.Insert(splittedRule[0], splittedRule[1], 1, splittedRule[2:]...); err != nil {
return err
}
}
}
// IPv6 // IPv6
ip6tables, err := iptables.NewWithProtocol(iptables.ProtocolIPv6) if errV6 := deactivateIPTables(iptables.ProtocolIPv6, v6once, v6chains); errV6 != nil && errV4 == nil {
return errV6
}
return errV4
}
func activateIPTables(protocol iptables.Protocol, rules, once, chains []string) error {
tbls, err := iptables.NewWithProtocol(protocol)
if err != nil { if err != nil {
return err return err
} }
for _, chain := range v6chains { for _, chain := range chains {
splittedRule := strings.Split(chain, " ") splittedRule := strings.Split(chain, " ")
if err = ip6tables.ClearChain(splittedRule[0], splittedRule[1]); err != nil { if err = tbls.ClearChain(splittedRule[0], splittedRule[1]); err != nil {
return err return err
} }
} }
for _, rule := range v6rules { for _, rule := range rules {
splittedRule := strings.Split(rule, " ") splittedRule := strings.Split(rule, " ")
if err = ip6tables.Append(splittedRule[0], splittedRule[1], splittedRule[2:]...); err != nil { if err = tbls.Append(splittedRule[0], splittedRule[1], splittedRule[2:]...); err != nil {
return err return err
} }
} }
for _, rule := range v6once { for _, rule := range once {
splittedRule := strings.Split(rule, " ") splittedRule := strings.Split(rule, " ")
ok, err := ip6tables.Exists(splittedRule[0], splittedRule[1], splittedRule[2:]...) ok, err := tbls.Exists(splittedRule[0], splittedRule[1], splittedRule[2:]...)
if err != nil { if err != nil {
return err return err
} }
if !ok { if !ok {
if err = ip6tables.Insert(splittedRule[0], splittedRule[1], 1, splittedRule[2:]...); err != nil { if err = tbls.Insert(splittedRule[0], splittedRule[1], 1, splittedRule[2:]...); err != nil {
return err return err
} }
} }
@ -179,68 +168,37 @@ func activateNfqueueFirewall() error {
return nil return nil
} }
// DeactivateNfqueueFirewall drops portmaster related IP tables rules. func deactivateIPTables(protocol iptables.Protocol, rules, chains []string) error {
func DeactivateNfqueueFirewall(force bool) error { tbls, err := iptables.NewWithProtocol(protocol)
// IPv4
ip4tables, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
if err != nil { if err != nil {
return err return err
} }
var ok bool var firstErr error
for _, rule := range v4once { for _, rule := range rules {
splittedRule := strings.Split(rule, " ") splittedRule := strings.Split(rule, " ")
ok, err = ip4tables.Exists(splittedRule[0], splittedRule[1], splittedRule[2:]...) ok, err := tbls.Exists(splittedRule[0], splittedRule[1], splittedRule[2:]...)
if err != nil { if err != nil && firstErr == nil {
return err firstErr = err
} }
if ok { if ok {
if err = ip4tables.Delete(splittedRule[0], splittedRule[1], splittedRule[2:]...); err != nil && !force { if err = tbls.Delete(splittedRule[0], splittedRule[1], splittedRule[2:]...); err != nil && firstErr == nil {
return err firstErr = err
} }
} }
} }
for _, chain := range v4chains { for _, chain := range chains {
splittedRule := strings.Split(chain, " ") splittedRule := strings.Split(chain, " ")
if err = ip4tables.ClearChain(splittedRule[0], splittedRule[1]); err != nil && !force { if err = tbls.ClearChain(splittedRule[0], splittedRule[1]); err != nil && firstErr == nil {
return err firstErr = err
} }
if err = ip4tables.DeleteChain(splittedRule[0], splittedRule[1]); err != nil && !force { if err = tbls.DeleteChain(splittedRule[0], splittedRule[1]); err != nil && firstErr == nil {
return err firstErr = err
} }
} }
// IPv6 return firstErr
ip6tables, err := iptables.NewWithProtocol(iptables.ProtocolIPv6)
if err != nil {
return err
}
for _, rule := range v6once {
splittedRule := strings.Split(rule, " ")
ok, err := ip6tables.Exists(splittedRule[0], splittedRule[1], splittedRule[2:]...)
if err != nil {
return err
}
if ok {
if err = ip6tables.Delete(splittedRule[0], splittedRule[1], splittedRule[2:]...); err != nil && !force {
return err
}
}
}
for _, chain := range v6chains {
splittedRule := strings.Split(chain, " ")
if err := ip6tables.ClearChain(splittedRule[0], splittedRule[1]); err != nil && !force {
return err
}
if err := ip6tables.DeleteChain(splittedRule[0], splittedRule[1]); err != nil && !force {
return err
}
}
return nil
} }
// StartNfqueueInterception starts the nfqueue interception. // StartNfqueueInterception starts the nfqueue interception.
@ -294,7 +252,7 @@ func StopNfqueueInterception() error {
in6Queue.Destroy() in6Queue.Destroy()
} }
err := DeactivateNfqueueFirewall(false) err := DeactivateNfqueueFirewall()
if err != nil { if err != nil {
return fmt.Errorf("interception: error while deactivating nfqueue: %s", err) return fmt.Errorf("interception: error while deactivating nfqueue: %s", err)
} }