mirrors/opensnitch
1
0
Fork 0
mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 08:34:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fw, nftables: better rules deletion on exit

Browse source 
We were not deleting our rules correctly on exit if another fw tool had
added rules to the nftables tables. This problem caused to detect that
our rules were not added, so we added them again.
This commit is contained in:
Gustavo Iñiguez Goia 2022-02-17 23:54:55 +01:00
parent 88b30e98d1
commit 1f79b3a8fd
1 changed files with 24 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
daemon/firewall/nftables/rules.go
View file

@ -162,35 +162,38 @@ func (n *Nft) delRulesByKey(key string) {
}
commit := false
for _, c := range chains {
deletedRules := 0
rules, err := n.conn.GetRule(c.Table, c)
if err != nil {
log.Warning("nftables, error listing rules: %s", err)
log.Warning("nftables, error listing rules (%s): %s", c.Table.Name, err)
continue
}
commit = false
for _, r := range rules {
if string(r.UserData) == key {
// just passing the rule object doesn't work.
if err := n.conn.DelRule(&nftables.Rule{
Table: c.Table,
Chain: c,
Handle: r.Handle,
}); err != nil {
log.Warning("nftables, error deleting interception rule: %s", err)
continue
}
deletedRules++
commit = true
if string(r.UserData) != key {
continue
}
// just passing the rule object doesn't work.
if err := n.conn.DelRule(&nftables.Rule{
Table: c.Table,
Chain: c,
Handle: r.Handle,
}); err != nil {
log.Warning("nftables, error adding rule to be deleted (%s/%s): %s", c.Table.Name, c.Name, err)
continue
}
commit = true
}
if commit {
if err := n.conn.Flush(); err != nil {
log.Warning("nftables, error deleting interception rules (%s/%s): %s", c.Table.Name, c.Name, err)
}
}
if deletedRules == len(rules) {
n.conn.DelTable(c.Table)
}
}
if commit {
if err := n.conn.Flush(); err != nil {
log.Warning("nftables, error applying interception rules: %s", err)
if rules, err := n.conn.GetRule(c.Table, c); err == nil {
if commit && len(rules) == 0 {
n.conn.DelChain(c)
n.conn.Flush()
}
}
}