sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-26 17:41:30 +02:00
Code Issues Packages Projects Releases Wiki Activity

Remove the notrack chain cleanup

Browse Source
This commit is contained in:
Viktor Liu
2026-08-25 18:33:01 +02:00
parent e9409ccbc1
commit afd048331b
2 changed files with 0 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
client/firewall/iptables/manager_linux.go
View File

@@ -120,10 +120,6 @@ func (m *Manager) Init(stateManager *statemanager.Manager) error {
return err
}
if err := m.cleanupNoTrackChain(); err != nil {
log.Debugf("cleanup notrack chain: %v", err)
}
// Trust after all fatal init steps so a later failure doesn't leave the
// interface in firewalld's trusted zone without a corresponding Close.
if err := firewalld.TrustInterface(m.wgIface.Name()); err != nil {
@@ -335,10 +331,6 @@ func (m *Manager) Close(stateManager *statemanager.Manager) error {
var merr *multierror.Error
if err := m.cleanupNoTrackChain(); err != nil {
merr = multierror.Append(merr, fmt.Errorf("cleanup notrack chain: %w", err))
}
if m.hasIPv6() {
if err := m.aclMgr6.Reset(); err != nil {
merr = multierror.Append(merr, fmt.Errorf("reset v6 acl manager: %w", err))
@@ -517,42 +509,6 @@ func (m *Manager) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Proto
return m.router.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
}
const (
chainNameRaw = "NETBIRD-RAW"
chainOUTPUT = "OUTPUT"
tableRaw = "raw"
)
// cleanupNoTrackChain removes the chain that earlier versions used to exempt the
// WireGuard proxy's loopback traffic from connection tracking. The raw table is
// not always available, so a lookup failure is not an error here.
func (m *Manager) cleanupNoTrackChain() error {
exists, err := m.ipv4Client.ChainExists(tableRaw, chainNameRaw)
if err != nil {
log.Debugf("look up %s chain: %v", chainNameRaw, err)
return nil
}
if !exists {
return nil
}
jumpRule := []string{"-j", chainNameRaw}
if err := m.ipv4Client.DeleteIfExists(tableRaw, chainOUTPUT, jumpRule...); err != nil {
return fmt.Errorf("remove output jump rule: %w", err)
}
if err := m.ipv4Client.DeleteIfExists(tableRaw, chainPREROUTING, jumpRule...); err != nil {
return fmt.Errorf("remove prerouting jump rule: %w", err)
}
if err := m.ipv4Client.ClearAndDeleteChain(tableRaw, chainNameRaw); err != nil {
return fmt.Errorf("clear and delete chain: %w", err)
}
return nil
}
func getConntrackEstablished() []string {
return []string{"-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"}
}

41
client/firewall/nftables/manager_linux.go
View File

@@ -198,10 +198,6 @@ func (m *Manager) initFirewall() (err error) {
}
}
if err := m.cleanupNoTrackChains(); err != nil {
log.Debugf("cleanup notrack chains: %v", err)
}
return nil
}
@@ -664,43 +660,6 @@ func (m *Manager) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Proto
return m.router.RemoveOutputDNAT(localAddr, protocol, originalPort, translatedPort)
}
const (
chainNameRawOutput = "netbird-raw-out"
chainNameRawPrerouting = "netbird-raw-pre"
)
// cleanupNoTrackChains removes the chains that earlier versions used to exempt
// the WireGuard proxy's loopback traffic from connection tracking.
func (m *Manager) cleanupNoTrackChains() error {
chains, err := m.rConn.ListChainsOfTableFamily(nftables.TableFamilyIPv4)
if err != nil {
return fmt.Errorf("list chains: %w", err)
}
tableName := getTableName()
var found bool
for _, c := range chains {
if c.Table.Name != tableName {
continue
}
if c.Name != chainNameRawOutput && c.Name != chainNameRawPrerouting {
continue
}
m.rConn.DelChain(c)
found = true
}
if !found {
return nil
}
if err := m.rConn.Flush(); err != nil {
return fmt.Errorf("flush chain removal: %w", err)
}
return nil
}
func (m *Manager) createWorkTable() (*nftables.Table, error) {
return m.createWorkTableFamily(nftables.TableFamilyIPv4)
}