sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-30 16:29:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into peer-acl-merge-main

Browse Source 
# Conflicts:
#	client/firewall/iptables/acl_linux.go
#	client/firewall/iptables/manager_linux.go
#	client/firewall/iptables/router_linux.go
#	client/firewall/nftables/manager_linux.go
#	client/firewall/nftables/router_linux.go
#	client/internal/acl/manager.go
This commit is contained in:
Viktor Liu
2026-08-20 20:50:57 +02:00
parent 3df2b170ba 4a6efbb5fc
commit c7f5e35074
408 changed files with 30725 additions and 4257 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/firewall/nftables/dnat_linux.go
+13 -5
View File
@@ -28,10 +28,11 @@ func (r *family) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
return nil, fmt.Errorf("convert protocol to number: %w", err)
}
// Request forwarding once the rule is about to be installed, releasing
// it if a later step fails so the refcount tracks the real rules.
if err := r.ipFwdState.RequestForwarding(); err != nil {
return nil, err
// Request forwarding before queueing rules: addDnatRedirect/addDnatMasq
// buffer netlink messages on r.conn that the next caller's Flush would
// commit if we returned without flushing them ourselves.
if err := r.ipFwdState.RequestForwarding(r.isV6()); err != nil {
return nil, fmt.Errorf("enable forwarding: %w", err)
}
if err := r.addDnatRedirect(rule, protoNum, ruleID); err != nil {
@@ -52,6 +53,8 @@ func (r *family) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
if err := r.conn.Flush(); err != nil {
r.releaseForwarding()
delete(r.rules, ruleID+dnatSuffix)
delete(r.rules, ruleID+snatSuffix)
return nil, fmt.Errorf("flush rules: %w", err)
}
@@ -322,11 +325,16 @@ func (r *family) DeleteDNATRule(rule firewall.Rule) error {
// releaseForwarding drops one IP forwarding reference, logging any error.
func (r *family) releaseForwarding() {
if err := r.ipFwdState.ReleaseForwarding(); err != nil {
if err := r.ipFwdState.ReleaseForwarding(r.isV6()); err != nil {
log.Errorf("release IP forwarding: %v", err)
}
}
// isV6 reports whether this family handles the IPv6 table.
func (r *family) isV6() bool {
return r.af.tableFamily == nftables.TableFamilyIPv6
}
func (r *family) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
ruleID := firewall.RuleID(fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))