This commit is contained in:
Alexey
2026-07-06 20:12:36 +03:00
parent a1ebd44cee
commit b8be805aed
8 changed files with 41 additions and 32 deletions
+4 -14
View File
@@ -68,13 +68,9 @@ async fn apply_rules_for_binary(
let chain = namespace.iptables_chain.as_str();
let _ = run_command(binary, &["-t", "filter", "-N", chain], None).await;
run_command(binary, &["-t", "filter", "-F", chain], None).await?;
if run_command(
binary,
&["-t", "filter", "-C", "INPUT", "-j", chain],
None,
)
.await
.is_err()
if run_command(binary, &["-t", "filter", "-C", "INPUT", "-j", chain], None)
.await
.is_err()
{
run_command(
binary,
@@ -260,13 +256,7 @@ pub(super) async fn clear_rules_for_binary(
let mut removed = false;
let chain = namespace.iptables_chain.as_str();
for _ in 0..8 {
match run_command(
binary,
&["-t", "filter", "-D", "INPUT", "-j", chain],
None,
)
.await
{
match run_command(binary, &["-t", "filter", "-D", "INPUT", "-j", chain], None).await {
Ok(()) => {
removed = true;
}
+1 -3
View File
@@ -97,9 +97,7 @@ pub(crate) async fn clear_synlimit_rules_all_backends() -> Result<bool, String>
clear_synlimit_rules_for_namespace(&namespace).await
}
async fn clear_synlimit_rules_for_namespace(
namespace: &SynLimitNamespace,
) -> Result<bool, String> {
async fn clear_synlimit_rules_for_namespace(namespace: &SynLimitNamespace) -> Result<bool, String> {
if !has_cap_net_admin() {
return Ok(false);
}
+4 -1
View File
@@ -319,7 +319,10 @@ mod tests {
targets.iptables_v4[0].ip,
Some(IpAddr::V4(Ipv4Addr::new(203, 0, 113, 1)))
);
assert_eq!(targets.iptables_v6[0].ip, Some(IpAddr::V6(Ipv6Addr::LOCALHOST)));
assert_eq!(
targets.iptables_v6[0].ip,
Some(IpAddr::V6(Ipv6Addr::LOCALHOST))
);
assert_eq!(
targets.nft_v4[0].ip,
Some(IpAddr::V4(Ipv4Addr::new(203, 0, 113, 2)))
+1 -2
View File
@@ -199,8 +199,7 @@ pub(super) async fn clear_rules_all_families(
let mut removed = false;
let table = namespace.nft_table.as_str();
for family in [NftFamily::Inet, NftFamily::Ip, NftFamily::Ip6] {
match run_command("nft", &["delete", "table", family.as_str(), table], None).await
{
match run_command("nft", &["delete", "table", family.as_str(), table], None).await {
Ok(()) => {
removed = true;
}