You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
fw-daemon/iptables.go

45 lines
1.1 KiB

9 years ago
package main
import (
"fmt"
"os"
"os/exec"
"strings"
)
const iptablesRule = "OUTPUT -t mangle -m conntrack --ctstate NEW -j NFQUEUE --queue-num 0 --queue-bypass"
const dnsRule = "INPUT --protocol udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass"
const blockRule = "OUTPUT --protocol tcp -m mark --mark 1 -j REJECT"
9 years ago
func setupIPTables() {
addIPTRules(iptablesRule, dnsRule, blockRule)
9 years ago
}
func addIPTRules(rules ...string) {
for _, r := range rules {
if(iptables('C', r)) {
log.Info("IPTables rule already present: %s", r)
} else {
log.Info("Installing IPTables rule: %s", r)
iptables('I', r)
}
9 years ago
}
}
func iptables(verb rune, rule string) bool {
9 years ago
iptablesPath, err := exec.LookPath("iptables")
if err != nil {
log.Warning("Could not find iptables binary in path")
os.Exit(1)
}
argLine := fmt.Sprintf("-%c %s", verb, rule)
9 years ago
args := strings.Fields(argLine)
cmd := exec.Command(iptablesPath, args...)
_, err = cmd.CombinedOutput()
9 years ago
_, exitErr := err.(*exec.ExitError)
if err != nil && !exitErr {
log.Warning("Error running iptables: %v", err)
9 years ago
}
return !exitErr
9 years ago
}