diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/linux/firewall.rs | 5 | ||||
| -rw-r--r-- | src/linux/routes.rs | 13 |
2 files changed, 14 insertions, 4 deletions
diff --git a/src/linux/firewall.rs b/src/linux/firewall.rs index 8a0dd43..bbde560 100644 --- a/src/linux/firewall.rs +++ b/src/linux/firewall.rs @@ -126,7 +126,10 @@ fn apply_policy(enabled: bool, xray_uid: u32, allow_tun: bool) -> Result<()> { batch.add(&mark, MsgType::Add); let mut guard = Chain::new(c"guard", &table); guard.set_type(ChainType::Filter); - guard.set_hook(Hook::Out, 100); + // OUTPUT's hook state still names the original interface after the + // route chain changes skb's route. POSTROUTING sees the final egress, + // so the guard can allow TUN traffic without allowing direct fallback. + guard.set_hook(Hook::PostRouting, 100); guard.set_policy(Policy::Drop); batch.add(&guard, MsgType::Add); exceptions(&mut batch, &guard, xray_uid); diff --git a/src/linux/routes.rs b/src/linux/routes.rs index 4212183..0380faf 100644 --- a/src/linux/routes.rs +++ b/src/linux/routes.rs @@ -178,12 +178,19 @@ pub async fn remove() -> Result<()> { pub async fn tun_index() -> Result<Option<u32>> { let handle = connection()?; - Ok(handle + let result = handle .link() .get() .match_name("roentgen0") .execute() .try_next() - .await? - .map(|link| link.header.index)) + .await; + match result { + Ok(link) => Ok(link.map(|link| link.header.index)), + // A named RTM_GETLINK request reports ENODEV for an absent interface, + // including before Xray starts and while waiting for it to create TUN. + Err(rtnetlink::Error::NetlinkError(error)) + if error.raw_code() == -libc::ENODEV => Ok(None), + Err(error) => Err(error.into()), + } } |