From fc3c1d51b1be9db6ba6ad286584fbc34bb305f38 Mon Sep 17 00:00:00 2001 From: Andrew Guschin Date: Fri, 30 Oct 2026 03:32:00 +0400 Subject: Fix protected activation ordering and diagnostic review findings --- src/linux/firewall.rs | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) (limited to 'src/linux/firewall.rs') diff --git a/src/linux/firewall.rs b/src/linux/firewall.rs index 79731b7..8a0dd43 100644 --- a/src/linux/firewall.rs +++ b/src/linux/firewall.rs @@ -84,6 +84,12 @@ pub fn preflight() -> Result<()> { /// Replacing the table is one kernel transaction. Connection marks survive table replacement. pub fn apply(enabled: bool, xray_uid: u32) -> Result<()> { + apply_policy(enabled, xray_uid, false) +} +pub fn forward(xray_uid: u32) -> Result<()> { + apply_policy(true, xray_uid, true) +} +fn apply_policy(enabled: bool, xray_uid: u32, allow_tun: bool) -> Result<()> { let existing = tables()?; let table = Table::new(TABLE, ProtoFamily::Inet); let mut batch = Batch::new(); @@ -124,11 +130,13 @@ pub fn apply(enabled: bool, xray_uid: u32) -> Result<()> { guard.set_policy(Policy::Drop); batch.add(&guard, MsgType::Add); exceptions(&mut batch, &guard, xray_uid); - let mut tun = Rule::new(&guard); - tun.add_expr(&nft_expr!(meta oifname)); - tun.add_expr(&nft_expr!(cmp == &b"roentgen0\0"[..])); - tun.add_expr(&nft_expr!(verdict accept)); - batch.add(&tun, MsgType::Add); + if allow_tun { + let mut tun = Rule::new(&guard); + tun.add_expr(&nft_expr!(meta oifname)); + tun.add_expr(&nft_expr!(cmp == &b"roentgen0\0"[..])); + tun.add_expr(&nft_expr!(verdict accept)); + batch.add(&tun, MsgType::Add); + } } send(batch.finalize()).context("Could not apply Roentgen firewall transaction") } -- cgit v1.2.3