chore: import upstream snapshot with attribution

Sources/Containerization/IptablesRules.swift

@@ -0,0 +1,106 @@
+//===----------------------------------------------------------------------===//
+// Copyright © 2026 Apple Inc. and the Containerization project authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//===----------------------------------------------------------------------===//
+
+#if os(Linux)
+import ContainerizationError
+import ContainerizationOS
+import Foundation
+
+/// Thin idempotent wrappers around the `iptables` CLI for use by
+/// `BridgeManager`. We don't program nftables directly; modern distros
+/// ship the `iptables` binary as a shim over nftables and it's universally
+/// available.
+enum IptablesRules {
+    /// Add a rule unless it already exists. `args` is the rule body
+    /// excluding the leading action (`-A`/`-C`/`-D`).
+    ///
+    /// Implementation: run `iptables -C <args>` first; if exit 0, the rule
+    /// exists already — return. Otherwise run `iptables -A <args>` and
+    /// throw on non-zero exit.
+    static func ensure(table: String? = nil, args: [String]) throws {
+        let tableArgs = table.map { ["-t", $0] } ?? []
+        let check = try run(args: tableArgs + ["-C"] + args)
+        if check.exit == 0 { return }
+        let add = try run(args: tableArgs + ["-A"] + args)
+        if add.exit != 0 {
+            throw ContainerizationError(
+                .internalError,
+                message: """
+                    iptables -A \(args.joined(separator: " ")) failed (exit \(add.exit))\
+                    \(add.stderr.isEmpty ? "" : ": \(add.stderr)")
+                    """
+            )
+        }
+    }
+
+    /// Best-effort delete. Ignores non-zero exit (rule may not exist).
+    static func remove(table: String? = nil, args: [String]) {
+        let tableArgs = table.map { ["-t", $0] } ?? []
+        _ = try? run(args: tableArgs + ["-D"] + args)
+    }
+
+    /// Captured outcome of a single `iptables` invocation.
+    private struct InvocationResult {
+        let exit: Int32
+        let stderr: String
+    }
+
+    /// Run `iptables` with the given args, returning the exit status and any
+    /// stderr the binary emitted. Throws if no `iptables` binary is found.
+    private static func run(args: [String]) throws -> InvocationResult {
+        // ContainerizationOS.Command uses execve() under the hood, which
+        // requires an absolute path. Probe the two paths iptables actually
+        // ships at on Linux distros — /usr/sbin first (Debian, Ubuntu,
+        // Fedora, Alpine, RHEL), then /sbin (older / busybox-style).
+        let candidates = ["/usr/sbin/iptables", "/sbin/iptables"]
+        // Open /dev/null fresh rather than using FileHandle.nullDevice:
+        // swift-corelibs-foundation's nullDevice uses a sentinel fd that
+        // doesn't survive dup2() in Command's child, producing EBADF on exec.
+        // Capture stderr through a pipe so failures surface with the actual
+        // iptables error (locked xtables, missing kernel module, conflicting
+        // rule) instead of an opaque exit code.
+        let devNullOut = FileHandle(forWritingAtPath: "/dev/null")
+        let stderrPipe = Pipe()
+        defer {
+            try? devNullOut?.close()
+            try? stderrPipe.fileHandleForReading.close()
+        }
+        for path in candidates where FileManager.default.isExecutableFile(atPath: path) {
+            // `-w` makes iptables block on the xtables lock rather than
+            // failing (exit 4) when another actor — a sibling BridgeManager on
+            // a different bridge, Docker, firewalld — is mid-iptables. Accepted
+            // by both legacy iptables and the nft shim.
+            var cmd = Command(path, arguments: ["-w"] + args)
+            cmd.stdout = devNullOut
+            cmd.stderr = stderrPipe.fileHandleForWriting
+            try cmd.start()
+            // Close the parent's write end so the read end sees EOF when
+            // iptables exits, even if iptables itself never writes anything.
+            try? stderrPipe.fileHandleForWriting.close()
+            let exit = try cmd.wait()
+            let data = (try? stderrPipe.fileHandleForReading.readToEnd()) ?? Data()
+            let stderr =
+                String(data: data, encoding: .utf8)?
+                .trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
+            return InvocationResult(exit: exit, stderr: stderr)
+        }
+        throw ContainerizationError(
+            .notFound,
+            message: "iptables not found at /usr/sbin/iptables or /sbin/iptables; install iptables (or its nftables shim)"
+        )
+    }
+}
+#endif