wehub-resource-sync
680845cb1c
Linux build / Determine Swift version (push) Waiting to run
Linux build / Linux compile check (push) Blocked by required conditions
Build containerization / Verify commit signatures (push) Has been skipped
Build containerization / containerization (push) Successful in 0s
107 lines
4.9 KiB
Swift
107 lines
4.9 KiB
Swift
//===----------------------------------------------------------------------===//
|
|
// Copyright © 2026 Apple Inc. and the Containerization project authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// https://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#if os(Linux)
|
|
import ContainerizationError
|
|
import ContainerizationOS
|
|
import Foundation
|
|
|
|
/// Thin idempotent wrappers around the `iptables` CLI for use by
|
|
/// `BridgeManager`. We don't program nftables directly; modern distros
|
|
/// ship the `iptables` binary as a shim over nftables and it's universally
|
|
/// available.
|
|
enum IptablesRules {
|
|
/// Add a rule unless it already exists. `args` is the rule body
|
|
/// excluding the leading action (`-A`/`-C`/`-D`).
|
|
///
|
|
/// Implementation: run `iptables -C <args>` first; if exit 0, the rule
|
|
/// exists already — return. Otherwise run `iptables -A <args>` and
|
|
/// throw on non-zero exit.
|
|
static func ensure(table: String? = nil, args: [String]) throws {
|
|
let tableArgs = table.map { ["-t", $0] } ?? []
|
|
let check = try run(args: tableArgs + ["-C"] + args)
|
|
if check.exit == 0 { return }
|
|
let add = try run(args: tableArgs + ["-A"] + args)
|
|
if add.exit != 0 {
|
|
throw ContainerizationError(
|
|
.internalError,
|
|
message: """
|
|
iptables -A \(args.joined(separator: " ")) failed (exit \(add.exit))\
|
|
\(add.stderr.isEmpty ? "" : ": \(add.stderr)")
|
|
"""
|
|
)
|
|
}
|
|
}
|
|
|
|
/// Best-effort delete. Ignores non-zero exit (rule may not exist).
|
|
static func remove(table: String? = nil, args: [String]) {
|
|
let tableArgs = table.map { ["-t", $0] } ?? []
|
|
_ = try? run(args: tableArgs + ["-D"] + args)
|
|
}
|
|
|
|
/// Captured outcome of a single `iptables` invocation.
|
|
private struct InvocationResult {
|
|
let exit: Int32
|
|
let stderr: String
|
|
}
|
|
|
|
/// Run `iptables` with the given args, returning the exit status and any
|
|
/// stderr the binary emitted. Throws if no `iptables` binary is found.
|
|
private static func run(args: [String]) throws -> InvocationResult {
|
|
// ContainerizationOS.Command uses execve() under the hood, which
|
|
// requires an absolute path. Probe the two paths iptables actually
|
|
// ships at on Linux distros — /usr/sbin first (Debian, Ubuntu,
|
|
// Fedora, Alpine, RHEL), then /sbin (older / busybox-style).
|
|
let candidates = ["/usr/sbin/iptables", "/sbin/iptables"]
|
|
// Open /dev/null fresh rather than using FileHandle.nullDevice:
|
|
// swift-corelibs-foundation's nullDevice uses a sentinel fd that
|
|
// doesn't survive dup2() in Command's child, producing EBADF on exec.
|
|
// Capture stderr through a pipe so failures surface with the actual
|
|
// iptables error (locked xtables, missing kernel module, conflicting
|
|
// rule) instead of an opaque exit code.
|
|
let devNullOut = FileHandle(forWritingAtPath: "/dev/null")
|
|
let stderrPipe = Pipe()
|
|
defer {
|
|
try? devNullOut?.close()
|
|
try? stderrPipe.fileHandleForReading.close()
|
|
}
|
|
for path in candidates where FileManager.default.isExecutableFile(atPath: path) {
|
|
// `-w` makes iptables block on the xtables lock rather than
|
|
// failing (exit 4) when another actor — a sibling BridgeManager on
|
|
// a different bridge, Docker, firewalld — is mid-iptables. Accepted
|
|
// by both legacy iptables and the nft shim.
|
|
var cmd = Command(path, arguments: ["-w"] + args)
|
|
cmd.stdout = devNullOut
|
|
cmd.stderr = stderrPipe.fileHandleForWriting
|
|
try cmd.start()
|
|
// Close the parent's write end so the read end sees EOF when
|
|
// iptables exits, even if iptables itself never writes anything.
|
|
try? stderrPipe.fileHandleForWriting.close()
|
|
let exit = try cmd.wait()
|
|
let data = (try? stderrPipe.fileHandleForReading.readToEnd()) ?? Data()
|
|
let stderr =
|
|
String(data: data, encoding: .utf8)?
|
|
.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
|
|
return InvocationResult(exit: exit, stderr: stderr)
|
|
}
|
|
throw ContainerizationError(
|
|
.notFound,
|
|
message: "iptables not found at /usr/sbin/iptables or /sbin/iptables; install iptables (or its nftables shim)"
|
|
)
|
|
}
|
|
}
|
|
#endif
|