vanja/gluetun
1
0
Fork 0
mirror of https://github.com/qdm12/gluetun.git synced 2026-08-11 14:52:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

moare fixes

Browse Source
This commit is contained in:
Quentin McGaw
2026-08-06 20:19:10 +00:00
parent a10285d874
commit c463c56f86
8 changed files with 145 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/firewall/nftables/tcp.go
+6 -6
View File
@@ -94,16 +94,16 @@ func (f *Firewall) TempDropOutputTCPRST(_ context.Context,
// Match TCP protocol (6)
exprs = append(exprs,
&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{6}}, //nolint:mnd
&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{6}},
)
// Match source port
srcPortBytes := []byte{byte(src.Port() >> 8), byte(src.Port())} //nolint:mnd
srcPortBytes := []byte{byte(src.Port() >> 8), byte(src.Port())} //nolint:mnd,gosec // network byte order
exprs = append(exprs,
&expr.Payload{
DestRegister: 1,
Base: expr.PayloadBaseTransportHeader,
Offset: 0, //nolint:mnd
Offset: 0,
Len: 2, //nolint:mnd
},
&expr.Cmp{
@@ -114,7 +114,7 @@ func (f *Firewall) TempDropOutputTCPRST(_ context.Context,
)
// Match destination port
dstPortBytes := []byte{byte(dst.Port() >> 8), byte(dst.Port())} //nolint:mnd
dstPortBytes := []byte{byte(dst.Port() >> 8), byte(dst.Port())} //nolint:mnd,gosec // network byte order
exprs = append(exprs,
&expr.Payload{
DestRegister: 1,
@@ -143,12 +143,12 @@ func (f *Firewall) TempDropOutputTCPRST(_ context.Context,
&expr.Cmp{
Op: expr.CmpOpEq,
Register: 1,
Data: []byte{0x04}, //nolint:mnd
Data: []byte{0x04},
},
)
// Exclude packets with the mark using mark != excludeMark
markData := []byte{
markData := []byte{ //nolint:gosec // mark is int (32-bit), byte conversions are intentional
byte(excludeMark), byte(excludeMark >> 8), byte(excludeMark >> 16), byte(excludeMark >> 24), //nolint:mnd
}
exprs = append(exprs,