Полная реализация production-фиксов из up3: anti-torrent rebuild, peer-status, drift rate/ceil, reboot window

traffic_core/src/firewall.rs

@@ -1,7 +1,7 @@
 use crate::{
     config::Config,
     docker,
-    netns::{NsTransport, build_transport},
+    netns::{NsTransport, build_host_transport, build_transport},
 };
 
 #[derive(Debug, Clone)]
@@ -13,11 +13,13 @@ struct FirewallActual {
 }
 
 pub fn apply_firewall(cfg: &Config) -> anyhow::Result<()> {
-    let target = docker::discover_target(cfg)?;
-    let transport = build_transport(target.container_pid, &target.container_name);
+    let transport = firewall_transport(cfg)?;
 
     if !cfg.anti_torrent.enabled {
-        let _ = transport.run(&["nft", "delete", "table", "inet", "awg2_harness"]);
+        run_allow_notfound(
+            transport.as_ref(),
+            &["nft", "delete", "table", "inet", "awg2_harness"],
+        )?;
         return Ok(());
     }
 
@@ -26,11 +28,16 @@ pub fn apply_firewall(cfg: &Config) -> anyhow::Result<()> {
         return Ok(());
     }
 
-    run_allow_exists(
+    run_allow_notfound(
+        transport.as_ref(),
+        &["nft", "delete", "table", "inet", "awg2_harness"],
+    )?;
+
+    run_step(
         transport.as_ref(),
         &["nft", "add", "table", "inet", "awg2_harness"],
     )?;
-    run_allow_exists(
+    run_step(
         transport.as_ref(),
         &[
             "nft",
@@ -41,7 +48,7 @@ pub fn apply_firewall(cfg: &Config) -> anyhow::Result<()> {
             "antitorrent_dropped_v4",
         ],
     )?;
-    run_allow_exists_chain(transport.as_ref())?;
+    run_step_chain(transport.as_ref())?;
     apply_rule(
         transport.as_ref(),
         &cfg.anti_torrent.peer_ipv4_cidr,
@@ -80,6 +87,15 @@ fn inspect_firewall(transport: &dyn NsTransport, cfg: &Config) -> anyhow::Result
     })
 }
 
+fn firewall_transport(cfg: &Config) -> anyhow::Result<Box<dyn NsTransport>> {
+    if cfg.anti_torrent.apply_in_amnezia_netns {
+        let target = docker::discover_target(cfg)?;
+        Ok(build_transport(target.container_pid, &target.container_name))
+    } else {
+        Ok(build_host_transport())
+    }
+}
+
 fn apply_rule(transport: &dyn NsTransport, cidr: &str, max_conn: u32) -> anyhow::Result<()> {
     let _ = transport.run(&[
         "nft",
@@ -112,21 +128,13 @@ fn apply_rule(transport: &dyn NsTransport, cidr: &str, max_conn: u32) -> anyhow:
     Ok(())
 }
 
-fn run_allow_exists(transport: &dyn NsTransport, args: &[&str]) -> anyhow::Result<()> {
-    match transport.run(args) {
-        Ok(_) => Ok(()),
-        Err(e) => {
-            let msg = e.to_string();
-            if msg.contains("File exists") || msg.contains("exists") {
-                return Ok(());
-            }
-            Err(e)
-        }
-    }
+fn run_step(transport: &dyn NsTransport, args: &[&str]) -> anyhow::Result<()> {
+    let _ = transport.run(args)?;
+    Ok(())
 }
 
-fn run_allow_exists_chain(transport: &dyn NsTransport) -> anyhow::Result<()> {
-    run_allow_exists(
+fn run_step_chain(transport: &dyn NsTransport) -> anyhow::Result<()> {
+    run_step(
         transport,
         &[
             "nft",
@@ -149,13 +157,29 @@ fn run_allow_exists_chain(transport: &dyn NsTransport) -> anyhow::Result<()> {
     )
 }
 
+fn run_allow_notfound(transport: &dyn NsTransport, args: &[&str]) -> anyhow::Result<()> {
+    match transport.run(args) {
+        Ok(_) => Ok(()),
+        Err(e) => {
+            let msg = e.to_string();
+            if msg.contains("No such file")
+                || msg.contains("No such")
+                || msg.contains("not found")
+                || msg.contains("not exist")
+            {
+                return Ok(());
+            }
+            Err(e)
+        }
+    }
+}
+
 pub fn antitorrent_drop_counter(cfg: &Config) -> anyhow::Result<Option<(u64, u64)>> {
     if !cfg.anti_torrent.enabled {
         return Ok(None);
     }
 
-    let target = docker::discover_target(cfg)?;
-    let transport = build_transport(target.container_pid, &target.container_name);
+    let transport = firewall_transport(cfg)?;
     let table = transport
         .run(&["nft", "list", "table", "inet", "awg2_harness"])
         .unwrap_or_default();