traffic_core: продакшн-фиксы runtime и валидации

traffic_core/src/firewall.rs

@@ -20,16 +20,13 @@ struct FirewallActual {
 }
 
 pub fn apply_firewall(cfg: &Config) -> anyhow::Result<()> {
-    let transport = firewall_transport(cfg)?;
-
     if !cfg.anti_torrent.enabled {
-        run_allow_notfound(
-            transport.as_ref(),
-            &["nft", "delete", "table", "inet", "awg2_harness"],
-        )?;
+        apply_firewall_disabled(cfg)?;
         return Ok(());
     }
 
+    let transport = firewall_transport(cfg)?;
+
     let actual = inspect_firewall(transport.as_ref(), cfg)?;
     if !firewall_has_drift(&actual) {
         return Ok(());
@@ -72,6 +69,30 @@ pub fn apply_firewall(cfg: &Config) -> anyhow::Result<()> {
     Ok(())
 }
 
+fn apply_firewall_disabled(cfg: &Config) -> anyhow::Result<()> {
+    if cfg.anti_torrent.apply_in_amnezia_netns {
+        match docker::discover_target(cfg) {
+            Ok(target) => {
+                let transport = build_transport(target.container_pid, &target.container_name);
+                run_allow_notfound(
+                    transport.as_ref(),
+                    &["nft", "delete", "table", "inet", "awg2_harness"],
+                )?;
+            }
+            Err(_) => {
+                // container is absent now: nothing to remove in its netns
+            }
+        }
+    } else {
+        let transport = build_host_transport();
+        run_allow_notfound(
+            transport.as_ref(),
+            &["nft", "delete", "table", "inet", "awg2_harness"],
+        )?;
+    }
+    Ok(())
+}
+
 fn inspect_firewall(transport: &dyn NsTransport, cfg: &Config) -> anyhow::Result<FirewallActual> {
     let table = match transport.run(&["nft", "list", "table", "inet", "awg2_harness"]) {
         Ok(out) => out,
@@ -199,11 +220,14 @@ fn run_allow_notfound(transport: &dyn NsTransport, args: &[&str]) -> anyhow::Res
     match transport.run(args) {
         Ok(_) => Ok(()),
         Err(e) => {
-            let msg = e.to_string();
-            if msg.contains("No such file")
-                || msg.contains("No such")
+            let msg = e.to_string().to_ascii_lowercase();
+            if msg.contains("no such file")
+                || msg.contains("no such")
                 || msg.contains("not found")
                 || msg.contains("not exist")
+                || msg.contains("no such table")
+                || msg.contains("no such device")
+                || msg.contains("cannot find")
             {
                 return Ok(());
             }