cleanup

Author: f0ssel

namespace/linux.go

@@ -11,7 +11,7 @@ import (
 )
 
 // Linux implements jail.Commander using Linux network namespaces
-type LinuxNetNamespace struct {
+type Linux struct {
 	logger        *slog.Logger
 	namespace     string
 	vethHost      string // Host-side veth interface name for iptables rules
@@ -22,8 +22,8 @@ type LinuxNetNamespace struct {
 	userInfo      UserInfo
 }
 
-func NewLinux(config Config) (*LinuxNetNamespace, error) {
-	return &LinuxNetNamespace{
+func NewLinux(config Config) (*Linux, error) {
+	return &Linux{
 		logger:        config.Logger,
 		namespace:     newNamespaceName(),
 		httpProxyPort: config.HttpProxyPort,
@@ -34,7 +34,7 @@ func NewLinux(config Config) (*LinuxNetNamespace, error) {
 }
 
 // Start creates network namespace and configures iptables rules
-func (l *LinuxNetNamespace) Start() error {
+func (l *Linux) Start() error {
 	l.logger.Debug("Setup called")
 
 	// Setup DNS configuration BEFORE creating namespace
@@ -76,7 +76,7 @@ func (l *LinuxNetNamespace) Start() error {
 }
 
 // Command returns an exec.Cmd configured to run within the network namespace
-func (l *LinuxNetNamespace) Command(command []string) *exec.Cmd {
+func (l *Linux) Command(command []string) *exec.Cmd {
 	l.logger.Debug("Command called", "command", command)
 
 	// Create command with ip netns exec
@@ -96,7 +96,7 @@ func (l *LinuxNetNamespace) Command(command []string) *exec.Cmd {
 }
 
 // Close removes the network namespace and iptables rules
-func (l *LinuxNetNamespace) Close() error {
+func (l *Linux) Close() error {
 	// Remove iptables rules
 	err := l.removeIptables()
 	if err != nil {
@@ -123,7 +123,7 @@ func (l *LinuxNetNamespace) Close() error {
 }
 
 // createNamespace creates a new network namespace
-func (l *LinuxNetNamespace) createNamespace() error {
+func (l *Linux) createNamespace() error {
 	cmd := exec.Command("ip", "netns", "add", l.namespace)
 	err := cmd.Run()
 	if err != nil {
@@ -133,12 +133,12 @@ func (l *LinuxNetNamespace) createNamespace() error {
 }
 
 // setupNetworking configures networking within the namespace
-func (l *LinuxNetNamespace) setupNetworking() error {
+func (l *Linux) setupNetworking() error {
 	// Create veth pair with short names (Linux interface names limited to 15 chars)
 	// Generate unique ID to avoid conflicts
 	uniqueID := fmt.Sprintf("%d", time.Now().UnixNano()%10000000) // 7 digits max
-	vethHost := fmt.Sprintf("veth_h_%s", uniqueID)     // veth_h_1234567 = 14 chars
-	vethNetJail := fmt.Sprintf("veth_n_%s", uniqueID) // veth_n_1234567 = 14 chars
+	vethHost := fmt.Sprintf("veth_h_%s", uniqueID)                // veth_h_1234567 = 14 chars
+	vethNetJail := fmt.Sprintf("veth_n_%s", uniqueID)             // veth_n_1234567 = 14 chars
 
 	// Store veth interface name for iptables rules
 	l.vethHost = vethHost
@@ -169,7 +169,7 @@ func (l *LinuxNetNamespace) setupNetworking() error {
 // setupDNS configures DNS resolution for the namespace
 // This ensures reliable DNS resolution by using public DNS servers
 // instead of relying on the host's potentially complex DNS configuration
-func (l *LinuxNetNamespace) setupDNS() error {
+func (l *Linux) setupDNS() error {
 	// Always create namespace-specific resolv.conf with reliable public DNS servers
 	// This avoids issues with systemd-resolved, Docker DNS, and other complex setups
 	netnsEtc := fmt.Sprintf("/etc/netns/%s", l.namespace)
@@ -197,7 +197,7 @@ options timeout:2 attempts:2
 }
 
 // setupIptables configures iptables rules for comprehensive TCP traffic interception
-func (l *LinuxNetNamespace) setupIptables() error {
+func (l *Linux) setupIptables() error {
 	// Enable IP forwarding
 	cmd := exec.Command("sysctl", "-w", "net.ipv4.ip_forward=1")
 	cmd.Run() // Ignore error
@@ -222,7 +222,7 @@ func (l *LinuxNetNamespace) setupIptables() error {
 }
 
 // removeIptables removes iptables rules
-func (l *LinuxNetNamespace) removeIptables() error {
+func (l *Linux) removeIptables() error {
 	// Remove comprehensive TCP redirect rule
 	cmd := exec.Command("iptables", "-t", "nat", "-D", "PREROUTING", "-i", l.vethHost, "-p", "tcp", "-j", "REDIRECT", "--to-ports", fmt.Sprintf("%d", l.httpProxyPort))
 	cmd.Run() // Ignore errors during cleanup
@@ -235,11 +235,11 @@ func (l *LinuxNetNamespace) removeIptables() error {
 }
 
 // removeNamespace removes the network namespace
-func (l *LinuxNetNamespace) removeNamespace() error {
+func (l *Linux) removeNamespace() error {
 	cmd := exec.Command("ip", "netns", "del", l.namespace)
 	err := cmd.Run()
 	if err != nil {
 		return fmt.Errorf("failed to remove namespace: %v", err)
 	}
 	return nil
-}
+}

namespace/macos.go

@@ -19,16 +19,16 @@ const (
 
 // MacOSNetJail implements network jail using macOS PF (Packet Filter) and group-based isolation
 type MacOSNetJail struct {
-	restrictedGid  int
-	pfRulesPath    string
-	mainRulesPath  string
-	logger         *slog.Logger
-	commandEnv     []string
-	procAttr       *syscall.SysProcAttr
-	httpProxyPort  int
-	tlsConfigDir   string
-	caCertPath     string
-	userInfo       UserInfo
+	restrictedGid int
+	pfRulesPath   string
+	mainRulesPath string
+	logger        *slog.Logger
+	commandEnv    []string
+	procAttr      *syscall.SysProcAttr
+	httpProxyPort int
+	tlsConfigDir  string
+	caCertPath    string
+	userInfo      UserInfo
 }
 
 // NewMacOS creates a new macOS network jail instance
@@ -261,15 +261,10 @@ func (m *MacOSNetJail) setupPFRules() error {
 
 	// Load rules into anchor
 	cmd := exec.Command("pfctl", "-a", pfAnchorName, "-f", m.pfRulesPath)
-	output, err := cmd.CombinedOutput()
+	err = cmd.Run()
 	if err != nil {
-		m.logger.Error("Failed to load PF rules", "error", err, "output", string(output), "rules_file", m.pfRulesPath)
-		// Also log the actual rules content for debugging
-		rulesContent, readErr := os.ReadFile(m.pfRulesPath)
-		if readErr == nil {
-			m.logger.Debug("PF rules content", "rules", string(rulesContent))
-		}
-		return fmt.Errorf("failed to load PF rules: %v, output: %s", err, string(output))
+		m.logger.Error("Failed to load PF rules", "error", err, "rules_file", m.pfRulesPath)
+		return fmt.Errorf("failed to load PF rules: %v", err)
 	}
 
 	// Enable PF if not already enabled
@@ -307,7 +302,7 @@ anchor "%s"
 
 	// Verify that rules were loaded correctly
 	cmd = exec.Command("pfctl", "-a", pfAnchorName, "-s", "rules")
-	output, err = cmd.Output()
+	output, err := cmd.Output()
 	if err == nil && len(output) > 0 {
 		// Rules loaded successfully
 		return nil
@@ -333,4 +328,4 @@ func (m *MacOSNetJail) cleanupTempFiles() {
 	if m.mainRulesPath != "" {
 		os.Remove(m.mainRulesPath)
 	}
-}
+}