refactor

Author: evgeniy-scherbina

jail/linux.go

@@ -136,48 +136,38 @@ func (l *LinuxJail) Close() error {
 
 // setupIptables configures iptables rules for comprehensive TCP traffic interception
 func (l *LinuxJail) configureIptables() error {
-	// Enable IP forwarding
-	cmd := exec.Command("sysctl", "-w", "net.ipv4.ip_forward=1")
-	_ = cmd.Run() // Ignore error
-
-	// NAT rules for outgoing traffic (MASQUERADE for return traffic)
-	cmd = exec.Command("iptables", "-t", "nat", "-A", "POSTROUTING", "-s", "192.168.100.0/24", "-j", "MASQUERADE")
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		AmbientCaps: []uintptr{uintptr(unix.CAP_NET_ADMIN)},
-	}
-	err := cmd.Run()
-	if err != nil {
-		return fmt.Errorf("failed to add NAT rule: %v", err)
-	}
-
-	// COMPREHENSIVE APPROACH: Route ALL TCP traffic to HTTP proxy
-	// The HTTP proxy will intelligently handle both HTTP and TLS traffic
-	cmd = exec.Command("iptables", "-t", "nat", "-A", "PREROUTING", "-i", l.vethHostName, "-p", "tcp", "-j", "REDIRECT", "--to-ports", fmt.Sprintf("%d", l.httpProxyPort))
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		AmbientCaps: []uintptr{uintptr(unix.CAP_NET_ADMIN)},
-	}
-	err = cmd.Run()
-	if err != nil {
-		return fmt.Errorf("failed to add comprehensive TCP redirect rule: %v", err)
-	}
-
-	// TODO: clean up this rules
-	cmd = exec.Command("iptables", "-A", "FORWARD", "-s", "192.168.100.0/24", "-j", "ACCEPT")
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		AmbientCaps: []uintptr{uintptr(unix.CAP_NET_ADMIN)},
-	}
-	err = cmd.Run()
-	if err != nil {
-		return fmt.Errorf("forward -s error: %v", err)
-	}
-
-	cmd = exec.Command("iptables", "-A", "FORWARD", "-d", "192.168.100.0/24", "-j", "ACCEPT")
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		AmbientCaps: []uintptr{uintptr(unix.CAP_NET_ADMIN)},
-	}
-	err = cmd.Run()
-	if err != nil {
-		return fmt.Errorf("forward -r error: %v", err)
+	runner := newCommandRunner([]*command{
+		{
+			"enable IP forwarding",
+			exec.Command("sysctl", "-w", "net.ipv4.ip_forward=1"),
+			[]uintptr{},
+		},
+		{
+			"NAT rules for outgoing traffic (MASQUERADE for return traffic)",
+			exec.Command("iptables", "-t", "nat", "-A", "POSTROUTING", "-s", "192.168.100.0/24", "-j", "MASQUERADE"),
+			[]uintptr{uintptr(unix.CAP_NET_ADMIN)},
+		},
+		{
+			// COMPREHENSIVE APPROACH: Route ALL TCP traffic to HTTP proxy
+			// The HTTP proxy will intelligently handle both HTTP and TLS traffic
+			"Route ALL TCP traffic to HTTP proxy",
+			exec.Command("iptables", "-t", "nat", "-A", "PREROUTING", "-i", l.vethHostName, "-p", "tcp", "-j", "REDIRECT", "--to-ports", fmt.Sprintf("%d", l.httpProxyPort)),
+			[]uintptr{uintptr(unix.CAP_NET_ADMIN)},
+		},
+		// TODO: clean up this rules
+		{
+			"iptables FORWARD -s",
+			exec.Command("iptables", "-A", "FORWARD", "-s", "192.168.100.0/24", "-j", "ACCEPT"),
+			[]uintptr{uintptr(unix.CAP_NET_ADMIN)},
+		},
+		{
+			"iptables FORWARD -d",
+			exec.Command("iptables", "-A", "FORWARD", "-d", "192.168.100.0/24", "-j", "ACCEPT"),
+			[]uintptr{uintptr(unix.CAP_NET_ADMIN)},
+		},
+	})
+	if err := runner.run(); err != nil {
+		return err
 	}
 
 	l.logger.Debug("Comprehensive TCP boundarying enabled", "interface", l.vethHostName, "proxy_port", l.httpProxyPort)