fix: restore nftables helper functions removed with WireGuard cleanup

The WireGuard removal (931b95b) deleted firewall.go which also contained
shared nftables helpers still needed by firewall_proxy.go. Extract them
into firewall_helpers.go to fix the build.

Made-with: Cursor

Author: ZaneL1u

internal/network/firewall_helpers.go

@@ -0,0 +1,154 @@
+//go:build linux
+
+package network
+
+import (
+	"github.com/google/nftables"
+	"github.com/google/nftables/binaryutil"
+	"github.com/google/nftables/expr"
+)
+
+const ipprotoTCP = 6
+
+func applyIPv6Rules(conn *nftables.Conn, loIfIndex int) {
+	policyDrop := nftables.ChainPolicyDrop
+
+	table6 := conn.AddTable(&nftables.Table{
+		Family: nftables.TableFamilyIPv6,
+		Name:   "filter6",
+	})
+
+	output6 := conn.AddChain(&nftables.Chain{
+		Name:     "output6",
+		Table:    table6,
+		Type:     nftables.ChainTypeFilter,
+		Hooknum:  nftables.ChainHookOutput,
+		Priority: nftables.ChainPriorityFilter,
+		Policy:   &policyDrop,
+	})
+
+	addOifAcceptRule(conn, table6, output6, loIfIndex)
+}
+
+func addOifAcceptRule(conn *nftables.Conn, table *nftables.Table, chain *nftables.Chain, ifIndex int) {
+	conn.AddRule(&nftables.Rule{
+		Table: table,
+		Chain: chain,
+		Exprs: []expr.Any{
+			&expr.Meta{Key: expr.MetaKeyOIF, Register: 1},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     binaryutil.NativeEndian.PutUint32(uint32(ifIndex)),
+			},
+			&expr.Verdict{Kind: expr.VerdictAccept},
+		},
+	})
+}
+
+func addIifAcceptRule(conn *nftables.Conn, table *nftables.Table, chain *nftables.Chain, ifIndex int) {
+	conn.AddRule(&nftables.Rule{
+		Table: table,
+		Chain: chain,
+		Exprs: []expr.Any{
+			&expr.Meta{Key: expr.MetaKeyIIF, Register: 1},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     binaryutil.NativeEndian.PutUint32(uint32(ifIndex)),
+			},
+			&expr.Verdict{Kind: expr.VerdictAccept},
+		},
+	})
+}
+
+func addOifCtEstablishedRule(conn *nftables.Conn, table *nftables.Table, chain *nftables.Chain, ifIndex int) {
+	conn.AddRule(&nftables.Rule{
+		Table: table,
+		Chain: chain,
+		Exprs: []expr.Any{
+			&expr.Meta{Key: expr.MetaKeyOIF, Register: 1},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     binaryutil.NativeEndian.PutUint32(uint32(ifIndex)),
+			},
+			&expr.Ct{Register: 1, SourceRegister: false, Key: expr.CtKeySTATE},
+			&expr.Bitwise{
+				SourceRegister: 1,
+				DestRegister:   1,
+				Len:            4,
+				Mask:           binaryutil.NativeEndian.PutUint32(expr.CtStateBitESTABLISHED | expr.CtStateBitRELATED),
+				Xor:            binaryutil.NativeEndian.PutUint32(0),
+			},
+			&expr.Cmp{
+				Op:       expr.CmpOpNeq,
+				Register: 1,
+				Data:     []byte{0, 0, 0, 0},
+			},
+			&expr.Verdict{Kind: expr.VerdictAccept},
+		},
+	})
+}
+
+func addIifCtEstablishedRule(conn *nftables.Conn, table *nftables.Table, chain *nftables.Chain, ifIndex int) {
+	conn.AddRule(&nftables.Rule{
+		Table: table,
+		Chain: chain,
+		Exprs: []expr.Any{
+			&expr.Meta{Key: expr.MetaKeyIIF, Register: 1},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     binaryutil.NativeEndian.PutUint32(uint32(ifIndex)),
+			},
+			&expr.Ct{Register: 1, SourceRegister: false, Key: expr.CtKeySTATE},
+			&expr.Bitwise{
+				SourceRegister: 1,
+				DestRegister:   1,
+				Len:            4,
+				Mask:           binaryutil.NativeEndian.PutUint32(expr.CtStateBitESTABLISHED | expr.CtStateBitRELATED),
+				Xor:            binaryutil.NativeEndian.PutUint32(0),
+			},
+			&expr.Cmp{
+				Op:       expr.CmpOpNeq,
+				Register: 1,
+				Data:     []byte{0, 0, 0, 0},
+			},
+			&expr.Verdict{Kind: expr.VerdictAccept},
+		},
+	})
+}
+
+func addIifTCPDportAcceptRule(conn *nftables.Conn, table *nftables.Table, chain *nftables.Chain, ifIndex int, port uint16) {
+	conn.AddRule(&nftables.Rule{
+		Table: table,
+		Chain: chain,
+		Exprs: []expr.Any{
+			&expr.Meta{Key: expr.MetaKeyIIF, Register: 1},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     binaryutil.NativeEndian.PutUint32(uint32(ifIndex)),
+			},
+			&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     []byte{ipprotoTCP},
+			},
+			&expr.Payload{
+				DestRegister: 1,
+				Base:         expr.PayloadBaseTransportHeader,
+				Offset:       2,
+				Len:          2,
+			},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     binaryutil.BigEndian.PutUint16(port),
+			},
+			&expr.Verdict{Kind: expr.VerdictAccept},
+		},
+	})
+}