pre-clean stale state at startup, bump to 0.0.5

Drop-based rollback only runs on clean shutdown; SIGKILL / panic=abort /
OOM leave iptables / ip rule / route / TUN state behind, and the next
run fails with "File exists". Add a best-effort pre_clean pass that
wipes exactly the state this config would install, before apply().

Author: root

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "transparent-udp-obfus"
-version = "0.0.4"
+version = "0.0.5"
 edition = "2021"
 
 [[bin]]

Cargo.toml

@@ -54,6 +54,11 @@ async fn async_main(cfg: Config) -> Result<()> {
     let remote_rules = Arc::new(CompiledRule::compile_many(&cfg.remote_traffic)?);
     let keystream = Arc::new(Keystream::from_passphrase(&cfg.passphrase, cfg.cipher_mode));
 
+    // Wipe any stale state from a previously crashed run (SIGKILL / panic=abort
+    // / OOM) before we try to install our own. The Drop-based rollback in
+    // setup::apply only runs on clean shutdown; this covers the rest.
+    setup::pre_clean(&cfg, &local_rules, &remote_rules);
+
     // Create TUN queues: one read queue per worker for the sender, plus one
     // dedicated write queue shared across all receiver tasks.
     let sender_fds: Vec<OwnedFd> = tun::open_queues(&cfg.tun, cfg.num_threads)

src/main.rs

@@ -53,6 +53,96 @@ fn s(x: impl Into<String>) -> String {
     x.into()
 }
 
+/// Run a command silently, ignoring exit status and output. Used by the
+/// pre-clean pass where "not present" is the expected outcome on a fresh box.
+fn try_cmd(args: &[&str]) {
+    let _ = Command::new(args[0]).args(&args[1..]).output();
+}
+
+/// Best-effort removal of any leftover state this config would install, so we
+/// survive a previous crashed run (SIGKILL / panic=abort / OOM) that didn't
+/// run the Drop-based rollback. All failures are expected on a clean system
+/// and silently ignored.
+pub fn pre_clean(cfg: &Config, local_rules: &[CompiledRule], remote_rules: &[CompiledRule]) {
+    let tun = &cfg.tun;
+    let table = cfg.table.to_string();
+    let tproxy_table = (cfg.table + 1).to_string();
+    let mark_tproxy = format!("0x{:x}", cfg.mark_tproxy);
+
+    // iptables / ip6tables: delete the exact TPROXY rule we'd add. iptables -D
+    // only removes an exactly-matching rule, so we rebuild the full arg list.
+    for r in remote_rules {
+        let v6 = matches!(r.af, AfSpec::Ip6);
+        let bin = if v6 { "ip6tables" } else { "iptables" };
+        let on_ip = if v6 { "::1" } else { "127.0.0.1" };
+        let mut args: Vec<String> = vec![
+            s(bin), s("-t"), s("mangle"), s("-D"), s("PREROUTING"),
+            s("!"), s("-i"), tun.clone(),
+            s("-p"), s("udp"),
+        ];
+        if let Some(dp) = r.dstport {
+            args.extend([s("--dport"), dp.to_string()]);
+        }
+        if let Some(net) = &r.srcip {
+            args.extend([s("-s"), net.to_string()]);
+        }
+        if let Some(net) = &r.dstip {
+            args.extend([s("-d"), net.to_string()]);
+        }
+        if let Some((lo, hi)) = r.srcport {
+            args.extend([s("--sport"), format!("{}:{}", lo, hi)]);
+        }
+        args.extend([s("-m"), s("mark"), s("!"), s("--mark"), format!("0x{:x}", cfg.mark_reinject)]);
+        args.extend([s("-m"), s("addrtype"), s("--dst-type"), s("LOCAL")]);
+        args.extend([s("-j"), s("TPROXY")]);
+        args.extend([s("--on-ip"), s(on_ip)]);
+        args.extend([s("--on-port"), cfg.tproxy_port.to_string()]);
+        args.extend([s("--tproxy-mark"), mark_tproxy.clone()]);
+        let refs: Vec<&str> = args.iter().map(|x| x.as_str()).collect();
+        try_cmd(&refs);
+    }
+
+    // Per-local_traffic ip rule: build the same spec as apply() but with `del`.
+    for r in local_rules {
+        let v6 = matches!(r.af, AfSpec::Ip6);
+        let mut args: Vec<String> = vec![s("ip")];
+        if v6 {
+            args.push(s("-6"));
+        }
+        args.extend([s("rule"), s("del"), s("iif"), s("lo")]);
+        if let Some(net) = &r.dstip {
+            args.extend([s("to"), net.to_string()]);
+        }
+        if let Some(net) = &r.srcip {
+            args.extend([s("from"), net.to_string()]);
+        }
+        if let Some(dp) = r.dstport {
+            args.extend([s("dport"), dp.to_string()]);
+        }
+        if let Some((lo, hi)) = r.srcport {
+            args.extend([s("sport"), format!("{}-{}", lo, hi)]);
+        }
+        args.extend([s("fwmark"), format!("0x0/0x{:x}", cfg.mark_reinject)]);
+        args.extend([s("lookup"), table.clone()]);
+        let refs: Vec<&str> = args.iter().map(|x| x.as_str()).collect();
+        try_cmd(&refs);
+    }
+
+    // tproxy fwmark rule (v4 + v6)
+    try_cmd(&["ip", "rule", "del", "fwmark", &mark_tproxy, "lookup", &tproxy_table]);
+    try_cmd(&["ip", "-6", "rule", "del", "fwmark", &mark_tproxy, "lookup", &tproxy_table]);
+
+    // Routes: flushing our own tables is cheaper + more robust than reverse-
+    // engineering each entry, and the tables are ours by config so it is safe.
+    try_cmd(&["ip", "route", "flush", "table", &table]);
+    try_cmd(&["ip", "-6", "route", "flush", "table", &table]);
+    try_cmd(&["ip", "route", "flush", "table", &tproxy_table]);
+    try_cmd(&["ip", "-6", "route", "flush", "table", &tproxy_table]);
+
+    // Leftover TUN device from a crashed run. The new apply() will re-open it.
+    try_cmd(&["ip", "link", "del", tun]);
+}
+
 fn read_sysctl(path: &str, fallback: &str) -> String {
     std::fs::read_to_string(path)
         .map(|x| x.trim().to_string())