DebTik/internal/firewall/decorate.go

package firewall

import (
	"crypto/sha256"
	"fmt"
	"strings"
)

func decorateRuleLines(kind string, rule any, lines []string) []string {
	v := values(rule)
	id := text(v, "id")
	var out []string
	for i, line := range lines {
		marker := "-m comment --comment " + quote("id:"+id)
		at := strings.LastIndex(line, marker)
		if at < 0 {
			out = append(out, line)
			continue
		}
		end := at + len(marker)
		match, target := line[:end], strings.TrimSpace(line[end:])
		if log, _ := v["log"].(bool); log && text(v, "action") != "log" {
			prefix := text(v, "log_prefix")
			logMatch := strings.Replace(match, marker, "-m comment --comment "+quote("id:"+id+":log"), 1)
			out = append(out, logMatch+" -j LOG --log-prefix "+quote(prefix))
		}
		pass, _ := v["passthrough"].(bool)
		action := text(v, "action")
		if kind == "mangle" && !pass && action != "accept" && action != "drop" && action != "return" && action != "jump" {
			h := sha256.Sum256([]byte(fmt.Sprintf("%s:%d", id, i)))
			chain := fmt.Sprintf("R_%x", h[:6])
			out = append(out, ":"+chain+" - [0:0]", match+" -g "+chain)
			if target != "" {
				out = append(out, "-A "+chain+" "+target)
			}
			out = append(out, "-A "+chain+" -j RETURN")
		} else {
			out = append(out, line)
		}
	}
	return out
}