Add local redirect

Author: nekohasekai

redirect_nftables.go

@@ -61,8 +61,23 @@ func (r *autoRedirect) setupNFTables() error {
 				return err
 			}
 			r.nftablesCreateUnreachable(nft, table, chainOutput)
-			r.nftablesCreateRedirect(nft, table, chainOutput)
-
+			err = r.nftablesCreateRedirect(nft, table, chainOutput)
+			if err != nil {
+				return err
+			}
+			if len(r.tunOptions.Inet4LocalRedirectAddress) > 0 || len(r.tunOptions.Inet6LocalRedirectAddress) > 0 {
+				chainOutputRoute := nft.AddChain(&nftables.Chain{
+					Name:     "output_route",
+					Table:    table,
+					Hooknum:  nftables.ChainHookOutput,
+					Priority: nftables.ChainPriorityMangle,
+					Type:     nftables.ChainTypeRoute,
+				})
+				err = r.nftablesCreateLocalRedirectReroute(nft, table, chainOutputRoute)
+				if err != nil {
+					return err
+				}
+			}
 			chainOutputUDP := nft.AddChain(&nftables.Chain{
 				Name:     "output_udp_icmp",
 				Table:    table,
@@ -77,14 +92,17 @@ func (r *autoRedirect) setupNFTables() error {
 			r.nftablesCreateUnreachable(nft, table, chainOutputUDP)
 			r.nftablesCreateMark(nft, table, chainOutputUDP)
 		} else {
-			r.nftablesCreateRedirect(nft, table, chainOutput, &expr.Meta{
+			err = r.nftablesCreateRedirect(nft, table, chainOutput, &expr.Meta{
 				Key:      expr.MetaKeyOIFNAME,
 				Register: 1,
 			}, &expr.Cmp{
 				Op:       expr.CmpOpEq,
 				Register: 1,
 				Data:     nftablesIfname(r.tunOptions.Name),
 			})
+			if err != nil {
+				return err
+			}
 		}
 	}
 
@@ -100,11 +118,26 @@ func (r *autoRedirect) setupNFTables() error {
 		return err
 	}
 	r.nftablesCreateUnreachable(nft, table, chainPreRouting)
-	r.nftablesCreateRedirect(nft, table, chainPreRouting)
+	err = r.nftablesCreateRedirect(nft, table, chainPreRouting)
+	if err != nil {
+		return err
+	}
 	if r.tunOptions.AutoRedirectMarkMode {
 		r.nftablesCreateMark(nft, table, chainPreRouting)
 	}
-
+	if r.tunOptions.AutoRedirectMarkMode && (len(r.tunOptions.Inet4LocalRedirectAddress) > 0 || len(r.tunOptions.Inet6LocalRedirectAddress) > 0) {
+		chainPreRoutingFilter := nft.AddChain(&nftables.Chain{
+			Name:     "prerouting_filter",
+			Table:    table,
+			Hooknum:  nftables.ChainHookPrerouting,
+			Priority: nftables.ChainPriorityRef(*nftables.ChainPriorityNATDest + 1),
+			Type:     nftables.ChainTypeFilter,
+		})
+		err = r.nftablesCreateLocalRedirectReroute(nft, table, chainPreRoutingFilter)
+		if err != nil {
+			return err
+		}
+	}
 	if r.tunOptions.AutoRedirectMarkMode {
 		chainPreRoutingUDP := nft.AddChain(&nftables.Chain{
 			Name:     "prerouting_udp",