util/linuxfw, wgengine: allow ingress to magicsock UDP port on Linux (#10370)

* util/linuxfw, wgengine: allow ingress to magicsock UDP port on Linux

Updates #9084.

Currently, we have to tell users to manually open UDP ports on Linux when
certain firewalls (like ufw) are enabled. This change automates the process of
adding and updating those firewall rules as magicsock changes what port it
listens on.

Signed-off-by: Naman Sood <mail@nsood.in>

wgengine/router/router_linux_test.go

@@ -607,6 +607,58 @@ func (n *fakeIPTablesRunner) DelSNATRule() error {
 	return nil
 }
 
+// buildMagicsockPortRule builds a fake rule to use in AddMagicsockPortRule and
+// DelMagicsockPortRule below.
+func buildMagicsockPortRule(port uint16) string {
+	return fmt.Sprintf("-p udp --dport %v -j ACCEPT", port)
+}
+
+// AddMagicsockPortRule implements the NetfilterRunner interface, but stores
+// rules in fakeIPTablesRunner's internal maps rather than actually calling out
+// to iptables. This is mainly to test the linux router implementation.
+func (n *fakeIPTablesRunner) AddMagicsockPortRule(port uint16, network string) error {
+	var ipt map[string][]string
+	switch network {
+	case "udp4":
+		ipt = n.ipt4
+	case "udp6":
+		ipt = n.ipt6
+	default:
+		return fmt.Errorf("unsupported network %s", network)
+	}
+
+	rule := buildMagicsockPortRule(port)
+
+	if err := appendRule(n, ipt, "filter/ts-input", rule); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// DelMagicsockPortRule implements the NetfilterRunner interface, but removes
+// rules from fakeIPTablesRunner's internal maps rather than actually calling
+// out to iptables. This is mainly to test the linux router implementation.
+func (n *fakeIPTablesRunner) DelMagicsockPortRule(port uint16, network string) error {
+	var ipt map[string][]string
+	switch network {
+	case "udp4":
+		ipt = n.ipt4
+	case "udp6":
+		ipt = n.ipt6
+	default:
+		return fmt.Errorf("unsupported network %s", network)
+	}
+
+	rule := buildMagicsockPortRule(port)
+
+	if err := deleteRule(n, ipt, "filter/ts-input", rule); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func (n *fakeIPTablesRunner) HasIPV6() bool    { return true }
 func (n *fakeIPTablesRunner) HasIPV6NAT() bool { return true }