We chose to use the iptables crate rather than the nftables one (nftnl) because it is much higher level and seems to be more mature/popular.
This adds a new firewall (fw) actor that handles event and a fw module that provides high level functions (setup, add port, cleanup).
Still TODO / needs to be discussed :
Do we need to cleanup iptables rules when diplonat is stopped ? Do we tackle this with tokio / unix signal handlers / shutdown_hooks ?
More global question : are we handling "delete service/port" events ? it doesn't seem to be done in the other actors, or am I mistaken ? :)
Should we cleanup? We should avoid state if possible
So in my review I propose a bit agressive solutions: flushing entries on each notification. Of course, we should be careful to not break the connection if we do that, it is maybe a bad idea. But we can cleanup at process start. Cleaning on stopping is a bit hard as process may crash, I think it will be lot of burden for close to no gain
IGD ports are removed by reaching a timeout due to not renewing them
Considering IGD, ports are registered with a timeout: if registration is not renewed, the entry is garbage collected automatically by the router.
On each notification, the full sets of ports to be opened is sent, so by not renewing ports that are not required, the NAT entry on the router will naturally expire.