Improve VPN client connection management

test/server/gateway-routing.test.js

@@ -16,8 +16,8 @@ test('gateway switches only the TProxy PREROUTING jump', () => {
   ]);
 
   calls.length = 0;
-  const existing = (command, args) => {
-    calls.push([command, args]);
+  const existing = (command, args, commandOptions) => {
+    calls.push([command, args, commandOptions]);
     return { status: 0, stderr: '' };
   };
   setGatewayInterception(false, 'VPN_PROXY_TPROXY', existing);
@@ -25,4 +25,22 @@ test('gateway switches only the TProxy PREROUTING jump', () => {
     ['-w', '-t', 'mangle', '-C', 'PREROUTING', '-j', 'VPN_PROXY_TPROXY'],
     ['-w', '-t', 'mangle', '-D', 'PREROUTING', '-j', 'VPN_PROXY_TPROXY'],
   ]);
+
+  calls.length = 0;
+  setGatewayInterception(true, 'VPN_PROXY_TPROXY', existing);
+  assert.deepEqual(calls.map(([command, args]) => [command, args]), [
+    ['iptables', ['-w', '-t', 'mangle', '-C', 'PREROUTING', '-j', 'VPN_PROXY_TPROXY']],
+    ['iptables-restore', ['-w', '--noflush']],
+  ]);
+  assert.match(calls[1][2].input, /-D PREROUTING -j VPN_PROXY_TPROXY\n-I PREROUTING 1 -j VPN_PROXY_TPROXY/);
+
+  assert.doesNotThrow(() => setGatewayInterception(true, 'VPN_PROXY_TPROXY', (_command, args) => ({
+    status: args.includes('-C') ? 0 : 1,
+    stderr: args.includes('-C') ? '' : 'atomic reorder failed',
+  })));
+
+  assert.throws(
+    () => setGatewayInterception(true, 'VPN_PROXY_TPROXY\nCOMMIT', () => assert.fail('iptables must not run')),
+    /Некорректная TProxy chain/,
+  );
 });