uspfilter

package
v0.37.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 24, 2025 License: BSD-3-Clause Imports: 22 Imported by: 1

Documentation

Index

Constants

View Source 
const (
	// EnvDisableConntrack disables the stateful filter, replies to outbound traffic won't be allowed.
	EnvDisableConntrack = "NB_DISABLE_CONNTRACK"

	// EnvDisableUserspaceRouting disables userspace routing, to-be-routed packets will be dropped.
	EnvDisableUserspaceRouting = "NB_DISABLE_USERSPACE_ROUTING"

	// EnvForceUserspaceRouter forces userspace routing even if native routing is available.
	EnvForceUserspaceRouter = "NB_FORCE_USERSPACE_ROUTER"

	// EnvEnableNetstackLocalForwarding enables forwarding of local traffic to the native stack when running netstack
	// Leaving this on by default introduces a security risk as sockets on listening on localhost only will be accessible
	EnvEnableNetstackLocalForwarding = "NB_ENABLE_NETSTACK_LOCAL_FORWARDING"
)

Variables

This section is empty.

Functions

This section is empty.

Types

type ForwarderAction added in v0.36.6 

type ForwarderAction struct {
	Action     string
	RemoteAddr string
	Error      error
}

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

Manager userspace firewall manager

func Create 

func Create(iface common.IFaceMapper, disableServerRoutes bool) (*Manager, error)

Create userspace firewall manager constructor

func CreateWithNativeFirewall added in v0.24.4 

func CreateWithNativeFirewall(iface common.IFaceMapper, nativeFirewall firewall.Manager, disableServerRoutes bool) (*Manager, error)

func (*Manager) AddNatRule added in v0.30.0 

func (m *Manager) AddNatRule(pair firewall.RouterPair) error

func (*Manager) AddPeerFiltering added in v0.30.0 

func (m *Manager) AddPeerFiltering(
	ip net.IP,
	proto firewall.Protocol,
	sPort *firewall.Port,
	dPort *firewall.Port,
	action firewall.Action,
	_ string,
	comment string,
) ([]firewall.Rule, error)

AddPeerFiltering rule to the firewall

If comment argument is empty firewall manager should set rule ID as comment for the rule

func (*Manager) AddRouteFiltering added in v0.30.0 

func (m *Manager) AddRouteFiltering(
	sources []netip.Prefix,
	destination netip.Prefix,
	proto firewall.Protocol,
	sPort *firewall.Port,
	dPort *firewall.Port,
	action firewall.Action,
) (firewall.Rule, error)

func (*Manager) AddUDPPacketHook added in v0.21.2 

func (m *Manager) AddUDPPacketHook(
	in bool, ip net.IP, dPort uint16, hook func([]byte) bool,
) string

AddUDPPacketHook calls hook when UDP packet from given direction matched

Hook function returns flag which indicates should be the matched package dropped or not

func (*Manager) AllowNetbird added in v0.23.0 

func (m *Manager) AllowNetbird() error

AllowNetbird allows netbird interface traffic

func (*Manager) DeletePeerRule added in v0.30.0 

func (m *Manager) DeletePeerRule(rule firewall.Rule) error

DeletePeerRule from the firewall by rule definition

func (*Manager) DeleteRouteRule added in v0.30.0 

func (m *Manager) DeleteRouteRule(rule firewall.Rule) error

func (*Manager) DisableRouting added in v0.36.6 

func (m *Manager) DisableRouting() error

func (*Manager) DropIncoming 

func (m *Manager) DropIncoming(packetData []byte) bool

DropIncoming filter incoming packets

func (*Manager) DropOutgoing 

func (m *Manager) DropOutgoing(packetData []byte) bool

DropOutgoing filter outgoing packets

func (*Manager) EnableRouting added in v0.36.6 

func (m *Manager) EnableRouting() error

func (*Manager) Flush added in v0.21.9 

func (m *Manager) Flush() error

Flush doesn't need to be implemented for this manager

func (*Manager) Init added in v0.30.3 

func (m *Manager) Init(*statemanager.Manager) error

func (*Manager) IsServerRouteSupported added in v0.24.4 

func (m *Manager) IsServerRouteSupported() bool

func (*Manager) RemoveNatRule added in v0.30.0 

func (m *Manager) RemoveNatRule(pair firewall.RouterPair) error

RemoveNatRule removes a routing firewall rule

func (*Manager) RemovePacketHook added in v0.21.2 

func (m *Manager) RemovePacketHook(hookID string) error

RemovePacketHook removes packet hook by given ID

func (*Manager) Reset 

func (m *Manager) Reset(stateManager *statemanager.Manager) error

Reset firewall to the default state

func (*Manager) SetLegacyManagement added in v0.30.0 

func (m *Manager) SetLegacyManagement(isLegacy bool) error

SetLegacyManagement doesn't need to be implemented for this manager

func (*Manager) SetLogLevel added in v0.36.6 

func (m *Manager) SetLogLevel(level log.Level)

SetLogLevel sets the log level for the firewall manager

func (*Manager) SetNetwork 

func (m *Manager) SetNetwork(network *net.IPNet)

SetNetwork of the wireguard interface to which filtering applied

func (*Manager) TracePacket added in v0.36.6 

func (m *Manager) TracePacket(packetData []byte, direction fw.RuleDirection) *PacketTrace

func (*Manager) TracePacketFromBuilder added in v0.36.6 

func (m *Manager) TracePacketFromBuilder(builder *PacketBuilder) (*PacketTrace, error)

func (*Manager) UpdateLocalIPs added in v0.36.6 

func (m *Manager) UpdateLocalIPs() error

UpdateLocalIPs updates the list of local IPs

type PacketBuilder added in v0.36.6 

type PacketBuilder struct {
	SrcIP       net.IP
	DstIP       net.IP
	Protocol    fw.Protocol
	SrcPort     uint16
	DstPort     uint16
	ICMPType    uint8
	ICMPCode    uint8
	Direction   fw.RuleDirection
	PayloadSize int
	TCPState    *TCPState
}

func (*PacketBuilder) Build added in v0.36.6 

func (p *PacketBuilder) Build() ([]byte, error)

type PacketStage added in v0.36.6 

type PacketStage int
const (
	StageReceived PacketStage = iota
	StageConntrack
	StagePeerACL
	StageRouting
	StageRouteACL
	StageForwarding
	StageCompleted
)

func (PacketStage) String added in v0.36.6 

func (s PacketStage) String() string

type PacketTrace added in v0.36.6 

type PacketTrace struct {
	SourceIP        net.IP
	DestinationIP   net.IP
	Protocol        string
	SourcePort      uint16
	DestinationPort uint16
	Direction       fw.RuleDirection
	Results         []TraceResult
}

func (*PacketTrace) AddResult added in v0.36.6 

func (t *PacketTrace) AddResult(stage PacketStage, message string, allowed bool)

func (*PacketTrace) AddResultWithForwarder added in v0.36.6 

func (t *PacketTrace) AddResultWithForwarder(stage PacketStage, message string, allowed bool, action *ForwarderAction)

type PeerRule added in v0.36.6 

type PeerRule struct {
	// contains filtered or unexported fields
}

PeerRule to handle management of rules

func (*PeerRule) GetRuleID added in v0.36.6 

func (r *PeerRule) GetRuleID() string

GetRuleID returns the rule id

type RouteRule added in v0.36.6 

type RouteRule struct {
	// contains filtered or unexported fields
}

func (*RouteRule) GetRuleID added in v0.36.6 

func (r *RouteRule) GetRuleID() string

GetRuleID returns the rule id

type RouteRules added in v0.36.6 

type RouteRules []RouteRule

func (RouteRules) Sort added in v0.36.6 

func (r RouteRules) Sort()

type RuleSet added in v0.21.9 

type RuleSet map[string]PeerRule

RuleSet is a set of rules grouped by a string key

type TCPState added in v0.36.6 

type TCPState struct {
	SYN bool
	ACK bool
	FIN bool
	RST bool
	PSH bool
	URG bool
}

type TraceResult added in v0.36.6 

type TraceResult struct {
	Timestamp       time.Time
	Stage           PacketStage
	Message         string
	Allowed         bool
	ForwarderAction *ForwarderAction
}

Source Files

View all Source files

Directories

Path Synopsis
common.go
 common.go
Package logger provides a high-performance, non-blocking logger for userspace networking
 Package logger provides a high-performance, non-blocking logger for userspace networking

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.
JackTT - Gopher 🇻🇳