Documentation ¶
Overview ¶
Package iptables supports packet filtering and manipulation via the iptables tool.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Chain ¶
type Chain struct { // Name is the chain name. Name string // Rules is the list of rules to traverse. Rules []Rule }
A Chain defines a list of rules for packet processing. When a packet traverses a chain, it is checked against each rule until either a rule returns a verdict or the chain ends.
By convention, builtin chains end with a rule that matches everything and returns either Accept or Drop. User-defined chains end with Return. These aren't strictly necessary here, but the iptables tool writes tables this way.
type Hook ¶
type Hook uint
A Hook specifies one of the hooks built into the network stack.
Userspace app Userspace app ^ | | v [Input] [Output] ^ | | v | routing | | | v
----->[Prerouting]----->routing----->[Forward]---------Postrouting----->
Hook 指定了网络协议栈中内置的钩子。
const ( // Prerouting happens before a packet is routed to applications or to be forwarded. // Prerouting 发生在数据包被路由到应用程序或被 forward 转发前。 Prerouting Hook = iota // Input happens before a packet reaches an application. // Input 发生在数据包到达应用程序之前。 Input // Forward happens once it's decided that a packet should be forwarded to another host. // Forward 发生在将一个数据包转发到另一台主机时。 Forward // Output happens after a packet is written by an application to be sent out. // Output 发生在应用程序写入一个数据包并将其发送出去之后。 Output // Postrouting happens just before a packet goes out on the wire. // Postrouting 发生在数据包在线路上发出之前。 Postrouting // The total number of hooks. // 钩子的总数。 NumHooks )
These values correspond to values in include/uapi/linux/netfilter.h.
type IPTables ¶
type IPTables struct { // Tables maps table names to tables. User tables have arbitrary names. Tables map[string]Table // Priorities maps each hook to a list of table names. The order of the // list is the order in which each table should be visited for that hook. Priorities map[Hook][]string }
IPTables holds all the tables for a netstack.
func DefaultTables ¶
func DefaultTables() IPTables
DefaultTables returns a default set of tables.
Each chain is set to accept all packets.
type Matcher ¶
type Matcher interface { // Match returns whether the packet matches and whether the packet // should be "hotdropped", i.e. dropped immediately. This is usually // used for suspicious packets. Match(hook Hook, packet buffer.VectorisedView, interfaceName string) (matches bool, hotdrop bool) }
A Matcher is the interface for matching packets.
type Rule ¶
type Rule struct { // Matchers is the list of matchers for this rule. Matchers []Matcher // Target is the action to invoke if all the matchers match the packet. Target Target }
A Rule is a packet processing rule. It consists of two pieces. First it contains zero or more matchers, each of which is a specification of which packets this rule applies to. If there are no matchers in the rule, it applies to any packet.
type Table ¶
type Table struct { // BuiltinChains holds the un-deletable chains built into netstack. // If a hook isn't present in the map, this table doesn't utilize that hook. BuiltinChains map[Hook]Chain // DefaultTargets holds a target for each hook that will be executed if // chain traversal doesn't yield a verdict. DefaultTargets map[Hook]Target // UserChains holds user-defined chains for the keyed by name. Users // can give their chains arbitrary names. UserChains map[string]Chain // Chains maps names to chains for both builtin and user-defined chains. // Its entries point to Chains already either in BuiltinChains or // UserChains, and its purpose is to make looking up tables by name // fast. Chains map[string]*Chain // contains filtered or unexported fields }
A Table defines a set of chains and hooks into the network stack. The currently supported tables are:
- nat
- mangle
func (*Table) Metadata ¶
func (table *Table) Metadata() interface{}
Metadata returns the metadata object stored in table.
func (*Table) SetMetadata ¶
func (table *Table) SetMetadata(metadata interface{})
SetMetadata sets the metadata object stored in table.
func (*Table) ValidHooks ¶
ValidHooks returns a bitmap of the builtin hooks for the given table.
type Target ¶
type Target interface { // Action takes an action on the packet and returns a verdict on how // traversal should (or should not) continue. If the return value is // Jump, it also returns the name of the chain to jump to. Action(packet buffer.VectorisedView) (Verdict, string) }
A Target is the interface for taking an action for a packet.
type UnconditionalAcceptTarget ¶
type UnconditionalAcceptTarget struct{}
UnconditionalAcceptTarget accepts all packets.
func (UnconditionalAcceptTarget) Action ¶
func (UnconditionalAcceptTarget) Action(packet buffer.VectorisedView) (Verdict, string)
Action implements Target.Action.
type UnconditionalDropTarget ¶
type UnconditionalDropTarget struct{}
UnconditionalDropTarget denies all packets.
func (UnconditionalDropTarget) Action ¶
func (UnconditionalDropTarget) Action(packet buffer.VectorisedView) (Verdict, string)
Action implements Target.Action.
type Verdict ¶
type Verdict int
A Verdict is returned by a rule's target to indicate how traversal of rules should (or should not) continue.
Verdict 由规则的目标返回,用于指示规则的遍历应该(或不应该)如何继续。
const ( // Accept indicates the packet should continue traversing netstack as normal. // Accept 表示数据包应该正常地继续遍历 netstack 。 Accept Verdict = iota // Drop inicates the packet should be dropped, stopping traversing netstack. // Drop 指示数据包应该被丢弃,停止遍历 netstack 。 Drop // Stolen indicates the packet was co-opted by the target and should stop traversing netstack. // Stolen 表示数据包被目标方获取,应停止遍历 netstack 。(?) Stolen // Queue indicates the packet should be queued for userspace processing. // Queue 表示数据包应该排队等待用户空间处理。 Queue // Repeat indicates the packet should re-traverse the chains for the current hook. // Repeat 表示数据包应该为当前的钩子重新遍历链。(?) Repeat // None indicates no verdict was reached. // None 表示没有作出判决。 None // Jump indicates a jump to another chain. // Jump 表示跳到另一个链上。 Jump // Continue indicates that traversal should continue at the next rule. // Continue 表示应在下一条规则处继续遍历。 Continue // Return indicates that traversal should return to the calling chain. // Return 表示遍历应该返回到调用链。 Return )