rules

package
v0.0.0-...-21cfbab Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 10, 2023 License: Apache-2.0, Apache-2.0 Imports: 19 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// ChainNamePrefix is a prefix used for all our iptables chain names.  We include a '-' at
	// the end to reduce clashes with other apps.  Our OpenStack DHCP agent uses prefix
	// 'calico-dhcp-', for example.
	ChainNamePrefix = "cali-"
	// IPSetNamePrefix: similarly for IP sets, we use the following prefix; the IP sets layer
	// adds its own "-" so it isn't included here.
	IPSetNamePrefix = "cali"

	ChainFilterInput   = ChainNamePrefix + "INPUT"
	ChainFilterForward = ChainNamePrefix + "FORWARD"
	ChainFilterOutput  = ChainNamePrefix + "OUTPUT"

	ChainRawPrerouting         = ChainNamePrefix + "PREROUTING"
	ChainRawOutput             = ChainNamePrefix + "OUTPUT"
	ChainRawUntrackedFlows     = ChainNamePrefix + "untracked-flows"
	ChainRawBPFUntrackedPolicy = ChainNamePrefix + "untracked-policy"

	ChainFailsafeIn  = ChainNamePrefix + "failsafe-in"
	ChainFailsafeOut = ChainNamePrefix + "failsafe-out"

	ChainNATPrerouting  = ChainNamePrefix + "PREROUTING"
	ChainNATPostrouting = ChainNamePrefix + "POSTROUTING"
	ChainNATOutput      = ChainNamePrefix + "OUTPUT"
	ChainNATOutgoing    = ChainNamePrefix + "nat-outgoing"

	ChainManglePrerouting  = ChainNamePrefix + "PREROUTING"
	ChainManglePostrouting = ChainNamePrefix + "POSTROUTING"

	IPSetIDNATOutgoingAllPools  = "all-ipam-pools"
	IPSetIDNATOutgoingMasqPools = "masq-ipam-pools"

	IPSetIDAllHostNets        = "all-hosts-net"
	IPSetIDAllVXLANSourceNets = "all-vxlan-net"
	IPSetIDThisHostIPs        = "this-host"

	ChainFIPDnat = ChainNamePrefix + "fip-dnat"
	ChainFIPSnat = ChainNamePrefix + "fip-snat"

	ChainCIDRBlock = ChainNamePrefix + "cidr-block"

	PolicyInboundPfx   PolicyChainNamePrefix  = ChainNamePrefix + "pi-"
	PolicyOutboundPfx  PolicyChainNamePrefix  = ChainNamePrefix + "po-"
	ProfileInboundPfx  ProfileChainNamePrefix = ChainNamePrefix + "pri-"
	ProfileOutboundPfx ProfileChainNamePrefix = ChainNamePrefix + "pro-"

	ChainWorkloadToHost       = ChainNamePrefix + "wl-to-host"
	ChainFromWorkloadDispatch = ChainNamePrefix + "from-wl-dispatch"
	ChainToWorkloadDispatch   = ChainNamePrefix + "to-wl-dispatch"

	ChainDispatchToHostEndpoint          = ChainNamePrefix + "to-host-endpoint"
	ChainDispatchFromHostEndpoint        = ChainNamePrefix + "from-host-endpoint"
	ChainDispatchToHostEndpointForward   = ChainNamePrefix + "to-hep-forward"
	ChainDispatchFromHostEndPointForward = ChainNamePrefix + "from-hep-forward"
	ChainDispatchSetEndPointMark         = ChainNamePrefix + "set-endpoint-mark"
	ChainDispatchFromEndPointMark        = ChainNamePrefix + "from-endpoint-mark"

	ChainForwardCheck        = ChainNamePrefix + "forward-check"
	ChainForwardEndpointMark = ChainNamePrefix + "forward-endpoint-mark"

	ChainSetWireguardIncomingMark = ChainNamePrefix + "wireguard-incoming-mark"

	ChainRpfSkip = ChainNamePrefix + "rpf-skip"

	WorkloadToEndpointPfx   = ChainNamePrefix + "tw-"
	WorkloadPfxSpecialAllow = "ALLOW"
	WorkloadFromEndpointPfx = ChainNamePrefix + "fw-"

	SetEndPointMarkPfx = ChainNamePrefix + "sm-"

	HostToEndpointPfx          = ChainNamePrefix + "th-"
	HostFromEndpointPfx        = ChainNamePrefix + "fh-"
	HostToEndpointForwardPfx   = ChainNamePrefix + "thfw-"
	HostFromEndpointForwardPfx = ChainNamePrefix + "fhfw-"

	RPFChain = ChainNamePrefix + "rpf"

	RuleHashPrefix = "cali:"

	// HistoricNATRuleInsertRegex is a regex pattern to match to match
	// special-case rules inserted by old versions of felix.  Specifically,
	// Python felix used to insert a masquerade rule directly into the
	// POSTROUTING chain.
	//
	// Note: this regex depends on the output format of iptables-save so,
	// where possible, it's best to match only on part of the rule that
	// we're sure can't change (such as the ipset name in the masquerade
	// rule).
	HistoricInsertedNATRuleRegex = `-A POSTROUTING .* felix-masq-ipam-pools .*|` +
		`-A POSTROUTING -o tunl0 -m addrtype ! --src-type LOCAL --limit-iface-out -m addrtype --src-type LOCAL -j MASQUERADE`

	KubeProxyInsertRuleRegex = `-j KUBE-[a-zA-Z0-9-]*SERVICES|-j KUBE-FORWARD`
)
View Source 
const (
	ProtoIPIP   = 4
	ProtoTCP    = 6
	ProtoUDP    = 17
	ProtoICMPv6 = 58
)

Variables

View Source 
var (
	// AllHistoricChainNamePrefixes lists all the prefixes that we've used for chains.  Keeping
	// track of the old names lets us clean them up.
	AllHistoricChainNamePrefixes = []string{

		"cali-",

		"califw-",
		"calitw-",
		"califh-",
		"calith-",
		"calipi-",
		"calipo-",

		"felix-",
	}
	// AllHistoricIPSetNamePrefixes, similarly contains all the prefixes we've ever used for IP
	// sets.
	AllHistoricIPSetNamePrefixes = []string{"felix-", "cali"}
	// LegacyV4IPSetNames contains some extra IP set names that were used in older versions of
	// Felix and don't fit our versioned pattern.
	LegacyV4IPSetNames = []string{"felix-masq-ipam-pools", "felix-all-ipam-pools"}

	// Rule previxes used by kube-proxy.  Note: we exclude the so-called utility chains KUBE-MARK-MASQ and co because
	// they are jointly owned by kube-proxy and kubelet.
	KubeProxyChainPrefixes = []string{
		"KUBE-FORWARD",
		"KUBE-SERVICES",
		"KUBE-EXTERNAL-SERVICES",
		"KUBE-NODEPORTS",
		"KUBE-SVC-",
		"KUBE-SEP-",
		"KUBE-FW-",
		"KUBE-XLB-",
	}
)

Functions

func EndpointChainName 

func EndpointChainName(prefix string, ifaceName string) string

func FilterRuleToIPVersion 

func FilterRuleToIPVersion(ipVersion uint8, pRule *proto.Rule) *proto.Rule

FilterRuleToIPVersion: If the rule applies to the given IP version, returns a copy of the rule excluding the CIDRs that are not of the given IP version. If the rule does not apply to the given IP version at all, returns nil.

func PolicyChainName 

func PolicyChainName(prefix PolicyChainNamePrefix, polID *proto.PolicyID) string

func ProfileChainName 

func ProfileChainName(prefix ProfileChainNamePrefix, profID *proto.ProfileID) string

func RPFilter 

func RPFilter(ipVersion uint8, mark, mask uint32, openStackSpecialCasesEnabled, acceptLocal bool, dropActionOverride Action) []Rule

RPFilter returns rules that implement RPF

func SplitPortList 

func SplitPortList(ports []*proto.PortRange) (splits [][]*proto.PortRange)

SplitPortList splits the input list of ports into groups containing up to 15 port numbers. If the input list is empty, it returns an empty slice.

The requirement to split into groups of 15, comes from iptables' limit on the number of ports "slots" in a multiport match. A single port takes up one slot, a range of ports requires 2.

Types

type Config 

type Config struct {
	IPSetConfigV4 *ipsets.IPVersionConfig
	IPSetConfigV6 *ipsets.IPVersionConfig

	WorkloadIfacePrefixes []string

	IptablesMarkAccept   uint32
	IptablesMarkPass     uint32
	IptablesMarkScratch0 uint32
	IptablesMarkScratch1 uint32
	IptablesMarkEndpoint uint32
	// IptablesMarkNonCaliEndpoint is an endpoint mark which is reserved
	// to mark non-calico (workload or host) endpoint.
	IptablesMarkNonCaliEndpoint uint32

	KubeNodePortRanges     []numorstring.Port
	KubeIPVSSupportEnabled bool

	OpenStackMetadataIP          net.IP
	OpenStackMetadataPort        uint16
	OpenStackSpecialCasesEnabled bool

	VXLANEnabled   bool
	VXLANEnabledV6 bool
	VXLANPort      int
	VXLANVNI       int

	IPIPEnabled            bool
	FelixConfigIPIPEnabled *bool
	// IPIPTunnelAddress is an address chosen from an IPAM pool, used as a source address
	// by the host when sending traffic to a workload over IPIP.
	IPIPTunnelAddress net.IP
	// Same for VXLAN.
	VXLANTunnelAddress   net.IP
	VXLANTunnelAddressV6 net.IP

	AllowVXLANPacketsFromWorkloads bool
	AllowIPIPPacketsFromWorkloads  bool

	WireguardEnabled            bool
	WireguardEnabledV6          bool
	WireguardInterfaceName      string
	WireguardInterfaceNameV6    string
	WireguardIptablesMark       uint32
	WireguardListeningPort      int
	WireguardListeningPortV6    int
	WireguardEncryptHostTraffic bool
	RouteSource                 string

	IptablesLogPrefix         string
	EndpointToHostAction      string
	IptablesFilterAllowAction string
	IptablesMangleAllowAction string
	IptablesFilterDenyAction  string

	FailsafeInboundHostPorts  []config.ProtoPort
	FailsafeOutboundHostPorts []config.ProtoPort

	DisableConntrackInvalid bool

	NATPortRange                       numorstring.Port
	IptablesNATOutgoingInterfaceFilter string

	NATOutgoingAddress net.IP
	BPFEnabled         bool

	ServiceLoopPrevention string
}

type DefaultEPMarkManager 

type DefaultEPMarkManager struct {
	// contains filtered or unexported fields
}

func (*DefaultEPMarkManager) GetEndpointMark 

func (epmm *DefaultEPMarkManager) GetEndpointMark(ep string) (uint32, error)

func (*DefaultEPMarkManager) GetMask 

func (epmm *DefaultEPMarkManager) GetMask() uint32

func (*DefaultEPMarkManager) ReleaseEndpointMark 

func (epmm *DefaultEPMarkManager) ReleaseEndpointMark(ep string)

func (*DefaultEPMarkManager) SetEndpointMark 

func (epmm *DefaultEPMarkManager) SetEndpointMark(ep string, mark uint32) error

This is used to set a mark for an endpoint from previous allocated mark. The endpoint should not have a mark already.

type DefaultRuleRenderer 

type DefaultRuleRenderer struct {
	Config
	// contains filtered or unexported fields
}

func (*DefaultRuleRenderer) BlockedCIDRsToIptablesChains 

func (r *DefaultRuleRenderer) BlockedCIDRsToIptablesChains(cidrs []string, ipVersion uint8) []*iptables.Chain

func (*DefaultRuleRenderer) CalculateActions 

func (r *DefaultRuleRenderer) CalculateActions(pRule *proto.Rule, ipVersion uint8) (mark uint32, actions []iptables.Action)

func (*DefaultRuleRenderer) CalculateRuleMatch 

func (r *DefaultRuleRenderer) CalculateRuleMatch(pRule *proto.Rule, ipVersion uint8) iptables.MatchCriteria

func (*DefaultRuleRenderer) DNATsToIptablesChains 

func (r *DefaultRuleRenderer) DNATsToIptablesChains(dnats map[string]string) []*iptables.Chain

func (*DefaultRuleRenderer) EndpointMarkDispatchChains 

func (r *DefaultRuleRenderer) EndpointMarkDispatchChains(
	epMarkMapper EndpointMarkMapper,
	wlEndpoints map[proto.WorkloadEndpointID]*proto.WorkloadEndpoint,
	hepEndpoints map[string]proto.HostEndpointID,
) []*Chain

In some scenario, e.g. packet goes to an kubernetes ipvs service ip. Traffic goes through input/output filter chain instead of forward filter chain. It is not feasible to match on an incoming workload/host interface with service ips. Assemble a set-endpoint-mark chain to set the endpoint mark matching on the incoming workload/host interface and a from-endpoint-mark chain to jump to a corresponding endpoint chain matching on its endpoint mark.

func (*DefaultRuleRenderer) FromHostDispatchChains 

func (r *DefaultRuleRenderer) FromHostDispatchChains(
	endpoints map[string]proto.HostEndpointID,
	defaultIfaceName string,
) []*Chain

For pre-DNAT policy, which only applies on ingress from a host endpoint.

func (*DefaultRuleRenderer) HostDispatchChains 

func (r *DefaultRuleRenderer) HostDispatchChains(
	endpoints map[string]proto.HostEndpointID,
	defaultIfaceName string,
	applyOnForward bool,
) []*Chain

func (*DefaultRuleRenderer) HostEndpointToFilterChains 

func (r *DefaultRuleRenderer) HostEndpointToFilterChains(
	ifaceName string,
	epMarkMapper EndpointMarkMapper,
	ingressPolicyNames []string,
	egressPolicyNames []string,
	ingressForwardPolicyNames []string,
	egressForwardPolicyNames []string,
	profileIDs []string,
) []*Chain

func (*DefaultRuleRenderer) HostEndpointToMangleEgressChains 

func (r *DefaultRuleRenderer) HostEndpointToMangleEgressChains(
	ifaceName string,
	egressPolicyNames []string,
	profileIDs []string,
) []*Chain

func (*DefaultRuleRenderer) HostEndpointToMangleIngressChains 

func (r *DefaultRuleRenderer) HostEndpointToMangleIngressChains(
	ifaceName string,
	preDNATPolicyNames []string,
) []*Chain

func (*DefaultRuleRenderer) HostEndpointToRawChains 

func (r *DefaultRuleRenderer) HostEndpointToRawChains(
	ifaceName string,
	ingressPolicyNames []string,
	egressPolicyNames []string,
) []*Chain

func (*DefaultRuleRenderer) HostEndpointToRawEgressChain 

func (r *DefaultRuleRenderer) HostEndpointToRawEgressChain(
	ifaceName string,
	egressPolicyNames []string,
) *Chain

func (*DefaultRuleRenderer) IptablesFilterDenyAction 

func (r *DefaultRuleRenderer) IptablesFilterDenyAction() iptables.Action

func (*DefaultRuleRenderer) MakeNatOutgoingRule 

func (r *DefaultRuleRenderer) MakeNatOutgoingRule(protocol string, action iptables.Action, ipVersion uint8) iptables.Rule

func (*DefaultRuleRenderer) NATOutgoingChain 

func (r *DefaultRuleRenderer) NATOutgoingChain(natOutgoingActive bool, ipVersion uint8) *iptables.Chain

func (*DefaultRuleRenderer) PolicyToIptablesChains 

func (r *DefaultRuleRenderer) PolicyToIptablesChains(policyID *proto.PolicyID, policy *proto.Policy, ipVersion uint8) []*iptables.Chain

func (*DefaultRuleRenderer) ProfileToIptablesChains 

func (r *DefaultRuleRenderer) ProfileToIptablesChains(profileID *proto.ProfileID, profile *proto.Profile, ipVersion uint8) (inbound, outbound *iptables.Chain)

func (*DefaultRuleRenderer) ProtoRuleToIptablesRules 

func (r *DefaultRuleRenderer) ProtoRuleToIptablesRules(pRule *proto.Rule, ipVersion uint8) []iptables.Rule

func (*DefaultRuleRenderer) ProtoRulesToIptablesRules 

func (r *DefaultRuleRenderer) ProtoRulesToIptablesRules(protoRules []*proto.Rule, ipVersion uint8, chainComments ...string) []iptables.Rule

func (*DefaultRuleRenderer) SNATsToIptablesChains 

func (r *DefaultRuleRenderer) SNATsToIptablesChains(snats map[string]string) []*iptables.Chain

func (*DefaultRuleRenderer) StaticBPFModeRawChains 

func (r *DefaultRuleRenderer) StaticBPFModeRawChains(ipVersion uint8,
	wgEncryptHost, bypassHostConntrack bool) []*Chain

func (*DefaultRuleRenderer) StaticFilterForwardAppendRules 

func (r *DefaultRuleRenderer) StaticFilterForwardAppendRules() []Rule

StaticFilterForwardAppendRules returns rules which should be statically appended to the end of the filter table's forward chain.

func (*DefaultRuleRenderer) StaticFilterForwardChains 

func (r *DefaultRuleRenderer) StaticFilterForwardChains() []*Chain

func (*DefaultRuleRenderer) StaticFilterInputChains 

func (r *DefaultRuleRenderer) StaticFilterInputChains(ipVersion uint8) []*Chain

func (*DefaultRuleRenderer) StaticFilterInputForwardCheckChain 

func (r *DefaultRuleRenderer) StaticFilterInputForwardCheckChain(ipVersion uint8) *Chain

Forward check chain is to check if a packet belongs to a forwarded traffic or not. With kube-proxy running in ipvs mode, both local or forwarded traffic goes through INPUT filter chain.

func (*DefaultRuleRenderer) StaticFilterOutputChains 

func (r *DefaultRuleRenderer) StaticFilterOutputChains(ipVersion uint8) []*Chain

func (*DefaultRuleRenderer) StaticFilterOutputForwardEndpointMarkChain 

func (r *DefaultRuleRenderer) StaticFilterOutputForwardEndpointMarkChain() *Chain

With kube-proxy running in ipvs mode, we categorise traffic going through OUTPUT chain into three classes. Class 1. forwarded packet originated from a calico workload or host endpoint --> INPUT filter --> OUTPUT filter Class 2. forwarded packet originated from a non calico endpoint --> INPUT filter --> OUTPUT filter Class 3. local process originated packet --> OUTPUT filter This function handles traffic in Class 1 and Class 2.

func (*DefaultRuleRenderer) StaticFilterTableChains 

func (r *DefaultRuleRenderer) StaticFilterTableChains(ipVersion uint8) (chains []*Chain)

func (*DefaultRuleRenderer) StaticManglePostroutingChain 

func (r *DefaultRuleRenderer) StaticManglePostroutingChain(ipVersion uint8) *Chain

func (*DefaultRuleRenderer) StaticManglePreroutingChain 

func (r *DefaultRuleRenderer) StaticManglePreroutingChain(ipVersion uint8) *Chain

func (*DefaultRuleRenderer) StaticMangleTableChains 

func (r *DefaultRuleRenderer) StaticMangleTableChains(ipVersion uint8) []*Chain

func (*DefaultRuleRenderer) StaticNATOutputChains 

func (r *DefaultRuleRenderer) StaticNATOutputChains(ipVersion uint8) []*Chain

func (*DefaultRuleRenderer) StaticNATPostroutingChains 

func (r *DefaultRuleRenderer) StaticNATPostroutingChains(ipVersion uint8) []*Chain

func (*DefaultRuleRenderer) StaticNATPreroutingChains 

func (r *DefaultRuleRenderer) StaticNATPreroutingChains(ipVersion uint8) []*Chain

func (*DefaultRuleRenderer) StaticNATTableChains 

func (r *DefaultRuleRenderer) StaticNATTableChains(ipVersion uint8) (chains []*Chain)

func (*DefaultRuleRenderer) StaticRawOutputChain 

func (r *DefaultRuleRenderer) StaticRawOutputChain(tcBypassMark uint32) *Chain

func (*DefaultRuleRenderer) StaticRawPreroutingChain 

func (r *DefaultRuleRenderer) StaticRawPreroutingChain(ipVersion uint8) *Chain

func (*DefaultRuleRenderer) StaticRawTableChains 

func (r *DefaultRuleRenderer) StaticRawTableChains(ipVersion uint8) []*Chain

func (*DefaultRuleRenderer) ToHostDispatchChains 

func (r *DefaultRuleRenderer) ToHostDispatchChains(
	endpoints map[string]proto.HostEndpointID,
	defaultIfaceName string,
) []*Chain

For applying normal host endpoint egress policy to traffic from the host which has been DNAT'd.

func (*DefaultRuleRenderer) WireguardIncomingMarkChain 

func (r *DefaultRuleRenderer) WireguardIncomingMarkChain() *Chain

func (*DefaultRuleRenderer) WorkloadDispatchChains 

func (r *DefaultRuleRenderer) WorkloadDispatchChains(
	endpoints map[proto.WorkloadEndpointID]*proto.WorkloadEndpoint,
) []*Chain

func (*DefaultRuleRenderer) WorkloadEndpointToIptablesChains 

func (r *DefaultRuleRenderer) WorkloadEndpointToIptablesChains(
	ifaceName string,
	epMarkMapper EndpointMarkMapper,
	adminUp bool,
	ingressPolicies []string,
	egressPolicies []string,
	profileIDs []string,
) []*Chain

func (*DefaultRuleRenderer) WorkloadInterfaceAllowChains 

func (r *DefaultRuleRenderer) WorkloadInterfaceAllowChains(
	endpoints map[proto.WorkloadEndpointID]*proto.WorkloadEndpoint,
) []*Chain

type EndpointMarkMapper 

type EndpointMarkMapper interface {
	GetMask() uint32
	GetEndpointMark(ep string) (uint32, error)
	ReleaseEndpointMark(ep string)
	SetEndpointMark(ep string, mark uint32) error
}

Endpoint Mark Mapper (EPM) provides set of functions to manage allocation/free endpoint mark bit given a mark bit mask. Note: This is not thread safe.

func NewEndpointMarkMapper 

func NewEndpointMarkMapper(markMask, nonCaliMark uint32) EndpointMarkMapper

func NewEndpointMarkMapperWithShim 

func NewEndpointMarkMapperWithShim(markMask, nonCaliMark uint32, hash32 HashCalculator32) EndpointMarkMapper

type HashCalculator32 

type HashCalculator32 interface {
	// Write (via the embedded io.Writer interface) adds more data to the running hash.
	// It never returns an error.
	io.Writer

	// Sum32 returns a hash result of uint32.
	// It does not change the underlying hash state.
	Sum32() uint32

	// Reset resets the Hash to its initial state.
	Reset()
}

This interface has subset of functions of built in hash32 interface.

type PolicyChainNamePrefix 

type PolicyChainNamePrefix string

Typedefs to prevent accidentally passing the wrong prefix to the Policy/ProfileChainName()

type ProfileChainNamePrefix 

type ProfileChainNamePrefix string

Typedefs to prevent accidentally passing the wrong prefix to the Policy/ProfileChainName()

type RuleRenderer 

type RuleRenderer interface {
	StaticFilterTableChains(ipVersion uint8) []*iptables.Chain
	StaticNATTableChains(ipVersion uint8) []*iptables.Chain
	StaticNATPostroutingChains(ipVersion uint8) []*iptables.Chain
	StaticRawTableChains(ipVersion uint8) []*iptables.Chain
	StaticBPFModeRawChains(ipVersion uint8, wgEncryptHost, disableConntrack bool) []*iptables.Chain
	StaticMangleTableChains(ipVersion uint8) []*iptables.Chain
	StaticFilterForwardAppendRules() []iptables.Rule

	WorkloadDispatchChains(map[proto.WorkloadEndpointID]*proto.WorkloadEndpoint) []*iptables.Chain
	WorkloadEndpointToIptablesChains(
		ifaceName string,
		epMarkMapper EndpointMarkMapper,
		adminUp bool,
		ingressPolicies []string,
		egressPolicies []string,
		profileIDs []string,
	) []*iptables.Chain

	WorkloadInterfaceAllowChains(endpoints map[proto.WorkloadEndpointID]*proto.WorkloadEndpoint) []*iptables.Chain

	EndpointMarkDispatchChains(
		epMarkMapper EndpointMarkMapper,
		wlEndpoints map[proto.WorkloadEndpointID]*proto.WorkloadEndpoint,
		hepEndpoints map[string]proto.HostEndpointID,
	) []*iptables.Chain

	HostDispatchChains(map[string]proto.HostEndpointID, string, bool) []*iptables.Chain
	FromHostDispatchChains(map[string]proto.HostEndpointID, string) []*iptables.Chain
	ToHostDispatchChains(map[string]proto.HostEndpointID, string) []*iptables.Chain
	HostEndpointToFilterChains(
		ifaceName string,
		epMarkMapper EndpointMarkMapper,
		ingressPolicyNames []string,
		egressPolicyNames []string,
		ingressForwardPolicyNames []string,
		egressForwardPolicyNames []string,
		profileIDs []string,
	) []*iptables.Chain
	HostEndpointToMangleEgressChains(
		ifaceName string,
		egressPolicyNames []string,
		profileIDs []string,
	) []*iptables.Chain
	HostEndpointToRawEgressChain(
		ifaceName string,
		egressPolicyNames []string,
	) *iptables.Chain
	HostEndpointToRawChains(
		ifaceName string,
		ingressPolicyNames []string,
		egressPolicyNames []string,
	) []*iptables.Chain
	HostEndpointToMangleIngressChains(
		ifaceName string,
		preDNATPolicyNames []string,
	) []*iptables.Chain

	PolicyToIptablesChains(policyID *proto.PolicyID, policy *proto.Policy, ipVersion uint8) []*iptables.Chain
	ProfileToIptablesChains(profileID *proto.ProfileID, policy *proto.Profile, ipVersion uint8) (inbound, outbound *iptables.Chain)
	ProtoRuleToIptablesRules(pRule *proto.Rule, ipVersion uint8) []iptables.Rule

	MakeNatOutgoingRule(protocol string, action iptables.Action, ipVersion uint8) iptables.Rule
	NATOutgoingChain(active bool, ipVersion uint8) *iptables.Chain

	DNATsToIptablesChains(dnats map[string]string) []*iptables.Chain
	SNATsToIptablesChains(snats map[string]string) []*iptables.Chain
	BlockedCIDRsToIptablesChains(cidrs []string, ipVersion uint8) []*iptables.Chain

	WireguardIncomingMarkChain() *iptables.Chain

	IptablesFilterDenyAction() iptables.Action
}

func NewRenderer 

func NewRenderer(config Config) RuleRenderer

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.