uspfilter

Documentation

Index

• type IFaceMapper
• type Manager
  • func Create(iface IFaceMapper) (*Manager, error)
  • func CreateWithNativeFirewall(iface IFaceMapper, nativeFirewall firewall.Manager) (*Manager, error)
  • func (m *Manager) AddNatRule(pair firewall.RouterPair) error
  • func (m *Manager) AddPeerFiltering(ip net.IP, proto firewall.Protocol, sPort *firewall.Port, dPort *firewall.Port, ...) ([]firewall.Rule, error)
  • func (m *Manager) AddRouteFiltering(sources []netip.Prefix, destination netip.Prefix, proto firewall.Protocol, ...) (firewall.Rule, error)
  • func (m *Manager) AddUDPPacketHook(in bool, ip net.IP, dPort uint16, hook func([]byte) bool) string
  • func (m *Manager) AllowNetbird() error
  • func (m *Manager) DeletePeerRule(rule firewall.Rule) error
  • func (m *Manager) DeleteRouteRule(rule firewall.Rule) error
  • func (m *Manager) DropIncoming(packetData []byte) bool
  • func (m *Manager) DropOutgoing(packetData []byte) bool
  • func (m *Manager) Flush() error
  • func (m *Manager) Init(*statemanager.Manager) error
  • func (m *Manager) IsServerRouteSupported() bool
  • func (m *Manager) RemoveNatRule(pair firewall.RouterPair) error
  • func (m *Manager) RemovePacketHook(hookID string) error
  • func (m *Manager) Reset(stateManager *statemanager.Manager) error
  • func (m *Manager) SetLegacyManagement(isLegacy bool) error
  • func (m *Manager) SetNetwork(network *net.IPNet)
• type Rule
  • func (r *Rule) GetRuleID() string
• type RuleSet

Types

type IFaceMapper

type IFaceMapper interface {
	SetFilter(device.PacketFilter) error
	Address() iface.WGAddress
}

IFaceMapper defines subset methods of interface required for manager

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager userspace firewall manager

func Create

func Create(iface IFaceMapper) (*Manager, error)

Create userspace firewall manager constructor

func CreateWithNativeFirewall

func CreateWithNativeFirewall(iface IFaceMapper, nativeFirewall firewall.Manager) (*Manager, error)

func (*Manager) AddNatRule

func (m *Manager) AddNatRule(pair firewall.RouterPair) error

func (*Manager) AddPeerFiltering

func (m *Manager) AddPeerFiltering(
	ip net.IP,
	proto firewall.Protocol,
	sPort *firewall.Port,
	dPort *firewall.Port,
	direction firewall.RuleDirection,
	action firewall.Action,
	ipsetName string,
	comment string,
) ([]firewall.Rule, error)

AddPeerFiltering rule to the firewall

If comment argument is empty firewall manager should set rule ID as comment for the rule

func (*Manager) AddRouteFiltering

func (m *Manager) AddRouteFiltering(sources []netip.Prefix, destination netip.Prefix, proto firewall.Protocol, sPort *firewall.Port, dPort *firewall.Port, action firewall.Action) (firewall.Rule, error)

func (*Manager) AddUDPPacketHook

func (m *Manager) AddUDPPacketHook(
	in bool, ip net.IP, dPort uint16, hook func([]byte) bool,
) string

AddUDPPacketHook calls hook when UDP packet from given direction matched

Hook function returns flag which indicates should be the matched package dropped or not

func (*Manager) AllowNetbird

func (m *Manager) AllowNetbird() error

AllowNetbird allows netbird interface traffic

func (*Manager) DeletePeerRule

func (m *Manager) DeletePeerRule(rule firewall.Rule) error

DeletePeerRule from the firewall by rule definition

func (*Manager) DeleteRouteRule

func (m *Manager) DeleteRouteRule(rule firewall.Rule) error

func (*Manager) DropIncoming

func (m *Manager) DropIncoming(packetData []byte) bool

DropIncoming filter incoming packets

func (*Manager) DropOutgoing

func (m *Manager) DropOutgoing(packetData []byte) bool

DropOutgoing filter outgoing packets

func (*Manager) Flush

func (m *Manager) Flush() error

Flush doesn't need to be implemented for this manager

func (*Manager) Init

func (m *Manager) Init(*statemanager.Manager) error

func (*Manager) IsServerRouteSupported

func (m *Manager) IsServerRouteSupported() bool

func (*Manager) RemoveNatRule

func (m *Manager) RemoveNatRule(pair firewall.RouterPair) error

RemoveNatRule removes a routing firewall rule

func (*Manager) RemovePacketHook

func (m *Manager) RemovePacketHook(hookID string) error

RemovePacketHook removes packet hook by given ID

func (*Manager) Reset

func (m *Manager) Reset(stateManager *statemanager.Manager) error

Reset firewall to the default state

func (*Manager) SetLegacyManagement

func (m *Manager) SetLegacyManagement(isLegacy bool) error

SetLegacyManagement doesn't need to be implemented for this manager

func (*Manager) SetNetwork

func (m *Manager) SetNetwork(network *net.IPNet)

SetNetwork of the wireguard interface to which filtering applied

type Rule

type Rule struct {
	// contains filtered or unexported fields
}

Rule to handle management of rules

func (*Rule) GetRuleID

func (r *Rule) GetRuleID() string

GetRuleID returns the rule id

type RuleSet

type RuleSet map[string]Rule

RuleSet is a set of rules grouped by a string key