firewall

Documentation

Index

• Variables
• type Config
  • func NewConfig(ctx context.Context, logger Logger, runner command.Runner, ...) (config *Config, err error)
  • func (c *Config) RedirectPort(ctx context.Context, intf string, sourcePort, destinationPort uint16) (err error)
  • func (c *Config) RemoveAllowedPort(ctx context.Context, port uint16) (err error)
  • func (c *Config) SetAllowedPort(ctx context.Context, port uint16, intf string) (err error)
  • func (c *Config) SetEnabled(ctx context.Context, enabled bool) (err error)
  • func (c *Config) SetOutboundSubnets(ctx context.Context, subnets []netip.Prefix) (err error)
  • func (c *Config) SetVPNConnection(ctx context.Context, connection models.Connection, vpnIntf string) (err error)
  • func (c *Config) Version(ctx context.Context) (string, error)
• type Logger

Variables

var (
	ErrIPTablesVersionTooShort = errors.New("iptables version string is too short")
	ErrPolicyUnknown           = errors.New("unknown policy")
	ErrNeedIP6Tables           = errors.New("ip6tables is required, please upgrade your kernel to support it")
)

var (
	ErrNetAdminMissing      = errors.New("NET_ADMIN capability is missing")
	ErrTestRuleCleanup      = errors.New("failed cleaning up test rule")
	ErrInputPolicyNotFound  = errors.New("input policy not found")
	ErrIPTablesNotSupported = errors.New("no iptables supported found")
)

var ErrPolicyNotValid = errors.New("policy is not valid")

Types

type Config

type Config struct {
	// contains filtered or unexported fields
}

func NewConfig

func NewConfig(ctx context.Context, logger Logger,
	runner command.Runner, defaultRoutes []routing.DefaultRoute,
	localNetworks []routing.LocalNetwork) (config *Config, err error)

NewConfig creates a new Config instance and returns an error if no iptables implementation is available.

func (*Config) RedirectPort

func (c *Config) RedirectPort(ctx context.Context, intf string, sourcePort,
	destinationPort uint16) (err error)

RedirectPort redirects a source port to a destination port on the interface intf. If intf is empty, it is set to "*" which means all interfaces. If a redirection for the source port given already exists, it is removed first. If the destination port is zero, the redirection for the source port is removed and no new redirection is added.

func (*Config) RemoveAllowedPort

func (c *Config) RemoveAllowedPort(ctx context.Context, port uint16) (err error)

func (*Config) SetAllowedPort

func (c *Config) SetAllowedPort(ctx context.Context, port uint16, intf string) (err error)

func (*Config) SetEnabled

func (c *Config) SetEnabled(ctx context.Context, enabled bool) (err error)

func (*Config) SetOutboundSubnets

func (c *Config) SetOutboundSubnets(ctx context.Context, subnets []netip.Prefix) (err error)

func (*Config) SetVPNConnection

func (c *Config) SetVPNConnection(ctx context.Context,
	connection models.Connection, vpnIntf string) (err error)

func (*Config) Version

func (c *Config) Version(ctx context.Context) (string, error)

Version obtains the version of the installed iptables.

type Logger

type Logger interface {
	Debug(s string)
	Info(s string)
	Error(s string)
}