firewall

Documentation

Index

• Variables
• func FilterConnection(ctx context.Context, conn *network.Connection, pkt packet.Packet, ...)
• func FilterResolvedDNS(ctx context.Context, conn *network.Connection, q *resolver.Query, ...) *resolver.RRCache
• func GetPermittedPort(protocol packet.IPProtocol) uint16
• func PermittedAddr(network string) net.Addr
• func PermittedTCPAddr() *net.TCPAddr
• func PermittedUDPAddr() *net.UDPAddr
• func PreventBypassing(ctx context.Context, conn *network.Connection) (endpoints.EPResult, string, nsutil.Responder)
• func SetNameserverIPMatcher(fn func(ip net.IP) bool) error
• func UpdateIPsAndCNAMEs(q *resolver.Query, rrCache *resolver.RRCache, conn *network.Connection)

Variables

var (
	CfgOptionEnableFilterKey = "filter/enable"

	CfgOptionAskWithSystemNotificationsKey = "filter/askWithSystemNotifications"

	CfgOptionAskTimeoutKey = "filter/askTimeout"

	CfgOptionPermanentVerdictsKey = "filter/permanentVerdicts"

	CfgOptionDNSQueryInterceptionKey = "filter/dnsQueryInterception"
)

Configuration Keys.

Functions

func FilterConnection

func FilterConnection(ctx context.Context, conn *network.Connection, pkt packet.Packet, checkFilter, checkTunnel bool)

FilterConnection runs all the filtering (and tunneling) procedures.

func FilterResolvedDNS

func FilterResolvedDNS(
	ctx context.Context,
	conn *network.Connection,
	q *resolver.Query,
	rrCache *resolver.RRCache,
) *resolver.RRCache

FilterResolvedDNS filters a dns response according to the application profile and settings.

func GetPermittedPort

func GetPermittedPort(protocol packet.IPProtocol) uint16

GetPermittedPort returns a local port number that is already permitted for communication. This bypasses the process attribution step to guarantee connectivity. Communication on the returned port is attributed to the Portmaster. Every pre-authenticated port is only valid once. If no unused local port number can be found, it will return 0, which is expected to trigger automatic port selection by the underlying OS.

func PermittedAddr

func PermittedAddr(network string) net.Addr

PermittedAddr returns an already permitted local address for the given network for reliable connectivity. Returns nil in case of error.

func PermittedTCPAddr

func PermittedTCPAddr() *net.TCPAddr

PermittedTCPAddr returns an already permitted local tcp address for reliable connectivity. Returns nil in case of error.

func PermittedUDPAddr

func PermittedUDPAddr() *net.UDPAddr

PermittedUDPAddr returns an already permitted local udp address for reliable connectivity. Returns nil in case of error.

func PreventBypassing

func PreventBypassing(ctx context.Context, conn *network.Connection) (endpoints.EPResult, string, nsutil.Responder)

PreventBypassing checks if the connection should be denied or permitted based on some bypass protection checks.

func SetNameserverIPMatcher

func SetNameserverIPMatcher(fn func(ip net.IP) bool) error

SetNameserverIPMatcher sets a function that is used to match the internal nameserver IP(s). Can only bet set once.

func UpdateIPsAndCNAMEs

func UpdateIPsAndCNAMEs(q *resolver.Query, rrCache *resolver.RRCache, conn *network.Connection)

UpdateIPsAndCNAMEs saves all the IP->Name mappings to the cache database and updates the CNAMEs in the Connection's Entity.