ipset

Documentation

Index

• Constants
• Variables
• func IsNotFoundError(err error) bool
• type Entry
  • func (e *Entry) String() string
• type IPSet
• type Interface
  • func New() Interface
• type PortRange
  • func (p PortRange) String() string
• type ProtocolFamilyType
• type ProtocolType
• type Type

Constants

const IPSetCmd = "ipset"

IPSetCmd represents the ipset util. We use ipset command for ipset execute.

Variables

var DefaultPortRange = PortRange{
	End: 65535,
}

DefaultPortRange defines the default bitmap:port valid port range.

var EntryMemberPattern = "(?m)^(.*\n)*Members:\n"

EntryMemberPattern is the regular expression pattern of ipset member list. The raw output of ipset command `ipset list {set}` is similar to:

Name: foobar
Type: hash:ip,port
Revision: 2
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 16592
References: 0
Members:
  192.168.1.2,tcp:8080
  192.168.1.1,udp:53

var VersionPattern = "v[0-9]+\\.[0-9]+"

VersionPattern is the regular expression pattern of ipset version string. ipset version output is similar to "v6.10".

Functions

func IsNotFoundError

func IsNotFoundError(err error) bool

IsNotFoundError returns true if the error indicates "not found". It parses the error string looking for known values, which is imperfect but works in practice.

Types

type Entry

type Entry struct {
	// IP is the entry's IP.  The IP address protocol corresponds to the HashFamily of IPSet.
	// All entries' IP addresses in the same ip set has same the protocol, IPv4 or IPv6.
	IP string
	// Port is the entry's Port.
	Port uint
	// Protocol is the entry's Protocol.  The protocols of entries in the same ip set are all
	// the same.  The accepted protocols are TCP and UDP.
	Protocol ProtocolType
	// Net is the entry's IP network address.  Network address with zero prefix size can NOT
	// be stored.
	Net string
	// IP2 is the entry's second IP.  IP2 may not be empty for `hash:ip,port,ip` type ip set.
	IP2 string
	// SetType is the type of ipset where the entry exists.
	SetType Type
	//  [ timeout value ] [ packets value ] [ bytes value ] [ comment string ] [ skbmark value ] [ skbprio value ] [ skbqueue value ]
	Options []string
}

Entry represents a ipset entry.

func (*Entry) String

func (e *Entry) String() string

String returns the string format for ipset entry.

type IPSet

type IPSet struct {
	// Name is the set name.
	Name string
	// SetType specifies the ipset type.
	SetType Type
	// HashFamily specifies the protocol family of the IP addresses to be stored in the set.
	// The default is inet, i.e IPv4.  If users want to use IPv6, they should specify inet6.
	HashFamily ProtocolFamilyType
	// HashSize specifies the hash table size of ipset.
	HashSize uint
	// MaxElem specifies the max element number of ipset.
	MaxElem uint
	// PortRange specifies the port range of bitmap:port type ipset.
	PortRange PortRange
}

IPSet implements an Interface to an set.

type Interface

type Interface interface {
	// FlushSet deletes all entries from a named set.
	FlushSet(set string) error
	// DestroySet deletes a named set.
	DestroySet(set string) error
	// DestroyAllSets deletes all sets.
	DestroyAllSets() error
	// CreateSet creates a new set.  It will ignore error when the set already exists if ignoreExistErr=true.
	CreateSet(set *IPSet, ignoreExistErr bool) error
	// AddEntry adds a new IP entry to the named set.  It will ignore error when the entry already exists if ignoreExistErr=true.
	AddIPEntry(ip string, set string, ignoreExistErr bool) error
	AddEntry(entry *Entry, set string, ignoreExistErr bool) error
	// DelEntry deletes one entry from the named set
	DelIPEntry(ip string, set string) error
	DelEntry(entry *Entry, set string) error
	// Test test if an entry exists in the named set
	TestIPEntry(ip string, set string) (bool, error)
	TestEntry(entry *Entry, set string) (bool, error)
	// ListEntries lists all the entries from a named set
	ListEntries(set string) ([]string, error)
	// ListSets list all set names from kernel
	ListSets() ([]string, error)
	// GetVersion returns the "X.Y" version string for ipset.
	GetVersion() (string, error)
}

Interface is an injectable interface for running ipset commands. Implementations must be goroutine-safe.

func New

func New() Interface

New returns a new Interface which will exec ipset.

type PortRange

type PortRange struct {
	Begin uint
	End   uint
}

func (PortRange) String

func (p PortRange) String() string

type ProtocolFamilyType

type ProtocolFamilyType string

const (
	// ProtocolFamilyIPV4 represents IPv4 protocol.
	ProtocolFamilyIPV4 ProtocolFamilyType = "inet"
	// ProtocolFamilyIPV6 represents IPv6 protocol.
	ProtocolFamilyIPV6 ProtocolFamilyType = "inet6"
)

type ProtocolType

type ProtocolType string

const (
	// ProtocolTCP represents TCP protocol.
	ProtocolTCP ProtocolType = "tcp"
	// ProtocolUDP represents UDP protocol.
	ProtocolUDP ProtocolType = "udp"
)

type Type

type Type string

Type represents the ipset type.

const (
	HashIP Type = "hash:ip"
	// HashIPPort represents the `hash:ip,port` type ipset.  The hash:ip,port is similar to hash:ip but
	// you can store IP address and protocol-port pairs in it.  TCP, SCTP, UDP, UDPLITE, ICMP and ICMPv6 are supported
	// with port numbers/ICMP(v6) types and other protocol numbers without port information.
	HashIPPort Type = "hash:ip,port"
	// HashIPPortIP represents the `hash:ip,port,ip` type ipset.  The hash:ip,port,ip set type uses a hash to store
	// IP address, port number and a second IP address triples.  The port number is interpreted together with a
	// protocol (default TCP) and zero protocol number cannot be used.
	HashIPPortIP Type = "hash:ip,port,ip"
	// HashIPPortNet represents the `hash:ip,port,net` type ipset.  The hash:ip,port,net set type uses a hash
	// to store IP address, port number and IP network address triples.  The port number is interpreted together
	// with a protocol (default TCP) and zero protocol number cannot be used. Network address with zero prefix
	// size cannot be stored either.
	HashIPPortNet Type = "hash:ip,port,net"
	// BitmapPort represents the `bitmap:port` type ipset.  The bitmap:port set type uses a memory range, where each bit
	// represents one TCP/UDP port.  A bitmap:port type of set can store up to 65535 ports.
	BitmapPort Type = "bitmap:port"

	HashNet Type = "hash:net"

	HashNetPort Type = "hash:net,port"
)