nft

Documentation

Index

• Constants
• func Apply(nft Nft) error
• func ApplyFromFile(cfg string) error
• func Drop(family Family, table, chain string, handle int) error
• func IPv4Set(family Family, table string, name string, ips ...string) error
• func IPv4SetDel(family Family, table, name string, ips ...string) error
• func IPv4SetGet(family Family, table, name string) ([]string, error)
• type API
• type And
  • func (f And) Match(rule *NftRuleBlock) bool
• type Chain
• type ChainFilter
  • func (f *ChainFilter) Match(rule *NftRuleBlock) bool
• type Chains
• type Family
• type FamilyFilter
  • func (f *FamilyFilter) Match(rule *NftRuleBlock) bool
• type Filter
• type FilterRule
  • func Find(f ...Filter) ([]FilterRule, error)
• type IPMatchFilter
  • func (f *IPMatchFilter) Match(rule *NftRuleBlock) bool
• type IntMatchFilter
  • func (f *IntMatchFilter) Match(rule *NftRuleBlock) bool
• type MarkFilter
  • func (f *MarkFilter) Match(rule *NftRuleBlock) bool
• type MetaMatchFilter
  • func (f *MetaMatchFilter) Match(rule *NftRuleBlock) bool
• type NetworkMatchFilter
  • func (f *NetworkMatchFilter) Match(rule *NftRuleBlock) bool
• type Nft
  • func (n Nft) MarshalText() ([]byte, error)
• type NftChainBlock
• type NftJsonBlock
• type NftRuleBlock
• type NftSetBlock
• type NftTableBlock
• type Or
  • func (f Or) Match(rule *NftRuleBlock) bool
• type Port
• type Rule
• type Set
• type Sets
• type Table
• type TableFilter
  • func (f *TableFilter) Match(rule *NftRuleBlock) bool
• type Type

Constants

const (
	NFT = iota
	TABLE
	CHAIN

	FamilyIP     = Family("ip")
	FamilyIP6    = Family("ip6")
	FamilyNET    = Family("net")
	FamilyINET   = Family("inet")
	FamilyARP    = Family("arp")
	FamilyBridge = Family("bridge")

	TypeSkipCreate = Type("")
	TypeNAT        = Type("nat")
	TypeFilter     = Type("filter")
)

const (
	//NFTDebug if true, nft files will not be deleted for inspection
	NFTDebug = false
)

Functions

func Apply

func Apply(nft Nft) error

Apply (merge) nft rules

func ApplyFromFile

func ApplyFromFile(cfg string) error

ApplyFromFile applies nft rules from a file

func Drop

func Drop(family Family, table, chain string, handle int) error

Drop drops a single rule given a handle

func IPv4Set

func IPv4Set(family Family, table string, name string, ips ...string) error

IPv4Set creates/updates element set of type ipv4_addr

func IPv4SetDel

func IPv4SetDel(family Family, table, name string, ips ...string) error

IPv4SetDel delete ips from a ipv4_addr set

func IPv4SetGet

func IPv4SetGet(family Family, table, name string) ([]string, error)

IPv4SetGet gets the current ipv4 set

Types

type API

type API interface {
	Apply(nft Nft) error
	Drop(family Family, table, chain string, handle int) error
	Find(filter ...Filter) ([]FilterRule, error)

	IPv4Set(family Family, table string, name string, ips ...string) error
	IPv4SetDel(family Family, table, name string, ips ...string) error
}

API defines nft api

type And

type And []Filter

And allows grouping filters in an And op

func (And) Match

func (f And) Match(rule *NftRuleBlock) bool

type Chain

type Chain struct {
	Type     Type
	Hook     string
	Priority int
	Policy   string
	Rules    []Rule
}

type ChainFilter

type ChainFilter struct {
	Chain string
}

func (*ChainFilter) Match

func (f *ChainFilter) Match(rule *NftRuleBlock) bool

type Chains

type Chains map[string]Chain

type Family

type Family string

type FamilyFilter

type FamilyFilter struct {
	Family Family
}

func (*FamilyFilter) Match

func (f *FamilyFilter) Match(rule *NftRuleBlock) bool

type Filter

type Filter interface {
	Match(rule *NftRuleBlock) bool
}

Filter interface

type FilterRule

type FilterRule struct {
	Rule
	Handle int
	Table  string
	Chain  string
	Family Family
}

func Find

func Find(f ...Filter) ([]FilterRule, error)

type IPMatchFilter

type IPMatchFilter struct {
	Name  string
	Field string
	Value net.IP
}

func (*IPMatchFilter) Match

func (f *IPMatchFilter) Match(rule *NftRuleBlock) bool

type IntMatchFilter

type IntMatchFilter struct {
	Name  string
	Field string
	Value uint64
}

MatchFilter is a simple match rule

func (*IntMatchFilter) Match

func (f *IntMatchFilter) Match(rule *NftRuleBlock) bool

type MarkFilter

type MarkFilter struct {
	Mark uint32
}

MetaFilter find a rule by meta mark

func (*MarkFilter) Match

func (f *MarkFilter) Match(rule *NftRuleBlock) bool

type MetaMatchFilter

type MetaMatchFilter struct {
	Name  string
	Value string
}

func (*MetaMatchFilter) Match

func (f *MetaMatchFilter) Match(rule *NftRuleBlock) bool

type NetworkMatchFilter

type NetworkMatchFilter struct {
	Name  string
	Field string
	Value *net.IPNet
}

func (*NetworkMatchFilter) Match

func (f *NetworkMatchFilter) Match(rule *NftRuleBlock) bool

type Nft

type Nft map[string]Table

func (Nft) MarshalText

func (n Nft) MarshalText() ([]byte, error)

type NftChainBlock

type NftChainBlock struct {
	/*
		{'hook': 'prerouting',
		'family': 'ip',
		'prio': 0,
		'table': 'nat',
		'name': 'pre',
		'handle': 1,
		'type': 'nat',
		'policy': 'accept'}
	*/
	Hook     string `json:"hook"`
	Family   Family `json:"family"`
	Priority int    `json:"prio"`
	Table    string `json:"table"`
	Name     string `json:"name"`
	Handle   int    `json:"handle"`
	Type     Type   `json:"type"`
	Policy   string `json:"policy"`
}

type NftJsonBlock

type NftJsonBlock map[string]json.RawMessage

NftJsonBlock defines a nft json block

type NftRuleBlock

type NftRuleBlock struct {
	/*
		{'family': 'inet',
		'expr': [{'match': {'right': {'set': ['established', 'related']},
			'left': {'ct': {'key': 'state'}}}},
		{'accept': None}],
		'table': 'filter',
		'handle': 5,
		'chain': 'input'}
	*/
	Family    Family         `json:"family"`
	Expresion []NftJsonBlock `json:"expr"`
	Table     string         `json:"table"`
	Handle    int            `json:"handle"`
	Chain     string         `json:"chain"`
}

type NftSetBlock

type NftSetBlock struct {
	Family   Family   `json:"family"`
	Name     string   `json:"name"`
	Table    string   `json:"table"`
	Elements []string `json:"elem"`
	Type     string   `json:"type"`
	Handle   int      `json:"handle"`
}

type NftTableBlock

type NftTableBlock struct {
	//{'family': 'ip', 'name': 'nat', 'handle': 0}
	Family Family `json:"family"`
	Name   string `json:"name"`
	Handle int    `json:"handle"`
}

type Or

type Or []Filter

func (Or) Match

func (f Or) Match(rule *NftRuleBlock) bool

type Port

type Port struct {
	Port      uint16 `json:"port"`
	Interface string `json:"interface,omitempty"`
	Subnet    string `json:"subnet,omitempty"`
}

type Rule

type Rule struct {
	Body string
}

type Set

type Set struct {
	//We only support ipv4_addr type
	Elements []string
}

type Sets

type Sets map[string]Set

type Table

type Table struct {
	Family Family
	Chains Chains
	Sets   Sets
}

type TableFilter

type TableFilter struct {
	Table string
}

func (*TableFilter) Match

func (f *TableFilter) Match(rule *NftRuleBlock) bool

type Type

type Type string