filter

Documentation

Overview

Package filter contains a stateful packet filter.

Index

• Variables
• func Netmask(bits int) packet.IP
• func NewIP(ip net.IP) packet.IP
• type Filter
  • func New(matches Matches, localNets []Net, shareStateWith *Filter, logf logger.Logf) *Filter
  • func NewAllowAll(localNets []Net, logf logger.Logf) *Filter
  • func NewAllowNone(logf logger.Logf) *Filter
  • func (f *Filter) RunIn(b []byte, q *packet.QDecode, rf RunFlags) Response
  • func (f *Filter) RunOut(b []byte, q *packet.QDecode, rf RunFlags) Response
• type Match
  • func (m Match) Clone() (res Match)
  • func (m Match) String() string
• type Matches
  • func (m Matches) Clone() (res Matches)
• type Net
  • func (n Net) Bits() int
  • func (n Net) Includes(ip packet.IP) bool
  • func (n Net) String() string
• type NetPortRange
  • func (ipr NetPortRange) String() string
• type PortRange
  • func (pr PortRange) String() string
• type Response
  • func (r Response) String() string
• type RunFlags

Variables

var MatchAllowAll = Matches{
	Match{[]NetPortRange{NetPortRangeAny}, []Net{NetAny}},
}

MatchAllowAll matches all packets.

var NetAny = Net{0, 0}

var NetNone = Net{^packet.IP(0), ^packet.IP(0)}

var NetPortRangeAny = NetPortRange{NetAny, PortRangeAny}

var PortRangeAny = PortRange{0, 65535}

Functions

func Netmask

func Netmask(bits int) packet.IP

func NewIP

func NewIP(ip net.IP) packet.IP

Types

type Filter

type Filter struct {
	// contains filtered or unexported fields
}

Filter is a stateful packet filter.

func New

func New(matches Matches, localNets []Net, shareStateWith *Filter, logf logger.Logf) *Filter

New creates a new packet filter. The filter enforces that incoming packets must be destined to an IP in localNets, and must be allowed by matches. If shareStateWith is non-nil, the returned filter shares state with the previous one, to enable rules to be changed at runtime without breaking existing flows.

func NewAllowAll

func NewAllowAll(localNets []Net, logf logger.Logf) *Filter

NewAllowAll returns a packet filter that accepts everything to and from localNets.

func NewAllowNone

func NewAllowNone(logf logger.Logf) *Filter

NewAllowNone returns a packet filter that rejects everything.

func (*Filter) RunIn

func (f *Filter) RunIn(b []byte, q *packet.QDecode, rf RunFlags) Response

func (*Filter) RunOut

func (f *Filter) RunOut(b []byte, q *packet.QDecode, rf RunFlags) Response

type Match

type Match struct {
	Dsts []NetPortRange
	Srcs []Net
}

func (Match) Clone

func (m Match) Clone() (res Match)

func (Match) String

func (m Match) String() string

type Matches

type Matches []Match

func (Matches) Clone

func (m Matches) Clone() (res Matches)

type Net

type Net struct {
	IP   packet.IP
	Mask packet.IP
}

func (Net) Bits

func (n Net) Bits() int

func (Net) Includes

func (n Net) Includes(ip packet.IP) bool

func (Net) String

func (n Net) String() string

type NetPortRange

type NetPortRange struct {
	Net   Net
	Ports PortRange
}

func (NetPortRange) String

func (ipr NetPortRange) String() string

type PortRange

type PortRange struct {
	First, Last uint16
}

func (PortRange) String

func (pr PortRange) String() string

type Response

type Response int

Response is a verdict: either a Drop, Accept, or noVerdict skip to continue processing.

const (
	Drop Response = iota
	Accept
)

func (Response) String

func (r Response) String() string

type RunFlags

type RunFlags int

RunFlags controls the filter's debug log verbosity at runtime.

const (
	LogDrops RunFlags = 1 << iota
	LogAccepts
	HexdumpDrops
	HexdumpAccepts
)