filter

Documentation

Overview

Package filter contains a stateful packet filter.

Index

• Variables
• func Netmask(bits int) packet.IP
• func NewIP(ip net.IP) packet.IP
• type Filter
  • func New(matches Matches, localNets []Net, shareStateWith *Filter, logf logger.Logf) *Filter
  • func NewAllowAll(localNets []Net, logf logger.Logf) *Filter
  • func NewAllowNone(logf logger.Logf) *Filter
  • func (f *Filter) RunIn(q *packet.ParsedPacket, rf RunFlags) Response
  • func (f *Filter) RunOut(q *packet.ParsedPacket, rf RunFlags) Response
• type Match
  • func (m Match) Clone() (res Match)
  • func (m Match) String() string
• type Matches
  • func MatchesFromFilterRules(pf []tailcfg.FilterRule) (Matches, error)
  • func (m Matches) Clone() (res Matches)
• type Net
  • func (n Net) Bits() int
  • func (n Net) Includes(ip packet.IP) bool
  • func (n Net) String() string
• type NetPortRange
  • func (ipr NetPortRange) String() string
• type PortRange
  • func (pr PortRange) String() string
• type Response
  • func (r Response) String() string
• type RunFlags

Variables

var MatchAllowAll = Matches{
	Match{[]NetPortRange{NetPortRangeAny}, []Net{NetAny}},
}

MatchAllowAll matches all packets.

var NetAny = Net{0, 0}

var NetNone = Net{^packet.IP(0), ^packet.IP(0)}

var NetPortRangeAny = NetPortRange{NetAny, PortRangeAny}

var PortRangeAny = PortRange{0, 65535}

Functions

func Netmask

func Netmask(bits int) packet.IP

func NewIP

func NewIP(ip net.IP) packet.IP

Types

type Filter

type Filter struct {
	// contains filtered or unexported fields
}

Filter is a stateful packet filter.

func New

func New(matches Matches, localNets []Net, shareStateWith *Filter, logf logger.Logf) *Filter

New creates a new packet filter. The filter enforces that incoming packets must be destined to an IP in localNets, and must be allowed by matches. If shareStateWith is non-nil, the returned filter shares state with the previous one, to enable rules to be changed at runtime without breaking existing flows.

func NewAllowAll

func NewAllowAll(localNets []Net, logf logger.Logf) *Filter

NewAllowAll returns a packet filter that accepts everything to and from localNets.

func NewAllowNone

func NewAllowNone(logf logger.Logf) *Filter

NewAllowNone returns a packet filter that rejects everything.

func (*Filter) RunIn

func (f *Filter) RunIn(q *packet.ParsedPacket, rf RunFlags) Response

RunIn determines whether this node is allowed to receive q from a Tailscale peer.

func (*Filter) RunOut

func (f *Filter) RunOut(q *packet.ParsedPacket, rf RunFlags) Response

RunOut determines whether this node is allowed to send q to a Tailscale peer.

type Match

type Match struct {
	Dsts []NetPortRange
	Srcs []Net
}

func (Match) Clone

func (m Match) Clone() (res Match)

func (Match) String

func (m Match) String() string

type Matches

type Matches []Match

func MatchesFromFilterRules

func MatchesFromFilterRules(pf []tailcfg.FilterRule) (Matches, error)

MatchesFromFilterRules parse a number of wire-format FilterRule values into the Matches format. If an error is returned, the Matches result is still valid, containing the rules that were successfully converted.

func (Matches) Clone

func (m Matches) Clone() (res Matches)

type Net

type Net struct {
	IP   packet.IP
	Mask packet.IP
}

func (Net) Bits

func (n Net) Bits() int

func (Net) Includes

func (n Net) Includes(ip packet.IP) bool

func (Net) String

func (n Net) String() string

type NetPortRange

type NetPortRange struct {
	Net   Net
	Ports PortRange
}

func (NetPortRange) String

func (ipr NetPortRange) String() string

type PortRange

type PortRange struct {
	First, Last uint16
}

func (PortRange) String

func (pr PortRange) String() string

type Response

type Response int

Response is a verdict: either a Drop, Accept, or noVerdict skip to continue processing.

const (
	Drop Response = iota
	Accept
)

func (Response) String

func (r Response) String() string

type RunFlags

type RunFlags int

RunFlags controls the filter's debug log verbosity at runtime.

const (
	LogDrops RunFlags = 1 << iota
	LogAccepts
	HexdumpDrops
	HexdumpAccepts
)