filter

package
v0.0.0-...-e99c6c0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 3, 2026 License: GPL-3.0 Imports: 13 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	OrderBucketRichPre            = "rich_pre"
	OrderBucketRichZeroDeny       = "rich_zero_deny"
	OrderBucketZonePrimitiveAllow = "zone_primitive_allow"
	OrderBucketRichZeroAllow      = "rich_zero_allow"
	OrderBucketRichPost           = "rich_post"
)
View Source 
const (
	BasicBeforeChain   = constant.FirewallBasicBeforeChain
	IptablesInputChain = constant.FirewallBasicChain
	BasicAfterChain    = constant.FirewallBasicAfterChain
	FirewalldInputZone = "public"
	UFWInputChain      = "incoming"
)
View Source 
const MaxAtomicExpansion = 256
View Source 
const ObservedFieldProtocol = "protocol"

Variables

View Source 
var (
	ErrAdapterUnavailable   = errors.New("firewall rule adapter is unavailable")
	ErrInventoryUnavailable = errors.New("firewall rule inventory is unavailable")
)
View Source 
var (
	ErrRuleStale         = errors.New("firewall rule state is stale")
	ErrRuleOperation     = errors.New("firewall rule operation is not allowed")
	ErrRuleCheckRequired = errors.New("firewall rule must be checked again")
)
View Source 
var (
	ErrInvalidScope     = errors.New("invalid firewall scope")
	ErrUnsupportedScope = errors.New("unsupported firewall scope")
	ErrInvalidRule      = errors.New("invalid firewall rule")
	ErrProtectedRule    = errors.New("protected firewall rule cannot be modified")
	ErrLockoutRisk      = errors.New("firewall change may lock out management access")
	ErrCompositeRule    = errors.New("firewall rule must be atomic")
	ErrExpansionLimit   = errors.New("firewall rule expansion limit exceeded")
)
View Source 
var ErrProviderUnavailable = errors.New("firewall provider is unavailable")
View Source 
var ErrVerificationFailed = errors.New("firewall rule verification failed")

Functions

func GuardMutation 

func GuardMutation(
	snapshot Snapshot,
	target ObservedRule,
	after FirewallRule,
	clientIP string,
	protectedPorts ...PortWhitelist,
) error

func InstanceKey 

func InstanceKey(rule ObservedRule) (string, error)

func ObservedRuleMatchesExpected 

func ObservedRuleMatchesExpected(observed ObservedRule, expected FirewallRule) bool

ObservedRuleMatchesExpected compares the semantic fields that the backend could actually observe. Partial rules name fields omitted by their native listing; those fields are supplied from the expected rule before comparing normalized identities.

func RuleBlocksManagementConnection 

func RuleBlocksManagementConnection(
	rule FirewallRule,
	clientIP string,
	protectedPorts ...PortWhitelist,
) bool

func RuleCovers 

func RuleCovers(existing, requested FirewallRule) bool

func RuleKey 

func RuleKey(rule FirewallRule) (string, error)

func RulesOverlap 

func RulesOverlap(left, right FirewallRule) bool

func RuntimeUsageKey 

func RuntimeUsageKey(rule FirewallRule) string

func SameLocator 

func SameLocator(left, right Locator) bool

func SnapshotRevision 

func SnapshotRevision(scope Scope, rules []ObservedRule) (string, error)

Types

type Action 

type Action string
const (
	ActionAccept Action = "accept"
	ActionDrop   Action = "drop"
	ActionReject Action = "reject"
)

type Adapter 

type Adapter interface {
	Provider() Provider
	Capabilities(context.Context) (Capabilities, error)
	Observe(context.Context, Scope) (Snapshot, error)
	Compile(Snapshot, []DesiredChange) (BackendPlan, error)
	Apply(context.Context, BackendPlan) (ApplyResult, error)
	Verify(context.Context, BackendPlan) (VerifyResult, error)
}

type ApplyResult 

type ApplyResult struct {
	Applied      []ObservedRule `json:"applied"`
	Verification *VerifyResult  `json:"verification,omitempty"`
}

type BackendPlan 

type BackendPlan struct {
	Provider         Provider         `json:"provider"`
	Scope            Scope            `json:"scope"`
	SnapshotRevision string           `json:"snapshotRevision"`
	Rules            []NativeRulePlan `json:"rules"`
}

type Capabilities 

type Capabilities struct {
	Scopes                []ScopePattern
	Marker                bool
	AtomicApply           bool
	TransactionalRollback bool
	OwnedChains           bool
	ExplicitPosition      bool
	ExplicitPriority      bool
	NativePort            bool
}

func (Capabilities) SupportsScope 

func (c Capabilities) SupportsScope(scope Scope) bool

type ChangeOperation 

type ChangeOperation string
const (
	ChangeCreate  ChangeOperation = "create"
	ChangeAdopt   ChangeOperation = "adopt"
	ChangeUpdate  ChangeOperation = "update"
	ChangeDelete  ChangeOperation = "delete"
	ChangeReorder ChangeOperation = "reorder"
)

type CheckAction 

type CheckAction string
const (
	CheckActionCreate      CheckAction = "create"
	CheckActionAdopt       CheckAction = "adopt"
	CheckActionSelectAdopt CheckAction = "select_adopt"
	CheckActionCancel      CheckAction = "cancel"
)

type CheckClassification 

type CheckClassification string
const (
	CheckClassificationNone          CheckClassification = "none"
	CheckClassificationExactManaged  CheckClassification = "exact_managed"
	CheckClassificationExactExternal CheckClassification = "exact_external"
	CheckClassificationConflict      CheckClassification = "conflict"
	CheckClassificationUnsupported   CheckClassification = "unsupported"
	CheckClassificationProtected     CheckClassification = "protected"
)

type CheckDecision 

type CheckDecision string
const (
	CheckDecisionReady                CheckDecision = "ready"
	CheckDecisionConfirmationRequired CheckDecision = "confirmation_required"
	CheckDecisionBlocked              CheckDecision = "blocked"
	CheckDecisionNoChange             CheckDecision = "no_change"
)

type CheckFlagCodec 

type CheckFlagCodec struct {
	// contains filtered or unexported fields
}

func NewCheckFlagCodec 

func NewCheckFlagCodec(secret []byte, version int) *CheckFlagCodec

func (*CheckFlagCodec) Authorize 

func (c *CheckFlagCodec) Authorize(
	checkFlag string,
	action CheckAction,
	adoptInstanceKey string,
	rule FirewallRule,
	snapshot Snapshot,
	managedRevision string,
) (CreateAuthorization, error)

func (*CheckFlagCodec) Sign 

func (c *CheckFlagCodec) Sign(result RuleCheckResult, snapshot Snapshot, managedRevision string) (string, error)

type CreateAuthorization 

type CreateAuthorization struct {
	Operation ChangeOperation
	Locator   *Locator
}

type DesiredChange 

type DesiredChange struct {
	Operation      ChangeOperation `json:"operation"`
	Before         *FirewallRule   `json:"before,omitempty"`
	After          *FirewallRule   `json:"after,omitempty"`
	Locator        *Locator        `json:"locator,omitempty"`
	PreviousMarker string          `json:"previousMarker,omitempty"`
	Append         bool            `json:"append,omitempty"`
	RestoreAtEnd   bool            `json:"restoreAtEnd,omitempty"`
}

type DesiredRule 

type DesiredRule struct {
	UUID                string       `json:"uuid"`
	Rule                FirewallRule `json:"rule"`
	RuleKey             string       `json:"ruleKey"`
	Origin              RuleOrigin   `json:"origin"`
	Protected           bool         `json:"protected,omitempty"`
	Marker              string       `json:"marker,omitempty"`
	ObservedInstanceKey string       `json:"observedInstanceKey,omitempty"`
}

type Direction 

type Direction string
const (
	DirectionInput Direction = "input"
)

type Family 

type Family string
const (
	FamilyIPv4 Family = constant.FirewallFamilyIPv4
	FamilyIPv6 Family = constant.FirewallFamilyIPv6
	FamilyInet Family = constant.FirewallFamilyInet
)

type FirewallRule 

type FirewallRule struct {
	UUID               string     `json:"uuid,omitempty"`
	Scope              Scope      `json:"scope"`
	NativeKind         NativeKind `json:"nativeKind"`
	Protocol           string     `json:"protocol"`
	SourceAddress      string     `json:"sourceAddress,omitempty"`
	SourcePort         string     `json:"sourcePort,omitempty"`
	DestinationAddress string     `json:"destinationAddress,omitempty"`
	DestinationPort    string     `json:"destinationPort,omitempty"`
	Interface          string     `json:"interface,omitempty"`
	ConnectionStates   []string   `json:"connectionStates,omitempty"`
	Action             Action     `json:"action"`
	Priority           *int       `json:"priority,omitempty"`
	OrderIndex         *int64     `json:"orderIndex,omitempty"`
	OrderBucket        string     `json:"orderBucket,omitempty"`
	Description        string     `json:"description,omitempty"`
}

func ExpandAtomicRules 

func ExpandAtomicRules(input FirewallRule) ([]FirewallRule, error)

func NormalizeRule 

func NormalizeRule(rule FirewallRule) (FirewallRule, error)

type Inventory 

type Inventory struct {
	Items   []InventoryItem `json:"items"`
	Notices []ScopeNotice   `json:"notices,omitempty"`
}

type InventoryItem 

type InventoryItem struct {
	Rule     FirewallRule   `json:"rule"`
	Observed *ObservedRule  `json:"observed,omitempty"`
	Desired  *DesiredRule   `json:"desired,omitempty"`
	State    InventoryState `json:"state"`
	Match    InventoryMatch `json:"match"`
	Usage    *RuntimeUsage  `json:"usage,omitempty"`
}

func AttachRuntimeUsage 

func AttachRuntimeUsage(items []InventoryItem, usage map[string]RuntimeUsage) []InventoryItem

func MergeInventory 

func MergeInventory(input InventoryMergeInput) ([]InventoryItem, error)

type InventoryMatch 

type InventoryMatch string
const (
	InventoryMatchNone      InventoryMatch = "none"
	InventoryMatchExact     InventoryMatch = "exact"
	InventoryMatchChanged   InventoryMatch = "changed"
	InventoryMatchMissing   InventoryMatch = "missing"
	InventoryMatchAmbiguous InventoryMatch = "ambiguous"
	InventoryMatchOpaque    InventoryMatch = "opaque"
)

type InventoryMergeInput 

type InventoryMergeInput struct {
	Observed              []ObservedRule
	Desired               []DesiredRule
	ProtectedObservedKeys map[string]struct{}
}

type InventoryState 

type InventoryState string
const (
	InventoryStateManaged   InventoryState = "managed"
	InventoryStateAdopted   InventoryState = "adopted"
	InventoryStateExternal  InventoryState = "external"
	InventoryStateDrifted   InventoryState = "drifted"
	InventoryStateProtected InventoryState = "protected"
)

type Locator 

type Locator struct {
	Provider  Provider `json:"provider"`
	ScopeKey  string   `json:"scopeKey"`
	NativeID  string   `json:"nativeId,omitempty"`
	Canonical string   `json:"canonical,omitempty"`
	Position  *int     `json:"position,omitempty"`
}

type MultiScopeObserver 

type MultiScopeObserver interface {
	ObserveScopes(context.Context, []Scope) ([]Snapshot, error)
}

type NativeCommand 

type NativeCommand struct {
	Executable string   `json:"executable"`
	Args       []string `json:"args"`
	Stdin      string   `json:"stdin,omitempty"`
}

type NativeDetailReader 

type NativeDetailReader interface {
	NativeDetail(context.Context, string, bool) (string, error)
}

type NativeKind 

type NativeKind string
const (
	NativeKindRule           NativeKind = "rule"
	NativeKindZonePort       NativeKind = "zone_port"
	NativeKindRichRule       NativeKind = "rich_rule"
	NativeKindUFWRule        NativeKind = "ufw_rule"
	NativeKindUFWApplication NativeKind = "ufw_application"
	NativeKindOpaque         NativeKind = "opaque"
	NativeKindZoneService    NativeKind = "zone_service"
)

type NativeRulePlan 

type NativeRulePlan struct {
	RuleUUID         string          `json:"ruleUUID"`
	Operation        ChangeOperation `json:"operation"`
	Commands         []NativeCommand `json:"commands"`
	RollbackCommands []NativeCommand `json:"rollbackCommands,omitempty"`
	Previous         *ObservedRule   `json:"previous,omitempty"`
	Expected         ObservedRule    `json:"expected"`
}

type ObservedRule 

type ObservedRule struct {
	Rule            FirewallRule      `json:"rule"`
	Locator         Locator           `json:"locator"`
	InstanceKey     string            `json:"instanceKey,omitempty"`
	Marker          string            `json:"marker,omitempty"`
	ParseStatus     ParseStatus       `json:"parseStatus"`
	UncertainFields []string          `json:"uncertainFields,omitempty"`
	Raw             string            `json:"raw,omitempty"`
	Protected       bool              `json:"protected"`
	Persistence     PersistenceStatus `json:"persistence,omitempty"`
}

func FindCandidate 

func FindCandidate(candidates []ObservedRule, selected string) (ObservedRule, error)

func FindCommittedObserved 

func FindCommittedObserved(snapshot Snapshot, requested FirewallRule, plan BackendPlan) (ObservedRule, error)

func ManagedObserved 

func ManagedObserved(snapshot Snapshot, desired DesiredRule) (ObservedRule, error)

func MatchObservedByRuleKey 

func MatchObservedByRuleKey(observed []ObservedRule, rule FirewallRule) ([]ObservedRule, error)

type ParseStatus 

type ParseStatus string
const (
	ParseStatusSupported ParseStatus = "supported"
	ParseStatusPartial   ParseStatus = "partial"
	ParseStatusOpaque    ParseStatus = "opaque"
)

type PersistenceStatus 

type PersistenceStatus string
const (
	PersistenceStatusConverged     PersistenceStatus = "converged"
	PersistenceStatusRuntimeOnly   PersistenceStatus = "runtime_only"
	PersistenceStatusPermanentOnly PersistenceStatus = "permanent_only"
)

type PlanRollbacker 

type PlanRollbacker interface {
	Rollback(context.Context, BackendPlan) error
}

type PortWhitelist 

type PortWhitelist struct {
	Family   string `json:"family"`
	Port     string `json:"port"`
	Protocol string `json:"protocol"`
}

type Provider 

type Provider string
const (
	ProviderIptables  Provider = constant.FirewallProviderIptables
	ProviderNftables  Provider = constant.FirewallProviderNftables
	ProviderFirewalld Provider = constant.FirewallProviderFirewalld
	ProviderUFW       Provider = constant.FirewallProviderUFW
)

type RuleCheckResult 

type RuleCheckResult struct {
	Decision         CheckDecision       `json:"decision"`
	Classification   CheckClassification `json:"classification"`
	Reason           string              `json:"reason"`
	RequestedRule    FirewallRule        `json:"requestedRule"`
	RequestedRuleKey string              `json:"requestedRuleKey"`
	ExistingRuleUUID string              `json:"existingRuleUUID,omitempty"`
	Candidates       []ObservedRule      `json:"candidates,omitempty"`
	AllowedActions   []CheckAction       `json:"allowedActions,omitempty"`
}

func CheckCreate 

func CheckCreate(
	snapshot Snapshot,
	requested FirewallRule,
	desired []DesiredRule,
	clientIP string,
	protectedPorts ...PortWhitelist,
) (RuleCheckResult, error)

type RuleChecker 

type RuleChecker interface {
	CheckRule(context.Context, FirewallRule) error
}

type RuleOrigin 

type RuleOrigin string
const (
	RuleOriginCreated RuleOrigin = constant.FirewallRuleOriginCreated
	RuleOriginAdopted RuleOrigin = constant.FirewallRuleOriginAdopted
)

type RulePreparer 

type RulePreparer interface {
	PrepareRule(FirewallRule) (FirewallRule, error)
}

type RuntimeUsage 

type RuntimeUsage struct {
	Used   bool     `json:"used"`
	UsedBy []string `json:"usedBy,omitempty"`
	Reason string   `json:"reason,omitempty"`
}

type Scope 

type Scope struct {
	Provider  Provider  `json:"provider"`
	Family    Family    `json:"family"`
	Table     string    `json:"table,omitempty"`
	Zone      string    `json:"zone,omitempty"`
	Chain     string    `json:"chain,omitempty"`
	Direction Direction `json:"direction"`
}

func ManagedInputScopes 

func ManagedInputScopes(provider Provider) []Scope

func (Scope) Key 

func (s Scope) Key() string

func (Scope) Normalize 

func (s Scope) Normalize() Scope

func (Scope) ValidateMVP 

func (s Scope) ValidateMVP() error

type ScopeNotice 

type ScopeNotice struct {
	Code   ScopeNoticeCode `json:"code"`
	Values []string        `json:"values,omitempty"`
}

type ScopeNoticeCode 

type ScopeNoticeCode string
const (
	ScopeNoticeDefaultScopeMismatch     ScopeNoticeCode = "default_scope_mismatch"
	ScopeNoticeManagedScopeInactive     ScopeNoticeCode = "managed_scope_inactive"
	ScopeNoticeUnmanagedActiveScopes    ScopeNoticeCode = "unmanaged_active_scopes"
	ScopeNoticeRuntimePermanentMismatch ScopeNoticeCode = "runtime_permanent_mismatch"
	ScopeNoticeManagedScopeMissing      ScopeNoticeCode = "managed_scope_missing"
)

type ScopePattern 

type ScopePattern struct {
	Provider   Provider
	Families   []Family
	Table      string
	Zone       string
	Chains     []string
	Directions []Direction
}

func MVPScopePatterns 

func MVPScopePatterns() []ScopePattern

func (ScopePattern) Matches 

func (p ScopePattern) Matches(scope Scope) bool

type Snapshot 

type Snapshot struct {
	Scope    Scope          `json:"scope"`
	Revision string         `json:"revision"`
	Rules    []ObservedRule `json:"rules"`
	Notices  []ScopeNotice  `json:"notices,omitempty"`
}

func NewSnapshot 

func NewSnapshot(scope Scope, rules []ObservedRule) (Snapshot, error)

func ProtectSnapshot 

func ProtectSnapshot(snapshot Snapshot, ports []PortWhitelist) (Snapshot, error)

type UnverifiedRuleAppender 

type UnverifiedRuleAppender interface {
	AppendUnverified(context.Context, FirewallRule, string) error
}

type VerifyResult 

type VerifyResult struct {
	Snapshot Snapshot `json:"snapshot"`
	Matched  bool     `json:"matched"`
}

Source Files

View all Source files

Directories

Path Synopsis
providers
firewalld
iptables
nftables
ufw

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.