Documentation
¶
Overview ¶
Package hostfw reads the host firewall (ufw, firewalld, nftables, iptables) and opens exactly ports 80 and 443 in it, nothing else. It never enables a disabled firewall, never edits or deletes a rule it did not add, and every change it makes has a printed undo.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrRefused = errors.New("hostfw: refused")
ErrRefused is wrapped by Apply when the change is not safe to make here.
var WebPorts = []int{80, 443}
WebPorts are the only ports this package ever opens.
Functions ¶
func InputFiltered ¶
InputFiltered classifies whether the backend's input path drops traffic, with the same helpers the doctor check uses. known is false for backends that are not read as a raw ruleset or when the dump cannot be read.
func IptablesInputFiltered ¶
IptablesInputFiltered reports whether `iptables -S` output drops inbound traffic on INPUT by policy, by rule, or through a user chain INPUT jumps to.
func NftInputFiltered ¶
NftInputFiltered reports whether an `nft list ruleset` dump has an input hook that drops by policy or by rule. Docker's NAT, raw and forward rules do not count.
Types ¶
type Plan ¶
type Plan struct {
Backend Backend `json:"backend"`
Ports []int `json:"ports"`
Add []Command `json:"add"`
Undo []Command `json:"undo"`
// Persistent is false when the rule is lost on reboot unless the operator saves the ruleset.
Persistent bool `json:"persistent"`
Note string `json:"note,omitempty"`
// Refusal is set when the change must not be made from here; Add is then empty.
Refusal string `json:"refusal,omitempty"`
}
Plan is exactly what opening the web ports would run and how to reverse it.
type Result ¶
type Result struct {
Plan Plan `json:"plan"`
Status Status `json:"status"`
// Undo are the commands that reverse exactly what was added.
Undo []Command `json:"undo"`
}
Result is what Apply did.
type Status ¶
type Status struct {
Backend Backend `json:"backend"`
// Installed is true when a firewall tool exists on the host.
Installed bool `json:"installed"`
// Active is true when the firewall filters incoming traffic.
Active bool `json:"active"`
// Unknown is true when a tool exists but could not be read, usually for lack of privileges.
Unknown bool `json:"unknown"`
// Open reports, per web port, whether incoming TCP is allowed.
Open map[int]bool `json:"open"`
Detail string `json:"detail"`
// contains filtered or unexported fields
}
Status is what the host firewall does with ports 80 and 443 right now.
func Detect ¶
Detect reads every installed firewall tool and reports the one that is enforcing, else the first that is installed, else BackendNone.
func (Status) MissingPorts ¶
MissingPorts lists the web ports an active firewall does not allow.
Source Files