Documentation
¶
Index ¶
- type Filter
- func (f *Filter) Ban(addr netip.Addr, ttl time.Duration) error
- func (f *Filter) Close()
- func (f *Filter) EtherTypes() map[string]uint64
- func (f *Filter) Mode() string
- func (f *Filter) SetBlock(block []netip.Prefix) error
- func (f *Filter) SetSYNRate(syn SYNRate) error
- func (f *Filter) Stats() map[string]uint64
- type SYNRate
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Filter ¶
type Filter struct {
// contains filtered or unexported fields
}
Filter is a loaded XDP program and its maps. Close detaches it.
func Attach ¶
Attach loads the XDP filter onto ifaceName. Driver mode first, generic (SKB) as fallback.
func (*Filter) Ban ¶
Ban pins addr until ttl elapses (monotonic clock, same as BPF): the address itself for IPv4, its /64 for IPv6, which is what one user usually holds. ttl <= 0 is forever. XDP then drops that source before its next handshake.
func (*Filter) EtherTypes ¶ added in v0.3.0
EtherTypes counts the frames dropped for their EtherType (drop_ethertype), by EtherType as 0x88cc, or llc for an IEEE 802.3 frame, whose type field is a length. The program tracks up to 64 types.
func (*Filter) Mode ¶
Mode is how the filter attached: driver (in the NIC driver, before the kernel allocates for a packet) or generic (after, slower).
func (*Filter) SetBlock ¶
SetBlock replaces the permanent drop list (expire_ns == 0). Runtime bans (expire_ns != 0) stay. The XDP program keeps running.
func (*Filter) SetSYNRate ¶
SetSYNRate changes the SYN limit while XDP runs. Sources keep the tokens they have; they refill at the new rate.
Source Files