Documentation
¶
Overview ¶
Package killswitch provides a minimal client for the killswitch daemon admin API.
The daemon accepts only one temporary ruleset per admin API connection. This package therefore keeps all caller-created temporary rulesets in memory, merges them into one connection-level ruleset, and re-sends that merged ruleset whenever local state changes or the daemon connection is restored.
Index ¶
Constants ¶
const (
DefaultAdminSocketPath = "/run/killswitch/admin.sock"
)
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AllowRules ¶
type AllowRules struct {
AllowAll bool `json:"allow_all"` //nolint:tagliatelle
EnableV4 bool `json:"enable_v4"` //nolint:tagliatelle
EnableV6 bool `json:"enable_v6"` //nolint:tagliatelle
AllowedMarks []string `json:"allowed_marks,omitempty"` //nolint:tagliatelle
AllowedPorts []string `json:"allowed_ports,omitempty"` //nolint:tagliatelle
AllowedV4Hosts []string `json:"allowed_v4_hosts,omitempty"` //nolint:tagliatelle
AllowedV6Hosts []string `json:"allowed_v6_hosts,omitempty"` //nolint:tagliatelle
AllowedV4Pairs []string `json:"allowed_v4_hostports,omitempty"` //nolint:tagliatelle
AllowedV6Pairs []string `json:"allowed_v6_hostports,omitempty"` //nolint:tagliatelle
}
AllowRules is the policy part of a killswitch temporary ruleset.
String fields use the daemon's admin API syntax:
- AllowedMarks accepts integer marks such as "0x8000" or "32768".
- AllowedPorts accepts "tcp/443" or "udp/53".
- AllowedV4Hosts and AllowedV6Hosts accept plain IP addresses.
- AllowedV4Pairs and AllowedV6Pairs accept "tcp/192.0.2.1:443", "udp/[2001:db8::1]:53", and similar host-port rules.
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client maintains temporary killswitch rulesets over the daemon admin API.
Client hides IPC state from callers. Temporary ruleset methods are available before the daemon socket exists, while the daemon is down, and after disconnects. A background goroutine reconnects forever with exponential backoff from 1s to 64s, resetting the delay after every successful connection. Close stops that goroutine.
The daemon applies temporary rulesets to explicit interface names. Client subscribes to interface events, tracks the current daemon-reported interface name list, and attaches the merged temporary ruleset to every available interface. Interface property-only events do not trigger a re-send; only a changed set of interface names does.
func NewClient ¶
NewClient starts a killswitch admin API client for path.
logf may be nil. The returned client immediately starts trying to connect, but temporary ruleset methods do not require the connection to be available. If path is empty, DefaultAdminSocketPath is used.
func (*Client) Close ¶
Close stops reconnecting and closes the current admin API connection, if any. It does not clear the in-memory ruleset map.
func (*Client) CreateTMPRuleset ¶
func (c *Client) CreateTMPRuleset(rules AllowRules) (uint64, error)
CreateTMPRuleset stores a new temporary ruleset, schedules a daemon update, and returns the generated ruleset ID. Callers must keep the ID and pass it to UpdateTMPRuleset or DeleteTMPRuleset to modify or remove the same ruleset.
func (*Client) DeleteTMPRuleset ¶
DeleteTMPRuleset removes a temporary ruleset and schedules a daemon update. Deleting a missing ruleset is a no-op.
func (*Client) UpdateTMPRuleset ¶
func (c *Client) UpdateTMPRuleset(id uint64, rules AllowRules) error
UpdateTMPRuleset replaces an existing temporary ruleset and schedules a daemon update. It returns an error if id does not identify an existing ruleset.
Source Files