Documentation
¶
Overview ¶
Package firewall is the relay's security-group model, after OpenStack Neutron's networking API: ports carry security groups, groups hold rules, rules only allow, and everything not allowed is denied.
A flow from port S to port D is allowed iff one of S's EGRESS rules allows it AND one of D's INGRESS rules allows it, as Neutron filters at each port. Groups on a port are a union and rules have no order, so the result does not depend on the order anything was added in.
Statefulness: a port is stateful unless every group on it is stateless (Neutron's "stateful" attribute). A stateful port lets replies of an allowed flow through without a rule (the relay's connection tracking). For a stateless port the reverse direction must be allowed too: a TCP connect whose source or destination port is stateless also needs D's egress and S's ingress to allow the reverse flow, and every UDP datagram is checked on its own.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Decision ¶
type Decision struct {
Allowed bool
EgressRule string // the rule at the source that allowed it
IngressRule string // the rule at the destination that allowed it
Log bool // one of the matching rules asked for a log line
Reason string // why not, when not
}
Decision says whether a flow is allowed, and by which rules.
type Policy ¶
type Policy struct {
Groups map[string]*Group
// Members returns the addresses of every port that carries the group,
// for remote_group_id.
Members func(groupID string) []netip.Addr
}
Policy is the set of groups of one class and the lookups a decision needs.
type Port ¶
type Port struct {
ID string
Addr netip.Addr
Groups []string // group ids
PortSecurity bool // false: no filtering at all (teacher only)
}
Port is one container endpoint as the firewall sees it.
type Protocol ¶
type Protocol uint8
Protocol numbers, IANA's (as Neutron's protocol attribute accepts them).
func ParseProtocol ¶
ParseProtocol reads "tcp", "udp", "icmp", "any" or a number of one of them.
type Rule ¶
type Rule struct {
ID string
GroupID string
Direction Direction
Protocol Protocol
PortMin uint16
PortMax uint16
RemotePrefix netip.Prefix // zero value: unset
RemoteGroup string
Description string
Log bool
}
Rule is one security group rule. PortMin/PortMax are a TCP/UDP port range (0,0 = every port) or, for ICMP, a type and a code (0 meaning any when AnyICMP is set). Remote is at most one of RemotePrefix and RemoteGroup; neither means any remote.
Source Files