Documentation
¶
Overview ¶
Package nftbackend provides the core interface to nftables operations.
Architecture ¶
This package is the single point of truth for nftables write operations in NFTBan. It enforces the single-writer architecture where only the nftband daemon should perform nftables modifications.
Operations ¶
The backend supports:
- Ban: Add IP to blacklist set
- Unban: Remove IP from blacklist set
- Whitelist: Add/remove from whitelist set
- Sync: Bulk update of sets (feeds, geoban)
- Flush: Clear all entries from a set
Safety Features ¶
- Validates IPs before operations
- Prevents blocking of system IPs
- Uses atomic nft transactions
- Logs all operations for audit
Thread Safety ¶
The Backend type uses mutex locking to ensure thread-safe operations. Multiple goroutines can safely call Ban/Unban concurrently.
Usage ¶
The backend is instantiated by nftband daemon:
backend := nftbackend.New()
err := backend.Ban("192.168.1.100", "manual", 0)
err := backend.Unban("192.168.1.100")
CLI tools should use the IPC client instead of this package directly.
Index ¶
- type AddElementRequest
- type ApplyRulesetRequest
- type Backend
- func (b *Backend) AddElement(ctx context.Context, req AddElementRequest) error
- func (b *Backend) ApplyRuleset(ctx context.Context, req ApplyRulesetRequest) error
- func (b *Backend) Ban(ctx context.Context, req BanRequest) (*BanResult, error)
- func (b *Backend) CheckIP(ctx context.Context, ip string) (bool, string, error)
- func (b *Backend) DeleteElement(ctx context.Context, req DeleteElementRequest) error
- func (b *Backend) FlushSet(ctx context.Context, req FlushSetRequest) error
- func (b *Backend) GetStats() Stats
- func (b *Backend) HealthCheck(ctx context.Context) error
- func (b *Backend) Unban(ctx context.Context, req UnbanRequest) (*UnbanResult, error)
- type BanRequest
- type BanResult
- type DeleteElementRequest
- type FlushSetRequest
- type Stats
- type UnbanRequest
- type UnbanResult
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AddElementRequest ¶
type AddElementRequest struct {
Table string // e.g., "ip nftban", "ip6 nftban", "inet nftban"
Set string // e.g., "whitelist_ipv4", "tcp_ports"
Element string // e.g., "1.2.3.4", "8080"
Timeout int // seconds, 0 = permanent
}
AddElementRequest for generic set element operations
type ApplyRulesetRequest ¶
type ApplyRulesetRequest struct {
FilePath string // path to .nft file
Check bool // if true, validate only (nft -c)
}
ApplyRulesetRequest for applying complete rulesets
type Backend ¶
type Backend struct {
// contains filtered or unexported fields
}
Backend provides serialized access to nftables write operations. All operations are thread-safe and atomic where possible.
func (*Backend) AddElement ¶
func (b *Backend) AddElement(ctx context.Context, req AddElementRequest) error
AddElement adds an element to any set This is the ONLY authorized add element implementation
func (*Backend) ApplyRuleset ¶
func (b *Backend) ApplyRuleset(ctx context.Context, req ApplyRulesetRequest) error
ApplyRuleset applies a ruleset from a file This is the ONLY authorized apply ruleset implementation
func (*Backend) Ban ¶
Ban adds an IP to the appropriate blacklist set This is the ONLY authorized ban implementation
func (*Backend) DeleteElement ¶
func (b *Backend) DeleteElement(ctx context.Context, req DeleteElementRequest) error
DeleteElement removes an element from any set This is the ONLY authorized delete element implementation
func (*Backend) FlushSet ¶
func (b *Backend) FlushSet(ctx context.Context, req FlushSetRequest) error
FlushSet flushes all elements from a set This is the ONLY authorized flush set implementation
func (*Backend) HealthCheck ¶
HealthCheck verifies nftables is operational
func (*Backend) Unban ¶
func (b *Backend) Unban(ctx context.Context, req UnbanRequest) (*UnbanResult, error)
Unban removes an IP from the appropriate blacklist set This is the ONLY authorized unban implementation
type BanRequest ¶
type BanRequest struct {
IP string
Timeout int // seconds, 0 = permanent
Reason string
Source string
}
BanRequest contains parameters for banning an IP
type DeleteElementRequest ¶
DeleteElementRequest for removing set elements
type FlushSetRequest ¶
FlushSetRequest for flushing sets
type UnbanRequest ¶
type UnbanRequest struct {
IP string
}
UnbanRequest contains parameters for unbanning an IP
Source Files