iptables

package
v0.0.4 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Apr 15, 2025 License: Apache-2.0 Imports: 3 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type IPTablesManager

type IPTablesManager struct {
	// contains filtered or unexported fields
}

IPTablesManager implements Manager using the go-iptables library.

func (*IPTablesManager) AddJumpRule

func (m *IPTablesManager) AddJumpRule(sourceIP, targetChain string) error

AddJumpRule appends a jump from the main chain to the container chain for the given source IP.

func (*IPTablesManager) AddRule

func (m *IPTablesManager) AddRule(chainName string, rule OutboundRule) error

AddRule inserts a new rule (or rules) into the chain.

func (*IPTablesManager) ChainExists

func (m *IPTablesManager) ChainExists(chainName string) (bool, error)

ChainExists checks whether the chain is present.

func (*IPTablesManager) ClearAndDeleteChain

func (m *IPTablesManager) ClearAndDeleteChain(chainName string) error

ClearAndDeleteChain first clears all rules from the chain, then deletes it.

func (*IPTablesManager) CreateContainerChain

func (m *IPTablesManager) CreateContainerChain(containerChain string) error

CreateContainerChain makes a new chain for a specific container and sets up default rules.

func (*IPTablesManager) EnsureMainChainExists

func (m *IPTablesManager) EnsureMainChainExists() error

EnsureMainChainExists creates the main chain if it doesn't exist and inserts a jump in CNI-FORWARD.

func (*IPTablesManager) RemoveJumpRule

func (m *IPTablesManager) RemoveJumpRule(sourceIP, targetChain string) error

RemoveJumpRule deletes a jump rule referencing the targetChain for the given source IP.

func (*IPTablesManager) RemoveJumpRuleByTargetChain

func (m *IPTablesManager) RemoveJumpRuleByTargetChain(targetChain string) error

RemoveJumpRuleByTargetChain does a more robust token-based matching to avoid partial strings.

func (*IPTablesManager) VerifyRules

func (m *IPTablesManager) VerifyRules(chainName string, rules []OutboundRule) error

VerifyRules verifies that each of the plugin's rules (and default actions) exist in iptables.

type IPTablesWrapper

type IPTablesWrapper interface {
	NewChain(table, chain string) error
	ClearChain(table, chain string) error
	DeleteChain(table, chain string) error
	ChainExists(table, chain string) (bool, error)
	Append(table, chain string, rulespec ...string) error
	Insert(table, chain string, pos int, rulespec ...string) error
	Delete(table, chain string, rulespec ...string) error
	List(table, chain string) ([]string, error)
}

IPTablesWrapper is a minimal subset of go-iptables/iptables interfaces we rely on (for mocking in tests).

type Manager

type Manager interface {
	EnsureMainChainExists() error
	CreateContainerChain(containerChain string) error
	AddRule(chainName string, rule OutboundRule) error
	AddJumpRule(sourceIP, targetChain string) error
	RemoveJumpRule(sourceIP, targetChain string) error
	RemoveJumpRuleByTargetChain(targetChain string) error
	ClearAndDeleteChain(chainName string) error
	ChainExists(chainName string) (bool, error)
	VerifyRules(chainName string, rules []OutboundRule) error
}

Manager defines the interface for creating chains, rules, etc.

func NewIPTablesManager

func NewIPTablesManager(mainChainName, defaultAction, logIdentifier string, dryRun, logDrops bool) (Manager, error)

NewIPTablesManager constructs the IPTablesManager with the specified main chain, default action, etc.

type OutboundRule

type OutboundRule struct {
	Host   string
	Proto  string
	Port   string
	Action string
}

OutboundRule describes a basic firewall rule: host, protocol, port, and the action (ACCEPT/DROP).

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL