manager

type Action int

type ForwardRule struct {
	Protocol          Protocol
	DestinationPort   Port
	TranslatedAddress netip.Addr
	TranslatedPort    Port
}

type LegacyManager interface {
	RemoveAllLegacyRouteRules() error
	GetLegacyManagement() bool
	SetLegacyManagement(bool)
}

type Manager interface {
	Init(stateManager *statemanager.Manager) error

	// AddFilterRule adds a packet-filtering rule to the firewall.
	//
	// If destination is the zero Network, the rule applies to traffic
	// inbound to this node, i.e. peer ACL semantics, installed in
	// the kernel's input chain. If destination is set (prefix or
	// set), the rule applies to forwarded traffic with that
	// destination, route ACL semantics, installed in the forward
	// chain.
	//
	// sources must be a single address family; the caller splits mixed
	// families and calls once per family. "Match any source" must be
	// expressed with an explicit /0 prefix; an empty sources list is
	// rejected with ErrNoSources so a zeroed list can never widen a
	// rule to every source.
	//
	// Note: callers should call Flush() after adding rules.
	AddFilterRule(
		id []byte,
		sources []netip.Prefix,
		destination Network,
		proto Protocol,
		sPort *Port,
		dPort *Port,
		action Action,
	) (Rule, error)

	// DeleteFilterRule removes a filtering rule previously added via
	// AddFilterRule. The rule's own type identifies whether it lives
	// in the peer (input) or route (forward) path.
	DeleteFilterRule(rule Rule) error

	// IsServerRouteSupported returns true if the firewall supports server side routing operations
	IsServerRouteSupported() bool

	IsStateful() bool

	// AddNatRule inserts a routing NAT rule
	AddNatRule(pair RouterPair) error

	// RemoveNatRule removes a routing NAT rule
	RemoveNatRule(pair RouterPair) error

	// SetLegacyManagement sets the legacy management mode
	SetLegacyManagement(legacy bool) error

	// Close closes the firewall manager
	Close(stateManager *statemanager.Manager) error

	// Flush the changes to firewall controller
	Flush() error

	SetLogLevel(log.Level)

	EnableRouting() error

	DisableRouting() error

	// AddDNATRule adds outbound DNAT rule for forwarding external traffic to the NetBird network.
	AddDNATRule(ForwardRule) (Rule, error)

	// DeleteDNATRule deletes the outbound DNAT rule.
	DeleteDNATRule(Rule) error

	// UpdateSet updates the set with the given prefixes
	UpdateSet(hash Set, prefixes []netip.Prefix) error

	// AddInboundDNAT adds an inbound DNAT rule redirecting traffic from NetBird peers to local services
	AddInboundDNAT(localAddr netip.Addr, protocol Protocol, originalPort, translatedPort uint16) error

	// RemoveInboundDNAT removes inbound DNAT rule
	RemoveInboundDNAT(localAddr netip.Addr, protocol Protocol, originalPort, translatedPort uint16) error

	// AddOutputDNAT adds an OUTPUT chain DNAT rule for locally-generated traffic.
	AddOutputDNAT(localAddr netip.Addr, protocol Protocol, originalPort, translatedPort uint16) error

	// RemoveOutputDNAT removes an OUTPUT chain DNAT rule.
	RemoveOutputDNAT(localAddr netip.Addr, protocol Protocol, originalPort, translatedPort uint16) error

	// SetupEBPFProxyNoTrack creates static notrack rules for eBPF proxy loopback traffic.
	// This prevents conntrack from interfering with WireGuard proxy communication.
	SetupEBPFProxyNoTrack(proxyPort, wgPort uint16) error
}

type Network struct {
	Set    Set
	Prefix netip.Prefix
}

type Port struct {
	// IsRange is true Values contains two values, the first is the start port, the second is the end port
	IsRange bool

	// Values contains one value for single port, multiple values for the list of ports, or two values for the range of ports
	Values []uint16
}

type Protocol string

type RouterPair struct {
	ID          route.ID
	Source      Network
	Destination Network
	Masquerade  bool
	Inverse     bool
	// Dynamic indicates the route is domain-based. NAT rules for dynamic
	// routes are duplicated to the v6 table so that resolved AAAA records
	// are masqueraded correctly.
	Dynamic bool
}

type Rule interface {
	// ID returns the rule id
	ID() RuleID
}

type RuleDirection int

type RuleID string

type Set struct {
	// contains filtered or unexported fields
}