Documentation
¶
Overview ¶
Package firewall is the VM side of dynamic stateful packet filtering.
weft (control plane) publishes the per-VM effective ruleset — a flat [pod.Firewall] derived from every Security-Group the VM belongs to, with remote_group_uuid references already expanded into concrete CIDRs — on the per-VM event-bus subject. The agent reconciles its nftables table whole on every push : replace-set, idempotent, a missed message self-heals on the next publish.
Pattern matches pkg/mesh and pkg/mounts: one Subscriber, one ApplyFunc, JSON payload of a single [pod.Firewall]. The actual nftables reconciler lives next to the binary (firewall_linux.go), not here, so this package stays pure-Go and testable on darwin.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func HandleMessage ¶
HandleMessage decodes a published firewall update and applies it. Pure aside from the injected apply, so the decode/validate path is testable without nftables or a NATS server.
Types ¶
type ApplyFunc ¶
ApplyFunc reconciles the kernel firewall to the desired ruleset. The real implementation drives nftables via netlink (Linux); tests inject a stub.
type Subscriber ¶
type Subscriber struct {
// contains filtered or unexported fields
}
Subscriber listens for this VM's firewall updates and applies each one.
func NewSubscriber ¶
NewSubscriber builds a Subscriber for vmID that applies updates via apply.
func (*Subscriber) Start ¶
func (s *Subscriber) Start() (*nats.Subscription, error)
Start subscribes to the VM's firewall subject. The returned subscription is live until unsubscribed or the connection drops.
Source Files