filter

package

v0.1.1 Latest Latest Go to latest Published: Oct 21, 2026 License: AGPL-3.0 Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/sneakybugmaster/transporter

Links

Open Source Insights

Documentation ¶

Overview ¶

Package filter is the packet filter every agent applies to traffic that arrives from the mesh. The coordinator compiles the access-control policy into Rules for each node; the filter admits inbound packets a rule allows plus replies to connections the node opened itself.

Index ¶

Constants
Variables
func Allowed(rules []Rule, src, dst netip.Addr, proto uint8, port uint16) (bool, int)
type Dst
type Filter
- func New() *Filter
type PortRange
- func (r PortRange) Contains(port uint16) bool
type Rule
- func (r Rule) Match(src, dst netip.Addr, proto uint8, port uint16, anyPort bool) bool

Constants ¶

View Source

const (
	ProtoICMP uint8 = 1
	ProtoTCP  uint8 = 6
	ProtoUDP  uint8 = 17
)

IP protocol numbers used in rules.

Variables ¶

View Source

var AllPorts = PortRange{0, 65535}

AllPorts matches every port.

Functions ¶

func Allowed ¶

func Allowed(rules []Rule, src, dst netip.Addr, proto uint8, port uint16) (bool, int)

Allowed reports whether any rule admits the packet, returning its index or -1.

Types ¶

type Dst ¶

type Dst struct {
	Prefix netip.Prefix
	Ports  PortRange
}

Dst is a destination prefix and the ports allowed on it.

type Filter ¶

type Filter struct {

	// PingPort is a UDP port that is treated like ICMP echo: open to every
	// peer a rule lets reach this node on any port.
	PingPort uint16
	// contains filtered or unexported fields
}

Filter is a stateful packet filter. It is safe for concurrent use.

func New ¶

func New() *Filter

New returns a filter that drops every inbound packet until SetRules is called.

func (*Filter) Inbound ¶

func (f *Filter) Inbound(pkt []byte) bool

Inbound reports whether a packet that arrived from the mesh may be delivered.

func (*Filter) Outbound ¶

func (f *Filter) Outbound(pkt []byte)

Outbound records a packet this node sends into the mesh, so replies to it are admitted.

func (*Filter) Rules ¶

func (f *Filter) Rules() []Rule

Rules returns the current rules.

func (*Filter) SetRules ¶

func (f *Filter) SetRules(rules []Rule)

SetRules replaces the rules.

type PortRange ¶

type PortRange struct {
	First, Last uint16
}

PortRange is an inclusive range of ports; {0, 65535} is every port.

func (PortRange) Contains ¶

func (r PortRange) Contains(port uint16) bool

Contains reports whether port is in the range.

type Rule ¶

type Rule struct {
	Srcs   []netip.Prefix
	Dsts   []Dst
	Protos []uint8
}

Rule admits packets from any of Srcs to any of Dsts using one of Protos (any protocol when Protos is empty).

func (Rule) Match ¶

func (r Rule) Match(src, dst netip.Addr, proto uint8, port uint16, anyPort bool) bool

Match reports whether the rule admits a packet. Ports are ignored when anyPort is set (ICMP, and the agent's ping service).

Source Files ¶

View all Source files

filter.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL