Documentation
¶
Overview ¶
Package firewall filters sandbox outgoing traffic.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Firewall ¶
type Firewall struct {
// contains filtered or unexported fields
}
func New ¶
New creates and starts the firewall. Installs nftables rules in the network namespace of the process pid, which send the first packet of each new connection to a queue. The queue logs and allows each connection attempt.
The caller should call the Firewall.Stop() function on program termination.
type Rule ¶
type Rule struct {
// contains filtered or unexported fields
}
Rule defines an action to take by the firewall and the traffic destination to which the action applies.
type RuleSet ¶
type RuleSet struct {
// contains filtered or unexported fields
}
RuleSet holds indexed firewall rules.
func NewRuleSet ¶
NewRuleSet creates a RuleSet as configured by the cfg. For now, only inline rules are handled.
func (*RuleSet) Add ¶
Add adds the rule to the set. Of equally specific rules matching the same traffic, the one added later is used.
func (*RuleSet) ConnectionAction ¶
ConnectionAction returns the action for a connection to addr and port with the proto ("tcp", "udp" or empty for other protocols, which match only rules without ports and protocol). domain is the lowercase name without the trailing dot that addr was resolved from, empty if not known.
func (*RuleSet) ResolverAction ¶
ResolverAction returns the action for a DNS query for the domain.
Source Files