Documentation
¶
Overview ¶
Package netfilter helps the sentry interact with netstack's netfilter capabilities.
Index ¶
- Constants
- func DefaultLinuxTables(clock tcpip.Clock, rand *rand.Rand) *stack.IPTables
- func GetEntries4(t *kernel.Task, stack *stack.Stack, outPtr hostarch.Addr, outLen int) (linux.KernelIPTGetEntries, *syserr.Error)
- func GetEntries6(t *kernel.Task, stack *stack.Stack, outPtr hostarch.Addr, outLen int) (linux.KernelIP6TGetEntries, *syserr.Error)
- func GetInfo(t *kernel.Task, stack *stack.Stack, outPtr hostarch.Addr, ipv6 bool) (linux.IPTGetinfo, *syserr.Error)
- func MatchRevision(t *kernel.Task, revPtr hostarch.Addr) (linux.XTGetRevision, *syserr.Error)
- func SetEntries(mapper IDMapper, stk *stack.Stack, optVal []byte, ipv6 bool) *syserr.Error
- func TargetRevision(t *kernel.Task, revPtr hostarch.Addr, netProto tcpip.NetworkProtocolNumber) (linux.XTGetRevision, *syserr.Error)
- type IDMapper
- type JumpTarget
- type MarkMatcher
- type OwnerMatcher
- type OwnerMatcherV1
- type TCPMatcher
- type UDPMatcher
Constants ¶
const CTTargetName = "CT"
CTTargetName is the name of the CT target used in the raw table for conntrack zone assignment.
const DNATTargetName = "DNAT"
DNATTargetName is used to mark targets as DNAT targets. DNAT targets should be reached for only NAT table. These targets will change the source port and/or IP for packets.
const ErrorTargetName = "ERROR"
ErrorTargetName is used to mark targets as error targets. Error targets shouldn't be reached - an error has occurred if we fall through to one.
const MasqueradeTargetName = "MASQUERADE"
MasqueradeTargetName is used to mark targets as masquerade targets. Masquerade targets are only valid in the nat table's POSTROUTING chain. They change the source address to the outgoing interface's primary address.
const RedirectTargetName = "REDIRECT"
RedirectTargetName is used to mark targets as redirect targets. Redirect targets should be reached for only NAT and Mangle tables. These targets will change the destination port and/or IP for packets.
const RejectTargetName = "REJECT"
RejectTargetName is used to mark targets as reject targets.
const SNATTargetName = "SNAT"
SNATTargetName is used to mark targets as SNAT targets. SNAT targets should be reached for only NAT table. These targets will change the source port and/or IP for packets.
Variables ¶
This section is empty.
Functions ¶
func DefaultLinuxTables ¶
DefaultLinuxTables returns the rules of stack.DefaultTables() wrapped for compatibility with netfilter extensions.
func GetEntries4 ¶
func GetEntries4(t *kernel.Task, stack *stack.Stack, outPtr hostarch.Addr, outLen int) (linux.KernelIPTGetEntries, *syserr.Error)
GetEntries4 returns netstack's iptables rules.
func GetEntries6 ¶
func GetEntries6(t *kernel.Task, stack *stack.Stack, outPtr hostarch.Addr, outLen int) (linux.KernelIP6TGetEntries, *syserr.Error)
GetEntries6 returns netstack's ip6tables rules.
func GetInfo ¶
func GetInfo(t *kernel.Task, stack *stack.Stack, outPtr hostarch.Addr, ipv6 bool) (linux.IPTGetinfo, *syserr.Error)
GetInfo returns information about iptables.
func MatchRevision ¶
MatchRevision returns a "linux.XTGetRevision" for a given matcher. It sets "Revision" to the highest supported value, unless the provided revision number is higher.
func SetEntries ¶
SetEntries sets iptables rules for a single table. See net/ipv4/netfilter/ip_tables.c:translate_table for reference.
func TargetRevision ¶
func TargetRevision(t *kernel.Task, revPtr hostarch.Addr, netProto tcpip.NetworkProtocolNumber) (linux.XTGetRevision, *syserr.Error)
TargetRevision returns a linux.XTGetRevision for a given target. It sets Revision to the highest supported value, unless the provided revision number is larger.
Types ¶
type JumpTarget ¶
type JumpTarget struct {
// Offset is the byte offset of the rule to jump to. It is used for
// marshaling and unmarshaling.
Offset uint32
// RuleNum is the rule to jump to.
RuleNum int
// NetworkProtocol is the network protocol the target is used with.
NetworkProtocol tcpip.NetworkProtocolNumber
}
JumpTarget implements stack.Target.
+stateify savable
func (*JumpTarget) Action ¶
func (jt *JumpTarget) Action(*stack.PacketBuffer, stack.Hook, *stack.Route, stack.AddressableEndpoint) (stack.RuleVerdict, int)
Action implements stack.Target.Action.
type MarkMatcher ¶
type MarkMatcher struct {
// contains filtered or unexported fields
}
MarkMatcher matches against a packet mark.
func NewMarkMatcher ¶
func NewMarkMatcher(mark, mask uint32, invert bool) *MarkMatcher
NewMarkMatcher creates a new MarkMatcher.
func (*MarkMatcher) Match ¶
func (mm *MarkMatcher) Match(_ stack.Hook, pkt *stack.PacketBuffer, _, _ string) (bool, bool)
Match implements Matcher.Match.
type OwnerMatcher ¶
type OwnerMatcher struct {
// contains filtered or unexported fields
}
OwnerMatcher matches against a UID and/or GID.
func (*OwnerMatcher) Match ¶
func (om *OwnerMatcher) Match(hook stack.Hook, pkt *stack.PacketBuffer, _, _ string) (bool, bool)
Match implements Matcher.Match.
type OwnerMatcherV1 ¶
type OwnerMatcherV1 struct {
// contains filtered or unexported fields
}
OwnerMatcherV1 matches against a UID and/or GID.
func (*OwnerMatcherV1) Match ¶
func (om *OwnerMatcherV1) Match(hook stack.Hook, pkt *stack.PacketBuffer, _, _ string) (bool, bool)
Match implements Matcher.Match.
type TCPMatcher ¶
type TCPMatcher struct {
// contains filtered or unexported fields
}
TCPMatcher matches TCP packets and their headers. It implements Matcher.
func (*TCPMatcher) Match ¶
func (tm *TCPMatcher) Match(hook stack.Hook, pkt *stack.PacketBuffer, _, _ string) (bool, bool)
Match implements Matcher.Match.
type UDPMatcher ¶
type UDPMatcher struct {
// contains filtered or unexported fields
}
UDPMatcher matches UDP packets and their headers. It implements Matcher.
func (*UDPMatcher) Match ¶
func (um *UDPMatcher) Match(hook stack.Hook, pkt *stack.PacketBuffer, _, _ string) (bool, bool)
Match implements Matcher.Match.
Source Files