filter

type CapMatch = filtertype.CapMatch

type CapTestFunc = func(srcIP netip.Addr, cap tailcfg.NodeCapability) bool

type Filter struct {

	// IngressAllowHooks are hooks that allow extensions to accept inbound
	// packets beyond the standard filter rules. Packets that are not dropped
	// by the direction-agnostic pre-check, but would be not accepted by the
	// main filter rules, including the check for destinations in the node's
	// local IP set, will be accepted if they match one of these hooks.
	// As of 2026-02-24, the ingress filter does not implement explicit drop
	// rules, but if it does, an explicitly dropped packet will be dropped,
	// and these hooks will not be evaluated.
	//
	// Processing of hooks stop after the first one that returns true.
	// The returned why string of the first match is used in logging.
	// Returning false does not drop the packet.
	// See also [filter.Filter.IngressAllowHooks].
	IngressAllowHooks []PacketMatch

	// LinkLocalAllowHooks are hooks that provide exceptions to the default
	// policy of dropping link-local unicast packets. They run inside the
	// direction-agnostic pre-checks for both ingress and egress.
	//
	// A hook can allow a link-local packet to pass the link-local check,
	// but the packet is still subject to all other filter rules, and could be
	// dropped elsewhere. Matching link-local packets are not logged.
	// See also [filter.Filter.LinkLocalAllowHooks].
	LinkLocalAllowHooks []PacketMatch
	// contains filtered or unexported fields
}

type Match = filtertype.Match

type NetPortRange = filtertype.NetPortRange

type PacketMatch func(packet.Parsed) (match bool, why string)

type PortRange = filtertype.PortRange

type Response int

type RunFlags int