iptables

Documentation

Index

• Constants
• func IsIPv6Protocol(protocol Protocol) bool
• func Lock(lockFilePath string, timeout time.Duration) (func() error, error)
• func MakeChainLine(chain string) string
• type Client
  • func New(enableIPV4, enableIPV6 bool) (*Client, error)
  • func (c *Client) AppendRule(protocol Protocol, table string, chain string, ruleSpec []string) error
  • func (c *Client) ChainExists(protocol Protocol, table string, chain string) (bool, error)
  • func (c *Client) DeleteChain(protocol Protocol, table string, chain string) error
  • func (c *Client) DeleteRule(protocol Protocol, table string, chain string, ruleSpec []string) error
  • func (c *Client) EnsureChain(protocol Protocol, table string, chain string) error
  • func (c *Client) InsertRule(protocol Protocol, table string, chain string, ruleSpec []string) error
  • func (c *Client) ListRules(table string, chain string) ([]string, error)
  • func (c *Client) Restore(data string, flush bool, useIPv6 bool) error
  • func (c *Client) Save() ([]byte, error)
• type IPTablesRule
• type IPTablesRuleBuilder
  • func NewRuleBuilder(chain string) IPTablesRuleBuilder
• type Interface
• type Protocol
  • func (p Protocol) String() string

Constants

const (
	NATTable    = "nat"
	FilterTable = "filter"
	MangleTable = "mangle"
	RawTable    = "raw"

	AcceptTarget     = "ACCEPT"
	DropTarget       = "DROP"
	MasqueradeTarget = "MASQUERADE"
	MarkTarget       = "MARK"
	ReturnTarget     = "RETURN"
	ConnTrackTarget  = "CT"
	NoTrackTarget    = "NOTRACK"
	SNATTarget       = "SNAT"
	DNATTarget       = "DNAT"
	RejectTarget     = "REJECT"

	PreRoutingChain  = "PREROUTING"
	InputChain       = "INPUT"
	ForwardChain     = "FORWARD"
	PostRoutingChain = "POSTROUTING"
	OutputChain      = "OUTPUT"
)

const (
	ProtocolTCP    = "tcp"
	ProtocolUDP    = "udp"
	ProtocolSCTP   = "sctp"
	ProtocolICMP   = "icmp"
	ProtocolICMPv6 = "icmp6"
)

const (
	XtablesLockFilePath = "/var/run/xtables.lock"
)

Functions

func IsIPv6Protocol

func IsIPv6Protocol(protocol Protocol) bool

func Lock

func Lock(lockFilePath string, timeout time.Duration) (func() error, error)

Lock acquires the provided file lock. It's thread-safe. It will block until the lock is acquired or the timeout is reached.

func MakeChainLine

func MakeChainLine(chain string) string

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

func New

func New(enableIPV4, enableIPV6 bool) (*Client, error)

func (*Client) AppendRule

func (c *Client) AppendRule(protocol Protocol, table string, chain string, ruleSpec []string) error

AppendRule checks if target rule already exists with the protocol, appends it if not.

func (*Client) ChainExists

func (c *Client) ChainExists(protocol Protocol, table string, chain string) (bool, error)

ChainExists checks if target chain already exists in a table

func (*Client) DeleteChain

func (c *Client) DeleteChain(protocol Protocol, table string, chain string) error

DeleteChain deletes all rules from a chain in a table and then delete the chain.

func (*Client) DeleteRule

func (c *Client) DeleteRule(protocol Protocol, table string, chain string, ruleSpec []string) error

DeleteRule checks if target rule already exists, deletes the rule if found.

func (*Client) EnsureChain

func (c *Client) EnsureChain(protocol Protocol, table string, chain string) error

EnsureChain checks if target chain already exists, creates it if not.

func (*Client) InsertRule

func (c *Client) InsertRule(protocol Protocol, table string, chain string, ruleSpec []string) error

InsertRule checks if target rule already exists, inserts it at the beginning of the chain if not.

func (*Client) ListRules

func (c *Client) ListRules(table string, chain string) ([]string, error)

ListRules lists all rules from a chain in a table.

func (*Client) Restore

func (c *Client) Restore(data string, flush bool, useIPv6 bool) error

Restore calls iptable-restore to restore iptables with the provided content. If flush is true, all previous contents of the respective tables will be flushed. Otherwise only involved chains will be flushed. Restore supports "ip6tables-restore" for IPv6.

func (*Client) Save

func (c *Client) Save() ([]byte, error)

Save calls iptables-saves to dump chains and tables in iptables.

type IPTablesRule

type IPTablesRule interface {
	GetRule() string
}

type IPTablesRuleBuilder

type IPTablesRuleBuilder interface {
	MatchCIDRSrc(cidr string) IPTablesRuleBuilder
	MatchCIDRDst(cidr string) IPTablesRuleBuilder
	MatchIPSetSrc(ipset string) IPTablesRuleBuilder
	MatchIPSetDst(ipset string) IPTablesRuleBuilder
	MatchTransProtocol(protocol string) IPTablesRuleBuilder
	MatchDstPort(port *intstr.IntOrString, endPort *int32) IPTablesRuleBuilder
	MatchSrcPort(port, endPort *int32) IPTablesRuleBuilder
	MatchICMP(icmpType, icmpCode *int32, ipProtocol Protocol) IPTablesRuleBuilder
	MatchEstablishedOrRelated() IPTablesRuleBuilder
	MatchInputInterface(interfaceName string) IPTablesRuleBuilder
	MatchOutputInterface(interfaceName string) IPTablesRuleBuilder
	SetTarget(target string) IPTablesRuleBuilder
	SetComment(comment string) IPTablesRuleBuilder
	CopyBuilder() IPTablesRuleBuilder
	Done() IPTablesRule
}

func NewRuleBuilder

func NewRuleBuilder(chain string) IPTablesRuleBuilder

type Interface

type Interface interface {
	EnsureChain(protocol Protocol, table string, chain string) error

	ChainExists(protocol Protocol, table string, chain string) (bool, error)

	AppendRule(protocol Protocol, table string, chain string, ruleSpec []string) error

	InsertRule(protocol Protocol, table string, chain string, ruleSpec []string) error

	DeleteRule(protocol Protocol, table string, chain string, ruleSpec []string) error

	DeleteChain(protocol Protocol, table string, chain string) error

	ListRules(table string, chain string) ([]string, error)

	Restore(data string, flush bool, useIPv6 bool) error

	Save() ([]byte, error)
}

type Protocol

type Protocol byte

const (
	ProtocolDual Protocol = iota
	ProtocolIPv4
	ProtocolIPv6
)

func (Protocol) String

func (p Protocol) String() string