docker_guard

Documentation

Index

• Constants
• Variables
• func CanonicalHost(value string) string
• func DecodeSources(value string) []string
• func NormalizePolicyUUIDs(values []string) ([]string, error)
• func PolicyStatesEqual(left, right []Policy) bool
• func PolicySyncKey(policy Policy) string
• func ReconcileTarget(backend string, policies []Policy, runtime Runtime) error
• func Verify(runtime Runtime, desired []Policy) error
• type FamilyError
  • func (e *FamilyError) Error() string
  • func (e *FamilyError) Unwrap() error
• type FamilyStatus
• type Manager
  • func NewManager() *Manager
  • func NewManagerWithRunner(runner Runner) *Manager
  • func (m *Manager) Bind() error
  • func (m *Manager) Cleanup() error
  • func (m *Manager) Initialize(policies []Policy) error
  • func (m *Manager) Initialized(family string) (bool, error)
  • func (m *Manager) ListPolicies() ([]Policy, error)
  • func (m *Manager) Reconcile(policies []Policy) error
  • func (m *Manager) Status(family string) FamilyStatus
  • func (m *Manager) Unbind() error
• type NftablesManager
  • func NewNftablesManager() *NftablesManager
  • func NewNftablesManagerWithRunner(runner Runner) *NftablesManager
  • func (m *NftablesManager) Bind() error
  • func (m *NftablesManager) Cleanup() error
  • func (m *NftablesManager) Initialize(policies []Policy) error
  • func (m *NftablesManager) Initialized(family string) (bool, error)
  • func (m *NftablesManager) ListPolicies() ([]Policy, error)
  • func (m *NftablesManager) Reconcile(policies []Policy) error
  • func (m *NftablesManager) Status(family string) FamilyStatus
  • func (m *NftablesManager) Unbind() error
• type Policy
  • func NormalizePolicy(policy Policy) (Policy, error)
• type Runner
• type Runtime
  • func NewRuntime(provider string) Runtime

Constants

const (
	Chain       = "1PANEL_DOCKER"
	DockerChain = "DOCKER-USER"
	FamilyIPv4  = constant.FirewallFamilyIPv4
	FamilyIPv6  = constant.FirewallFamilyIPv6
	ModeSources = "deny_sources"
	ModeAllow   = "allow_sources"
	ModeAll     = "deny_all"

	StatusEffective    = "effective"
	StatusDisabled     = "disabled"
	StatusNotEffective = "not_effective"

	ReasonCommandMissing     = "command_missing"
	ReasonDockerChainMissing = "docker_chain_missing"
	ReasonGuardChainMissing  = "guard_chain_missing"
	ReasonJumpMissing        = "jump_missing"
	ReasonJumpNotFirst       = "jump_not_first"
	ReasonJumpDuplicate      = "jump_duplicate"
	ReasonInspectFailed      = "inspect_failed"
)

const (
	NftTable     = "nft_1panel_docker"
	NftBaseChain = "NFT_1PANEL_DOCKER_FORWARD"
	NftChain     = "NFT_1PANEL_DOCKER"
)

Variables

var (
	ErrDockerChainUnavailable         = errors.New("Docker DOCKER-USER chain is unavailable")
	ErrDockerIptablesChainUnavailable = fmt.Errorf("%w for iptables", ErrDockerChainUnavailable)
	ErrDockerNftablesChainUnavailable = fmt.Errorf("%w for nftables", ErrDockerChainUnavailable)
)

var ErrInvalidPolicy = errors.New("invalid Docker port guard request")

Functions

func CanonicalHost

func CanonicalHost(value string) string

func DecodeSources

func DecodeSources(value string) []string

func NormalizePolicyUUIDs

func NormalizePolicyUUIDs(values []string) ([]string, error)

func PolicyStatesEqual

func PolicyStatesEqual(left, right []Policy) bool

func PolicySyncKey

func PolicySyncKey(policy Policy) string

func ReconcileTarget

func ReconcileTarget(backend string, policies []Policy, runtime Runtime) error

func Verify

func Verify(runtime Runtime, desired []Policy) error

Types

type FamilyError

type FamilyError struct {
	Family string
	Err    error
}

func (*FamilyError) Error

func (e *FamilyError) Error() string

func (*FamilyError) Unwrap

func (e *FamilyError) Unwrap() error

type FamilyStatus

type FamilyStatus struct {
	State       string
	Reason      string
	Initialized bool
	Bound       bool
	Effective   bool
}

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

func NewManager

func NewManager() *Manager

func NewManagerWithRunner

func NewManagerWithRunner(runner Runner) *Manager

func (*Manager) Bind

func (m *Manager) Bind() error

func (*Manager) Cleanup

func (m *Manager) Cleanup() error

func (*Manager) Initialize

func (m *Manager) Initialize(policies []Policy) error

func (*Manager) Initialized

func (m *Manager) Initialized(family string) (bool, error)

func (*Manager) ListPolicies

func (m *Manager) ListPolicies() ([]Policy, error)

func (*Manager) Reconcile

func (m *Manager) Reconcile(policies []Policy) error

func (*Manager) Status

func (m *Manager) Status(family string) FamilyStatus

func (*Manager) Unbind

func (m *Manager) Unbind() error

type NftablesManager

type NftablesManager struct {
	// contains filtered or unexported fields
}

func NewNftablesManager

func NewNftablesManager() *NftablesManager

func NewNftablesManagerWithRunner

func NewNftablesManagerWithRunner(runner Runner) *NftablesManager

func (*NftablesManager) Bind

func (m *NftablesManager) Bind() error

func (*NftablesManager) Cleanup

func (m *NftablesManager) Cleanup() error

func (*NftablesManager) Initialize

func (m *NftablesManager) Initialize(policies []Policy) error

func (*NftablesManager) Initialized

func (m *NftablesManager) Initialized(family string) (bool, error)

func (*NftablesManager) ListPolicies

func (m *NftablesManager) ListPolicies() ([]Policy, error)

func (*NftablesManager) Reconcile

func (m *NftablesManager) Reconcile(policies []Policy) error

func (*NftablesManager) Status

func (m *NftablesManager) Status(family string) FamilyStatus

func (*NftablesManager) Unbind

func (m *NftablesManager) Unbind() error

type Policy

type Policy struct {
	UUID     string
	Family   string
	HostIP   string
	HostPort uint16
	Protocol string
	Mode     string
	Sources  []string
}

func NormalizePolicy

func NormalizePolicy(policy Policy) (Policy, error)

type Runner

type Runner interface {
	Run(executable string, args ...string) (string, error)
	RunInput(executable, input string, args ...string) (string, error)
	Exists(executable string) bool
}

type Runtime

type Runtime interface {
	Initialize([]Policy) error
	Bind() error
	Reconcile([]Policy) error
	Unbind() error
	Cleanup() error
	Initialized(string) (bool, error)
	Status(string) FamilyStatus
	ListPolicies() ([]Policy, error)
}

func NewRuntime

func NewRuntime(provider string) Runtime