netfilter

Documentation

Index

• Constants
• type Packet
  • func (p *Packet) IsIPv4() bool
  • func (p *Packet) SetRequeueVerdict(newQueueID uint16)
  • func (p *Packet) SetVerdict(v Verdict)
  • func (p *Packet) SetVerdictAndMark(v Verdict, mark uint32)
  • func (p *Packet) SetVerdictWithPacket(v Verdict, packet []byte)
• type Queue
  • func NewQueue(queueID uint16) (q *Queue, err error)
  • func (q *Queue) Close()
  • func (q *Queue) Packets() <-chan Packet
• type Verdict
• type VerdictContainer
• type VerdictContainerC

Constants

const (
	AF_INET  = 2
	AF_INET6 = 10

	NF_DROP   Verdict = 0
	NF_ACCEPT Verdict = 1
	NF_STOLEN Verdict = 2
	NF_QUEUE  Verdict = 3
	NF_REPEAT Verdict = 4
	NF_STOP   Verdict = 5

	NF_DEFAULT_QUEUE_SIZE  uint32 = 4096
	NF_DEFAULT_PACKET_SIZE uint32 = 4096
)

const (
	IPv4 = 4
)

packet consts

Types

type Packet

type Packet struct {
	Packet gopacket.Packet
	Mark   uint32

	UID             uint32
	NetworkProtocol uint8
	IfaceInIdx      int
	IfaceOutIdx     int
	// contains filtered or unexported fields
}

Packet holds the data of a network packet

func (*Packet) IsIPv4

func (p *Packet) IsIPv4() bool

IsIPv4 returns if the packet is IPv4

func (*Packet) SetRequeueVerdict

func (p *Packet) SetRequeueVerdict(newQueueID uint16)

SetRequeueVerdict apply a verdict on a requeued packet

func (*Packet) SetVerdict

func (p *Packet) SetVerdict(v Verdict)

SetVerdict emits a veredict on a packet

func (*Packet) SetVerdictAndMark

func (p *Packet) SetVerdictAndMark(v Verdict, mark uint32)

SetVerdictAndMark emits a veredict on a packet and marks it in order to not analyze it again.

func (*Packet) SetVerdictWithPacket

func (p *Packet) SetVerdictWithPacket(v Verdict, packet []byte)

SetVerdictWithPacket apply a verdict, but with a new packet

type Queue

type Queue struct {
	// contains filtered or unexported fields
}

Queue holds the information of a netfilter queue. The handles of the connection to the kernel and the created queue. A channel where the intercepted packets will be received. The ID of the queue.

func NewQueue

func NewQueue(queueID uint16) (q *Queue, err error)

NewQueue opens a new netfilter queue to receive packets marked with a mark.

func (*Queue) Close

func (q *Queue) Close()

Close ensures that nfqueue resources are freed and closed. C.stop_reading_packets() stops the reading packets loop, which causes go-subroutine run() to exit. After exit, listening queue is destroyed and closed. If for some reason any of the steps stucks while closing it, we'll exit by timeout.

func (*Queue) Packets

func (q *Queue) Packets() <-chan Packet

Packets return the list of enqueued packets.

type Verdict

type Verdict C.uint

Verdict holds the action to perform on a packet (NF_DROP, NF_ACCEPT, etc)

type VerdictContainer

type VerdictContainer struct {
	Verdict Verdict
	Mark    uint32
	Packet  []byte
}

VerdictContainer struct

type VerdictContainerC

type VerdictContainerC C.verdictContainer

VerdictContainerC is the struct that contains the mark, action, length and payload of a packet. It's defined in queue.h, and filled on go_callback()