filter

Documentation

Overview

Package filter provides network filtering utilities.

Index

• Constants
• func EmitSynthetic(logger *slog.Logger, component string, conn net.Conn, target string) string
• func EmitSyntheticUDP(logger *slog.Logger, component, sourceIP string, sourcePort int, dst string) string
• func FlowID(sourceIP string, sourcePort int, destinationIP string, destinationPort int, ...) string
• func IsSyntheticRecent(flowID string) bool
• func MarkSynthetic(flowID string)
• func Serve53(ctx context.Context, allowlist []string, opts Options) error
• func Serve80(ctx context.Context, allowlist []string, opts Options) error
• func Serve443(ctx context.Context, allowlist []string, opts Options) error
• type Options

Constants

const (

	// ActionRedirected is logged when traffic is redirected.
	ActionRedirected = "REDIRECTED"

	// ModeSNI is the SNI-based filtering mode.
	ModeSNI = "sni"
	// ModeDNS is the DNS-based filtering mode.
	ModeDNS = "dns"
)

Functions

func EmitSynthetic

func EmitSynthetic(logger *slog.Logger, component string, conn net.Conn, target string) string

EmitSynthetic emits a synthetic nflog event for a TCP redirect and marks the flow to suppress duplicates.

func EmitSyntheticUDP

func EmitSyntheticUDP(logger *slog.Logger, component, sourceIP string, sourcePort int, dst string) string

EmitSyntheticUDP emits a synthetic nflog event for a UDP redirect (DNS) and marks the flow to suppress duplicates.

func FlowID

func FlowID(sourceIP string, sourcePort int, destinationIP string, destinationPort int, proto string) string

FlowID generates a deterministic hash identifier for a network flow using source, destination, and protocol.

func IsSyntheticRecent

func IsSyntheticRecent(flowID string) bool

IsSyntheticRecent returns true if a synthetic log was emitted for this flow within the suppress window.

func MarkSynthetic

func MarkSynthetic(flowID string)

MarkSynthetic records that a synthetic log event was emitted for this flow to prevent duplicate nflog events.

func Serve53

func Serve53(ctx context.Context, allowlist []string, opts Options) error

Serve53 starts a DNS proxy server that filters requests based on an allowlist of domains.

func Serve80

func Serve80(ctx context.Context, allowlist []string, opts Options) error

Serve80 starts an HTTP Host-based egress filter.

func Serve443

func Serve443(ctx context.Context, allowlist []string, opts Options) error

Serve443 starts the TLS SNI filter.

Types

type Options

type Options struct {
	ListenAddr  string
	DialTimeout int // ms
	IdleTimeout int // ms
	DropWithRST bool
	Logger      *slog.Logger
}

Options contains configuration for network filtering.