firewalld

package module
v0.0.0-...-2b834e6 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 2, 2026 License: MIT Imports: 8 Imported by: 0

README

go-firewalld

Go Reference

A comprehensive Go client for the firewalld D-Bus API, built on github.com/godbus/dbus/v5.

  • Runtime + permanent operations, mirroring firewall-cmd (transient vs --permanent).
  • Version/capability aware: one binary serves both old (EL7, firewalld 0.6.x) and new (EL9+, firewalld 1.x/2.x) servers. The dict (a{sv}) settings path and zone-to-zone policies are used where supported and transparently fall back to the v1 tuple path where they are not.
  • Typed, errors.Is-able errors mapped from firewalld exceptions (ErrAlreadyEnabled, ErrNotEnabled, ErrInvalidZone, …).

Install

go get github.com/grmrgecko/go-firewalld

Usage

ctx := context.Background()
conn, err := firewalld.Connect(ctx)
if err != nil {
	log.Fatal(err)
}
defer conn.Close()

fmt.Println(conn.Version())                      // e.g. "1.3.4"
fmt.Println(conn.Supports(firewalld.Policies))   // false on EL7, true on EL9+

// Permanent edits (apply after a reload).
zone := conn.Permanent().Zone("public")
if err := zone.AddPort(ctx, firewalld.Port{Port: "4242", Protocol: "udp"}); err != nil {
	if errors.Is(err, firewalld.ErrAlreadyEnabled) {
		// idempotent no-op
	} else {
		log.Fatal(err)
	}
}
_ = zone.SetTarget(ctx, firewalld.TargetDROP)
_ = conn.Reload(ctx)

// Read settings (transport chosen automatically by server capability).
s, _ := conn.Permanent().Zone("public").Settings(ctx)
fmt.Println(s.Services, s.Ports, s.Forward)

// Runtime (transient) edits, with an optional timeout.
_ = conn.Runtime().Zone("public").AddRichRule(ctx,
	`rule family="ipv4" source address="10.0.0.0/8" reject`, 30*time.Second)

// Low-level escape hatch for anything not yet wrapped.
var out []string
_ = conn.Call(ctx, "/org/fedoraproject/FirewallD1",
	"org.fedoraproject.FirewallD1.zone", "getZones", []any{&out})

Coverage

Area Types / handles
Connection & lifecycle Connect, Open, Version, Supports, Reload, CompleteReload, RuntimeToPermanent, ResetToDefaults, CheckPermanentConfig, panic mode, log-denied, default zone
Zones (permanent) Permanent().Zone(name): settings, update, add/remove/query for port/source/source-port/service/protocol/forward-port/masquerade/icmp-block/icmp-block-inversion/interface/rich-rule, target/short/description/version, rename, remove, load-defaults
Zones (runtime) Runtime().Zone(name): same element set with timeouts; change-interface/change-source (move between zones); active zones, zone-of-interface/source; wholesale Runtime().SetSettings (dict servers)
Config management zone names/paths, add-zone, zone-of-interface/source
Daemon properties RuntimeInfo (state, IPv4/IPv6/IPSet/bridge support, ipset & icmp types), DaemonConfig (backend, rp-filter, cleanup, …) get/set
IPSets runtime + permanent: settings, entries, options, existence query
Services list, read (tuple/dict), permanent editor incl. includes
ICMP types list, read, permanent editor
Helpers (conntrack) list, read, permanent editor
Policies (≥ 0.9) runtime + permanent, capability-gated
Direct interface runtime chains/rules/passthroughs + permanent direct config blob
Lockdown enable/disable/query + whitelist (command/context/user/uid)
Signals WatchSignals, WatchReloaded

Deliberately omitted as redundant with Settings()/Update(): the per-field bulk setX list-setters and scalar getX getters on config objects. Legacy/no-op methods (authorizeAll, isImmutable, *AutomaticHelpers, the changeZone alias) are also skipped.

Testing

Unit tests need no bus and cover encode/decode round-trips plus dbus.SignatureOf assertions for every compound type:

go test ./...

Integration tests run against a live firewalld and are gated behind a build tag. They operate only on throwaway zones/ipsets/policies they create and remove, so a failure cannot disturb the default zone or an SSH session. Build a test binary and run it on the target host (no Go toolchain needed there):

CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
  go test -c -tags firewalld_integration -o firewalld.itest .
scp firewalld.itest root@host:/tmp/
ssh root@host '/tmp/firewalld.itest -test.v'

Verified against firewalld 0.6.3 (CentOS 7, iptables backend) and 1.3.4 (Rocky 9, nftables backend); signature tests additionally cover 2.4.3.

Documentation

Overview

Package firewalld is a comprehensive Go client for the firewalld D-Bus API.

It exposes both runtime (transient) and permanent configuration operations, mirroring firewall-cmd's default and --permanent modes, and adapts to the connected server's version so a single binary serves both old (EL7 0.6.x) and new (EL9 1.x) firewalld. Compound values are encoded as concrete Go structs so godbus emits the D-Bus tuples firewalld requires (see CLAUDE.md).

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrAlreadyEnabled   = errors.New("firewalld: already enabled")
	ErrNotEnabled       = errors.New("firewalld: not enabled")
	ErrInvalidZone      = errors.New("firewalld: invalid zone")
	ErrInvalidPort      = errors.New("firewalld: invalid port")
	ErrInvalidProtocol  = errors.New("firewalld: invalid protocol")
	ErrInvalidService   = errors.New("firewalld: invalid service")
	ErrInvalidICMPType  = errors.New("firewalld: invalid icmptype")
	ErrInvalidIPSet     = errors.New("firewalld: invalid ipset")
	ErrInvalidInterface = errors.New("firewalld: invalid interface")
	ErrInvalidSource    = errors.New("firewalld: invalid source")
	ErrInvalidPolicy    = errors.New("firewalld: invalid policy")
	ErrInvalidHelper    = errors.New("firewalld: invalid helper")
	ErrInvalidCommand   = errors.New("firewalld: invalid command")
	ErrNameConflict     = errors.New("firewalld: name conflict")
	ErrZoneConflict     = errors.New("firewalld: zone conflict")
	ErrBuiltinZone      = errors.New("firewalld: builtin zone")
	ErrAlreadySet       = errors.New("firewalld: already set")
	ErrMissingName      = errors.New("firewalld: missing name")
	ErrNotRunning       = errors.New("firewalld: not running")
	ErrNotApplicable    = errors.New("firewalld: not applicable")
	// ErrUnsupported is returned by this library (not firewalld) when a caller
	// asks for a feature the connected server's version does not provide.
	ErrUnsupported = errors.New("firewalld: operation not supported by this server version")
)

Sentinel errors mapped from firewalld exception messages. Callers match with errors.Is. ErrAlreadyEnabled/ErrNotEnabled are the idempotency signals: an add of something already present, or a remove of something absent.

Functions

This section is empty.

Types

type ActiveZone 

type ActiveZone struct {
	Name       string
	Interfaces []string
	Sources    []string
}

ActiveZone pairs a zone name with the interfaces and sources currently bound to it, as reported by getActiveZones.

type Capability 

type Capability int

Capability names a version-gated feature of the firewalld D-Bus surface. Callers test support with Conn.Supports; internal code version-gates transports (tuple vs dict) on these flags. 

const (
	// DictZoneSettings gates the a{sv} zone-settings path (getSettings2/update2 on
	// config.zone, getZoneSettings2/setZoneSettings2 on the runtime .zone). Added
	// in firewalld 0.9. Absent on EL7 0.6.3, which uses the v1 tuple only.
	DictZoneSettings Capability = iota
	// Policies gates zone-to-zone policy objects (config listPolicies/addPolicy,
	// runtime getPolicySettings/getActivePolicies). Added in 0.9. Absent on EL7.
	Policies
	// ServiceSettings2 gates getServiceSettings2/addService2 (a{sv} services).
	// Present on 1.3.4, absent on 0.6.3.
	ServiceSettings2
	// AddZone2 gates config.addZone2/addService2 (dict-based creation). Added 0.9.
	AddZone2
	// ResetToDefaults gates the main resetToDefaults method. Present on 1.x.
	ResetToDefaults
)

type Conn 

type Conn struct {
	// contains filtered or unexported fields
}

Conn is a connection to the firewalld service on the system bus. It caches the server version and derived capabilities so callers can branch on Supports and internal code can pick the tuple or dict transport. A Conn is safe for concurrent use to the extent godbus's connection is.

func Connect 

func Connect(ctx context.Context) (*Conn, error)

Connect dials the system bus, reads the firewalld version property, and derives the capability set. The context bounds the connection and initial version read.

func Open 

func Open(ctx context.Context, bus *dbus.Conn) (*Conn, error)

Open builds a Conn on a caller-supplied bus connection. The caller retains ownership: Close will not tear the bus down. Useful for sharing a bus or for tests against a private connection.

func (*Conn) Call 

func (c *Conn) Call(ctx context.Context, path dbus.ObjectPath, iface, method string, rets []any, args ...any) error

Call is the low-level escape hatch for any method not yet wrapped by a typed helper. It targets the given object path and interface, passes args verbatim, and stores results into rets (pointers). Errors are mapped to sentinels.

func (*Conn) CheckPermanentConfig 

func (c *Conn) CheckPermanentConfig(ctx context.Context) error

CheckPermanentConfig validates the on-disk permanent configuration, returning a firewalld error if it is inconsistent.

func (*Conn) Close 

func (c *Conn) Close() error

Close releases the connection. If the bus was dialed by Connect it is closed; a bus adopted via Open is left open for its owner.

func (*Conn) CompleteReload 

func (c *Conn) CompleteReload(ctx context.Context) error

CompleteReload reloads and also re-reads interface-to-zone bindings, dropping active runtime state. Heavier than Reload; use when the permanent set changed structurally.

func (*Conn) Config 

func (c *Conn) Config() *Permanent

Config is an alias for Permanent, matching the firewalld config object naming used by callers that think in terms of "the config interface".

func (*Conn) DefaultZone 

func (c *Conn) DefaultZone(ctx context.Context) (string, error)

DefaultZone returns the name of the default zone.

func (*Conn) Direct 

func (c *Conn) Direct() *Direct

Direct returns the direct-interface namespace.

func (*Conn) DisablePanicMode 

func (c *Conn) DisablePanicMode(ctx context.Context) error

DisablePanicMode restores normal packet processing.

func (*Conn) EnablePanicMode 

func (c *Conn) EnablePanicMode(ctx context.Context) error

EnablePanicMode drops all inbound and outbound packets.

func (*Conn) HelperSettings 

func (c *Conn) HelperSettings(ctx context.Context, helper string) (HelperSettings, error)

HelperSettings reads a conntrack helper definition from the running firewall.

func (*Conn) Helpers 

func (c *Conn) Helpers(ctx context.Context) ([]string, error)

Helpers lists the names of all conntrack helpers known to the runtime.

func (*Conn) ICMPTypeSettings 

func (c *Conn) ICMPTypeSettings(ctx context.Context, icmptype string) (ICMPTypeSettings, error)

ICMPTypeSettings reads an ICMP type definition from the running firewall.

func (*Conn) ICMPTypes 

func (c *Conn) ICMPTypes(ctx context.Context) ([]string, error)

ICMPTypes lists the names of all ICMP types known to the runtime.

func (*Conn) Lockdown 

func (c *Conn) Lockdown() *Lockdown

Lockdown returns the lockdown namespace.

func (*Conn) LogDenied 

func (c *Conn) LogDenied(ctx context.Context) (string, error)

LogDenied returns the current LogDenied setting ("off", "all", "unicast", ...).

func (*Conn) MainProperty 

func (c *Conn) MainProperty(ctx context.Context, name string) (dbus.Variant, error)

MainProperty reads a single read-only property from the main object (e.g. "IPv4", "IPSetTypes", "nf_conntrack_helpers") for values not covered by a typed accessor.

func (*Conn) Permanent 

func (c *Conn) Permanent() *Permanent

Permanent returns the permanent configuration namespace.

func (*Conn) QueryPanicMode 

func (c *Conn) QueryPanicMode(ctx context.Context) (bool, error)

QueryPanicMode reports whether panic mode is active.

func (*Conn) Reload 

func (c *Conn) Reload(ctx context.Context) error

Reload reloads firewalld's permanent configuration into the runtime, keeping active bindings where possible.

func (*Conn) ResetToDefaults 

func (c *Conn) ResetToDefaults(ctx context.Context) error

ResetToDefaults resets the permanent configuration to firewalld's defaults. Requires firewalld >= 1.0; returns ErrUnsupported on older servers.

func (*Conn) Runtime 

func (c *Conn) Runtime() *Runtime

Runtime returns the runtime operation namespace.

func (*Conn) RuntimeInfo 

func (c *Conn) RuntimeInfo(ctx context.Context) (RuntimeInfo, error)

RuntimeInfo reads the main object's runtime properties in one round-trip.

func (*Conn) RuntimeToPermanent 

func (c *Conn) RuntimeToPermanent(ctx context.Context) error

RuntimeToPermanent persists the current runtime configuration as permanent.

func (*Conn) ServiceSettings 

func (c *Conn) ServiceSettings(ctx context.Context, service string) (ServiceSettings, error)

ServiceSettings reads a service definition from the running firewall, choosing the dict transport (getServiceSettings2) when available so includes/helpers are populated, and falling back to the v1 tuple otherwise.

func (*Conn) Services 

func (c *Conn) Services(ctx context.Context) ([]string, error)

Services lists the names of all services known to the runtime.

func (*Conn) SetDefaultZone 

func (c *Conn) SetDefaultZone(ctx context.Context, zone string) error

SetDefaultZone sets the default zone by name.

func (*Conn) SetLogDenied 

func (c *Conn) SetLogDenied(ctx context.Context, value string) error

SetLogDenied sets the LogDenied value.

func (*Conn) State 

func (c *Conn) State(ctx context.Context) (string, error)

State returns firewalld's runtime state, e.g. "RUNNING".

func (*Conn) Supports 

func (c *Conn) Supports(cap Capability) bool

Supports reports whether the connected server provides a capability.

func (*Conn) Version 

func (c *Conn) Version() Version

Version returns the firewalld version reported by the server.

func (*Conn) WatchReloaded 

func (c *Conn) WatchReloaded(ctx context.Context) (<-chan struct{}, error)

WatchReloaded returns a channel that receives an empty struct each time firewalld emits its Reloaded signal, a convenience for callers that only need to re-read state after a reload.

func (*Conn) WatchSignals 

func (c *Conn) WatchSignals(ctx context.Context) (<-chan Signal, error)

WatchSignals subscribes to firewalld's signals and returns a channel of typed events. The subscription and channel are torn down when ctx is cancelled. The channel is buffered; a slow consumer that lets it fill will drop no earlier events but may block delivery of later ones until drained.

type DaemonConfig 

type DaemonConfig struct {
	DefaultZone          string
	MinimalMark          int32
	CleanupOnExit        string
	CleanupModulesOnExit string
	Lockdown             string
	IPv6RPFilter         string
	IPv6RPFilter2        string // finer-grained rp_filter (newer firewalld)
	IndividualCalls      string
	LogDenied            string
	AutomaticHelpers     string
	FirewallBackend      string
	FlushAllOnReload     string
	RFC3964IPv4          string
	AllowZoneDrifting    string
	NftablesTableOwner   string
	NftablesCounters     string // nftables rule counters (firewalld >= 2.0)
	NftablesFlowtable    string // nftables flowtable offload (firewalld >= 2.0)
	StrictForwardPorts   string // strict forward-port handling (firewalld >= 2.0)
}

DaemonConfig holds firewalld's permanent daemon settings (the firewalld.conf knobs). Fields absent on the connected version read as empty. Most values are firewalld's "yes"/"no" strings or an enum ("iptables"/"nftables"); they are exposed verbatim rather than coerced, since firewalld's own semantics vary.

type Direct 

type Direct struct {
	// contains filtered or unexported fields
}

Direct is the entry point for firewalld's direct interface, which passes rules straight to the underlying iptables/nftables backend. It is a low-level escape hatch: firewalld does not manage or reconcile direct rules the way it does zones. All operations here are runtime (the direct interface has no per-element permanent methods; the permanent form is a single config.direct blob).

func (*Direct) AddChain 

func (d *Direct) AddChain(ctx context.Context, ch DirectChain) error

AddChain adds a custom chain (ipv, table, chain).

func (*Direct) AddPassthrough 

func (d *Direct) AddPassthrough(ctx context.Context, ipv string, args []string) error

AddPassthrough persists a passthrough rule for an IP family.

func (*Direct) AddRule 

func (d *Direct) AddRule(ctx context.Context, r DirectRule) error

AddRule adds a direct rule at the given priority.

func (*Direct) AllChains 

func (d *Direct) AllChains(ctx context.Context) ([]DirectChain, error)

AllChains lists every custom chain across all families and tables.

func (*Direct) AllPassthroughs 

func (d *Direct) AllPassthroughs(ctx context.Context) ([]DirectPassthrough, error)

AllPassthroughs lists every passthrough rule across all IP families.

func (*Direct) AllRules 

func (d *Direct) AllRules(ctx context.Context) ([]DirectRule, error)

AllRules lists every direct rule across all families, tables, and chains.

func (*Direct) Chains 

func (d *Direct) Chains(ctx context.Context, ipv, table string) ([]string, error)

Chains lists the custom chains in a table for an IP family.

func (*Direct) Passthrough 

func (d *Direct) Passthrough(ctx context.Context, ipv string, args []string) (string, error)

Passthrough sends a raw command straight to the backend for an IP family and returns the backend's output.

func (*Direct) Passthroughs 

func (d *Direct) Passthroughs(ctx context.Context, ipv string) ([][]string, error)

Passthroughs lists the passthrough rules for an IP family, each as an argv.

func (*Direct) QueryChain 

func (d *Direct) QueryChain(ctx context.Context, ch DirectChain) (bool, error)

QueryChain reports whether a custom chain exists.

func (*Direct) QueryPassthrough 

func (d *Direct) QueryPassthrough(ctx context.Context, ipv string, args []string) (bool, error)

QueryPassthrough reports whether a passthrough rule is present.

func (*Direct) QueryRule 

func (d *Direct) QueryRule(ctx context.Context, r DirectRule) (bool, error)

QueryRule reports whether a direct rule is present.

func (*Direct) RemoveAllPassthroughs 

func (d *Direct) RemoveAllPassthroughs(ctx context.Context) error

RemoveAllPassthroughs clears all passthrough rules.

func (*Direct) RemoveChain 

func (d *Direct) RemoveChain(ctx context.Context, ch DirectChain) error

RemoveChain removes a custom chain.

func (*Direct) RemovePassthrough 

func (d *Direct) RemovePassthrough(ctx context.Context, ipv string, args []string) error

RemovePassthrough removes a passthrough rule.

func (*Direct) RemoveRule 

func (d *Direct) RemoveRule(ctx context.Context, r DirectRule) error

RemoveRule removes a direct rule matching the given fields exactly.

func (*Direct) RemoveRules 

func (d *Direct) RemoveRules(ctx context.Context, ipv, table, chain string) error

RemoveRules removes all direct rules in a chain.

func (*Direct) Rules 

func (d *Direct) Rules(ctx context.Context, ipv, table, chain string) ([]DirectRule, error)

Rules lists the rules in a chain as (priority, args) pairs. The IPV/Table/Chain on each returned rule are filled in from the query arguments.

type DirectChain 

type DirectChain struct {
	IPV   string // "ipv4", "ipv6", or "eb" (ebtables)
	Table string // e.g. "filter", "nat"
	Chain string
}

DirectChain is a custom chain added through the direct interface.

type DirectConfig 

type DirectConfig struct {
	Chains       []DirectChain
	Rules        []DirectRule
	Passthroughs []DirectPassthrough
}

DirectConfig is the complete permanent direct configuration: all custom chains, rules, and passthroughs. It maps to the config.direct tuple "(a(sss)a(sssias)a(sas))".

type DirectPassthrough 

type DirectPassthrough struct {
	IPV  string
	Args []string
}

DirectPassthrough is a passthrough rule tagged with its IP family, as returned by AllPassthroughs.

type DirectRule 

type DirectRule struct {
	IPV      string
	Table    string
	Chain    string
	Priority int32
	Args     []string
}

DirectRule is a rule added through the direct interface, including the chain it belongs to, its priority, and the raw backend arguments.

type Error 

type Error struct {
	Code    string // firewalld token, e.g. "INVALID_ZONE"; empty if none parsed
	Message string // full exception message from firewalld
	// contains filtered or unexported fields
}

Error wraps a firewalld D-Bus exception, preserving the raw code and message while chaining to a sentinel (via Unwrap) so errors.Is works. Errors that are not firewalld exceptions are returned unchanged by mapError.

func (*Error) Error 

func (e *Error) Error() string

Error renders the underlying firewalld message.

func (*Error) Unwrap 

func (e *Error) Unwrap() error

Unwrap exposes the mapped sentinel so errors.Is matches (e.g. ErrInvalidZone).

type Family 

type Family string

Family selects the IP family for ipsets, rich rules, and helpers. 

const (
	FamilyIPv4 Family = "inet"
	FamilyIPv6 Family = "inet6"
)

type ForwardPort 

type ForwardPort struct {
	Port     string // incoming port or range
	Protocol string // "tcp" | "udp"
	ToPort   string // destination port; empty keeps the same port
	ToAddr   string // destination address; empty forwards locally
}

ForwardPort describes a port-forward rule. Encodes to the tuple "(ssss)" in the field order firewalld expects: port, protocol, toport, toaddr.

type HelperSettings 

type HelperSettings struct {
	Version     string
	Short       string
	Description string
	Family      string // "", "ipv4", or "ipv6"
	Module      string // e.g. "nf_conntrack_ftp"
	Ports       []Port
}

HelperSettings is the transport-neutral representation of a conntrack helper. It maps to the tuple "(sssssa(ss))": version, short, description, family, module, ports.

type ICMPTypeSettings 

type ICMPTypeSettings struct {
	Version      string
	Short        string
	Description  string
	Destinations []string
}

ICMPTypeSettings is the transport-neutral representation of an ICMP type. It maps to the tuple "(sssas)": version, short, description, destinations. The destinations list holds the IP families the type applies to ("ipv4", "ipv6").

type IPSetSettings 

type IPSetSettings struct {
	Version     string
	Name        string
	Description string
	Type        string            // e.g. "hash:ip", "hash:net"
	Options     map[string]string // e.g. {"family": "inet"}
	Entries     []string
}

IPSetSettings is the transport-neutral representation of an ipset. It maps to the D-Bus tuple "(ssssa{ss}as)": version, name, description, type, options, entries. ipsets have no dict form; the tuple is used on every server.

type Lockdown 

type Lockdown struct {
	// contains filtered or unexported fields
}

Lockdown controls firewalld's lockdown feature and its whitelist. Lockdown, when enabled, restricts which applications may change the firewall; the whitelist names the commands, contexts, users, and uids that remain allowed. These live on the main object's .policies interface (distinct from zone-to-zone policies).

func (*Lockdown) AddCommand 

func (l *Lockdown) AddCommand(ctx context.Context, command string) error

Whitelist command operations. A command entry may end in "*" to match a prefix.

func (*Lockdown) AddContext 

func (l *Lockdown) AddContext(ctx context.Context, selinuxContext string) error

Whitelist context (SELinux) operations.

func (*Lockdown) AddUID 

func (l *Lockdown) AddUID(ctx context.Context, uid int32) error

Whitelist uid operations (by numeric uid).

func (*Lockdown) AddUser 

func (l *Lockdown) AddUser(ctx context.Context, user string) error

Whitelist user operations (by user name).

func (*Lockdown) Commands 

func (l *Lockdown) Commands(ctx context.Context) ([]string, error)

func (*Lockdown) Contexts 

func (l *Lockdown) Contexts(ctx context.Context) ([]string, error)

func (*Lockdown) Disable 

func (l *Lockdown) Disable(ctx context.Context) error

Disable turns lockdown off.

func (*Lockdown) Enable 

func (l *Lockdown) Enable(ctx context.Context) error

Enable turns lockdown on.

func (*Lockdown) Query 

func (l *Lockdown) Query(ctx context.Context) (bool, error)

Query reports whether lockdown is currently enabled.

func (*Lockdown) QueryCommand 

func (l *Lockdown) QueryCommand(ctx context.Context, command string) (bool, error)

func (*Lockdown) QueryContext 

func (l *Lockdown) QueryContext(ctx context.Context, selinuxContext string) (bool, error)

func (*Lockdown) QueryUID 

func (l *Lockdown) QueryUID(ctx context.Context, uid int32) (bool, error)

func (*Lockdown) QueryUser 

func (l *Lockdown) QueryUser(ctx context.Context, user string) (bool, error)

func (*Lockdown) RemoveCommand 

func (l *Lockdown) RemoveCommand(ctx context.Context, command string) error

func (*Lockdown) RemoveContext 

func (l *Lockdown) RemoveContext(ctx context.Context, selinuxContext string) error

func (*Lockdown) RemoveUID 

func (l *Lockdown) RemoveUID(ctx context.Context, uid int32) error

func (*Lockdown) RemoveUser 

func (l *Lockdown) RemoveUser(ctx context.Context, user string) error

func (*Lockdown) UIDs 

func (l *Lockdown) UIDs(ctx context.Context) ([]int32, error)

func (*Lockdown) Users 

func (l *Lockdown) Users(ctx context.Context) ([]string, error)

type PermDirect 

type PermDirect struct {
	// contains filtered or unexported fields
}

PermDirect reads and writes firewalld's permanent direct configuration as a single blob (the config.direct object), the permanent counterpart to the runtime Direct interface.

func (*PermDirect) Settings 

func (p *PermDirect) Settings(ctx context.Context) (DirectConfig, error)

Settings reads the whole permanent direct configuration.

func (*PermDirect) Update 

func (p *PermDirect) Update(ctx context.Context, cfg DirectConfig) error

Update replaces the whole permanent direct configuration.

type PermHelper 

type PermHelper struct {
	// contains filtered or unexported fields
}

PermHelper is a handle for permanent edits to a single conntrack helper, operating on the helper's config child object (/config/helper/N).

func (*PermHelper) AddPort 

func (s *PermHelper) AddPort(ctx context.Context, p Port) error

AddPort adds a port to the permanent helper.

func (*PermHelper) Remove 

func (s *PermHelper) Remove(ctx context.Context) error

Remove deletes the helper from the permanent configuration.

func (*PermHelper) RemovePort 

func (s *PermHelper) RemovePort(ctx context.Context, p Port) error

RemovePort removes a port from the permanent helper.

func (*PermHelper) SetDescription 

func (s *PermHelper) SetDescription(ctx context.Context, description string) error

SetDescription sets the permanent helper description.

func (*PermHelper) SetFamily 

func (s *PermHelper) SetFamily(ctx context.Context, family string) error

SetFamily sets the helper's IP family ("", "ipv4", "ipv6").

func (*PermHelper) SetModule 

func (s *PermHelper) SetModule(ctx context.Context, module string) error

SetModule sets the helper's netfilter module name.

func (*PermHelper) Settings 

func (s *PermHelper) Settings(ctx context.Context) (HelperSettings, error)

Settings reads the helper's permanent settings.

func (*PermHelper) Update 

func (s *PermHelper) Update(ctx context.Context, settings HelperSettings) error

Update replaces the helper's permanent settings.

type PermICMPType 

type PermICMPType struct {
	// contains filtered or unexported fields
}

PermICMPType is a handle for permanent edits to a single ICMP type, operating on the icmptype's config child object (/config/icmptype/N).

func (*PermICMPType) AddDestination 

func (s *PermICMPType) AddDestination(ctx context.Context, family string) error

AddDestination adds an IP family ("ipv4"/"ipv6") the type applies to.

func (*PermICMPType) QueryDestination 

func (s *PermICMPType) QueryDestination(ctx context.Context, family string) (bool, error)

QueryDestination reports whether the type applies to an IP family.

func (*PermICMPType) Remove 

func (s *PermICMPType) Remove(ctx context.Context) error

Remove deletes the ICMP type from the permanent configuration.

func (*PermICMPType) RemoveDestination 

func (s *PermICMPType) RemoveDestination(ctx context.Context, family string) error

RemoveDestination removes an IP family from the type.

func (*PermICMPType) SetDescription 

func (s *PermICMPType) SetDescription(ctx context.Context, description string) error

SetDescription sets the permanent ICMP type description.

func (*PermICMPType) Settings 

func (s *PermICMPType) Settings(ctx context.Context) (ICMPTypeSettings, error)

Settings reads the ICMP type's permanent settings.

func (*PermICMPType) Update 

func (s *PermICMPType) Update(ctx context.Context, settings ICMPTypeSettings) error

Update replaces the ICMP type's permanent settings.

type PermIPSet 

type PermIPSet struct {
	// contains filtered or unexported fields
}

PermIPSet is a handle for permanent edits to a single ipset, operating on the ipset's config child object (/config/ipset/N).

func (*PermIPSet) AddEntry 

func (s *PermIPSet) AddEntry(ctx context.Context, entry string) error

AddEntry adds an entry to the permanent ipset.

func (*PermIPSet) AddOption 

func (s *PermIPSet) AddOption(ctx context.Context, key, value string) error

AddOption sets an option (key/value) on the permanent ipset.

func (*PermIPSet) Entries 

func (s *PermIPSet) Entries(ctx context.Context) ([]string, error)

Entries returns all entries of the permanent ipset.

func (*PermIPSet) QueryEntry 

func (s *PermIPSet) QueryEntry(ctx context.Context, entry string) (bool, error)

QueryEntry reports whether an entry is present in the permanent ipset.

func (*PermIPSet) Remove 

func (s *PermIPSet) Remove(ctx context.Context) error

Remove deletes the ipset from the permanent configuration.

func (*PermIPSet) RemoveEntry 

func (s *PermIPSet) RemoveEntry(ctx context.Context, entry string) error

RemoveEntry removes an entry from the permanent ipset.

func (*PermIPSet) RemoveOption 

func (s *PermIPSet) RemoveOption(ctx context.Context, key string) error

RemoveOption removes an option from the permanent ipset.

func (*PermIPSet) SetDescription 

func (s *PermIPSet) SetDescription(ctx context.Context, description string) error

SetDescription sets the permanent ipset description.

func (*PermIPSet) SetEntries 

func (s *PermIPSet) SetEntries(ctx context.Context, entries []string) error

SetEntries replaces all entries of the permanent ipset.

func (*PermIPSet) Settings 

func (s *PermIPSet) Settings(ctx context.Context) (IPSetSettings, error)

Settings reads the ipset's permanent settings.

func (*PermIPSet) Update 

func (s *PermIPSet) Update(ctx context.Context, settings IPSetSettings) error

Update replaces the ipset's permanent settings wholesale.

type PermPolicy 

type PermPolicy struct {
	// contains filtered or unexported fields
}

PermPolicy is a handle for permanent edits to a single policy, operating on the policy's config child object (/config/policy/N).

func (*PermPolicy) Remove 

func (s *PermPolicy) Remove(ctx context.Context) error

Remove deletes the policy from the permanent configuration.

func (*PermPolicy) Rename 

func (s *PermPolicy) Rename(ctx context.Context, newName string) error

Rename changes the policy's name and invalidates the cached path.

func (*PermPolicy) Settings 

func (s *PermPolicy) Settings(ctx context.Context) (PolicySettings, error)

Settings reads the policy's permanent settings.

func (*PermPolicy) Update 

func (s *PermPolicy) Update(ctx context.Context, settings PolicySettings) error

Update replaces the policy's permanent settings wholesale.

type PermService 

type PermService struct {
	// contains filtered or unexported fields
}

PermService is a handle for permanent edits to a single service definition, operating on the service's config child object (/config/service/N).

func (*PermService) AddInclude 

func (s *PermService) AddInclude(ctx context.Context, service string) error

Include operations compose other services into this one (firewalld >= 1.0).

func (*PermService) AddModule 

func (s *PermService) AddModule(ctx context.Context, module string) error

Module (netfilter helper) operations.

func (*PermService) AddPort 

func (s *PermService) AddPort(ctx context.Context, p Port) error

Port operations.

func (*PermService) AddProtocol 

func (s *PermService) AddProtocol(ctx context.Context, proto string) error

Protocol operations.

func (*PermService) Includes 

func (s *PermService) Includes(ctx context.Context) ([]string, error)

func (*PermService) QueryInclude 

func (s *PermService) QueryInclude(ctx context.Context, service string) (bool, error)

func (*PermService) Remove 

func (s *PermService) Remove(ctx context.Context) error

Remove deletes the service from the permanent configuration.

func (*PermService) RemoveDestination 

func (s *PermService) RemoveDestination(ctx context.Context, family string) error

RemoveDestination clears the destination for an IP family.

func (*PermService) RemoveInclude 

func (s *PermService) RemoveInclude(ctx context.Context, service string) error

func (*PermService) RemoveModule 

func (s *PermService) RemoveModule(ctx context.Context, module string) error

func (*PermService) RemovePort 

func (s *PermService) RemovePort(ctx context.Context, p Port) error

func (*PermService) RemoveProtocol 

func (s *PermService) RemoveProtocol(ctx context.Context, proto string) error

func (*PermService) SetDescription 

func (s *PermService) SetDescription(ctx context.Context, description string) error

SetDescription sets the permanent service description.

func (*PermService) SetDestination 

func (s *PermService) SetDestination(ctx context.Context, family, address string) error

SetDestination sets the destination address for an IP family ("ipv4"/"ipv6").

func (*PermService) Settings 

func (s *PermService) Settings(ctx context.Context) (ServiceSettings, error)

Settings reads the service's permanent settings via the v1 tuple.

func (*PermService) Update 

func (s *PermService) Update(ctx context.Context, settings ServiceSettings) error

Update replaces the service's permanent settings via the v1 tuple.

type PermZone 

type PermZone struct {
	// contains filtered or unexported fields
}

PermZone is a handle for permanent edits to a single zone, operating on the zone's config child object (/config/zone/N). The object path is resolved once from the zone name and cached. Permanent element methods take no timeout and return nothing; changes apply after a Reload.

func (*PermZone) AddForwardPort 

func (z *PermZone) AddForwardPort(ctx context.Context, fp ForwardPort) error

ForwardPort operations.

func (*PermZone) AddIcmpBlock 

func (z *PermZone) AddIcmpBlock(ctx context.Context, icmptype string) error

IcmpBlock operations.

func (*PermZone) AddIcmpBlockInversion 

func (z *PermZone) AddIcmpBlockInversion(ctx context.Context) error

IcmpBlockInversion operations.

func (*PermZone) AddInterface 

func (z *PermZone) AddInterface(ctx context.Context, iface string) error

Interface operations.

func (*PermZone) AddMasquerade 

func (z *PermZone) AddMasquerade(ctx context.Context) error

Masquerade operations.

func (*PermZone) AddPort 

func (z *PermZone) AddPort(ctx context.Context, p Port) error

Port operations.

func (*PermZone) AddProtocol 

func (z *PermZone) AddProtocol(ctx context.Context, proto string) error

Protocol operations.

func (*PermZone) AddRichRule 

func (z *PermZone) AddRichRule(ctx context.Context, rule string) error

RichRule operations.

func (*PermZone) AddService 

func (z *PermZone) AddService(ctx context.Context, service string) error

Service operations.

func (*PermZone) AddSource 

func (z *PermZone) AddSource(ctx context.Context, source string) error

Source operations.

func (*PermZone) AddSourcePort 

func (z *PermZone) AddSourcePort(ctx context.Context, p Port) error

SourcePort operations.

func (*PermZone) Interfaces 

func (z *PermZone) Interfaces(ctx context.Context) ([]string, error)

func (*PermZone) LoadDefaults 

func (z *PermZone) LoadDefaults(ctx context.Context) error

LoadDefaults resets the zone to its built-in defaults.

func (*PermZone) Name 

func (z *PermZone) Name() string

Name returns the zone name this handle targets.

func (*PermZone) Protocols 

func (z *PermZone) Protocols(ctx context.Context) ([]string, error)

func (*PermZone) QueryForwardPort 

func (z *PermZone) QueryForwardPort(ctx context.Context, fp ForwardPort) (bool, error)

func (*PermZone) QueryIcmpBlock 

func (z *PermZone) QueryIcmpBlock(ctx context.Context, icmptype string) (bool, error)

func (*PermZone) QueryIcmpBlockInversion 

func (z *PermZone) QueryIcmpBlockInversion(ctx context.Context) (bool, error)

func (*PermZone) QueryInterface 

func (z *PermZone) QueryInterface(ctx context.Context, iface string) (bool, error)

func (*PermZone) QueryMasquerade 

func (z *PermZone) QueryMasquerade(ctx context.Context) (bool, error)

func (*PermZone) QueryPort 

func (z *PermZone) QueryPort(ctx context.Context, p Port) (bool, error)

func (*PermZone) QueryProtocol 

func (z *PermZone) QueryProtocol(ctx context.Context, proto string) (bool, error)

func (*PermZone) QueryRichRule 

func (z *PermZone) QueryRichRule(ctx context.Context, rule string) (bool, error)

func (*PermZone) QueryService 

func (z *PermZone) QueryService(ctx context.Context, service string) (bool, error)

func (*PermZone) QuerySource 

func (z *PermZone) QuerySource(ctx context.Context, source string) (bool, error)

func (*PermZone) QuerySourcePort 

func (z *PermZone) QuerySourcePort(ctx context.Context, p Port) (bool, error)

func (*PermZone) Remove 

func (z *PermZone) Remove(ctx context.Context) error

Remove deletes the zone from the permanent configuration.

func (*PermZone) RemoveForwardPort 

func (z *PermZone) RemoveForwardPort(ctx context.Context, fp ForwardPort) error

func (*PermZone) RemoveIcmpBlock 

func (z *PermZone) RemoveIcmpBlock(ctx context.Context, icmptype string) error

func (*PermZone) RemoveIcmpBlockInversion 

func (z *PermZone) RemoveIcmpBlockInversion(ctx context.Context) error

func (*PermZone) RemoveInterface 

func (z *PermZone) RemoveInterface(ctx context.Context, iface string) error

func (*PermZone) RemoveMasquerade 

func (z *PermZone) RemoveMasquerade(ctx context.Context) error

func (*PermZone) RemovePort 

func (z *PermZone) RemovePort(ctx context.Context, p Port) error

func (*PermZone) RemoveProtocol 

func (z *PermZone) RemoveProtocol(ctx context.Context, proto string) error

func (*PermZone) RemoveRichRule 

func (z *PermZone) RemoveRichRule(ctx context.Context, rule string) error

func (*PermZone) RemoveService 

func (z *PermZone) RemoveService(ctx context.Context, service string) error

func (*PermZone) RemoveSource 

func (z *PermZone) RemoveSource(ctx context.Context, source string) error

func (*PermZone) RemoveSourcePort 

func (z *PermZone) RemoveSourcePort(ctx context.Context, p Port) error

func (*PermZone) Rename 

func (z *PermZone) Rename(ctx context.Context, newName string) error

Rename changes the zone's name. The cached path is invalidated so subsequent calls re-resolve under the new name.

func (*PermZone) RichRules 

func (z *PermZone) RichRules(ctx context.Context) ([]string, error)

func (*PermZone) Services 

func (z *PermZone) Services(ctx context.Context) ([]string, error)

Getters for the current permanent element lists.

func (*PermZone) SetDescription 

func (z *PermZone) SetDescription(ctx context.Context, description string) error

func (*PermZone) SetShort 

func (z *PermZone) SetShort(ctx context.Context, short string) error

func (*PermZone) SetTarget 

func (z *PermZone) SetTarget(ctx context.Context, target Target) error

Scalar setters for zone metadata and default policy.

func (*PermZone) SetVersion 

func (z *PermZone) SetVersion(ctx context.Context, version string) error

func (*PermZone) Settings 

func (z *PermZone) Settings(ctx context.Context) (ZoneSettings, error)

Settings reads the zone's permanent settings, choosing the dict transport (getSettings2) when supported and falling back to the v1 tuple (getSettings).

func (*PermZone) Sources 

func (z *PermZone) Sources(ctx context.Context) ([]string, error)

func (*PermZone) Target 

func (z *PermZone) Target(ctx context.Context) (Target, error)

func (*PermZone) Update 

func (z *PermZone) Update(ctx context.Context, settings ZoneSettings) error

Update replaces the zone's permanent settings wholesale, using update2 (dict) when supported and update (v1 tuple) otherwise.

type Permanent 

type Permanent struct {
	// contains filtered or unexported fields
}

Permanent is the entry point for operations on firewalld's on-disk permanent configuration, mirroring firewall-cmd --permanent. Changes take effect after a Reload. It also exposes the config-object management methods (listing and creating zones, ipsets, services, and so on).

func (*Permanent) AddHelper 

func (p *Permanent) AddHelper(ctx context.Context, name string, settings HelperSettings) (dbus.ObjectPath, error)

AddHelper creates a new permanent conntrack helper and returns its config path.

func (*Permanent) AddICMPType 

func (p *Permanent) AddICMPType(ctx context.Context, name string, settings ICMPTypeSettings) (dbus.ObjectPath, error)

AddICMPType creates a new permanent ICMP type and returns its config path.

func (*Permanent) AddIPSet 

func (p *Permanent) AddIPSet(ctx context.Context, name string, settings IPSetSettings) (dbus.ObjectPath, error)

AddIPSet creates a new permanent ipset from the given settings and returns its config object path.

func (*Permanent) AddPolicy 

func (p *Permanent) AddPolicy(ctx context.Context, name string, settings PolicySettings) (dbus.ObjectPath, error)

AddPolicy creates a new permanent policy and returns its config object path.

func (*Permanent) AddService 

func (p *Permanent) AddService(ctx context.Context, name string, settings ServiceSettings) (dbus.ObjectPath, error)

AddService creates a new permanent service and returns its config object path.

func (*Permanent) AddZone 

func (p *Permanent) AddZone(ctx context.Context, name string, settings ZoneSettings) (dbus.ObjectPath, error)

AddZone creates a new permanent zone from the given settings and returns its object path. On dict-capable servers it uses addZone2; otherwise addZone with the v1 tuple.

func (*Permanent) ConfigProperty 

func (p *Permanent) ConfigProperty(ctx context.Context, name string) (dbus.Variant, error)

ConfigProperty reads a single daemon-config property by its firewalld name (e.g. "FirewallBackend", "IPv6_rpfilter").

func (*Permanent) DaemonConfig 

func (p *Permanent) DaemonConfig(ctx context.Context) (DaemonConfig, error)

DaemonConfig reads the config object's daemon-settings properties.

func (*Permanent) Direct 

func (p *Permanent) Direct() *PermDirect

Direct returns a handle for the permanent direct configuration.

func (*Permanent) Helper 

func (p *Permanent) Helper(name string) *PermHelper

Helper returns a handle for permanent operations on the named helper.

func (*Permanent) HelperNames 

func (p *Permanent) HelperNames(ctx context.Context) ([]string, error)

HelperNames lists the names of all permanent conntrack helpers.

func (*Permanent) HelperPaths 

func (p *Permanent) HelperPaths(ctx context.Context) ([]dbus.ObjectPath, error)

HelperPaths lists the config object paths of all permanent helpers.

func (*Permanent) ICMPType 

func (p *Permanent) ICMPType(name string) *PermICMPType

ICMPType returns a handle for permanent operations on the named ICMP type.

func (*Permanent) ICMPTypeNames 

func (p *Permanent) ICMPTypeNames(ctx context.Context) ([]string, error)

ICMPTypeNames lists the names of all permanent ICMP types.

func (*Permanent) IPSet 

func (p *Permanent) IPSet(name string) *PermIPSet

IPSet returns a handle for permanent operations on the named ipset.

func (*Permanent) IPSetNames 

func (p *Permanent) IPSetNames(ctx context.Context) ([]string, error)

IPSetNames lists the names of all permanent ipsets.

func (*Permanent) IPSetPaths 

func (p *Permanent) IPSetPaths(ctx context.Context) ([]dbus.ObjectPath, error)

IPSetPaths lists the config object paths of all permanent ipsets (listIPSets).

func (*Permanent) Policy 

func (p *Permanent) Policy(name string) *PermPolicy

Policy returns a handle for permanent operations on the named policy.

func (*Permanent) PolicyNames 

func (p *Permanent) PolicyNames(ctx context.Context) ([]string, error)

PolicyNames lists the names of all permanent policies.

func (*Permanent) PolicyPaths 

func (p *Permanent) PolicyPaths(ctx context.Context) ([]dbus.ObjectPath, error)

PolicyPaths lists the config object paths of all permanent policies.

func (*Permanent) Service 

func (p *Permanent) Service(name string) *PermService

Service returns a handle for permanent operations on the named service.

func (*Permanent) ServiceNames 

func (p *Permanent) ServiceNames(ctx context.Context) ([]string, error)

ServiceNames lists the names of all permanent services.

func (*Permanent) SetConfigProperty 

func (p *Permanent) SetConfigProperty(ctx context.Context, name string, value any) error

SetConfigProperty writes a daemon-config property. Changes are permanent and take effect after a reload; most require privilege.

func (*Permanent) SetFirewallBackend 

func (p *Permanent) SetFirewallBackend(ctx context.Context, backend string) error

SetFirewallBackend selects the packet backend ("nftables" or "iptables").

func (*Permanent) Zone 

func (p *Permanent) Zone(name string) *PermZone

Zone returns a handle for permanent operations on the named zone. The object path is resolved lazily on first use via getZoneByName.

func (*Permanent) ZoneNames 

func (p *Permanent) ZoneNames(ctx context.Context) ([]string, error)

ZoneNames lists the names of all permanently configured zones.

func (*Permanent) ZoneOfInterface 

func (p *Permanent) ZoneOfInterface(ctx context.Context, iface string) (string, error)

ZoneOfInterface returns the permanent zone bound to an interface, or "" if none.

func (*Permanent) ZoneOfSource 

func (p *Permanent) ZoneOfSource(ctx context.Context, source string) (string, error)

ZoneOfSource returns the permanent zone bound to a source, or "" if none.

func (*Permanent) ZonePaths 

func (p *Permanent) ZonePaths(ctx context.Context) ([]dbus.ObjectPath, error)

ZonePaths lists the object paths of all permanent zones (listZones -> ao).

type PolicySettings 

type PolicySettings struct {
	Version      string
	Short        string
	Description  string
	Target       string // CONTINUE, ACCEPT, DROP, REJECT
	Priority     int32
	IngressZones []string
	EgressZones  []string
	Services     []string
	Ports        []Port
	SourcePorts  []Port
	ICMPBlocks   []string
	Masquerade   bool
	ForwardPorts []ForwardPort
	RichRules    []string
	Protocols    []string
}

PolicySettings is the transport-neutral representation of a zone-to-zone policy (firewalld >= 0.9). Policies have no v1 tuple form; they are exchanged only as an a{sv} dict. Ingress and egress zones define the traffic the policy governs; the remaining fields mirror a zone's filtering elements.

type Port 

type Port struct {
	Port     string // single port "80" or range "1000-2000"
	Protocol string // "tcp" | "udp" | "sctp" | "dccp"
}

Port is a port-or-range with its protocol. Encodes to the D-Bus tuple "(ss)".

type Runtime 

type Runtime struct {
	// contains filtered or unexported fields
}

Runtime is the entry point for transient operations on the running firewall. Edits made here last until the next reload unless given a timeout, mirroring firewall-cmd without --permanent.

func (*Runtime) ActivePolicies 

func (r *Runtime) ActivePolicies(ctx context.Context) ([]string, error)

ActivePolicies returns the policies that currently have zones bound.

func (*Runtime) ActiveZones 

func (r *Runtime) ActiveZones(ctx context.Context) ([]ActiveZone, error)

ActiveZones returns the zones that currently have interfaces or sources bound. getActiveZones returns a{sa{sas}}: zone -> {"interfaces": [...], "sources": [...]}.

func (*Runtime) IPSet 

func (r *Runtime) IPSet(name string) *RuntimeIPSet

IPSet returns a handle for runtime operations on the named ipset.

func (*Runtime) IPSetExists 

func (r *Runtime) IPSetExists(ctx context.Context, name string) (bool, error)

IPSetExists reports whether an ipset of the given name exists at runtime.

func (*Runtime) IPSets 

func (r *Runtime) IPSets(ctx context.Context) ([]string, error)

IPSets lists the names of ipsets known to the runtime.

func (*Runtime) Policies 

func (r *Runtime) Policies(ctx context.Context) ([]string, error)

Policies lists the names of all policies known to the runtime. Returns ErrUnsupported on servers that predate policy support (firewalld < 0.9).

func (*Runtime) PolicySettings 

func (r *Runtime) PolicySettings(ctx context.Context, policy string) (PolicySettings, error)

PolicySettings reads a policy definition from the running firewall.

func (*Runtime) SetPolicySettings 

func (r *Runtime) SetPolicySettings(ctx context.Context, policy string, settings PolicySettings) error

SetPolicySettings replaces a policy's runtime settings wholesale.

func (*Runtime) SetSettings 

func (r *Runtime) SetSettings(ctx context.Context, zone string, settings ZoneSettings) error

SetSettings replaces a zone's runtime settings wholesale via setZoneSettings2. This is a dict-only path (firewalld >= 0.9); older servers expose no runtime settings writer, so it returns ErrUnsupported there.

func (*Runtime) Settings 

func (r *Runtime) Settings(ctx context.Context, zone string) (ZoneSettings, error)

Settings reads the runtime settings of a zone. On dict-capable servers it uses getZoneSettings2; otherwise it falls back to the main getZoneSettings tuple.

func (*Runtime) Zone 

func (r *Runtime) Zone(name string) *RuntimeZone

Zone returns a handle for runtime operations on the named zone.

func (*Runtime) ZoneOfInterface 

func (r *Runtime) ZoneOfInterface(ctx context.Context, iface string) (string, error)

ZoneOfInterface returns the zone an interface is bound to at runtime, or "" if none.

func (*Runtime) ZoneOfSource 

func (r *Runtime) ZoneOfSource(ctx context.Context, source string) (string, error)

ZoneOfSource returns the zone a source is bound to at runtime, or "" if none.

func (*Runtime) Zones 

func (r *Runtime) Zones(ctx context.Context) ([]string, error)

Zones lists the names of all defined zones (runtime view).

type RuntimeIPSet 

type RuntimeIPSet struct {
	// contains filtered or unexported fields
}

RuntimeIPSet is a handle for transient ipset entry operations on the running firewall. ipset runtime methods live on the main object's .ipset interface.

func (*RuntimeIPSet) AddEntry 

func (s *RuntimeIPSet) AddEntry(ctx context.Context, entry string) error

AddEntry adds a single entry to the ipset at runtime.

func (*RuntimeIPSet) Entries 

func (s *RuntimeIPSet) Entries(ctx context.Context) ([]string, error)

Entries returns all entries of the ipset at runtime.

func (*RuntimeIPSet) QueryEntry 

func (s *RuntimeIPSet) QueryEntry(ctx context.Context, entry string) (bool, error)

QueryEntry reports whether an entry is present at runtime.

func (*RuntimeIPSet) RemoveEntry 

func (s *RuntimeIPSet) RemoveEntry(ctx context.Context, entry string) error

RemoveEntry removes a single entry from the ipset at runtime.

func (*RuntimeIPSet) SetEntries 

func (s *RuntimeIPSet) SetEntries(ctx context.Context, entries []string) error

SetEntries replaces all entries of the ipset at runtime.

func (*RuntimeIPSet) Settings 

func (s *RuntimeIPSet) Settings(ctx context.Context) (IPSetSettings, error)

Settings reads the runtime settings of the ipset.

type RuntimeInfo 

type RuntimeInfo struct {
	State         string
	InterfaceVer  string
	IPv4          bool
	IPv6          bool
	IPv6RPFilter  bool
	Bridge        bool
	IPSet         bool
	IPSetTypes    []string
	IPv4ICMPTypes []string
	IPv6ICMPTypes []string
}

RuntimeInfo captures the main object's read-only capability and state properties, describing what the running firewalld supports.

type RuntimeZone 

type RuntimeZone struct {
	// contains filtered or unexported fields
}

RuntimeZone is a handle for transient edits to a single zone. Add methods take a timeout (zero for none) and return the affected zone name from firewalld.

func (*RuntimeZone) AddForwardPort 

func (z *RuntimeZone) AddForwardPort(ctx context.Context, fp ForwardPort, timeout time.Duration) error

ForwardPort operations.

func (*RuntimeZone) AddIcmpBlock 

func (z *RuntimeZone) AddIcmpBlock(ctx context.Context, icmptype string, timeout time.Duration) error

IcmpBlock operations.

func (*RuntimeZone) AddIcmpBlockInversion 

func (z *RuntimeZone) AddIcmpBlockInversion(ctx context.Context, timeout time.Duration) error

IcmpBlockInversion operations. Add takes a timeout; the others do not.

func (*RuntimeZone) AddInterface 

func (z *RuntimeZone) AddInterface(ctx context.Context, iface string) error

Interface operations bind and unbind network interfaces to the zone at runtime.

func (*RuntimeZone) AddMasquerade 

func (z *RuntimeZone) AddMasquerade(ctx context.Context, timeout time.Duration) error

Masquerade operations. Add takes a timeout; the others do not.

func (*RuntimeZone) AddPort 

func (z *RuntimeZone) AddPort(ctx context.Context, p Port, timeout time.Duration) error

Port operations.

func (*RuntimeZone) AddProtocol 

func (z *RuntimeZone) AddProtocol(ctx context.Context, proto string, timeout time.Duration) error

Protocol operations.

func (*RuntimeZone) AddRichRule 

func (z *RuntimeZone) AddRichRule(ctx context.Context, rule string, timeout time.Duration) error

RichRule operations.

func (*RuntimeZone) AddService 

func (z *RuntimeZone) AddService(ctx context.Context, service string, timeout time.Duration) error

Service operations.

func (*RuntimeZone) AddSource 

func (z *RuntimeZone) AddSource(ctx context.Context, source string) error

Source operations. Unlike ports/services, a source binding is not timed, so AddSource takes no timeout (firewalld's addSource has no timeout argument).

func (*RuntimeZone) AddSourcePort 

func (z *RuntimeZone) AddSourcePort(ctx context.Context, p Port, timeout time.Duration) error

SourcePort operations.

func (*RuntimeZone) ChangeInterface 

func (z *RuntimeZone) ChangeInterface(ctx context.Context, iface string) error

ChangeInterface moves an interface into this zone, detaching it from whatever zone currently owns it. Unlike AddInterface, it does not fail if the interface is already bound elsewhere (firewall-cmd --change-interface).

func (*RuntimeZone) ChangeSource 

func (z *RuntimeZone) ChangeSource(ctx context.Context, source string) error

ChangeSource moves a source into this zone, detaching it from its current zone.

func (*RuntimeZone) ForwardPorts 

func (z *RuntimeZone) ForwardPorts(ctx context.Context) ([]ForwardPort, error)

ForwardPorts returns the runtime forward ports as typed values.

func (*RuntimeZone) ICMPBlocks 

func (z *RuntimeZone) ICMPBlocks(ctx context.Context) ([]string, error)

func (*RuntimeZone) Interfaces 

func (z *RuntimeZone) Interfaces(ctx context.Context) ([]string, error)

func (*RuntimeZone) Name 

func (z *RuntimeZone) Name() string

Name returns the zone name this handle targets.

func (*RuntimeZone) Ports 

func (z *RuntimeZone) Ports(ctx context.Context) ([]Port, error)

Ports returns the runtime ports as typed pairs.

func (*RuntimeZone) Protocols 

func (z *RuntimeZone) Protocols(ctx context.Context) ([]string, error)

func (*RuntimeZone) QueryForwardPort 

func (z *RuntimeZone) QueryForwardPort(ctx context.Context, fp ForwardPort) (bool, error)

func (*RuntimeZone) QueryIcmpBlock 

func (z *RuntimeZone) QueryIcmpBlock(ctx context.Context, icmptype string) (bool, error)

func (*RuntimeZone) QueryIcmpBlockInversion 

func (z *RuntimeZone) QueryIcmpBlockInversion(ctx context.Context) (bool, error)

func (*RuntimeZone) QueryInterface 

func (z *RuntimeZone) QueryInterface(ctx context.Context, iface string) (bool, error)

func (*RuntimeZone) QueryMasquerade 

func (z *RuntimeZone) QueryMasquerade(ctx context.Context) (bool, error)

func (*RuntimeZone) QueryPort 

func (z *RuntimeZone) QueryPort(ctx context.Context, p Port) (bool, error)

func (*RuntimeZone) QueryProtocol 

func (z *RuntimeZone) QueryProtocol(ctx context.Context, proto string) (bool, error)

func (*RuntimeZone) QueryRichRule 

func (z *RuntimeZone) QueryRichRule(ctx context.Context, rule string) (bool, error)

func (*RuntimeZone) QueryService 

func (z *RuntimeZone) QueryService(ctx context.Context, service string) (bool, error)

func (*RuntimeZone) QuerySource 

func (z *RuntimeZone) QuerySource(ctx context.Context, source string) (bool, error)

func (*RuntimeZone) QuerySourcePort 

func (z *RuntimeZone) QuerySourcePort(ctx context.Context, p Port) (bool, error)

func (*RuntimeZone) RemoveForwardPort 

func (z *RuntimeZone) RemoveForwardPort(ctx context.Context, fp ForwardPort) error

func (*RuntimeZone) RemoveIcmpBlock 

func (z *RuntimeZone) RemoveIcmpBlock(ctx context.Context, icmptype string) error

func (*RuntimeZone) RemoveIcmpBlockInversion 

func (z *RuntimeZone) RemoveIcmpBlockInversion(ctx context.Context) error

func (*RuntimeZone) RemoveInterface 

func (z *RuntimeZone) RemoveInterface(ctx context.Context, iface string) error

func (*RuntimeZone) RemoveMasquerade 

func (z *RuntimeZone) RemoveMasquerade(ctx context.Context) error

func (*RuntimeZone) RemovePort 

func (z *RuntimeZone) RemovePort(ctx context.Context, p Port) error

func (*RuntimeZone) RemoveProtocol 

func (z *RuntimeZone) RemoveProtocol(ctx context.Context, proto string) error

func (*RuntimeZone) RemoveRichRule 

func (z *RuntimeZone) RemoveRichRule(ctx context.Context, rule string) error

func (*RuntimeZone) RemoveService 

func (z *RuntimeZone) RemoveService(ctx context.Context, service string) error

func (*RuntimeZone) RemoveSource 

func (z *RuntimeZone) RemoveSource(ctx context.Context, source string) error

func (*RuntimeZone) RemoveSourcePort 

func (z *RuntimeZone) RemoveSourcePort(ctx context.Context, p Port) error

func (*RuntimeZone) RichRules 

func (z *RuntimeZone) RichRules(ctx context.Context) ([]string, error)

func (*RuntimeZone) Services 

func (z *RuntimeZone) Services(ctx context.Context) ([]string, error)

Getters for the current runtime element lists.

func (*RuntimeZone) SourcePorts 

func (z *RuntimeZone) SourcePorts(ctx context.Context) ([]Port, error)

SourcePorts returns the runtime source ports as typed pairs.

func (*RuntimeZone) Sources 

func (z *RuntimeZone) Sources(ctx context.Context) ([]string, error)

type ServiceSettings 

type ServiceSettings struct {
	Version      string
	Short        string
	Description  string
	Ports        []Port
	Modules      []string          // netfilter helper modules
	Destinations map[string]string // family -> address, e.g. {"ipv4": "224.0.0.0/8"}
	Protocols    []string
	SourcePorts  []Port
	Includes     []string // dict-only (firewalld >= 1.0)
	Helpers      []string // dict-only (firewalld >= 1.0)
}

ServiceSettings is the transport-neutral representation of a firewalld service. It maps to the v1 tuple "(sssa(ss)asa{ss}asa(ss))": version, short, description, ports, modules, destinations, protocols, source_ports. Newer firewalld also exposes includes/helpers via the dict form (getSettings2), which are modelled here and populated when the dict transport is available.

type Signal 

type Signal struct {
	Member    string
	Interface string
	Path      dbus.ObjectPath
	Body      []any
}

Signal is a firewalld D-Bus signal delivered to a watcher. Member is the short signal name (e.g. "Reloaded", "PortAdded"); Interface is the emitting interface; Body carries the signal's arguments in firewalld's declared order.

type Target 

type Target string

Target is a zone's default packet policy for unmatched traffic. 

const (
	TargetDefault Target = "default"
	TargetACCEPT  Target = "ACCEPT"
	TargetDROP    Target = "DROP"
	TargetReject  Target = "%%REJECT%%"
)

type Version 

type Version struct {
	Major, Minor, Patch int
	Raw                 string
}

Version is a parsed firewalld version. Missing components read as zero, so a server reporting "1" compares equal to "1.0.0".

func (Version) String 

func (v Version) String() string

String returns the raw version string as reported by the server.

type ZoneSettings 

type ZoneSettings struct {
	Version            string
	Short              string
	Description        string
	Target             Target
	Services           []string
	Ports              []Port
	ICMPBlocks         []string
	Masquerade         bool
	ForwardPorts       []ForwardPort
	Interfaces         []string
	Sources            []string
	RichRules          []string
	Protocols          []string
	SourcePorts        []Port
	ICMPBlockInversion bool

	// v2-only (dict) fields.
	Forward         bool  // intra-zone forwarding (firewalld >= 0.9)
	EgressPriority  int32 // zone egress priority (newer firewalld)
	IngressPriority int32 // zone ingress priority (newer firewalld)
}

ZoneSettings is the complete, transport-neutral representation of a zone's configuration. It is populated from either the v1 tuple (EL7 and up) or the v2 dict (firewalld >= 0.9) and encodes back through whichever transport the server supports. The final three fields exist only in the v2 dict; on the tuple path they are ignored on write and left zero on read.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.