schema

Documentation

Index

• Constants
• type Chain
• type Counter
• type Dnat
• type Expression
  • func (e Expression) MarshalJSON() ([]byte, error)
  • func (e *Expression) UnmarshalJSON(data []byte) error
• type Flags
  • func (f Flags) MarshalJSON() ([]byte, error)
  • func (f *Flags) UnmarshalJSON(data []byte) error
• type FloatRange
• type IPPrefix
• type Masquerade
• type Match
• type Metainfo
• type Nat
• type Nftable
• type Objects
  • func (o Objects) MarshalJSON() ([]byte, error)
• type Payload
• type Prefix
• type Range
• type Redirect
• type Root
• type Rule
• type SetElement
  • func (s SetElement) MarshalJSON() ([]byte, error)
  • func (s *SetElement) UnmarshalJSON(data []byte) error
• type SimpleVerdict
• type Snat
• type Statement
  • func (s Statement) MarshalJSON() ([]byte, error)
  • func (s *Statement) UnmarshalJSON(data []byte) error
• type Table
• type ToTarget
• type Verdict
  • func Accept() Verdict
  • func Continue() Verdict
  • func Drop() Verdict
  • func Return() Verdict

Constants

const (
	TypeFilter = "filter"
	TypeNAT    = "nat"
	TypeRoute  = "route"
)

Chain Types

const (
	HookPreRouting  = "prerouting"
	HookInput       = "input"
	HookOutput      = "output"
	HookForward     = "forward"
	HookPostRouting = "postrouting"
	HookIngress     = "ingress"
)

Chain Hooks

const (
	PolicyAccept = "accept"
	PolicyDrop   = "drop"
)

Chain Policies

const (
	NATFlagRandom      = "random"
	NATFlagFullyRandom = "fully-random"
	NATFlagPersistent  = "persistent"
)

NAT Flags

const (
	VerdictAccept   = "accept"
	VerdictContinue = "continue"
	VerdictDrop     = "drop"
	VerdictReturn   = "return"
)

Verdict Operations

const (
	OperAND = "&"  // Binary AND
	OperOR  = "|"  // Binary OR
	OperXOR = "^"  // Binary XOR
	OperLSH = "<<" // Left shift
	OperRSH = ">>" // Right shift
	OperEQ  = "==" // Equal
	OperNEQ = "!=" // Not equal
	OperLS  = "<"  // Less than
	OperGR  = ">"  // Greater than
	OperLSE = "<=" // Less than or equal to
	OperGRE = ">=" // Greater than or equal to
	OperIN  = "in" // Perform a lookup, i.e. test if bits on RHS are contained in LHS value
)

Match Operators

const (
	PayloadKey = "payload"
	// Ethernet
	PayloadProtocolEther   = "ether"
	PayloadFieldEtherDAddr = "daddr"
	PayloadFieldEtherSAddr = "saddr"
	PayloadFieldEtherType  = "type"

	// IP (common)
	PayloadFieldIPVer   = "version"
	PayloadFieldIPDscp  = "dscp"
	PayloadFieldIPEcn   = "ecn"
	PayloadFieldIPLen   = "length"
	PayloadFieldIPSAddr = "saddr"
	PayloadFieldIPDAddr = "daddr"

	// IPv4
	PayloadProtocolIP4      = "ip"
	PayloadFieldIP4HdrLen   = "hdrlength"
	PayloadFieldIP4Id       = "id"
	PayloadFieldIP4FragOff  = "frag-off"
	PayloadFieldIP4Ttl      = "ttl"
	PayloadFieldIP4Protocol = "protocol"
	PayloadFieldIP4Chksum   = "checksum"

	// IPv6
	PayloadProtocolIP6       = "ip6"
	PayloadFieldIP6FlowLabel = "flowlabel"
	PayloadFieldIP6NextHdr   = "nexthdr"
	PayloadFieldIP6HopLimit  = "hoplimit"
)

Payload Expressions

const (
	FamilyIP     = "ip"     // IPv4 address AddressFamily.
	FamilyIP6    = "ip6"    // IPv6 address AddressFamily.
	FamilyINET   = "inet"   // Internet (IPv4/IPv6) address AddressFamily.
	FamilyARP    = "arp"    // ARP address AddressFamily, handling IPv4 ARP packets.
	FamilyBridge = "bridge" // Bridge address AddressFamily, handling packets which traverse a bridge device.
	FamilyNETDEV = "netdev" // Netdev address AddressFamily, handling packets from ingress.
)

Table Address Families

Types

type Chain

type Chain struct {
	Family string `json:"family"`
	Table  string `json:"table"`
	Name   string `json:"name"`
	Type   string `json:"type,omitempty"`
	Hook   string `json:"hook,omitempty"`
	Prio   *int   `json:"prio,omitempty"`
	Policy string `json:"policy,omitempty"`
}

type Counter

type Counter struct {
	Packets int `json:"packets"`
	Bytes   int `json:"bytes"`
}

type Dnat

type Dnat struct {
	Addr   *Expression `json:"addr,omitempty"`
	Family *string     `json:"family,omitempty"`
	Port   *Expression `json:"port,omitempty"`
	Flags  *Flags      `json:"flags,omitempty"`
}

type Expression

type Expression struct {
	String  *string  `json:"-"`
	Bool    *bool    `json:"-"`
	Float64 *float64 `json:"-"`
	Payload *Payload `json:"payload,omitempty"`
	// RowData accepts arbitrary data which cannot be composed from the existing schema.
	// Use `json.RawMessage()` or `[]byte()` for the value.
	// Example:
	// `schema.Expression{RowData: json.RawMessage(`{"meta":{"key":"iifname"}}`)}`
	RowData json.RawMessage `json:"-"`
	Set     *[]SetElement   `json:"set,omitempty"`
}

func (Expression) MarshalJSON

func (e Expression) MarshalJSON() ([]byte, error)

func (*Expression) UnmarshalJSON

func (e *Expression) UnmarshalJSON(data []byte) error

type Flags

type Flags struct {
	Flags []string `json:"-"`
}

func (Flags) MarshalJSON

func (f Flags) MarshalJSON() ([]byte, error)

func (*Flags) UnmarshalJSON

func (f *Flags) UnmarshalJSON(data []byte) error

type FloatRange

type FloatRange struct {
	FloatRange [2]float64 `json:"range,omitempty"`
}

type IPPrefix

type IPPrefix struct {
	Prefix Prefix `json:"prefix,omitempty"`
}

type Masquerade

type Masquerade struct {
	Enabled bool        `json:"-"`
	Port    *Expression `json:"port,omitempty"`
	Flags   *Flags      `json:"flags,omitempty"`
}

type Match

type Match struct {
	Op    string     `json:"op"`
	Left  Expression `json:"left"`
	Right Expression `json:"right"`
}

type Metainfo

type Metainfo struct {
	Version           string `json:"version"`
	ReleaseName       string `json:"release_name"`
	JsonSchemaVersion int    `json:"json_schema_version"`
}

type Nat

type Nat struct {
	Snat       *Snat       `json:"snat,omitempty"`
	Dnat       *Dnat       `json:"dnat,omitempty"`
	Masquerade *Masquerade `json:"masquerade,omitempty"`
	Redirect   *Redirect   `json:"redirect,omitempty"`
}

type Nftable

type Nftable struct {
	Table *Table `json:"table,omitempty"`
	Chain *Chain `json:"chain,omitempty"`
	Rule  *Rule  `json:"rule,omitempty"`

	Add    *Objects `json:"add,omitempty"`
	Delete *Objects `json:"delete,omitempty"`
	Flush  *Objects `json:"flush,omitempty"`

	Metainfo *Metainfo `json:"metainfo,omitempty"`
}

type Objects

type Objects struct {
	Table   *Table `json:"table,omitempty"`
	Chain   *Chain `json:"chain,omitempty"`
	Rule    *Rule  `json:"rule,omitempty"`
	Ruleset bool   `json:"-"`
}

func (Objects) MarshalJSON

func (o Objects) MarshalJSON() ([]byte, error)

type Payload

type Payload struct {
	Protocol string `json:"protocol"`
	Field    string `json:"field"`
}

type Prefix

type Prefix struct {
	Addr string `json:"addr"`
	Len  int    `json:"len"`
}

type Range

type Range struct {
	Range [2]string `json:"range,omitempty"`
}

type Redirect

type Redirect struct {
	Enabled bool        `json:"-"`
	Port    *Expression `json:"port,omitempty"`
	Flags   *Flags      `json:"flags,omitempty"`
}

type Root

type Root struct {
	Nftables []Nftable `json:"nftables"`
}

type Rule

type Rule struct {
	Family  string      `json:"family"`
	Table   string      `json:"table"`
	Chain   string      `json:"chain"`
	Expr    []Statement `json:"expr,omitempty"`
	Handle  *int        `json:"handle,omitempty"`
	Index   *int        `json:"index,omitempty"`
	Comment string      `json:"comment,omitempty"`
}

type SetElement

type SetElement struct {
	Value        string      `json:"-"`
	Float64Value float64     `json:"-"`
	Range        *Range      `json:"-"`
	Float64Range *FloatRange `json:"-"`
	IPPrefix     *IPPrefix   `json:"-"`
}

func (SetElement) MarshalJSON

func (s SetElement) MarshalJSON() ([]byte, error)

func (*SetElement) UnmarshalJSON

func (s *SetElement) UnmarshalJSON(data []byte) error

type SimpleVerdict

type SimpleVerdict struct {
	Accept   bool `json:"-"`
	Continue bool `json:"-"`
	Drop     bool `json:"-"`
	Return   bool `json:"-"`
}

type Snat

type Snat struct {
	Addr   *Expression `json:"addr,omitempty"`
	Family *string     `json:"family,omitempty"`
	Port   *Expression `json:"port,omitempty"`
	Flags  *Flags      `json:"flags,omitempty"`
}

type Statement

type Statement struct {
	Counter *Counter `json:"counter,omitempty"`
	Match   *Match   `json:"match,omitempty"`
	Verdict
	Nat
	RawData json.RawMessage `json:"-"`
}

func (Statement) MarshalJSON

func (s Statement) MarshalJSON() ([]byte, error)

func (*Statement) UnmarshalJSON

func (s *Statement) UnmarshalJSON(data []byte) error

type Table

type Table struct {
	Family string `json:"family"`
	Name   string `json:"name"`
}

type ToTarget

type ToTarget struct {
	Target string `json:"target"`
}

type Verdict

type Verdict struct {
	SimpleVerdict
	Jump *ToTarget `json:"jump,omitempty"`
	Goto *ToTarget `json:"goto,omitempty"`
}

func Accept

func Accept() Verdict

func Continue

func Continue() Verdict

func Drop

func Drop() Verdict

func Return

func Return() Verdict