filter

package
v1.20.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jan 14, 2022 License: BSD-3-Clause Imports: 12 Imported by: 25

Documentation

Overview

Package filter is a stateful packet filter.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Filter

type Filter struct {
	// contains filtered or unexported fields
}

Filter is a stateful packet filter.

func New

func New(matches []Match, localNets *netaddr.IPSet, logIPs *netaddr.IPSet, shareStateWith *Filter, logf logger.Logf) *Filter

New creates a new packet filter. The filter enforces that incoming packets must be destined to an IP in localNets, and must be allowed by matches. If shareStateWith is non-nil, the returned filter shares state with the previous one, to enable changing rules at runtime without breaking existing stateful flows.

func NewAllowAllForTest added in v1.4.0

func NewAllowAllForTest(logf logger.Logf) *Filter

NewAllowAllForTest returns a packet filter that accepts everything. Use in tests only, as it permits some kinds of spoofing attacks to reach the OS network stack.

func NewAllowNone

func NewAllowNone(logf logger.Logf, logIPs *netaddr.IPSet) *Filter

NewAllowNone returns a packet filter that rejects everything.

func NewShieldsUpFilter added in v1.4.0

func NewShieldsUpFilter(localNets *netaddr.IPSet, logIPs *netaddr.IPSet, shareStateWith *Filter, logf logger.Logf) *Filter

NewShieldsUpFilter returns a packet filter that rejects incoming connections.

If shareStateWith is non-nil, the returned filter shares state with the previous one, as long as the previous one was also a shields up filter.

func (*Filter) CheckTCP added in v1.4.0

func (f *Filter) CheckTCP(srcIP, dstIP netaddr.IP, dstPort uint16) Response

CheckTCP determines whether TCP traffic from srcIP to dstIP:dstPort is allowed.

func (*Filter) RunIn

func (f *Filter) RunIn(q *packet.Parsed, rf RunFlags) Response

RunIn determines whether this node is allowed to receive q from a Tailscale peer.

func (*Filter) RunOut

func (f *Filter) RunOut(q *packet.Parsed, rf RunFlags) Response

RunOut determines whether this node is allowed to send q to a Tailscale peer.

func (*Filter) ShieldsUp added in v1.4.0

func (f *Filter) ShieldsUp() bool

ShieldsUp reports whether this is a "shields up" (block everything incoming) filter.

type Match

type Match struct {
	IPProto []ipproto.Proto // required set (no default value at this layer)
	Dsts    []NetPortRange
	Srcs    []netaddr.IPPrefix
}

Match matches packets from any IP address in Srcs to any ip:port in Dsts.

func MatchesFromFilterRules added in v1.2.0

func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error)

MatchesFromFilterRules converts tailcfg FilterRules into Matches. If an error is returned, the Matches result is still valid, containing the rules that were successfully converted.

func (*Match) Clone

func (src *Match) Clone() *Match

Clone makes a deep copy of Match. The result aliases no memory with the original.

func (Match) String

func (m Match) String() string

type NetPortRange added in v0.98.1

type NetPortRange struct {
	Net   netaddr.IPPrefix
	Ports PortRange
}

NetPortRange combines an IP address prefix and PortRange.

func (NetPortRange) String added in v0.98.1

func (npr NetPortRange) String() string

type PortRange

type PortRange struct {
	First, Last uint16 // inclusive
}

PortRange is a range of TCP and UDP ports.

func (PortRange) String

func (pr PortRange) String() string

type Response

type Response int

Response is a verdict from the packet filter.

const (
	Drop         Response = iota // do not continue processing packet.
	DropSilently                 // do not continue processing packet, but also don't log
	Accept                       // continue processing packet.

)

func (Response) IsDrop added in v1.4.0

func (r Response) IsDrop() bool

func (Response) String

func (r Response) String() string

type RunFlags

type RunFlags int

RunFlags controls the filter's debug log verbosity at runtime.

const (
	LogDrops       RunFlags = 1 << iota // write dropped packet info to logf
	LogAccepts                          // write accepted packet info to logf
	HexdumpDrops                        // print packet hexdump when logging drops
	HexdumpAccepts                      // print packet hexdump when logging accepts
)

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL