nettools

type ConntrackHelper ¶

type ConntrackHelper interface {
	RemoveEntriesDNATingToIP(ip net.IP) (time.Duration, error)
}

ConntrackHelper provides operations backed up by the system "conntrack" command

RemoveEntriesDNATingToIP removes all entries in the conntrack table, that describe connections running with DNAT and having destination IP equal to ip. If returned error is nil, then time.Duration returned type is used to let the caller know how long it took to execute the command.

func NewExecConntrackHelper(executor command.Executor) ConntrackHelper

type IPRouteEntry ¶

type IPRouteEntry struct {
	TableName, TargetPrefix, Mode, Gateway, Options string
}

IPRouteEntry represents one routing information entry in a configured route table

func (e IPRouteEntry) String() string

type IPRouteHelper ¶

type IPRouteHelper interface {
	InitializeRoutingTablesPerInterface(ifaces []Interface) (time.Duration, error)
	EnsureOnlyOneIPRuleExistsForSourceIP(rule IPRule) ([]IPRule, time.Duration, error)
	RemoveIPRuleForSourceIP(rule IPRule) (time.Duration, error)
	RemoveAllIPRulesForAddressesInSubnet(sourceSubnet net.IPNet) ([]IPRule, time.Duration, error)
	RemoveAllIPRulesForAddress(ip net.IP) ([]IPRule, time.Duration, error)
	EnsureOnlyOneIPRuleExistsForFwMark(rule IPRule) ([]IPRule, time.Duration, error)
	EnsureRoutes(entries []IPRouteEntry) (time.Duration, error)
}

IPRouteHelper implements various iproute2 tool related actions.

InitializeRoutingTablesPerInterface creates entries in the '/etc/iproute2/rt_tables' file for each of the interfaces passed in ifaces slice. The name of the created routing table entry will be the same as the name of the interface. Additionally, it creates a routing rule for each of the IP addresses assigned to each of the passed interfaces to use route table created for this specific interface.

EnsureOnlyOneIPRuleExistsForSourceIP adds an "ip rule" entry for the SourceIP included in rule to use the routing table RouteTableName. The routing table must have been created earlier by a call to InitializeRoutingTablesPerInterface(). If there are already other ip rules for the same SourceIP but different RouteTableName than in the rule, the entries are removed, so that the only currently matching rule for SourceIP selects route table RouteTableName.

RemoveIPRuleForSourceIP removes ip rule entry for the SourceIP and RouteTableName specified in rule. If the entry doesn't exist, no error is returned.

RemoveAllIPRulesForAddressesInSubnet removes any rules existing for any source IP within the sourceSubnet. No error is returned if no entries were removed.

RemoveAllIPRulesForAddress removes any rules existing for the specific IP address. No error is returned if no entries were removed.

EnsureOnlyOneIPRuleExistsForFwMark adds an "ip rule" entry for the FwMark included in rule to use the routing table RouteTableName. The routing table must have been created earlier by a call to InitializeRoutingTablesPerInterface(). If there are already other ip rules for the same FwMark but different RouteTableName than in the rule, the entries are removed, so that the only currently matching rule for FwMark selects route table RouteTableName.

EnsureRoute ensures that in the routing table tableName there is a route entry that has the form "targetPrefix" "mode" "gateway" "options", like: "10.10.10.0/24" "via" "10.10.20.1" "" or "10.10.10.0/24" "dev" "eth0" "scope link"

func NewExecIPRouteHelper(executor command.Executor, ioOp SimpleFileOperator) IPRouteHelper

type IPRule ¶

type IPRule struct {
	No             int
	FwMark         int
	SourceIP       net.IP
	RouteTableName string
}

IPRule represents a single ip routing rule based on source IP and selecting a named routing table.

func NewIPRuleForFwMark(mark int, tableName string) IPRule

func NewIPRuleForSourceIP(cidrAddress, tableName string) IPRule

func (r *IPRule) Copy() IPRule

func (r *IPRule) FwMarkHexed() string

func (r *IPRule) GrepEscaped() (string, string)

func (r *IPRule) ToString() string

type IPSetHelper ¶

type IPSetHelper interface {
	EnsureSetExists(name, setType string) error
	DeleteSet(name string) error
	EnsureSetHasOnly(name string, ips []net.IP) error
	GetIPs(name string) ([]net.IP, error)
	EnsureSetHasOnlyNetPort(name string, netports []NetPort) error
	GetNetPorts(name string) ([]NetPort, error)
}

IPSetHelper provides methods to manage ipset sets.

EnsureSetExists creates the named ipset if it doesn't exist.

DeleteSet removes the ipset with name. Returns error if it doesn't exist.

EnsureSetHasOnly makes sure that IP addresses from ips are the only ones present in the set name.

GetIPs returns a slice of IP addresses from set name. Returns error if it doesn't exist.

func NewExecIPSetHelper(exec command.Executor) IPSetHelper

type IPTablesHelper ¶

type IPTablesHelper interface {
	// EnsureChainExists makes sure the chain customChainName exists in table
	EnsureChainExists(table, customChainName string) error
	// EnsureJumpToChainExists makes sure a jump instruction from baseChainName to
	// customChainName exists in table
	EnsureJumpToChainExists(table, customChainName, baseChainName string) error
	// EnsureExistsInsert makes sure the rule exists. It is inserted at the start of
	// the chain, if the exact same rule doesn't exist; nothing happens otherwise.
	EnsureExistsInsert(args IPTablesRuleArgs) error
	// EnsureExistsAppend makes sure the rule exists. It is appended at the end of
	// the chain, if the exact same rule doesn't exist; nothing happens otherwise.
	EnsureExistsAppend(args IPTablesRuleArgs) error
	// EnsureExistsOnlyAppend checks if the exact same rule already exists. If not,
	// the rule is appended to the selected chain. If other rules with exactly the
	// same comment exist, they are removed.
	EnsureExistsOnlyAppend(args IPTablesRuleArgs) error
	// Delete removes the exact same rule. Returns error if it doesn't exist.
	Delete(args IPTablesRuleArgs) error
	// DeleteByComment removes all rules in the specified table and chain that have
	// the same comment.
	DeleteByComment(table, chain, comment string) error
	// FlushChain removes all rules in chain chainName in table tableName. Returns error
	// if the chain doesn't exist.
	FlushChain(tableName, chainName string) error
	// DeleteChain removes the chain chainName in table tableName. Returns error
	// if the chain doesn't exist.
	DeleteChain(tableName, chainName string) error
	// LoadRules loads all rules from the specified table and chain. Returns error
	// if the chain doesn't exist.
	LoadRules(tableName, chainName string) ([]*IPTablesRuleArgs, error)
}

IPTablesHelper provides interface to some operations on system's firewall system using the iptables command

func NewExecIPTablesHelper(exec command.Executor, lockTime time.Duration) IPTablesHelper

type IPTablesRuleArgs ¶

type IPTablesRuleArgs struct {
	Table     string
	ChainName string
	Selector  []string
	Action    []string
	Comment   string
}

IPTablesRuleArgs provides arguments for an iptables rule

func (args IPTablesRuleArgs) GetSelectorAndAction() (string, string)

type Interface ¶

type Interface interface {
	GetIndex() int
	Addrs() ([]net.IPNet, error)
	GetName() string
	Copy() Interface
}

Interface provides addresses and name of a single local network interface

Addrs() gets a slice with all addresses assigned to this interface ¶

GetName() returns name of the interfaces, as presented in the operating system

Copy() returns a full deep copy of the Interface object

func FilteredInterfaces(nameRegExp *regexp.Regexp, lister InterfaceLister) ([]Interface, error)

type InterfaceLister ¶

type InterfaceLister interface {
	GetInterfaces() ([]Interface, error)
}

InterfaceLister lists all network interfaces in the Operating System, together with their assigned IP addresses

type InterfaceProvider ¶

type InterfaceProvider interface {
	etime.Refresher
	Interfaces() ([]Interface, error)
	IsLocalIP(ip net.IP) bool
	GetInterfaceForLocalIP(ip net.IP) (Interface, error)
}

InterfaceProvider delivers information about local interfaces and assigned IP addresses. It also periodically refreshes this information in the background to stay in sync with changes in the Operating System.

Interfaces() lists all discovered networking interfaces ¶

IsLocalIP() checks if the ip passed as parameter is assigned to any discovered interface

GetInterfaceForLocalIP() returns Interface which has ip assigned. If no such interface is found, error must be set.

func NewChanInterfaceProvider(updateChan chan time.Time, lister InterfaceLister,
	managedInterfacesRegexp string, autoRefresh bool) (InterfaceProvider, error)

func NewInterfaceProvider(lister InterfaceLister, managedInterfacesRegexp string,
	autoRefresh bool, autoRefreshPeriod time.Duration) (InterfaceProvider, error)

func NewNetInterfaceProvider(managedInterfacesRegexp string,
	autoRefresh bool, autoRefreshPeriod time.Duration) (InterfaceProvider, error)

type NetPort ¶ added in v0.2.0

type NetPort struct {
	Net      net.IPNet
	Protocol Protocol
	Port     uint16
}

NetPort allows to store net.IPNet and a port number with protocol for ipsets based on that data.

func (np NetPort) Equal(np2 NetPort) bool

func (np NetPort) String() string

type Protocol ¶ added in v0.2.0

type Protocol string

Protocol is the type to provide different protocol names constants.

const (
	// Unknown is the Protocol returned for unknown protocols
	Unknown Protocol = "unknown"
	// TCP is the name of the tcp protocol, as used in go's net library
	TCP Protocol = "tcp"
	// UDP is the name of the udp protocol, as used in go's net library
	UDP Protocol = "udp"
)

func ParseProtocol(proto string) (Protocol, error)

type SimpleFileOperator ¶

type SimpleFileOperator interface {
	ReadFile(fileName string) ([]byte, error)
	AppendToFile(fileName, textToAppend string) error
}

SimpleFileOperator provides simple subset of typical text file IO operations

ReadFile reads the contents of a whole file and returns it as []byte

AppendToFile tries to appens string textToAppend at the end of file named fileName

func NewIOSimpleFileOperator() SimpleFileOperator