Documentation
¶
Index ¶
- Constants
- type Nftables
- func (d Nftables) Compat() (bool, error)
- func (d Nftables) InstanceClearBridgeFilter(projectName string, instanceName string, deviceName string, parentName string, ...) error
- func (d Nftables) InstanceClearProxyNAT(projectName string, instanceName string, deviceName string) error
- func (d Nftables) InstanceClearRPFilter(projectName string, instanceName string, deviceName string) error
- func (d Nftables) InstanceSetupBridgeFilter(projectName string, instanceName string, deviceName string, parentName string, ...) error
- func (d Nftables) InstanceSetupProxyNAT(projectName string, instanceName string, deviceName string, ...) error
- func (d Nftables) InstanceSetupRPFilter(projectName string, instanceName string, deviceName string, hostName string) error
- func (d Nftables) NetworkClear(networkName string, ipVersion uint) error
- func (d Nftables) NetworkSetupDHCPDNSAccess(networkName string, ipVersion uint) error
- func (d Nftables) NetworkSetupDHCPv4Checksum(networkName string) error
- func (d Nftables) NetworkSetupForwardingPolicy(networkName string, ipVersion uint, allow bool) error
- func (d Nftables) NetworkSetupOutboundNAT(networkName string, subnet *net.IPNet, srcIP net.IP, _ bool) error
- func (d Nftables) String() string
- type Xtables
- func (d Xtables) Compat() (bool, error)
- func (d Xtables) InstanceClearBridgeFilter(projectName string, instanceName string, deviceName string, parentName string, ...) error
- func (d Xtables) InstanceClearProxyNAT(projectName string, instanceName string, deviceName string) error
- func (d Xtables) InstanceClearRPFilter(projectName string, instanceName string, deviceName string) error
- func (d Xtables) InstanceSetupBridgeFilter(projectName string, instanceName string, deviceName string, parentName string, ...) error
- func (d Xtables) InstanceSetupProxyNAT(projectName string, instanceName string, deviceName string, ...) error
- func (d Xtables) InstanceSetupRPFilter(projectName string, instanceName string, deviceName string, hostName string) error
- func (d Xtables) NetworkClear(networkName string, ipVersion uint) error
- func (d Xtables) NetworkSetupDHCPDNSAccess(networkName string, ipVersion uint) error
- func (d Xtables) NetworkSetupDHCPv4Checksum(networkName string) error
- func (d Xtables) NetworkSetupForwardingPolicy(networkName string, ipVersion uint, allow bool) error
- func (d Xtables) NetworkSetupOutboundNAT(networkName string, subnet *net.IPNet, srcIP net.IP, appendRule bool) error
- func (d Xtables) String() string
Constants ¶
const FilterIPv4All = "0.0.0.0"
FilterIPv4All used to indicate to firewall package to filter all IPv4 traffic.
const FilterIPv6All = "::"
FilterIPv6All used to indicate to firewall package to filter all IPv6 traffic.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Nftables ¶
type Nftables struct{}
Nftables is an implmentation of LXD firewall using nftables.
func (Nftables) Compat ¶
Compat returns whether the driver backend is in use, and any host compatibility errors.
func (Nftables) InstanceClearBridgeFilter ¶
func (d Nftables) InstanceClearBridgeFilter(projectName string, instanceName string, deviceName string, parentName string, hostName string, hwAddr string, _ net.IP, _ net.IP) error
InstanceClearBridgeFilter removes any filter rules that were added to apply bridged device IP filtering.
func (Nftables) InstanceClearProxyNAT ¶
func (d Nftables) InstanceClearProxyNAT(projectName string, instanceName string, deviceName string) error
InstanceClearProxyNAT remove DNAT rules for proxy devices.
func (Nftables) InstanceClearRPFilter ¶
func (d Nftables) InstanceClearRPFilter(projectName string, instanceName string, deviceName string) error
InstanceClearRPFilter removes reverse path filtering for the specified instance device on the host interface.
func (Nftables) InstanceSetupBridgeFilter ¶
func (d Nftables) InstanceSetupBridgeFilter(projectName string, instanceName string, deviceName string, parentName string, hostName string, hwAddr string, IPv4 net.IP, IPv6 net.IP) error
InstanceSetupBridgeFilter sets up the filter rules to apply bridged device IP filtering.
func (Nftables) InstanceSetupProxyNAT ¶
func (d Nftables) InstanceSetupProxyNAT(projectName string, instanceName string, deviceName string, listen, connect *deviceConfig.ProxyAddress) error
InstanceSetupProxyNAT creates DNAT rules for proxy devices.
func (Nftables) InstanceSetupRPFilter ¶
func (d Nftables) InstanceSetupRPFilter(projectName string, instanceName string, deviceName string, hostName string) error
InstanceSetupRPFilter activates reverse path filtering for the specified instance device on the host interface.
func (Nftables) NetworkClear ¶
NetworkClear removes the LXD network related chains.
func (Nftables) NetworkSetupDHCPDNSAccess ¶
NetworkSetupDHCPDNSAccess sets up basic nftables overrides for DHCP/DNS.
func (Nftables) NetworkSetupDHCPv4Checksum ¶
NetworkSetupDHCPv4Checksum attempts a workaround for broken DHCP clients. No-op as not supported by nftables. See https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables#CHECKSUM.
func (Nftables) NetworkSetupForwardingPolicy ¶
func (d Nftables) NetworkSetupForwardingPolicy(networkName string, ipVersion uint, allow bool) error
NetworkSetupForwardingPolicy allows forwarding dependent on boolean argument
func (Nftables) NetworkSetupOutboundNAT ¶
func (d Nftables) NetworkSetupOutboundNAT(networkName string, subnet *net.IPNet, srcIP net.IP, _ bool) error
NetworkSetupOutboundNAT configures outbound NAT. If srcIP is non-nil then SNAT is used with the specified address, otherwise MASQUERADE mode is used. Append mode is always on and so the append argument is ignored.
type Xtables ¶
type Xtables struct{}
Xtables is an implmentation of LXD firewall using {ip, ip6, eb}tables
func (Xtables) Compat ¶
Compat returns whether the driver backend is in use, and any host compatibility errors.
func (Xtables) InstanceClearBridgeFilter ¶
func (d Xtables) InstanceClearBridgeFilter(projectName string, instanceName string, deviceName string, parentName string, hostName string, hwAddr string, IPv4 net.IP, IPv6 net.IP) error
InstanceClearBridgeFilter removes any filter rules that were added to apply bridged device IP filtering.
func (Xtables) InstanceClearProxyNAT ¶
func (d Xtables) InstanceClearProxyNAT(projectName string, instanceName string, deviceName string) error
InstanceClearProxyNAT remove DNAT rules for proxy devices.
func (Xtables) InstanceClearRPFilter ¶
func (d Xtables) InstanceClearRPFilter(projectName string, instanceName string, deviceName string) error
InstanceClearRPFilter removes reverse path filtering for the specified instance device on the host interface.
func (Xtables) InstanceSetupBridgeFilter ¶
func (d Xtables) InstanceSetupBridgeFilter(projectName string, instanceName string, deviceName string, parentName string, hostName string, hwAddr string, IPv4 net.IP, IPv6 net.IP) error
InstanceSetupBridgeFilter sets up the filter rules to apply bridged device IP filtering.
func (Xtables) InstanceSetupProxyNAT ¶
func (d Xtables) InstanceSetupProxyNAT(projectName string, instanceName string, deviceName string, listen *deviceConfig.ProxyAddress, connect *deviceConfig.ProxyAddress) error
InstanceSetupProxyNAT creates DNAT rules for proxy devices.
func (Xtables) InstanceSetupRPFilter ¶
func (d Xtables) InstanceSetupRPFilter(projectName string, instanceName string, deviceName string, hostName string) error
InstanceSetupRPFilter activates reverse path filtering for the specified instance device on the host interface.
func (Xtables) NetworkClear ¶
NetworkClear removes network rules from filter, mangle and nat tables.
func (Xtables) NetworkSetupDHCPDNSAccess ¶
NetworkSetupDHCPDNSAccess sets up basic iptables overrides for DHCP/DNS.
func (Xtables) NetworkSetupDHCPv4Checksum ¶
NetworkSetupDHCPv4Checksum attempts a workaround for broken DHCP clients.
func (Xtables) NetworkSetupForwardingPolicy ¶
NetworkSetupForwardingPolicy allows forwarding dependent on boolean argument
func (Xtables) NetworkSetupOutboundNAT ¶
func (d Xtables) NetworkSetupOutboundNAT(networkName string, subnet *net.IPNet, srcIP net.IP, appendRule bool) error
NetworkSetupOutboundNAT configures outbound NAT. If srcIP is non-nil then SNAT is used with the specified address, otherwise MASQUERADE mode is used.
Source Files