nftables

type BaseChain ¶

type BaseChain struct {
	Name      string
	ChainType BaseChainType
	Hook      BaseChainHook
	Priority  int
	Policy    BaseChainPolicy // Defaults to BaseChainPolicyAccept
}

BaseChain constructs a new nftables base chain and returns a [ChainRef].

See https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Adding_base_chains

It is an error to create a base chain that already exists. If the underlying chain already exists, it will be flushed by the next Table.Apply before new rules are added.

type BaseChainHook ¶

type BaseChainHook string

BaseChainHook enumerates the base chain hook types. See https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Base_chain_hooks

const (
	BaseChainHookIngress     BaseChainHook = "ingress"
	BaseChainHookPrerouting  BaseChainHook = "prerouting"
	BaseChainHookInput       BaseChainHook = "input"
	BaseChainHookForward     BaseChainHook = "forward"
	BaseChainHookOutput      BaseChainHook = "output"
	BaseChainHookPostrouting BaseChainHook = "postrouting"
)

type BaseChainPolicy ¶

type BaseChainPolicy string

BaseChainPolicy enumerates base chain policies. See https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Base_chain_policy

const (
	BaseChainPolicyAccept BaseChainPolicy = "accept"
	BaseChainPolicyDrop   BaseChainPolicy = "drop"
)

type BaseChainType ¶

type BaseChainType string

BaseChainType enumerates the base chain types. See https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Base_chain_types

const (
	BaseChainTypeFilter BaseChainType = "filter"
	BaseChainTypeRoute  BaseChainType = "route"
	BaseChainTypeNAT    BaseChainType = "nat"
)

type Chain ¶

type Chain struct {
	Name string
}

Chain implements the Obj interface, it can be passed to a Modifier to create or delete a chain.

type Family ¶

type Family string

Family enumerates address families.

const (
	IPv4 Family = "ip"
	IPv6 Family = "ip6"
)

type Modifier ¶

type Modifier struct {
	// contains filtered or unexported fields
}

Modifier is used to apply changes to a Table.

func (tm *Modifier) Create(o Obj)

func (tm *Modifier) Delete(o Obj)

func (tm *Modifier) Reverse() Modifier

type NftType ¶

type NftType string

NftType enumerates nft types that can be used to define maps/sets etc.

const (
	NftTypeIPv4Addr    NftType = "ipv4_addr"
	NftTypeIPv6Addr    NftType = "ipv6_addr"
	NftTypeEtherAddr   NftType = "ether_addr"
	NftTypeInetProto   NftType = "inet_proto"
	NftTypeInetService NftType = "inet_service"
	NftTypeMark        NftType = "mark"
	NftTypeIfname      NftType = "ifname"
)

type Obj ¶

type Obj interface {
	// contains filtered or unexported methods
}

Obj is an object that can be given to a Modifier, representing an nftables object for it to create or delete.

type Rule ¶

type Rule struct {
	Chain string
	Group RuleGroup
	Rule  []string
	// IgnoreExist suppresses errors about deleting a rule that does not exist
	// or creating a rule that does already exist.
	//
	// Note that, when set, reversing the [Modifier] may not do what you want! For
	// example, if the original modifier deleted a rule that did not exist, the
	// reversed modifier will create that rule.
	IgnoreExist bool
}

Rule implements the Obj interface, it can be passed to a Modifier to create or delete a rule in a chain.

type RuleGroup ¶

type RuleGroup int

RuleGroup is used to allocate rules within a chain to a group. These groups are purely an internal construct, nftables knows nothing about them. Within groups rules retain the order in which they were added, and groups are ordered from lowest to highest numbered group.

type Set ¶

type Set struct {
	Name        string
	ElementType NftType
	Flags       []string
}

Set implements the Obj interface, it can be passed to a Modifier to create or delete a set.

type SetElement ¶

type SetElement struct {
	SetName string
	Element string
}

SetElement implements the Obj interface, it can be passed to a Modifier to create or delete an entry in a set.

type Table ¶

type Table struct {
	// contains filtered or unexported fields
}

Table is a handle for an nftables table.

func NewTable(family Family, name string) (Table, error)

func (t *Table) Apply(ctx context.Context, tm Modifier) (retErr error)

func (t Table) Family() Family

func (t Table) IsValid() bool

func (t Table) Name() string

func (t Table) Reload(ctx context.Context) error

func (t Table) SetBaseChainPolicy(ctx context.Context, chainName string, policy BaseChainPolicy) error

type VMap ¶

type VMap struct {
	Name        string
	ElementType NftType
	Flags       []string
}

VMap implements the Obj interface, it can be passed to a Modifier to create or delete a verdict map.

type VMapElement ¶

type VMapElement struct {
	VmapName string
	Key      string
	Verdict  string
}

VMapElement implements the Obj interface, it can be passed to a Modifier to create or delete an entry in a verdict map.