mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-12 17:59:06 +02:00
Viktor Liu
778b3b3264
* Unify peer and route ACL filtering with multi-source peer rules * Remove partial userspace firewall mode and open foreign chains via a table-less allower * Snapshot iptables rule maps before persisting state * Scope userspace firewall wildcard source rules per address family * Install nftables peer filter and mangle rules in a single transaction * Share the iptables jump rule spec between install and cleanup * Fix legacy ACL source wildcard and keep rollback tracking on delete failure * Fix CI: recognize multi-value port set lookups in tests and correct PeerIP lint suppression * Fall back to per-prefix filter rules when ipset is unavailable * Annotate legacy PeerIP usages in ACL tests and fix import formatting * Keep firewall rule bookkeeping in step with the kernel on replace and teardown * Release the routing reference when the route manager shuts down * Keep set references and rule tracking consistent when a routing rule fails
66 lines
1.4 KiB
Go
66 lines
1.4 KiB
Go
package id
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"fmt"
|
|
"net/netip"
|
|
"slices"
|
|
"strconv"
|
|
|
|
"github.com/netbirdio/netbird/client/firewall/manager"
|
|
)
|
|
|
|
// RuleID aliases manager.RuleID so existing nbid.RuleID references
|
|
// keep working while the canonical type lives in the firewall package.
|
|
type RuleID = manager.RuleID
|
|
|
|
// GenerateRuleID returns a deterministic content hash identifying a filter rule.
|
|
func GenerateRuleID(
|
|
sources []netip.Prefix,
|
|
destination manager.Network,
|
|
proto manager.Protocol,
|
|
sPort *manager.Port,
|
|
dPort *manager.Port,
|
|
action manager.Action,
|
|
) RuleID {
|
|
sources = slices.Clone(sources)
|
|
manager.SortPrefixes(sources)
|
|
|
|
h := sha256.New()
|
|
|
|
// Write all fields to the hasher, with delimiters
|
|
h.Write([]byte("sources:"))
|
|
for _, src := range sources {
|
|
h.Write([]byte(src.String()))
|
|
h.Write([]byte(","))
|
|
}
|
|
|
|
h.Write([]byte("destination:"))
|
|
h.Write([]byte(destination.String()))
|
|
|
|
h.Write([]byte("proto:"))
|
|
h.Write([]byte(proto))
|
|
|
|
h.Write([]byte("sPort:"))
|
|
if sPort != nil {
|
|
h.Write([]byte(sPort.String()))
|
|
} else {
|
|
h.Write([]byte("<nil>"))
|
|
}
|
|
|
|
h.Write([]byte("dPort:"))
|
|
if dPort != nil {
|
|
h.Write([]byte(dPort.String()))
|
|
} else {
|
|
h.Write([]byte("<nil>"))
|
|
}
|
|
|
|
h.Write([]byte("action:"))
|
|
h.Write([]byte(strconv.Itoa(int(action))))
|
|
hash := hex.EncodeToString(h.Sum(nil))
|
|
|
|
// prepend destination prefix to be able to identify the rule
|
|
return RuleID(fmt.Sprintf("%s-%s", destination.String(), hash[:16]))
|
|
}
|