mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-07 15:31:30 +02:00
778b3b3264
* Unify peer and route ACL filtering with multi-source peer rules * Remove partial userspace firewall mode and open foreign chains via a table-less allower * Snapshot iptables rule maps before persisting state * Scope userspace firewall wildcard source rules per address family * Install nftables peer filter and mangle rules in a single transaction * Share the iptables jump rule spec between install and cleanup * Fix legacy ACL source wildcard and keep rollback tracking on delete failure * Fix CI: recognize multi-value port set lookups in tests and correct PeerIP lint suppression * Fall back to per-prefix filter rules when ipset is unavailable * Annotate legacy PeerIP usages in ACL tests and fix import formatting * Keep firewall rule bookkeeping in step with the kernel on replace and teardown * Release the routing reference when the route manager shuts down * Keep set references and rule tracking consistent when a routing rule fails
27 lines
665 B
Go
27 lines
665 B
Go
package nftables
|
|
|
|
import (
|
|
"net/netip"
|
|
|
|
"github.com/google/nftables"
|
|
|
|
"github.com/netbirdio/netbird/client/firewall/manager"
|
|
)
|
|
|
|
// Rule wraps an installed filter rule (peer or route). Source set
|
|
// membership is encoded in the rule's expressions; DeleteFilterRule
|
|
// recovers the set name via findSets so the refcounter can drop the
|
|
// right reference. mangleRule is set only for peer rules.
|
|
type Rule struct {
|
|
nftRule *nftables.Rule
|
|
mangleRule *nftables.Rule
|
|
// sources is the canonical source list this rule was created for.
|
|
sources []netip.Prefix
|
|
id manager.RuleID
|
|
}
|
|
|
|
// ID returns the rule id
|
|
func (r *Rule) ID() manager.RuleID {
|
|
return r.id
|
|
}
|