mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-09 16:31:29 +02:00
778b3b3264
* Unify peer and route ACL filtering with multi-source peer rules * Remove partial userspace firewall mode and open foreign chains via a table-less allower * Snapshot iptables rule maps before persisting state * Scope userspace firewall wildcard source rules per address family * Install nftables peer filter and mangle rules in a single transaction * Share the iptables jump rule spec between install and cleanup * Fix legacy ACL source wildcard and keep rollback tracking on delete failure * Fix CI: recognize multi-value port set lookups in tests and correct PeerIP lint suppression * Fall back to per-prefix filter rules when ipset is unavailable * Annotate legacy PeerIP usages in ACL tests and fix import formatting * Keep firewall rule bookkeeping in step with the kernel on replace and teardown * Release the routing reference when the route manager shuts down * Keep set references and rule tracking consistent when a routing rule fails
44 lines
1.0 KiB
Go
44 lines
1.0 KiB
Go
package internal
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"net"
|
|
"net/netip"
|
|
|
|
firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
|
|
mgmProto "github.com/netbirdio/netbird/shared/management/proto"
|
|
)
|
|
|
|
func convertPortInfo(portInfo *mgmProto.PortInfo) (*firewallManager.Port, error) {
|
|
if portInfo == nil {
|
|
return nil, errors.New("portInfo cannot be nil")
|
|
}
|
|
|
|
if portInfo.GetPort() != 0 {
|
|
return firewallManager.NewPort(int(portInfo.GetPort()))
|
|
}
|
|
|
|
if portInfo.GetRange() != nil {
|
|
return firewallManager.NewPort(int(portInfo.GetRange().Start), int(portInfo.GetRange().End))
|
|
}
|
|
|
|
return nil, fmt.Errorf("invalid portInfo: %v", portInfo)
|
|
}
|
|
|
|
func convertToIP(rawIP []byte) (netip.Addr, error) {
|
|
if rawIP == nil {
|
|
return netip.Addr{}, errors.New("input bytes cannot be nil")
|
|
}
|
|
|
|
if len(rawIP) != net.IPv4len && len(rawIP) != net.IPv6len {
|
|
return netip.Addr{}, fmt.Errorf("invalid IP length: %d", len(rawIP))
|
|
}
|
|
|
|
if len(rawIP) == net.IPv4len {
|
|
return netip.AddrFrom4([4]byte(rawIP)), nil
|
|
}
|
|
|
|
return netip.AddrFrom16([16]byte(rawIP)), nil
|
|
}
|