mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-05 22:41:30 +02:00
778b3b3264
* Unify peer and route ACL filtering with multi-source peer rules * Remove partial userspace firewall mode and open foreign chains via a table-less allower * Snapshot iptables rule maps before persisting state * Scope userspace firewall wildcard source rules per address family * Install nftables peer filter and mangle rules in a single transaction * Share the iptables jump rule spec between install and cleanup * Fix legacy ACL source wildcard and keep rollback tracking on delete failure * Fix CI: recognize multi-value port set lookups in tests and correct PeerIP lint suppression * Fall back to per-prefix filter rules when ipset is unavailable * Annotate legacy PeerIP usages in ACL tests and fix import formatting * Keep firewall rule bookkeeping in step with the kernel on replace and teardown * Release the routing reference when the route manager shuts down * Keep set references and rule tracking consistent when a routing rule fails
30 lines
934 B
Go
30 lines
934 B
Go
//go:build !linux || android
|
|
|
|
package firewall
|
|
|
|
import (
|
|
"fmt"
|
|
"runtime"
|
|
|
|
firewall "github.com/netbirdio/netbird/client/firewall/manager"
|
|
"github.com/netbirdio/netbird/client/firewall/uspfilter"
|
|
nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
|
|
"github.com/netbirdio/netbird/client/internal/statemanager"
|
|
)
|
|
|
|
// NewFirewall creates a firewall manager instance
|
|
func NewFirewall(iface IFaceMapper, _ *statemanager.Manager, flowLogger nftypes.FlowLogger, disableServerRoutes bool, mtu uint16) (firewall.Manager, error) {
|
|
if !iface.IsUserspaceBind() {
|
|
return nil, fmt.Errorf("not implemented for this OS: %s", runtime.GOOS)
|
|
}
|
|
|
|
// use userspace packet filtering firewall
|
|
return uspfilter.Create(uspfilter.Config{
|
|
IFace: iface,
|
|
DisableServerRoutes: disableServerRoutes,
|
|
FlowLogger: flowLogger,
|
|
MTU: mtu,
|
|
InterfaceAllower: interfaceAllower(iface, mtu),
|
|
})
|
|
}
|