netstack3_filter/
lib.rs

1// Copyright 2024 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5//! Packet filtering framework.
6
7#![no_std]
8#![warn(
9    missing_docs,
10    unreachable_patterns,
11    clippy::useless_conversion,
12    clippy::redundant_clone,
13    clippy::precedence
14)]
15
16extern crate alloc;
17
18mod actions;
19mod api;
20mod conntrack;
21mod context;
22mod logic;
23mod matchers;
24mod packets;
25mod state;
26
27use logic::nat::NatConfig;
28
29/// A connection as tracked by conntrack.
30pub type ConntrackConnection<I, A, BT> = conntrack::Connection<I, NatConfig<I, A>, BT>;
31
32pub use actions::MarkAction;
33pub use api::FilterApi;
34pub use conntrack::{
35    ConnectionDirection, Table, TransportProtocol, Tuple,
36    WeakConnection as WeakConntrackConnection, WeakConnectionError,
37};
38pub use context::{
39    FilterBindingsContext, FilterBindingsTypes, FilterContext, FilterIpContext, NatContext,
40    SocketEgressFilterResult, SocketIngressFilterResult, SocketOpsFilter,
41    SocketOpsFilterBindingContext,
42};
43pub use logic::{
44    FilterHandler, FilterImpl, FilterTimerId, IngressVerdict, ProofOfEgressCheck, Verdict,
45};
46pub use matchers::{PacketMatcher, TransportProtocolMatcher};
47pub use packets::{
48    DynTransportSerializer, DynamicTransportSerializer, FilterIpExt, ForwardedPacket, IcmpMessage,
49    IpPacket, MaybeTransportPacket, MaybeTransportPacketMut, RawIpBody, TransportPacketSerializer,
50    TxPacket,
51};
52pub use state::validation::{ValidRoutines, ValidationError};
53pub use state::{
54    Action, FilterIpMetadata, FilterMarkMetadata, Hook, IpRoutines, NatRoutines, Routine, Routines,
55    Rule, State, TransparentProxy, UninstalledRoutine,
56};
57
58/// Testing-related utilities for use by other crates.
59#[cfg(any(test, feature = "testutils"))]
60pub mod testutil {
61    pub use crate::logic::testutil::NoopImpl;
62    pub use crate::packets::testutil::new_filter_egress_ip_packet;
63    use net_types::ip::IpVersion;
64    use packet::FragmentedByteSlice;
65
66    use crate::{
67        FilterIpExt, IpPacket, SocketEgressFilterResult, SocketIngressFilterResult, SocketOpsFilter,
68    };
69    use netstack3_base::socket::SocketCookie;
70    use netstack3_base::{Marks, StrongDeviceIdentifier};
71
72    #[cfg(test)]
73    pub(crate) trait TestIpExt:
74        crate::context::testutil::TestIpExt + crate::packets::testutil::internal::TestIpExt
75    {
76    }
77
78    #[cfg(test)]
79    impl<I> TestIpExt for I where
80        I: crate::context::testutil::TestIpExt + crate::packets::testutil::internal::TestIpExt
81    {
82    }
83
84    /// No-op implementation of `SocketOpsFilter`.
85    pub struct NoOpSocketOpsFilter;
86
87    impl<D: StrongDeviceIdentifier> SocketOpsFilter<D> for NoOpSocketOpsFilter {
88        fn on_egress<I: FilterIpExt, P: IpPacket<I>>(
89            &self,
90            _packet: &P,
91            _device: &D,
92            _cookie: SocketCookie,
93            _marks: &Marks,
94        ) -> SocketEgressFilterResult {
95            SocketEgressFilterResult::Pass { congestion: false }
96        }
97
98        fn on_ingress(
99            &self,
100            _ip_version: IpVersion,
101            _packet: FragmentedByteSlice<'_, &[u8]>,
102            _device: &D,
103            _cookie: SocketCookie,
104            _marks: &Marks,
105        ) -> SocketIngressFilterResult {
106            SocketIngressFilterResult::Accept
107        }
108    }
109}
netstack3_filter/lib.rs

netstack3_filter/
lib.rs
