1#![no_std]
8#![warn(
9 missing_docs,
10 unreachable_patterns,
11 clippy::useless_conversion,
12 clippy::redundant_clone,
13 clippy::precedence
14)]
15
16extern crate alloc;
17
18mod actions;
19mod api;
20mod conntrack;
21mod context;
22mod logic;
23mod matchers;
24mod packets;
25mod state;
26
27use logic::nat::NatConfig;
28
29pub type ConntrackConnection<I, A, BT> = conntrack::Connection<I, NatConfig<I, A>, BT>;
31
32pub use actions::MarkAction;
33pub use api::FilterApi;
34pub use conntrack::{
35 ConnectionDirection, Table, TransportProtocol, Tuple,
36 WeakConnection as WeakConntrackConnection, WeakConnectionError,
37};
38pub use context::{
39 FilterBindingsContext, FilterBindingsTypes, FilterContext, FilterIpContext, NatContext,
40 SocketEgressFilterResult, SocketIngressFilterResult, SocketOpsFilter,
41 SocketOpsFilterBindingContext,
42};
43pub use logic::{
44 FilterHandler, FilterImpl, FilterTimerId, IngressVerdict, ProofOfEgressCheck, Verdict,
45};
46pub use matchers::{
47 AddressMatcher, AddressMatcherType, InterfaceMatcher, InterfaceProperties, PacketMatcher,
48 PortMatcher, TransportProtocolMatcher,
49};
50pub use packets::{
51 FilterIpExt, ForwardedPacket, IcmpMessage, IpPacket, MaybeTransportPacket,
52 MaybeTransportPacketMut, RawIpBody, TransportPacketSerializer, TxPacket,
53};
54pub use state::validation::{ValidRoutines, ValidationError};
55pub use state::{
56 Action, FilterIpMetadata, FilterMarkMetadata, Hook, IpRoutines, NatRoutines, Routine, Routines,
57 Rule, State, TransparentProxy, UninstalledRoutine,
58};
59
60#[cfg(any(test, feature = "testutils"))]
62pub mod testutil {
63 pub use crate::logic::testutil::NoopImpl;
64 pub use crate::packets::testutil::new_filter_egress_ip_packet;
65 use net_types::ip::IpVersion;
66 use packet::FragmentedByteSlice;
67
68 use crate::{
69 FilterIpExt, IpPacket, SocketEgressFilterResult, SocketIngressFilterResult, SocketOpsFilter,
70 };
71 use netstack3_base::socket::SocketCookie;
72 use netstack3_base::{Marks, StrongDeviceIdentifier};
73
74 #[cfg(test)]
75 pub(crate) trait TestIpExt:
76 crate::context::testutil::TestIpExt + crate::packets::testutil::internal::TestIpExt
77 {
78 }
79
80 #[cfg(test)]
81 impl<I> TestIpExt for I where
82 I: crate::context::testutil::TestIpExt + crate::packets::testutil::internal::TestIpExt
83 {
84 }
85
86 pub struct NoOpSocketOpsFilter;
88
89 impl<D: StrongDeviceIdentifier> SocketOpsFilter<D> for NoOpSocketOpsFilter {
90 fn on_egress<I: FilterIpExt, P: IpPacket<I>>(
91 &self,
92 _packet: &P,
93 _device: &D,
94 _cookie: SocketCookie,
95 _marks: &Marks,
96 ) -> SocketEgressFilterResult {
97 SocketEgressFilterResult::Pass { congestion: false }
98 }
99
100 fn on_ingress(
101 &self,
102 _ip_version: IpVersion,
103 _packet: FragmentedByteSlice<'_, &[u8]>,
104 _device: &D,
105 _cookie: SocketCookie,
106 _marks: &Marks,
107 ) -> SocketIngressFilterResult {
108 SocketIngressFilterResult::Accept
109 }
110 }
111}