netstack3_filter/
lib.rs

1// Copyright 2024 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5//! Packet filtering framework.
6
7#![no_std]
8#![warn(
9    missing_docs,
10    unreachable_patterns,
11    clippy::useless_conversion,
12    clippy::redundant_clone,
13    clippy::precedence
14)]
15
16extern crate alloc;
17
18mod actions;
19mod api;
20mod conntrack;
21mod context;
22mod logic;
23mod matchers;
24mod packets;
25mod state;
26
27use logic::nat::NatConfig;
28
29/// A connection as tracked by conntrack.
30pub type ConntrackConnection<I, A, BT> = conntrack::Connection<I, NatConfig<I, A>, BT>;
31
32pub use actions::MarkAction;
33pub use api::FilterApi;
34pub use conntrack::{
35    ConnectionDirection, Table, TransportTuple, Tuple, WeakConnection as WeakConntrackConnection,
36    WeakConnectionError,
37};
38pub use context::{
39    EitherIpProto, FilterBindingsContext, FilterBindingsTypes, FilterContext, FilterIpContext,
40    FrameDestination, LocalFrameDestination, Marks, NatContext, PacketType,
41    SocketEgressFilterResult, SocketInfo, SocketIngressFilterResult, SocketOpsFilter,
42    SocketOpsFilterBindingContext,
43};
44pub use logic::{
45    Accept, DropOrReject, DropPacket, FilterHandler, FilterImpl, FilterTimerId, IngressStopReason,
46    IngressVerdict, Interfaces, ProofOfEgressCheck, Verdict,
47};
48pub use matchers::{BindingsPacketMatcher, PacketMatcher, TransportProtocolMatcher};
49pub use packets::{
50    DynTransportSerializer, DynamicTransportSerializer, FilterIpExt, FilterIpPacket,
51    ForwardedPacket, IcmpMessage, IpPacket, MaybeTransportPacket, MaybeTransportPacketMut,
52    RawIpBody, TransportPacketSerializer, TxPacket,
53};
54pub use state::validation::{ValidRoutines, ValidationError};
55pub use state::{
56    Action, FilterIpMetadata, FilterPacketMetadata, Hook, IpRoutines, NatRoutines, RejectType,
57    Routine, Routines, Rule, State, TransparentProxy, UninstalledRoutine,
58};
59
60/// Testing-related utilities for use by other crates.
61#[cfg(any(test, feature = "testutils"))]
62pub mod testutil {
63    pub use crate::logic::testutil::NoopImpl;
64    pub use crate::packets::testutil::new_filter_egress_ip_packet;
65    pub use crate::state::testutil::FakePacketMetadata;
66    use net_types::ip::IpVersion;
67    use packet::FragmentedByteSlice;
68
69    use crate::{
70        FilterIpExt, IpPacket, Marks, PacketType, SocketEgressFilterResult, SocketInfo,
71        SocketIngressFilterResult, SocketOpsFilter,
72    };
73
74    #[cfg(test)]
75    pub(crate) trait TestIpExt:
76        crate::context::testutil::TestIpExt + crate::packets::testutil::internal::TestIpExt
77    {
78    }
79
80    #[cfg(test)]
81    impl<I> TestIpExt for I where
82        I: crate::context::testutil::TestIpExt + crate::packets::testutil::internal::TestIpExt
83    {
84    }
85
86    /// No-op implementation of `SocketOpsFilter`.
87    pub struct NoOpSocketOpsFilter;
88
89    impl<D> SocketOpsFilter<D> for NoOpSocketOpsFilter {
90        fn on_egress<I: FilterIpExt, P: IpPacket<I>>(
91            &self,
92            _packet: &P,
93            _device: &D,
94            _socket_info: SocketInfo,
95            _marks: &Marks,
96            _gso_info: Option<netstack3_base::GsoInfo>,
97        ) -> SocketEgressFilterResult {
98            SocketEgressFilterResult::Pass { congestion: false }
99        }
100
101        fn on_ingress(
102            &self,
103            _ip_version: IpVersion,
104            _packet: FragmentedByteSlice<'_, &[u8]>,
105            _header_len: usize,
106            _device: &D,
107            _socket_info: SocketInfo,
108            _marks: &Marks,
109            _packet_type: PacketType,
110            _gso_info: Option<netstack3_base::GsoInfo>,
111        ) -> SocketIngressFilterResult {
112            SocketIngressFilterResult::Accept
113        }
114    }
115}
netstack3_filter/lib.rs

netstack3_filter/
lib.rs
