func Disable()

func Enable()error

func Enabled()bool

type BaseChain struct {NamestringChainTypeBaseChainTypeHookBaseChainHookPriorityintPolicyBaseChainPolicy// Defaults to BaseChainPolicyAccept}

type BaseChainHookstring

type BaseChainPolicystring

type BaseChainTypestring

type Chain struct {Namestring}

type Familystring

type Modifier struct {// contains filtered or unexported fields}

func (*Modifier)Create¶

func (tm *Modifier) Create(oObj)

Create enqueues creation of object o, to be applied by tm.Apply.

func (*Modifier)Delete¶

func (tm *Modifier) Delete(oObj)

Delete enqueues deletion of object o, to be applied by tm.Apply.

func (*Modifier)Reverse¶

func (tm *Modifier) Reverse()Modifier

Reverse returns a Modifier that will undo the actions of tm.Its operations are performed in reverse order, creates becomedeletes, and deletes become creates.

Most operations are fully reversible (chains/maps/sets must beempty before they're deleted, so no information is lost). But,there are exceptions, noted in comments in the object definitions.

Applying the updates in a reversed modifier may not work ifany of the objects have been removed or modified since theywere added. For example, if a Modifier creates a chain then anotherModifier adds rules, the reversed Modifier will not be able todelete the chain as it is not empty.

type NftTypestring

type Obj interface {// contains filtered or unexported methods}

type Rule struct {ChainstringGroupRuleGroupRule  []string// IgnoreExist suppresses errors about deleting a rule that does not exist// or creating a rule that does already exist.//// Note that, when set, reversing the [Modifier] may not do what you want! For// example, if the original modifier deleted a rule that did not exist, the// reversed modifier will create that rule.IgnoreExistbool}

type RuleGroupint

type Set struct {NamestringElementTypeNftTypeFlags       []string}

type SetElement struct {SetNamestringElementstring}

type Table struct {// contains filtered or unexported fields}

funcNewTable¶

func NewTable(familyFamily, namestring) (Table,error)

NewTable creates a new nftables table and returns aTable

Seehttps://wiki.nftables.org/wiki-nftables/index.php/Configuring_tables

To modify the table, instantiate aModifier, add commands to it, and callTable.Apply.

It's flushed in case it already exists in the host's nftables - when thathappens, rules in its chains will be deleted but not the chains themselves,maps, sets, or elements of maps or sets. But, those un-flushed items can't doanything disruptive unless referred to by rules, and they will be flushed ifthey get re-created via theTable, whenTable.Apply is next called(so, before they can be used by a new rule).

To fully delete an underlying nftables table, if one already exists,useTable.Reload after creating the table.

func (*Table)Apply¶

func (t *Table) Apply(ctxcontext.Context, tmModifier) (retErrerror)

Apply makes incremental updates to nftables. If there's a validationerror in any of the enqueued objects, or an error applying the updatesto the underlying nftables, theTable will be unmodified.

func (Table)Close¶

func (tTable) Close()error

Close releases resources associated with the table. It does not modify or deletethe underlying nftables table.

func (Table)Family¶

func (tTable) Family()Family

Family returns the address family of the nftables table described by [TableRef].

func (Table)IsValid¶

func (tTable) IsValid()bool

IsValid returns true if t is a valid reference to a table.

func (Table)Name¶

func (tTable) Name()string

Name returns the name of the table, or an empty string if t is not valid.

func (Table)Reload¶

func (tTable) Reload(ctxcontext.Context)error

Reload deletes the table, then re-creates it, atomically.

func (Table)SetBaseChainPolicy¶

func (tTable) SetBaseChainPolicy(ctxcontext.Context, chainNamestring, policyBaseChainPolicy)error

SetBaseChainPolicy sets the default policy for a base chain. The updateis applied immediately, unlike creation/deletion of objects via aModifierwhich are not applied until [Modifier.Apply] is called.

type VMap struct {NamestringElementTypeNftTypeFlags       []string}

type VMapElement struct {VmapNamestringKeystringVerdictstring}