Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[client] Add stateful userspace firewall and remove egress filters #3093

Open
wants to merge 15 commits into
base: main
Choose a base branch
from

Conversation

lixmal
Copy link
Contributor

@lixmal lixmal commented Dec 20, 2024

Describe your changes

  • Add stateful firewall functionality for UDP/TCP/ICMP in userspace firewalll
  • Removes all egress drop rules/filters, still needs refactoring so we don't add output rules to any chains/filters.
  • on Linux, if the OUTPUT policy is DROP then we don't do anything about it (no extra allow rules). This is up to the user, if they don't want anything leaving their machine they'll have to manage these rules explicitly.

Issue ticket number and link

Checklist

  • Is it a bug fix
  • Is a typo/documentation fix
  • Is a feature enhancement
  • It is a refactor
  • Created tests that fail without the change (if possible)
  • Extended the README / documentation, if necessary

@lixmal lixmal force-pushed the remove-egress-filters branch from 809d63f to 8216ab6 Compare December 20, 2024 16:53
Copy link

Quality Gate Failed Quality Gate failed

Failed conditions
8 New issues
8 New Code Smells (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@lixmal lixmal changed the title [client] Remove egress filters [client] Add stateful userspace firewall and remove egress filters Dec 21, 2024

// TrackOutbound processes an outbound TCP packet and updates connection state
func (t *TCPTracker) TrackOutbound(srcIP net.IP, dstIP net.IP, srcPort uint16, dstPort uint16, flags uint8) {
t.mutex.Lock()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can apply the locks later, right before touch the map.

// TCPTracker manages TCP connection states
type TCPTracker struct {
connections map[TCPConnKey]*TCPConnTrack
mutex sync.RWMutex
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is RWMutex but it has been used without RW feature

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants