serviceFilter — local packet filtering service

class serviceFilter.FilterService

Provide access to the local system packet filtering

addCounter(rulenum=None, **kwargs)

Add a counting rule and return the rulenum used. If a rulenum is specified, it is used. Potential arg keys: * input <interface>, watch incoming interface * output <interface, watch outgoing interface * marker 0-7, watch traffic with marker num only

addInputBlockingFilter(rulenum=None, **kwargs)

Add an input blocking rule and return the rulenum used. If one is specified, it is used Potential arg keys: * dst <cidr> - destination address as a CIDR * src <cidr> - source address as a CIDR * proto <num> - protocol number * sport <num> - single source port as a number * dport <num> - single destination port as a number

addOutputMarkingFilter(rulenum=None, **kwargs)

Add a marking rule and return the rulenum used. If a rulenum is specified, it is used Potential arg keys same as blocking filter plus: * marker 1-7, ipprecendece value to set on the matching packets

deleteBlocks()

Remove all blocking filters that we installed on this node

deleteCounters()

Delete all counting filters that we installed on this node

deleteFilter(rulenum)

Delete the filter with the associated rulenum

deleteMarkers()

Remove all marking filters that we installed on this node

class serviceFilter.IPFWFilters

Filter implementation for IPFW based systems such as FreeBSD

addCounter(rulenum, **kwargs)

blockInput(rulenum, **kwargs)

delete(rulenum)

ipfw lets us delete using just the rulenum we provided

class serviceFilter.NetfilterFilters

Filter implementation for a Linux/Netfilter based system

addCounter(rulenum, **kwargs)

MARK isn’t used as a target so the mark values are always 0. Matching NOT mark means that this match is always true anded with the next matches. We use it for id’ing our rule later on in a quick fashion

blockInput(rulenum, **kwargs)

delete(rulenum)

Netfilter doesn’t have ‘global’ rulenums so we need to remember the command we used to add the filter and use the same to delete it.

markOutput(rulenum, **kwargs)

class serviceFilter.NoFilters

Blank filter implementation for non supported operating systems

addCounter(rulenum, **kwargs)

blockInput(rulenum, **kwargs)

delete(rulenum)

init()

markOutput(rulenum, **kwargs)