mirror of
https://github.com/EasyTier/EasyTier.git
synced 2026-05-07 10:14:35 +00:00
Sijie.Sun
8e7a8de5e5
1. get acl stats
```
./easytier-cli acl stats
AclStats:
Global:
CacheHits: 4
CacheMaxSize: 10000
CacheSize: 5
DefaultAllows: 3
InboundPacketsAllowed: 2
InboundPacketsTotal: 2
OutboundPacketsAllowed: 7
OutboundPacketsTotal: 7
PacketsAllowed: 9
PacketsTotal: 9
RuleMatches: 2
ConnTrack:
[src: 10.14.11.1:57444, dst: 10.14.11.2:1000, proto: Tcp, state: New, pkts: 1, bytes: 60, created: 2025-07-24 10:13:39 +08:00, last_seen: 2025-07-24 10:13:39 +08:00]
Rules:
[name: 'tcp_whitelist', prio: 1000, action: Allow, enabled: true, proto: Tcp, ports: ["1000"], src_ports: [], src_ips: [], dst_ips: [], stateful: true, rate: 0, burst: 0] [pkts: 2, bytes: 120]
```
2. use tcp/udp whitelist to block unexpected traffic.
`sudo ./easytier-core -d --tcp-whitelist 1000`
3. use complete acl ability with config file:
```
[[acl.acl_v1.chains]]
name = "inbound_whitelist"
chain_type = 1
description = "Auto-generated inbound whitelist from CLI"
enabled = true
default_action = 2
[[acl.acl_v1.chains.rules]]
name = "tcp_whitelist"
description = "Auto-generated TCP whitelist rule"
priority = 1000
enabled = true
protocol = 1
ports = ["1000"]
source_ips = []
destination_ips = []
source_ports = []
action = 1
rate_limit = 0
burst_limit = 0
stateful = true
```
67 lines
1.7 KiB
Rust
67 lines
1.7 KiB
Rust
mod graph_algo;
|
|
|
|
pub mod acl_filter;
|
|
pub mod peer;
|
|
// pub mod peer_conn;
|
|
pub mod peer_conn;
|
|
pub mod peer_conn_ping;
|
|
pub mod peer_manager;
|
|
pub mod peer_map;
|
|
pub mod peer_ospf_route;
|
|
pub mod peer_rpc;
|
|
pub mod peer_rpc_service;
|
|
pub mod route_trait;
|
|
pub mod rpc_service;
|
|
|
|
pub mod foreign_network_client;
|
|
pub mod foreign_network_manager;
|
|
|
|
pub mod encrypt;
|
|
|
|
pub mod peer_task;
|
|
|
|
#[cfg(test)]
|
|
pub mod tests;
|
|
|
|
use crate::tunnel::packet_def::ZCPacket;
|
|
|
|
#[async_trait::async_trait]
|
|
#[auto_impl::auto_impl(Arc)]
|
|
pub trait PeerPacketFilter {
|
|
async fn try_process_packet_from_peer(&self, _zc_packet: ZCPacket) -> Option<ZCPacket> {
|
|
Some(_zc_packet)
|
|
}
|
|
}
|
|
|
|
#[async_trait::async_trait]
|
|
#[auto_impl::auto_impl(Arc)]
|
|
pub trait NicPacketFilter {
|
|
async fn try_process_packet_from_nic(&self, data: &mut ZCPacket) -> bool;
|
|
|
|
fn id(&self) -> String {
|
|
format!("{:p}", self)
|
|
}
|
|
}
|
|
|
|
type BoxPeerPacketFilter = Box<dyn PeerPacketFilter + Send + Sync>;
|
|
type BoxNicPacketFilter = Box<dyn NicPacketFilter + Send + Sync>;
|
|
|
|
// pub type PacketRecvChan = tachyonix::Sender<ZCPacket>;
|
|
// pub type PacketRecvChanReceiver = tachyonix::Receiver<ZCPacket>;
|
|
// pub fn create_packet_recv_chan() -> (PacketRecvChan, PacketRecvChanReceiver) {
|
|
// tachyonix::channel(128)
|
|
// }
|
|
pub type PacketRecvChan = tokio::sync::mpsc::Sender<ZCPacket>;
|
|
pub type PacketRecvChanReceiver = tokio::sync::mpsc::Receiver<ZCPacket>;
|
|
pub fn create_packet_recv_chan() -> (PacketRecvChan, PacketRecvChanReceiver) {
|
|
tokio::sync::mpsc::channel(128)
|
|
}
|
|
pub async fn recv_packet_from_chan(
|
|
packet_recv_chan_receiver: &mut PacketRecvChanReceiver,
|
|
) -> Result<ZCPacket, anyhow::Error> {
|
|
packet_recv_chan_receiver
|
|
.recv()
|
|
.await
|
|
.ok_or(anyhow::anyhow!("recv_packet_from_chan failed"))
|
|
}
|