netset

netset is a small Go package for managing Linux ipset sets and nftables sets through netlink, without external dependencies.

The public API follows the shape of github.com/nadoo/ipset for existing ipset users, and adds an NFTSet client for nftables.

ipset

package main

import "github.com/nadoo/netset"

func main() {
	if err := netset.Init(); err != nil {
		panic(err)
	}

	_ = netset.Destroy("myset")
	if err := netset.Create("myset"); err != nil {
		panic(err)
	}
	_ = netset.Add("myset", "1.1.1.1")
	_ = netset.Add("myset", "2.2.2.0/24")
}

nftables set

The nftables table must already exist. Use OptInterval() when the set will store CIDR prefixes, and use OptIPv6() when creating a set for IPv6 keys. The address version and interval mode are fixed after creation. A timeout must also be enabled when the set is created before per-element timeout overrides can be used.

package main

import "github.com/nadoo/netset"

func main() {
	s, err := netset.NewNFTSet("filter", "myset", netset.OptFamily(netset.FamilyINet), netset.OptInterval())
	if err != nil {
		panic(err)
	}
	defer s.Close()

	_ = s.Destroy()
	if err := s.Create(); err != nil {
		panic(err)
	}
	_ = s.Add("1.1.1.1")
	_ = s.Add("2.2.2.0/24")
}

On non-Linux platforms the constructors return an unsupported-platform error.