Add comprehensive nftables compiler with shorewall feature parity

Rewrites the compiler from ~440 to ~1700 lines covering all major shorewall
firewall features: loopback, conntrack fast-path, anti-spoof, DHCP, intra-zone,
blacklist/whitelist, conntrack notrack, tunnels (13 types), rules with sections,
DNAT/redirect, SNAT/masquerade, static NAT, policies with zone exclusions,
MSS clamping, rate limiting, connection limiting, negated addresses, ICMP type
matching, TCP RST reject, user/UID matching, mark match/set, NFQUEUE, NONAT,
and policy-level rate/conn limiting.

Adds full config types for all shorewall subsystems (mangle, accounting, maclist,
netmap, providers, tunnels, conntrack, blrules, proxyarp/ndp, routes, tc, secmarks),
shorewall migration tooling, expanded CLI commands, expression-level diff engine,
and 49 unit tests.

tomswall.example.yaml

@@ -2,9 +2,12 @@
 # Spiritual successor to shorewall — manages nftables directly
 
 settings:
+  # address_family: inet (default), ip (IPv4 only), ip6 (IPv6 only)
+  address_family: inet
   ip_forwarding: true
   log_level: info
   table_name: tomswall
+  implicit_continue: false
 
 # Named port groups — reusable port+protocol combos referenced in rules
 portgroups:
@@ -28,6 +31,7 @@ portgroups:
     ports: ["1024-65535"]
 
 # Security zones (replaces /etc/shorewall/zones)
+# Child zones are listed before parents; nesting via parents field.
 zones:
   fw:
     type: firewall
@@ -37,6 +41,10 @@ zones:
     type: ip
   dmz:
     type: ip
+  # Example nested zone: sam is a sub-zone of net
+  # sam:
+  #   type: ip
+  #   parents: [net]
 
 # Interface-to-zone mappings (replaces /etc/shorewall/interfaces)
 interfaces:
@@ -44,14 +52,18 @@ interfaces:
     interface: eth0
     options:
       dhcp: true
-      tcpflags: true
       nosmurfs: true
+      routefilter: 1
+      logmartians: true
   - zone: loc
     interface: eth1
+    options:
+      mss: 1400
   - zone: dmz
     interface: eth2
 
 # Host definitions (replaces /etc/shorewall/hosts)
+# Only needed when multiple zones share an interface.
 hosts:
   - zone: loc
     interface: eth1
@@ -59,7 +71,8 @@ hosts:
       - 192.168.1.0/24
 
 # Default zone-to-zone policies (replaces /etc/shorewall/policy)
-# Evaluated in order after specific rules; first match wins
+# Evaluated in order; first match wins.
+# Intra-zone traffic is implicitly ACCEPTed unless overridden with all+.
 policy:
   - source: fw
     dest: all
@@ -80,15 +93,12 @@ policy:
     log: info
 
 # Specific traffic rules (replaces /etc/shorewall/rules)
-# Supports zone:address notation, e.g. source: "net:203.0.113.0/24"
 rules:
-  # Allow SSH from local network to firewall
   - action: accept
     source: loc
     dest: fw
     portgroup: ssh
 
-  # Allow DNS from local network
   - action: accept
     source: loc
     dest: net
@@ -98,26 +108,178 @@ rules:
     dest: net
     portgroup: dns_tcp
 
-  # Allow web traffic from net to DMZ
   - action: accept
     source: net
     dest: dmz
     portgroup: web
 
-  # Allow ping from local network
   - action: accept
     source: loc
     dest: fw
     proto: icmp
 
-  # Drop all other ICMP from net
   - action: drop
     source: net
     dest: all
     proto: icmp
 
+  # DNAT: forward port 2222 from net to loc host on port 22
+  # - action: dnat
+  #   source: net
+  #   dest: loc:192.168.1.3:22
+  #   proto: tcp
+  #   dport: [2222]
+
+  # Time-restricted rule example
+  # - action: accept
+  #   source: loc
+  #   dest: net
+  #   portgroup: web
+  #   time:
+  #     weekdays: [Mon, Tue, Wed, Thu, Fri]
+  #     start: "08:00"
+  #     stop: "18:00"
+
 # Source NAT rules (replaces /etc/shorewall/snat)
+# First match wins.
 snat:
   - action: masquerade
     source: 192.168.1.0/24
-    dest_interface: eth0
+    dest: eth0
+
+  # Load-balanced SNAT across multiple addresses
+  # - action: snat
+  #   address: 1.1.1.1
+  #   source: 192.168.1.0/24
+  #   dest: eth0
+  #   probability: 0.5
+  # - action: snat
+  #   address: 1.1.1.2
+  #   source: 192.168.1.0/24
+  #   dest: eth0
+
+# One-to-one static NAT (replaces /etc/shorewall/nat)
+# Maps an external IP to an internal IP bidirectionally.
+# DNAT rules take precedence over static NAT.
+# nat:
+#   - external: 203.0.113.10
+#     interface: eth0
+#     internal: 192.168.1.10
+#     all_interfaces: false
+#     local: true
+
+# Network-to-network address mapping (replaces /etc/shorewall/netmap)
+# Maps one subnet to another at the IP header level.
+# netmap:
+#   - type: dnat
+#     net1: 10.0.0.0/24
+#     interface: eth0
+#     net2: 192.168.1.0/24
+#   - type: snat
+#     net1: 192.168.1.0/24
+#     interface: eth0
+#     net2: 10.0.0.0/24
+
+# Variables (replaces /etc/shorewall/params)
+# Simple key-value substitution for reuse across config.
+# vars:
+#   NET_IF: eth0
+#   DMZ_NET: 10.0.0.0/24
+
+# Connection tracking control (replaces /etc/shorewall/conntrack)
+# Bypass conntrack for high-volume traffic or assign CT helpers.
+# conntrack:
+#   - action: notrack
+#     source: net
+#     dest: fw
+#     proto: udp
+#     dport: [53]
+#     comment: "Skip conntrack for DNS"
+#   - action: helper
+#     source: loc
+#     dest: net
+#     proto: tcp
+#     dport: [21]
+#     helper: ftp
+#     comment: "FTP conntrack helper"
+
+# Blacklist/whitelist rules (replaces /etc/shorewall/blrules)
+# Processed before normal rules. ACCEPT/WHITELIST exempt from remaining blrules.
+# blrules:
+#   - action: drop
+#     source: net:192.88.99.1
+#     dest: all
+#     comment: "Block known bad host"
+#   - action: whitelist
+#     source: net:70.90.191.120/29
+#     dest: all
+#     comment: "Trusted range"
+
+# VPN tunnels (replaces /etc/shorewall/tunnels)
+# Allows encapsulated traffic to pass; actual tunnel traffic uses normal rules.
+# tunnels:
+#   - type: ipsec
+#     zone: net
+#     gateways: [4.33.99.124]
+#   - type: openvpn:udp
+#     zone: net
+#     gateways: [0.0.0.0/0]
+#     gateway_zones: [vpn]
+#     port: 1194
+
+# Routing rules (replaces /etc/shorewall/rtrules)
+# Directs traffic to specific provider routing tables.
+# rtrules:
+#   - source: eth1
+#     provider: ISP1
+#     priority: 1000
+#   - dest: 10.8.0.0/24
+#     provider: main
+#     priority: 1000
+#     comment: "OpenVPN traffic stays in main table"
+
+# Stopped rules (replaces /etc/shorewall/stoppedrules)
+# Traffic permitted when the firewall is stopped.
+# stoppedrules:
+#   - action: accept
+#     source: eth1
+#     dest: $FW
+#     comment: "Allow local access when stopped"
+#   - action: accept
+#     source: $FW
+#     dest: eth1
+#     comment: "Allow firewall to reach LAN when stopped"
+
+# Multi-ISP / policy routing (replaces /etc/shorewall/providers)
+# providers:
+#   - name: ISP1
+#     number: 1
+#     mark: 0x10000
+#     duplicate: main
+#     interface: eth0
+#     gateway: 206.124.146.254
+#     options:
+#       track: true
+#       balance: 1
+#     copy: [eth2]
+#   - name: ISP2
+#     number: 2
+#     mark: 0x20000
+#     duplicate: main
+#     interface: eth3
+#     gateway: 130.252.99.254
+#     options:
+#       track: true
+#       balance: 1
+#     copy: [eth2]
+
+# Proxy NDP (replaces /etc/shorewall6/proxyndp)
+# IPv6 equivalent of Proxy ARP — answers NDP queries on behalf of another host.
+# proxyndp:
+#   - address: "2001:db8::100"
+#     interface: eth1
+#     external: eth0
+#     persistent: true
+#   - address: "fd10::1"
+#     external: eth0
+#     haveroute: true