package config

import "fmt"

// SecmarkRule defines an SELinux security marking rule.
type SecmarkRule struct {
	Secmark string   `yaml:"secmark"` // SELinux context, or "save"/"restore"
	Chain   string   `yaml:"chain"`   // P/I/F/O/T with optional state
	Source  string   `yaml:"source,omitempty"`
	Dest    string   `yaml:"dest,omitempty"`
	Proto   string   `yaml:"proto,omitempty"`
	DPort   PortSpec `yaml:"dport,omitempty"`
	SPort   PortSpec `yaml:"sport,omitempty"`
	Comment string   `yaml:"comment,omitempty"`
}

func (c *Config) validateSecmarks() error {
	for i, s := range c.Secmarks {
		if s.Secmark == "" {
			return fmt.Errorf("secmarks[%d]: secmark required", i)
		}
		if s.Chain == "" {
			return fmt.Errorf("secmarks[%d]: chain required", i)
		}
	}
	return nil
}