unkinben
2a3eb3b04d
Spiritual successor to shorewall — manages nftables directly via google/nftables. Reads a single YAML config covering zones, interfaces, hosts, policy, rules, snat, and named portgroups. Computes differential changes against the running nftables state and applies them atomically. Supports detecting and purging rules added outside of tomswall.
39 lines
1.1 KiB
Go
39 lines
1.1 KiB
Go
package config
|
|
|
|
import "fmt"
|
|
|
|
type Interface struct {
|
|
Zone string `yaml:"zone"`
|
|
Interface string `yaml:"interface"`
|
|
Options InterfaceOptions `yaml:"options,omitempty"`
|
|
}
|
|
|
|
type InterfaceOptions struct {
|
|
DHCP bool `yaml:"dhcp,omitempty"`
|
|
TCPFlags bool `yaml:"tcpflags,omitempty"`
|
|
NoSmurfs bool `yaml:"nosmurfs,omitempty"`
|
|
RouteBack bool `yaml:"routeback,omitempty"`
|
|
Bridge bool `yaml:"bridge,omitempty"`
|
|
Optional bool `yaml:"optional,omitempty"`
|
|
}
|
|
|
|
func (c *Config) validateInterfaces() error {
|
|
seen := make(map[string]bool)
|
|
for i, iface := range c.Interfaces {
|
|
if iface.Interface == "" {
|
|
return fmt.Errorf("interface[%d]: interface name required", i)
|
|
}
|
|
if iface.Zone == "" {
|
|
return fmt.Errorf("interface[%d] %q: zone required", i, iface.Interface)
|
|
}
|
|
if _, ok := c.Zones[iface.Zone]; !ok {
|
|
return fmt.Errorf("interface[%d] %q: zone %q not defined", i, iface.Interface, iface.Zone)
|
|
}
|
|
if seen[iface.Interface] {
|
|
return fmt.Errorf("interface[%d]: duplicate interface %q", i, iface.Interface)
|
|
}
|
|
seen[iface.Interface] = true
|
|
}
|
|
return nil
|
|
}
|