unkinben
2a3eb3b04d
Spiritual successor to shorewall — manages nftables directly via google/nftables. Reads a single YAML config covering zones, interfaces, hosts, policy, rules, snat, and named portgroups. Computes differential changes against the running nftables state and applies them atomically. Supports detecting and purging rules added outside of tomswall.
40 lines
962 B
Go
40 lines
962 B
Go
package config
|
|
|
|
import "fmt"
|
|
|
|
type SNATAction string
|
|
|
|
const (
|
|
SNATMasquerade SNATAction = "masquerade"
|
|
SNATAddress SNATAction = "snat"
|
|
)
|
|
|
|
type SNATRule struct {
|
|
Action SNATAction `yaml:"action"`
|
|
Address string `yaml:"address,omitempty"`
|
|
Source string `yaml:"source,omitempty"`
|
|
DestInterface string `yaml:"dest_interface"`
|
|
Proto string `yaml:"proto,omitempty"`
|
|
DPort PortSpec `yaml:"dport,omitempty"`
|
|
Comment string `yaml:"comment,omitempty"`
|
|
}
|
|
|
|
func (c *Config) validateSNAT() error {
|
|
for i, s := range c.SNAT {
|
|
switch s.Action {
|
|
case SNATMasquerade, SNATAddress:
|
|
default:
|
|
return fmt.Errorf("snat[%d]: unknown action %q", i, s.Action)
|
|
}
|
|
|
|
if s.Action == SNATAddress && s.Address == "" {
|
|
return fmt.Errorf("snat[%d]: address required for snat action", i)
|
|
}
|
|
|
|
if s.DestInterface == "" {
|
|
return fmt.Errorf("snat[%d]: dest_interface required", i)
|
|
}
|
|
}
|
|
return nil
|
|
}
|