unkinben
2a3eb3b04d
Spiritual successor to shorewall — manages nftables directly via google/nftables. Reads a single YAML config covering zones, interfaces, hosts, policy, rules, snat, and named portgroups. Computes differential changes against the running nftables state and applies them atomically. Supports detecting and purging rules added outside of tomswall.
48 lines
983 B
Go
48 lines
983 B
Go
package config
|
|
|
|
import "fmt"
|
|
|
|
type ZoneType string
|
|
|
|
const (
|
|
ZoneIP ZoneType = "ip"
|
|
ZoneIPSec ZoneType = "ipsec"
|
|
ZoneFirewall ZoneType = "firewall"
|
|
ZoneLoopback ZoneType = "loopback"
|
|
)
|
|
|
|
type Zone struct {
|
|
Type ZoneType `yaml:"type"`
|
|
Parent string `yaml:"parent,omitempty"`
|
|
Options []string `yaml:"options,omitempty"`
|
|
}
|
|
|
|
func (c *Config) validateZones() error {
|
|
if len(c.Zones) == 0 {
|
|
return fmt.Errorf("no zones defined")
|
|
}
|
|
|
|
firewallCount := 0
|
|
for name, z := range c.Zones {
|
|
switch z.Type {
|
|
case ZoneIP, ZoneIPSec, ZoneFirewall, ZoneLoopback:
|
|
default:
|
|
return fmt.Errorf("zone %q: unknown type %q", name, z.Type)
|
|
}
|
|
if z.Type == ZoneFirewall {
|
|
firewallCount++
|
|
}
|
|
if z.Parent != "" {
|
|
if _, ok := c.Zones[z.Parent]; !ok {
|
|
return fmt.Errorf("zone %q: parent zone %q not defined", name, z.Parent)
|
|
}
|
|
}
|
|
}
|
|
|
|
if firewallCount != 1 {
|
|
return fmt.Errorf("exactly one firewall zone required, found %d", firewallCount)
|
|
}
|
|
|
|
return nil
|
|
}
|