unkinben
8d9a76c751
Rewrites the compiler from ~440 to ~1700 lines covering all major shorewall firewall features: loopback, conntrack fast-path, anti-spoof, DHCP, intra-zone, blacklist/whitelist, conntrack notrack, tunnels (13 types), rules with sections, DNAT/redirect, SNAT/masquerade, static NAT, policies with zone exclusions, MSS clamping, rate limiting, connection limiting, negated addresses, ICMP type matching, TCP RST reject, user/UID matching, mark match/set, NFQUEUE, NONAT, and policy-level rate/conn limiting. Adds full config types for all shorewall subsystems (mangle, accounting, maclist, netmap, providers, tunnels, conntrack, blrules, proxyarp/ndp, routes, tc, secmarks), shorewall migration tooling, expanded CLI commands, expression-level diff engine, and 49 unit tests.
68 lines
1.9 KiB
Go
68 lines
1.9 KiB
Go
package config
|
|
|
|
import "fmt"
|
|
|
|
type AccountingAction string
|
|
|
|
const (
|
|
AccountingCount AccountingAction = "count"
|
|
AccountingDone AccountingAction = "done"
|
|
AccountingLog AccountingAction = "log"
|
|
AccountingNFLog AccountingAction = "nflog"
|
|
)
|
|
|
|
type AccountingSection string
|
|
|
|
const (
|
|
AccountingSectionInput AccountingSection = "input"
|
|
AccountingSectionOutput AccountingSection = "output"
|
|
AccountingSectionForward AccountingSection = "forward"
|
|
AccountingSectionPrerouting AccountingSection = "prerouting"
|
|
AccountingSectionPostrouting AccountingSection = "postrouting"
|
|
)
|
|
|
|
type AccountingRule struct {
|
|
Action AccountingAction `yaml:"action"`
|
|
Section AccountingSection `yaml:"section"`
|
|
|
|
// Chain is an optional custom chain name.
|
|
Chain string `yaml:"chain,omitempty"`
|
|
|
|
Source string `yaml:"source,omitempty"`
|
|
Dest string `yaml:"dest,omitempty"`
|
|
|
|
Proto string `yaml:"proto,omitempty"`
|
|
DPort PortSpec `yaml:"dport,omitempty"`
|
|
SPort PortSpec `yaml:"sport,omitempty"`
|
|
|
|
Mark string `yaml:"mark,omitempty"`
|
|
Comment string `yaml:"comment,omitempty"`
|
|
}
|
|
|
|
var validAccountingActions = map[AccountingAction]bool{
|
|
AccountingCount: true, AccountingDone: true,
|
|
AccountingLog: true, AccountingNFLog: true,
|
|
}
|
|
|
|
var validAccountingSections = map[AccountingSection]bool{
|
|
AccountingSectionInput: true, AccountingSectionOutput: true,
|
|
AccountingSectionForward: true, AccountingSectionPrerouting: true,
|
|
AccountingSectionPostrouting: true,
|
|
}
|
|
|
|
func (c *Config) validateAccounting() error {
|
|
for i, a := range c.Accounting {
|
|
if !validAccountingActions[a.Action] {
|
|
return fmt.Errorf("accounting[%d]: unknown action %q", i, a.Action)
|
|
}
|
|
if !validAccountingSections[a.Section] {
|
|
return fmt.Errorf("accounting[%d]: unknown section %q", i, a.Section)
|
|
}
|
|
|
|
if a.Source == "" && a.Dest == "" {
|
|
return fmt.Errorf("accounting[%d]: source or dest required", i)
|
|
}
|
|
}
|
|
return nil
|
|
}
|