unkinben
8d9a76c751
Rewrites the compiler from ~440 to ~1700 lines covering all major shorewall firewall features: loopback, conntrack fast-path, anti-spoof, DHCP, intra-zone, blacklist/whitelist, conntrack notrack, tunnels (13 types), rules with sections, DNAT/redirect, SNAT/masquerade, static NAT, policies with zone exclusions, MSS clamping, rate limiting, connection limiting, negated addresses, ICMP type matching, TCP RST reject, user/UID matching, mark match/set, NFQUEUE, NONAT, and policy-level rate/conn limiting. Adds full config types for all shorewall subsystems (mangle, accounting, maclist, netmap, providers, tunnels, conntrack, blrules, proxyarp/ndp, routes, tc, secmarks), shorewall migration tooling, expanded CLI commands, expression-level diff engine, and 49 unit tests.
76 lines
2.0 KiB
Go
76 lines
2.0 KiB
Go
package config
|
|
|
|
import "fmt"
|
|
|
|
type BlruleAction string
|
|
|
|
const (
|
|
BlruleAccept BlruleAction = "accept"
|
|
BlruleWhitelist BlruleAction = "whitelist"
|
|
BlruleDrop BlruleAction = "drop"
|
|
BlruleReject BlruleAction = "reject"
|
|
BlruleLog BlruleAction = "log"
|
|
BlruleContinue BlruleAction = "continue"
|
|
BlruleNFQueue BlruleAction = "nfqueue"
|
|
)
|
|
|
|
// BlruleRule defines a blacklist/whitelist rule.
|
|
// Processed before normal rules; ACCEPT/WHITELIST/CONTINUE exempt matching
|
|
// traffic from remaining blacklist rules.
|
|
type BlruleRule struct {
|
|
Action BlruleAction `yaml:"action"`
|
|
|
|
Source string `yaml:"source"`
|
|
Dest string `yaml:"dest"`
|
|
|
|
Proto string `yaml:"proto,omitempty"`
|
|
DPort PortSpec `yaml:"dport,omitempty"`
|
|
SPort PortSpec `yaml:"sport,omitempty"`
|
|
|
|
Log string `yaml:"log,omitempty"`
|
|
|
|
// NFQUEUE number (only for nfqueue action).
|
|
NFQueue int `yaml:"nfqueue,omitempty"`
|
|
|
|
Comment string `yaml:"comment,omitempty"`
|
|
}
|
|
|
|
var validBlruleActions = map[BlruleAction]bool{
|
|
BlruleAccept: true, BlruleWhitelist: true,
|
|
BlruleDrop: true, BlruleReject: true,
|
|
BlruleLog: true, BlruleContinue: true,
|
|
BlruleNFQueue: true,
|
|
}
|
|
|
|
func (c *Config) validateBlrules() error {
|
|
for i, r := range c.Blrules {
|
|
if !validBlruleActions[r.Action] {
|
|
return fmt.Errorf("blrules[%d]: unknown action %q", i, r.Action)
|
|
}
|
|
|
|
if r.Source == "" {
|
|
return fmt.Errorf("blrules[%d]: source required", i)
|
|
}
|
|
if r.Dest == "" {
|
|
return fmt.Errorf("blrules[%d]: dest required", i)
|
|
}
|
|
|
|
if r.Source != "all" && r.Source != "any" && r.Source != "none" &&
|
|
!hasPrefix(r.Source, "all!") && !hasPrefix(r.Source, "any!") {
|
|
srcZone := zoneFromSpec(r.Source)
|
|
if _, ok := c.Zones[srcZone]; !ok {
|
|
return fmt.Errorf("blrules[%d]: source zone %q not defined", i, srcZone)
|
|
}
|
|
}
|
|
|
|
if r.Dest != "all" && r.Dest != "any" && r.Dest != "none" &&
|
|
!hasPrefix(r.Dest, "all!") && !hasPrefix(r.Dest, "any!") {
|
|
dstZone := zoneFromSpec(r.Dest)
|
|
if _, ok := c.Zones[dstZone]; !ok {
|
|
return fmt.Errorf("blrules[%d]: dest zone %q not defined", i, dstZone)
|
|
}
|
|
}
|
|
}
|
|
return nil
|
|
}
|