unkinben
8d9a76c751
Rewrites the compiler from ~440 to ~1700 lines covering all major shorewall firewall features: loopback, conntrack fast-path, anti-spoof, DHCP, intra-zone, blacklist/whitelist, conntrack notrack, tunnels (13 types), rules with sections, DNAT/redirect, SNAT/masquerade, static NAT, policies with zone exclusions, MSS clamping, rate limiting, connection limiting, negated addresses, ICMP type matching, TCP RST reject, user/UID matching, mark match/set, NFQUEUE, NONAT, and policy-level rate/conn limiting. Adds full config types for all shorewall subsystems (mangle, accounting, maclist, netmap, providers, tunnels, conntrack, blrules, proxyarp/ndp, routes, tc, secmarks), shorewall migration tooling, expanded CLI commands, expression-level diff engine, and 49 unit tests.
52 lines
1.3 KiB
Go
52 lines
1.3 KiB
Go
package config
|
|
|
|
import "fmt"
|
|
|
|
type MaclistAction string
|
|
|
|
const (
|
|
MaclistAccept MaclistAction = "accept"
|
|
MaclistDrop MaclistAction = "drop"
|
|
MaclistReject MaclistAction = "reject"
|
|
)
|
|
|
|
type MaclistEntry struct {
|
|
Action MaclistAction `yaml:"action"`
|
|
Interface string `yaml:"interface"`
|
|
MAC string `yaml:"mac,omitempty"`
|
|
Addresses []string `yaml:"addresses,omitempty"`
|
|
Log string `yaml:"log,omitempty"`
|
|
Comment string `yaml:"comment,omitempty"`
|
|
}
|
|
|
|
var validMaclistActions = map[MaclistAction]bool{
|
|
MaclistAccept: true, MaclistDrop: true, MaclistReject: true,
|
|
}
|
|
|
|
func (c *Config) validateMaclist() error {
|
|
// Build a set of configured interface names for lookup.
|
|
ifaceSet := make(map[string]bool, len(c.Interfaces))
|
|
for _, iface := range c.Interfaces {
|
|
ifaceSet[iface.Interface] = true
|
|
}
|
|
|
|
for i, m := range c.Maclist {
|
|
if !validMaclistActions[m.Action] {
|
|
return fmt.Errorf("maclist[%d]: unknown action %q", i, m.Action)
|
|
}
|
|
|
|
if m.Interface == "" {
|
|
return fmt.Errorf("maclist[%d]: interface required", i)
|
|
}
|
|
|
|
if m.MAC == "" && len(m.Addresses) == 0 {
|
|
return fmt.Errorf("maclist[%d]: mac or addresses required", i)
|
|
}
|
|
|
|
if !ifaceSet[m.Interface] {
|
|
return fmt.Errorf("maclist[%d]: interface %q not defined in config", i, m.Interface)
|
|
}
|
|
}
|
|
return nil
|
|
}
|