unkinben
8d9a76c751
Rewrites the compiler from ~440 to ~1700 lines covering all major shorewall firewall features: loopback, conntrack fast-path, anti-spoof, DHCP, intra-zone, blacklist/whitelist, conntrack notrack, tunnels (13 types), rules with sections, DNAT/redirect, SNAT/masquerade, static NAT, policies with zone exclusions, MSS clamping, rate limiting, connection limiting, negated addresses, ICMP type matching, TCP RST reject, user/UID matching, mark match/set, NFQUEUE, NONAT, and policy-level rate/conn limiting. Adds full config types for all shorewall subsystems (mangle, accounting, maclist, netmap, providers, tunnels, conntrack, blrules, proxyarp/ndp, routes, tc, secmarks), shorewall migration tooling, expanded CLI commands, expression-level diff engine, and 49 unit tests.
44 lines
1.1 KiB
Go
44 lines
1.1 KiB
Go
package config
|
|
|
|
import "fmt"
|
|
|
|
type StaticRoute struct {
|
|
// Provider is the routing provider/table this route belongs to.
|
|
Provider string `yaml:"provider"`
|
|
|
|
// Dest is the destination CIDR or host address.
|
|
Dest string `yaml:"dest"`
|
|
|
|
// Gateway is the next-hop IP address, or one of "blackhole", "prohibit", "unreachable".
|
|
Gateway string `yaml:"gateway"`
|
|
|
|
// Device is the outbound interface. Not allowed with blackhole/prohibit/unreachable gateways.
|
|
Device string `yaml:"device,omitempty"`
|
|
|
|
// Persistent survives firewall restarts.
|
|
Persistent bool `yaml:"persistent,omitempty"`
|
|
|
|
Comment string `yaml:"comment,omitempty"`
|
|
}
|
|
|
|
var specialGateways = map[string]bool{
|
|
"blackhole": true,
|
|
"prohibit": true,
|
|
"unreachable": true,
|
|
}
|
|
|
|
func (c *Config) validateRoutes() error {
|
|
for i, r := range c.Routes {
|
|
if r.Provider == "" {
|
|
return fmt.Errorf("routes[%d]: provider required", i)
|
|
}
|
|
if r.Dest == "" {
|
|
return fmt.Errorf("routes[%d]: dest required", i)
|
|
}
|
|
if r.Device != "" && specialGateways[r.Gateway] {
|
|
return fmt.Errorf("routes[%d]: device not allowed with %s gateway", i, r.Gateway)
|
|
}
|
|
}
|
|
return nil
|
|
}
|