unkinben
8d9a76c751
Rewrites the compiler from ~440 to ~1700 lines covering all major shorewall firewall features: loopback, conntrack fast-path, anti-spoof, DHCP, intra-zone, blacklist/whitelist, conntrack notrack, tunnels (13 types), rules with sections, DNAT/redirect, SNAT/masquerade, static NAT, policies with zone exclusions, MSS clamping, rate limiting, connection limiting, negated addresses, ICMP type matching, TCP RST reject, user/UID matching, mark match/set, NFQUEUE, NONAT, and policy-level rate/conn limiting. Adds full config types for all shorewall subsystems (mangle, accounting, maclist, netmap, providers, tunnels, conntrack, blrules, proxyarp/ndp, routes, tc, secmarks), shorewall migration tooling, expanded CLI commands, expression-level diff engine, and 49 unit tests.
28 lines
778 B
Go
28 lines
778 B
Go
package config
|
|
|
|
import "fmt"
|
|
|
|
// SecmarkRule defines an SELinux security marking rule.
|
|
type SecmarkRule struct {
|
|
Secmark string `yaml:"secmark"` // SELinux context, or "save"/"restore"
|
|
Chain string `yaml:"chain"` // P/I/F/O/T with optional state
|
|
Source string `yaml:"source,omitempty"`
|
|
Dest string `yaml:"dest,omitempty"`
|
|
Proto string `yaml:"proto,omitempty"`
|
|
DPort PortSpec `yaml:"dport,omitempty"`
|
|
SPort PortSpec `yaml:"sport,omitempty"`
|
|
Comment string `yaml:"comment,omitempty"`
|
|
}
|
|
|
|
func (c *Config) validateSecmarks() error {
|
|
for i, s := range c.Secmarks {
|
|
if s.Secmark == "" {
|
|
return fmt.Errorf("secmarks[%d]: secmark required", i)
|
|
}
|
|
if s.Chain == "" {
|
|
return fmt.Errorf("secmarks[%d]: chain required", i)
|
|
}
|
|
}
|
|
return nil
|
|
}
|