67 lines
1.7 KiB
Go
67 lines
1.7 KiB
Go
package config
|
|
|
|
import "fmt"
|
|
|
|
type BlruleAction string
|
|
|
|
const (
|
|
BlruleAccept BlruleAction = "accept"
|
|
BlruleWhitelist BlruleAction = "whitelist"
|
|
BlruleDrop BlruleAction = "drop"
|
|
BlruleReject BlruleAction = "reject"
|
|
BlruleLog BlruleAction = "log"
|
|
BlruleContinue BlruleAction = "continue"
|
|
BlruleNFQueue BlruleAction = "nfqueue"
|
|
)
|
|
|
|
// BlruleRule defines a blacklist/whitelist rule.
|
|
// Processed before normal rules; ACCEPT/WHITELIST/CONTINUE exempt matching
|
|
// traffic from remaining blacklist rules.
|
|
type BlruleRule struct {
|
|
Action BlruleAction `yaml:"action"`
|
|
|
|
Source string `yaml:"source"`
|
|
Dest string `yaml:"dest"`
|
|
|
|
Proto string `yaml:"proto,omitempty"`
|
|
DPort PortSpec `yaml:"dport,omitempty"`
|
|
SPort PortSpec `yaml:"sport,omitempty"`
|
|
|
|
Log string `yaml:"log,omitempty"`
|
|
|
|
// NFQUEUE number (only for nfqueue action).
|
|
NFQueue int `yaml:"nfqueue,omitempty"`
|
|
|
|
Comment string `yaml:"comment,omitempty"`
|
|
}
|
|
|
|
var validBlruleActions = map[BlruleAction]bool{
|
|
BlruleAccept: true, BlruleWhitelist: true,
|
|
BlruleDrop: true, BlruleReject: true,
|
|
BlruleLog: true, BlruleContinue: true,
|
|
BlruleNFQueue: true,
|
|
}
|
|
|
|
func (c *Config) validateBlrules() error {
|
|
for i, r := range c.Blrules {
|
|
if !validBlruleActions[r.Action] {
|
|
return fmt.Errorf("blrules[%d]: unknown action %q", i, r.Action)
|
|
}
|
|
|
|
if r.Source == "" {
|
|
return fmt.Errorf("blrules[%d]: source required", i)
|
|
}
|
|
if r.Dest == "" {
|
|
return fmt.Errorf("blrules[%d]: dest required", i)
|
|
}
|
|
|
|
if err := c.validateZoneRef(r.Source); err != nil {
|
|
return fmt.Errorf("blrules[%d]: source %w", i, err)
|
|
}
|
|
if err := c.validateZoneRef(r.Dest); err != nil {
|
|
return fmt.Errorf("blrules[%d]: dest %w", i, err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|