unkinben
8d9a76c751
Rewrites the compiler from ~440 to ~1700 lines covering all major shorewall firewall features: loopback, conntrack fast-path, anti-spoof, DHCP, intra-zone, blacklist/whitelist, conntrack notrack, tunnels (13 types), rules with sections, DNAT/redirect, SNAT/masquerade, static NAT, policies with zone exclusions, MSS clamping, rate limiting, connection limiting, negated addresses, ICMP type matching, TCP RST reject, user/UID matching, mark match/set, NFQUEUE, NONAT, and policy-level rate/conn limiting. Adds full config types for all shorewall subsystems (mangle, accounting, maclist, netmap, providers, tunnels, conntrack, blrules, proxyarp/ndp, routes, tc, secmarks), shorewall migration tooling, expanded CLI commands, expression-level diff engine, and 49 unit tests.
39 lines
1013 B
Go
39 lines
1013 B
Go
package config
|
|
|
|
import "fmt"
|
|
|
|
type ProxyARP struct {
|
|
// Address is the IP address to proxy ARP for.
|
|
Address string `yaml:"address"`
|
|
|
|
// Interface is the local interface where the proxied host resides.
|
|
Interface string `yaml:"interface,omitempty"`
|
|
|
|
// External is the external-facing interface.
|
|
External string `yaml:"external"`
|
|
|
|
// HaveRoute indicates that a route to the address already exists,
|
|
// so no interface is required.
|
|
HaveRoute bool `yaml:"haveroute,omitempty"`
|
|
|
|
// Persistent survives firewall restarts.
|
|
Persistent bool `yaml:"persistent,omitempty"`
|
|
|
|
Comment string `yaml:"comment,omitempty"`
|
|
}
|
|
|
|
func (c *Config) validateProxyARP() error {
|
|
for i, p := range c.ProxyARP {
|
|
if p.Address == "" {
|
|
return fmt.Errorf("proxyarp[%d]: address required", i)
|
|
}
|
|
if p.External == "" {
|
|
return fmt.Errorf("proxyarp[%d]: external required", i)
|
|
}
|
|
if p.Interface == "" && !p.HaveRoute {
|
|
return fmt.Errorf("proxyarp[%d]: interface required unless haveroute is set", i)
|
|
}
|
|
}
|
|
return nil
|
|
}
|