James Coleman
5095d90fa4
- New Capabilities: PortPair, Negation, RejectAction, FamilyWithoutAddress, DenyActionFromConfig, advertised per backend. - coversDirection isolates DirForward even when output is unowned; add splitNATDualRow so a concrete-family removal re-adds the opposite family's NAT translation. - Resolve ip6tables/ufw ICMPv6 type aliases; ParseNATKind rejects the "invalid" sentinel as input while JSON round-trips it. - Sync counts additions on mid-batch failure and uses RuleBatcher. - NewManager runs a probe loop joining each backend's reason for diagnosability; services.go drops "generated" from enabled, handles it on enable, clears start-limit-hit on restart, and matches rc.local by token. - nftables: per-source connection limits (meter set), quoted-token parsing preserving log-prefix spacing, digit-led prefix sanitizing. - apf/csf: deny-action-from-config with cached STOP settings, port lists and inexpressible shapes routed through the pre-hook, confKeyApplies guard against a missing config line. - atomic config writes fsync before rename and resolve symlinks; readConfValue is last-assignment-wins; runCommand preserves the exit code through the wrapped error. - Move coreos/go-systemd to the maintained v22 module directly.
43 lines
1.7 KiB
Go
43 lines
1.7 KiB
Go
//go:build integration && !linux
|
|
|
|
package firewall
|
|
|
|
// hookPlanter reports that no backend on this platform has a raw-iptables pre-hook:
|
|
// the pre-hook is a csf/apf construct and both are Linux-only. The shared suite skips
|
|
// its hook probe on a nil result. See the Linux implementation in
|
|
// integration_linux_test.go.
|
|
func hookPlanter(mgr Manager) func(*Rule) error {
|
|
return nil
|
|
}
|
|
|
|
// foreignSeeder reports no out-of-band foreign-rule seeder on this platform; the
|
|
// Linux implementation in integration_linux_test.go covers the Linux backends.
|
|
// The shared suite skips its foreignrule probe on a nil result. Seeding pf (pfctl
|
|
// anchors) and wf (netsh advfirewall) the same way is still open.
|
|
func foreignSeeder(mgr Manager) func(zone string) (*foreignSeed, error) {
|
|
return nil
|
|
}
|
|
|
|
// foreignMACSeeder reports no MAC zone-source seeder on this platform: the MAC
|
|
// source is a firewalld construct and firewalld is Linux-only.
|
|
func foreignMACSeeder(mgr Manager) func(zone string) (*foreignSeed, error) {
|
|
return nil
|
|
}
|
|
|
|
// foreignProtocolSeeder reports no zone protocol-entry seeder on this platform,
|
|
// for the same reason as foreignMACSeeder.
|
|
func foreignProtocolSeeder(mgr Manager) func(zone string) (*foreignSeed, error) {
|
|
return nil
|
|
}
|
|
|
|
// unmanagedRawRuleSeeder reports no unmanaged raw rules file on this platform:
|
|
// the before/after split is a ufw construct and ufw is Linux-only.
|
|
func unmanagedRawRuleSeeder(mgr Manager) func() (*Rule, func(), error) {
|
|
return nil
|
|
}
|
|
|
|
// zoneInterfaceSeeder reports no interface-to-zone seeder on this platform: the
|
|
// interface binding is a firewalld construct and firewalld is Linux-only.
|
|
func zoneInterfaceSeeder(mgr Manager) func(iface, zoneName string) (func(), error) {
|
|
return nil
|
|
}
|