James Coleman
a036c8e6e9
Introduce TCPUDP as the protocol analog of FamilyAny and DirAny: a merged value spanning both transports, distinct from ProtocolAny (which matches every IP protocol and carries no port). Backends whose native syntax holds both transports in one row (nftables, ufw, apf) store and read it as one rule; the rest fan it out with expandProtocols. Removing one transport of a merged row splits it via splitMergedRow, which composes the family and protocol splits so an nftables row merged on both axes leaves a correct, non-overlapping remainder. NAT rejects TCPUDP with ErrUnsupportedNAT. Remove read-side merging. GetRules now reports the firewall's actual rows and never synthesizes a FamilyAny, TCPUDP, or DirAny rule by pairing up separately-stored ones, so mergeFamilies, mergeDirections and their helpers are gone and mergedInsertIndex becomes logicalInsertIndex. Rules are instead compared by coverage: the new exported Rule.Covers / Rule.CoveredBy (and the NATRule pair) expand a rule across family, transport and direction and decide containment cell by cell, which is what lets Sync stay a no-op against its own output whichever representation a backend chose. Extract the systemd/SysV service helpers out of the iptables backend into services.go so every Linux backend shares one implementation, and document the multi-state rule model and the coverage helpers in the README.
11 lines
385 B
Go
11 lines
385 B
Go
//go:build integration && !linux
|
|
|
|
package firewall
|
|
|
|
// hookPlanter reports that no backend on this platform has a raw-iptables pre-hook:
|
|
// the pre-hook is a csf/apf construct and both are Linux-only. The shared suite skips
|
|
// its hook probe on a nil result. See the Linux implementation in
|
|
// integration_linux_test.go.
|
|
func hookPlanter(mgr Manager) func(*Rule) error {
|
|
return nil
|
|
}
|