firewall

type Action string

type Manager struct {
	// contains filtered or unexported fields
}

type Result struct {
	// Installed is false when the ufw binary itself isn't found. Managed
	// is always empty and Applied/Removed are always zero in that case.
	Installed bool
	// Active is ufw's own "Status: active" flag. When false, rules
	// cannot be meaningfully reported as applied (ufw isn't enforcing
	// anything), so Managed still lists every wanted rule but every
	// Applied is false and the Applied/Removed counters stay zero: Sync
	// never calls "ufw enable" itself, see the package doc comment.
	Active bool
	// Managed is one RuleStatus per Rule passed to Report/Sync, in the
	// same order.
	Managed []RuleStatus
	// Extra is every ufw rule this package tagged (the Manager prefix)
	// that Report/Sync found active but that wasn't in the caller's want
	// list, e.g. a rule a deleted record left behind because Sync
	// hadn't run since. Sync removes these; Report only reports them.
	Extra []RuleStatus
	// Applied and Removed count the ufw commands Sync actually ran
	// (never populated by Report, which never mutates).
	Applied int
	Removed int
	// Errors carries one message per failed ufw invocation. Sync/Report
	// still return a nil error and whatever partial Result it has when
	// this is non-empty: one broken rule must not block every other
	// rule from being read or applied correctly.
	Errors []string
}

type Rule struct {
	// Port is the host port the rule applies to.
	Port int
	// Proto is "tcp" or "udp". Empty defaults to "tcp".
	Proto string
	// SourceCIDR restricts the rule to traffic from this CIDR. Empty
	// means any source ("Anywhere" in ufw's own terminology).
	SourceCIDR string
	// Action is ActionAllow or ActionDeny.
	Action Action
	// Owner identifies what this rule is for (e.g. "rule:3",
	// "app:myapp"), stored as the ufw rule's comment with the
	// Manager's prefix prepended, and shown back in Report/Sync results
	// so a caller can tell which resource a given rule belongs to.
	Owner string
}

type RuleStatus struct {
	Rule
	// Applied is true when ufw's current rule set already has an entry
	// matching this exact port/proto/source/action, whether this
	// package's own Sync applied it or an operator had already set up
	// the identical rule outside this package.
	Applied bool
}