netguard

const (
	// FindingLockoutRiskSSH fires when no compiled rule can accept traffic on
	// any of the node's management ports.
	FindingLockoutRiskSSH = "lockout_risk_ssh"
	// FindingUnverifiedApply fires when the server has no public URL, so the
	// node-side apply cannot run a control-plane selfcheck after committing.
	FindingUnverifiedApply = "unverified_apply"
	// FindingManagementPortAssumed fires when the lockout check had no reported
	// reality to learn the node's real shell port from and fell back to tcp/22.
	// It is a warning rather than a block because tcp/22 is usually right; it
	// exists so an operator can tell a checked plan from a guessed one.
	FindingManagementPortAssumed = "management_port_assumed"
	// FindingInterfaceMissing fires when a rule matches an inbound interface
	// the node does not report. The public zone defaults to eth0, and twelve
	// fleet nodes have no eth0 (ens17, ens5, enp2s0, wlo1): every accept on
	// that interface matches nothing, the default drop takes over, and the
	// lockout check above still counts those accepts as a way in.
	FindingInterfaceMissing = "interface_missing"
	// FindingInterfaceUnverified fires when a rule matches an inbound interface
	// but the node has never reported which interfaces it has, so the lint
	// cannot tell a right name from a wrong one. It blocks rather than warns
	// because the wrong name is the lockout above, and a node that has not
	// reported is exactly the node most likely to be running an agent old
	// enough to have been enrolled with the eth0 guess.
	FindingInterfaceUnverified = "interface_unverified"

	SeverityBlock = "block"
	SeverityWarn  = "warn"

	// ManagementPort is the port the lockout lint falls back to when the node
	// has never reported which port its shell daemon actually listens on.
	ManagementPort = 22
)

const (
	SuggestionListenerMissingAllow       = "listener_missing_allow"
	SuggestionAllowWithoutListener       = "allow_without_listener"
	SuggestionOverlayListenerPublicAllow = "overlay_listener_public_allow"
	SuggestionOverlayZoneUntrusted       = "overlay_zone_untrusted"
	SuggestionManagedTableDrift          = "managed_table_drift"
)

const (
	// LegacyGroupPrefix namespaces the node-private security groups derived
	// from legacy NFTInputs baselines (design-13 §7.1).
	LegacyGroupPrefix = "sg-legacy-"
)

const MaxExpandedPortsPerRule = 1024