From 06a969575684ee21179a7d5730bbed2d65c38173 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sat, 18 Jul 2015 13:55:56 +0200
Subject: 3 lass.iptables: check if target is valid

---
 3modules/lass/iptables.nix | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

(limited to '3modules/lass')

diff --git a/3modules/lass/iptables.nix b/3modules/lass/iptables.nix
index ba05abeb2..52058821c 100644
--- a/3modules/lass/iptables.nix
+++ b/3modules/lass/iptables.nix
@@ -114,20 +114,18 @@ let
             ""
           else
             concatMapStringsSep "\n" (rule: "\n-A ${cn} ${rule}") ([]
-              ++ map buildRule ts."${tn}"."${cn}".rules
+              ++ map (buildRule tn cn) ts."${tn}"."${cn}".rules
             )
         else
           ""
         ;
 
 
-      buildRule = rule:
-        #TODO implement rule validation-test here
-        #
-        #target:
-        #target needs to be an existing chain (in the same table) or ACCEPT, REJECT, DROP, LOG, QUEUE, RETURN
+      buildRule = tn: cn: rule:
+        #target validation test:
+        assert (elemIsIn rule.target ([ "ACCEPT" "REJECT" "DROP" "QUEUE" "LOG" "RETURN" ] ++ ts."${tn}"."${cn}"));
 
-        #predicate:
+        #predicate validation test:
         #maybe use iptables-test
         #TODO: howto exit with evaluation error by shellscript?
           #apperantly not possible from nix because evalatution wouldn't be deterministic.
-- 
cgit v1.2.3