Historique | Voir | Annoter | Télécharger (8,92 ko)
init.pp: Purge trailing whitespace
Update init.pp comments
Change default hash location to /var/tmp to survive reboots and avoid bogus nftables reload
Added shell provider to execs. Hash generate now in array. Ran rubocop:autocorrect
Changed path to use fact. Partial conversion of execs to arrays
Change exec title
Fix typos
Correct docstring
Added purge_unmanaged_rules new variant of method
New clobber_default_config paramter
Certain OSes namely Debian and Archlinux provide default ruleswith the OS.
This module has always respected those rules and appended all ofits own rules to the end of the existing rules.
The new parameter `clobber_default_config` if set `true` (default `false`)...
Make "dropping invalid packets" configureable
It doesn't make sense to explicitly drop those pakets when the defaultpolicy is already `DROP`. Also some applications, like ceph, are knownto send packets that might be marked as invalid.
provide an option to disable logging rejected packets
init.pp: disable check_unsafe_interpolations
change parameters order: required before optional
Align filemode on RedHat to distro default
The RPM acutally ships the configuration and directory with0600/0700 while this module sets the mode to 0640/0750.
However, this has the drawback that on new nftables RPM versions,we are setting it back to the modules mode and triggering an nft...
Add all families as a valid noflush pattern
nftables has more valid families than the ones currently accepted by themodule.
This patch adds support for all the families currently supported as perthe documentation at:https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families
Add Debian support
systemctl: Use relative path
make path to echo configureable
make path to `nft` binary configureable
Add support for Arch Linux
Arch Linux stores the configuration in a different path and does notprovide firewalld without explicit installation.
This basically the same as #66 – I've reused their code since it hasn'tbeen merged in a while.
Fix typos in initial reference examples
support a different table name for 'nat'- Some applications (such as libvirt) still use iptables to inject firewall rules- iptables will refuse to update tables that were initially created with nft- This commit allows defining the name of the 'nat' table in order to avoid...
Allow creating a totally empty firewall
By setting `nftables::inet_filter` and `nftables::nat` to `false`users can now start off from a totally empty firewall and add thetables, chains and rules they'd like.
The default skeleton for inet-filter, ip-nat and ip6-nat is kept...
Enable parameter_documentation lint
The linter checks that every parameter has been documented.
While corrections have been made to great many classes some morecomplicated examples have been left for now. Should be updatedas the files get touched.
https://github.com/domcleal/puppet-lint-param-docs
Merge pull request #34 from traylenator/dedupe_flush
Remove duplicate flush on reload
Correct layout of ignore chain example
When nftables was reloaded a flush was being done both in the systemdreload call and in the nft script itself.
Comment why firewalld_enable parameter is required (#40)
Use single line for each parameter definition
lint_fix results
Merge pull request #29 from keachi/fwd_conntrack
Enable conntrack in FORWARD
New parameter noflush_tables to selectivly skip flush
Introduces a new structured fact nftables
```yamlnftables: tables: - inet-filter - ip-nat - ip6-nat - inet-f2b-table```
By default the nft script will continue to contain `nft flush ruleset`...
Merge pull request #22 from cernops/log_limit
Set a customisable rate limit to the logging rules
Allow sourcing sets from Hiera
Allow disabling default NAT tables and chains
Reload rules atomically
Background: The unit file for nftables on CentOS 8 contains:
```ExecStart=/sbin/nft -f /etc/sysconfig/nftables.confExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'ExecStop=/sbin/nft flush ruleset```...
Merge pull request #16 from cernops/icmp
Move ICMP stuff to separate classes allowing better customisation
Make masking Service['firewalld'] configurable
Move ICMP stuff to separate classes
Move ct rules from global to INPUT and OUTPUT
Allow tables to add comments to $log_prefix
Add a parameter to control the fate of discarded packets
Allow customising the log prefix
migrate create_resource to the generic loop over hash approach
create_resource is notorious for not providing exact line/file infowhen something fails. Since in puppet you can now loop over hashesand you have the splat assignment operator. This means you get much...
Allow to inject custom rules
New parameter out_all, default false
In order to allow all outbound traffic a parameter isadded to enable a simple `allow` entry on the out chain.
Default is false so backwards compatible.
If true all the other out_bound rules (ntp, ...) will be disabled...
Stop and mask firewalld service
Split init class
Use default
Rewrite ip-nat to concat
Replace filter with inet-filter
Refactoring
Write some spec tests for init class
Linting
Set NAT only for IPv4
Remove out rule ntp
Duplicate to chrony, but chrony allows every sport (which is required bychrony).
Allow http by default
CentOS mirrors are only available over http.
Apply a base firewall
Allow all services to install updates and manage the node.
initial release
