Historique | Voir | Annoter | Télécharger (9,73 ko)
Align filemode on RedHat to distro default
The RPM acutally ships the configuration and directory with0600/0700 while this module sets the mode to 0640/0750.
However, this has the drawback that on new nftables RPM versions,we are setting it back to the modules mode and triggering an nft...
New nftables::file type to include raw file
For example:
```puppetnftables::file{'geoip': content => "include \"/files/geoipsets/dbip/*.ipv4\"\n",}```
will right a file or content into the nftables configuration.
The file written will be included in configuration....
Add all families as a valid noflush pattern
nftables has more valid families than the ones currently accepted by themodule.
This patch adds support for all the families currently supported as perthe documentation at:https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families
Add Debian support
systemctl: Use relative path
make path to `nft` binary configureable
Add support for Arch Linux
Arch Linux stores the configuration in a different path and does notprovide firewalld without explicit installation.
This basically the same as #66 – I've reused their code since it hasn'tbeen merged in a while.
rubocop:auto_correct results
Pet rubocop
Allow creating a totally empty firewall
By setting `nftables::inet_filter` and `nftables::nat` to `false`users can now start off from a totally empty firewall and add thetables, chains and rules they'd like.
The default skeleton for inet-filter, ip-nat and ip6-nat is kept...
fix #74 - ensure table are initialized before flushing them (#75)
Remove duplicate flush on reload
When nftables was reloaded a flush was being done both in the systemdreload call and in the nft script itself.
rubocop:auto_correct fixes
New parameter noflush_tables to selectivly skip flush
Introduces a new structured fact nftables
```yamlnftables: tables: - inet-filter - ip-nat - ip6-nat - inet-f2b-table```
By default the nft script will continue to contain `nft flush ruleset`...
Allow sourcing sets from Hiera
Allow disabling default NAT tables and chains
Reload rules atomically
Background: The unit file for nftables on CentOS 8 contains:
```ExecStart=/sbin/nft -f /etc/sysconfig/nftables.confExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'ExecStop=/sbin/nft flush ruleset```...
Make masking Service['firewalld'] configurable
Switch $order$fragmenta/b to $order-$fragment-a/b
Add comments for all the nftable::rules entries
For each nftable::rule this adds an extra concat fragment toadd a comment containing the name and order number for the rule.
The motivation here is to make the mapping from resulting rules backto puppet code more obvious. When adding a new rule it should be more...
Allow to inject custom rules
fix offenses
New parameter out_all, default false
In order to allow all outbound traffic a parameter isadded to enable a simple `allow` entry on the out chain.
Default is false so backwards compatible.
If true all the other out_bound rules (ntp, ...) will be disabled...
Styling to make tests green
Stop and mask firewalld service
Write some spec tests for init class
Add spec tests it should compile
