puppet nftables

Révision 03d9e7da

New parameter noflush_tables to selectivly skip flush

Introduces a new structured fact nftables

```yaml
nftables:
tables:
- inet-filter
- ip-nat
- ip6-nat
- inet-f2b-table
```

By default the nft script will continue to contain `nft flush ruleset`

If noflush_tables is specified e.g.

```puppet
class{nftables:
noflush_tables => ['inet-f2b-table'],
}
```
the results script will explicity flush the other tables only.
i.e.

```
flush table inet filter
flush table ip nat
flush table ip6 nat
```

Motivation here is to allow a maintence of chain to managed by something else.
This example for fail2ban but could be docker, ...

<%- |

  Boolean $nat,

  Optional[Array[String[1],1]] $noflush = undef,

|-%>

<%-

if $noflush and $facts['nftables'] and $facts['nftables']['tables'] {

 $_flush_command = $facts['nftables']['tables'].filter |$_tab| { ! ($_tab in $noflush) }.map |$_table| {

   "flush table ${regsubst($_table,'-',' ')}"

 }

} else {

 $_flush_command = ['flush ruleset']

}

-%>

# puppet-preflight.nft is only used by puppet for validating new configs

# puppet.nft is real configuration that the nftables services uses.

# To process either the -I flag must be specified.

# nft -c -I /etc/nftables/puppet-preflight -f /etc/nftables/puppet-preflight.nft

# drop any existing nftables ruleset

flush ruleset

<%= $_flush_command.join('; ') %>

include "custom-*.nft"

include "inet-filter.nft"

Formats disponibles : Unified diff