root / manifests / chain.pp @ 1bf717d9
Historique | Voir | Annoter | Télécharger (1,64 ko)
| 1 |
# manage a chain |
|---|---|
| 2 |
define nftables::chain ( |
| 3 |
# lint:ignore:parameter_documentation |
| 4 |
Pattern[/^(ip|ip6|inet)-[a-zA-Z0-9_]+$/] $table = 'inet-filter', |
| 5 |
Pattern[/^[a-zA-Z0-9_]+$/] $chain = $title, |
| 6 |
Optional[Pattern[/^\d\d-[a-zA-Z0-9_]+$/]] $inject = undef, |
| 7 |
Optional[String] $inject_iif = undef, |
| 8 |
Optional[String] $inject_oif = undef, |
| 9 |
# lint:endignore |
| 10 |
) {
|
| 11 |
$concat_name = "nftables-${table}-chain-${chain}"
|
| 12 |
|
| 13 |
concat {
|
| 14 |
$concat_name: |
| 15 |
path => "/etc/nftables/puppet-preflight/${table}-chain-${chain}.nft",
|
| 16 |
owner => root, |
| 17 |
group => root, |
| 18 |
mode => '0640', |
| 19 |
ensure_newline => true, |
| 20 |
require => Package['nftables'], |
| 21 |
} ~> Exec['nft validate'] -> file {
|
| 22 |
"/etc/nftables/puppet/${table}-chain-${chain}.nft":
|
| 23 |
ensure => file, |
| 24 |
source => "/etc/nftables/puppet-preflight/${table}-chain-${chain}.nft",
|
| 25 |
owner => root, |
| 26 |
group => root, |
| 27 |
mode => '0640', |
| 28 |
} ~> Service['nftables'] |
| 29 |
|
| 30 |
concat::fragment {
|
| 31 |
default: |
| 32 |
target => $concat_name; |
| 33 |
"${concat_name}-header":
|
| 34 |
order => '00', |
| 35 |
content => "# Start of fragment order:00 ${chain} header\nchain ${chain} {";
|
| 36 |
"${concat_name}-footer":
|
| 37 |
order => '99', |
| 38 |
content => "# Start of fragment order:99 ${chain} footer\n}";
|
| 39 |
} |
| 40 |
|
| 41 |
if $inject {
|
| 42 |
$data = split($inject, '-') |
| 43 |
$iif = $inject_iif ? {
|
| 44 |
undef => '', |
| 45 |
default => "iifname ${inject_iif} ",
|
| 46 |
} |
| 47 |
$oif = $inject_oif ? {
|
| 48 |
undef => '', |
| 49 |
default => "oifname ${inject_oif} ",
|
| 50 |
} |
| 51 |
nftables::rule { "${data[1]}-jump_${chain}":
|
| 52 |
order => $data[0], |
| 53 |
content => "${iif}${oif}jump ${chain}",
|
| 54 |
} |
| 55 |
} |
| 56 |
} |