Projet

Général

Profil

Révision 1ef7d5c4

ID1ef7d5c45a28c69e427548b7448d0ff46b0df38f
Parent 96853629
Enfant 26fe453f

Ajouté par Tim Meusel il y a plus d'un an

rules::llmnr: Allow interface filtering

Voir les différences:

manifests/rules/llmnr.pp
3 3 
#
4 4 
# @param ipv4 Allow LLMNR over IPv4
5 5 
# @param ipv6 Allow LLMNR over IPv6
6 
# @param iifname optional list of incoming interfaces to filter on
7 
#
8 
# @author Tim Meusel <tim@bastelfreak.de>
6 9 
#
7 10 
# @see https://datatracker.ietf.org/doc/html/rfc4795
8 11 
#
9 12 
class nftables::rules::llmnr (
10 13 
  Boolean $ipv4 = true,
11 14 
  Boolean $ipv6 = true,
15 
  Array[String[1]] $iifname = [],
12 16 
) {
17 
  if empty($iifname) {
18 
    $_iifname = ''
19 
  } else {
20 
    $iifdata = $iifname.map |String[1] $interface| { "\"${interface}\"" }.join(', ')
21 
    $_iifname = "iifname { ${iifdata} } "
22 
  }
13 23 
  if $ipv4 {
14 24 
    nftables::rule { 'default_in-llmnr_v4':
15 
      content => 'ip daddr 224.0.0.252 udp dport 5355 accept comment "allow LLMNR"',
25 
      content => "${_iifname}ip daddr 224.0.0.252 udp dport 5355 accept comment \"allow LLMNR\"",
16 26 
    }
17 27 
  }
18 28 
  if $ipv6 {
19 29 
    nftables::rule { 'default_in-llmnr_v6':
20 
      content => 'ip6 daddr ff02::1:3 udp dport 5355 accept comment "allow LLMNR"',
30 
      content => "${_iifname}ip6 daddr ff02::1:3 udp dport 5355 accept comment \"allow LLMNR\"",
21 31 
    }
22 32 
  }
23 33 
}

Formats disponibles : Unified diff