Projet

Général

Profil

Révision 51850192

ID51850192bd901dbea04056624c5042c2416fbcd1
Parent 7e0fba49
Enfant 4c3d5d6b

Ajouté par Tim Meusel il y a plus d'un an

rules::out::mdns: Allow interface filtering

Voir les différences:

REFERENCE.md
1032 1032

  
1033 1033
* [`ipv4`](#-nftables--rules--out--mdns--ipv4)
1034 1034
* [`ipv6`](#-nftables--rules--out--mdns--ipv6)
1035
* [`oifname`](#-nftables--rules--out--mdns--oifname)
1035 1036

  
1036 1037
##### <a name="-nftables--rules--out--mdns--ipv4"></a>`ipv4`
1037 1038

  
......
1049 1050

  
1050 1051
Default value: `true`
1051 1052

  
1053
##### <a name="-nftables--rules--out--mdns--oifname"></a>`oifname`
1054

  
1055
Data type: `Array[String[1]]`
1056

  
1057
optional name for outgoing interfaces
1058

  
1059
Default value: `[]`
1060

  
1052 1061
### <a name="nftables--rules--out--mldv2"></a>`nftables::rules::out::mldv2`
1053 1062

  
1054 1063
allow multicast listener requests
manifests/rules/out/mdns.pp
3 3
#
4 4
# @param ipv4 Allow mdns over IPv4
5 5
# @param ipv6 Allow mdns over IPv6
6
# @param oifname optional name for outgoing interfaces
6 7
#
7 8
class nftables::rules::out::mdns (
8 9
  Boolean $ipv4 = true,
9 10
  Boolean $ipv6 = true,
11
  Array[String[1]] $oifname = [],
10 12
) {
13
  if empty($oifname) {
14
    $_oifname = ''
15
  } else {
16
    $oifdata = $oifname.map |String[1] $interface| { "\"${interface}\"" }.join(', ')
17
    $_oifname = "oifname { ${oifdata} } "
18
  }
11 19
  if $ipv4 {
12 20
    nftables::rule { 'default_out-mdns_v4':
13
      content => 'ip daddr 224.0.0.251 udp dport 5353 accept',
21
      content => "${_oifname}ip daddr 224.0.0.251 udp dport 5353 accept",
14 22
    }
15 23
  }
16 24
  if $ipv6 {
17 25
    nftables::rule { 'default_out-mdns_v6':
18
      content => 'ip6 daddr ff02::fb udp dport 5353 accept',
26
      content => "${_oifname}ip6 daddr ff02::fb udp dport 5353 accept",
19 27
    }
20 28
  }
21 29
}
spec/classes/rules/out/mdns_spec.rb
1
# frozen_string_literal: true
2

  
3
require 'spec_helper'
4

  
5
describe 'nftables::rules::out::mdns' do
6
  on_supported_os.each do |os, os_facts|
7
    context "on #{os}" do
8
      let :facts do
9
        os_facts
10
      end
11

  
12
      context 'default options' do
13
        it { is_expected.to compile.with_all_deps }
14
        it { is_expected.to contain_nftables__rule('default_out-mdns_v4').with_content('ip daddr 224.0.0.251 udp dport 5353 accept') }
15
        it { is_expected.to contain_nftables__rule('default_out-mdns_v6').with_content('ip6 daddr ff02::fb udp dport 5353 accept') }
16
      end
17

  
18
      context 'with input interfaces set' do
19
        let :params do
20
          {
21
            oifname: %w[docker0 eth0],
22
          }
23
        end
24

  
25
        it { is_expected.to compile }
26
        it { is_expected.to contain_nftables__rule('default_out-mdns_v4').with_content('oifname { "docker0", "eth0" } ip daddr 224.0.0.251 udp dport 5353 accept') }
27
        it { is_expected.to contain_nftables__rule('default_out-mdns_v6').with_content('oifname { "docker0", "eth0" } ip6 daddr ff02::fb udp dport 5353 accept') }
28
      end
29
    end
30
  end
31
end

Formats disponibles : Unified diff