Projet

Général

Profil

Révision 5df9303f

ID5df9303f1dc36f8994a6568e03434fce409e4ee3
Parent 8efbdf9a
Enfant 6f38efff

Ajouté par tr il y a plus de 4 ans

Replace filter with inet-filter

Voir les différences:

files/config/puppet-filter.nft
1 1 
table inet filter {
2 
  include "/etc/nftables/puppet/filter-chain-*.nft"
2 
  include "/etc/nftables/puppet/inet-filter-chain-*.nft"
3 3 

  		




  4
  4
  
    
  # something we want for all


  		




  5
  5
  
    
  chain global {


  		












  

    
      files/config/puppet.nft
    
  





  2
  2
  
    
flush ruleset


  		




  3
  3
  
    

  		




  4
  4
  
    
include "/etc/nftables/puppet/custom-*.nft"


  		




  5
  
  
    
include "/etc/nftables/puppet/filter.nft"


  		




  
  5
  
    
include "/etc/nftables/puppet/inet-filter.nft"


  		




  6
  6
  
    
include "/etc/nftables/puppet/ip-nat.nft"


  		












  

    
      manifests/chain.pp
    
  





  1
  1
  
    
# manage a chain


  		




  2
  2
  
    
define nftables::chain(


  		




  3
  
  
    
  String[1]


  		




  4
  
  
    
    $table = 'filter',


  		




  
  3
  
    
  Pattern[/^(ip|ip6|inet)-[a-zA-Z0-9_]+$/]


  		




  
  4
  
    
    $table = 'inet-filter',


  		




  5
  5
  
    
  Pattern[/^[a-zA-Z0-9_]+$/]


  		




  6
  6
  
    
    $chain = $title,


  		




  7
  7
  
    
  Optional[Pattern[/^\d\d-[a-zA-Z0-9_]+$/]]


  		












  

    
      manifests/init.pp
    
  





  34
  34
  
    
  }


  		




  35
  35
  
    

  		




  36
  36
  
    
  nftables::config{


  		




  37
  
  
    
    'filter':


  		




  
  37
  
    
    'inet-filter':


  		




  38
  38
  
    
      source => 'puppet:///modules/nftables/config/puppet-filter.nft';


  		




  39
  39
  
    
    'ip-nat':


  		




  40
  40
  
    
      source => 'puppet:///modules/nftables/config/puppet-ip-nat.nft';


  		












  

    
      manifests/rule.pp
    
  





  9
  9
  
    
  Pattern[/^\d\d$/]


  		




  10
  10
  
    
    $order = '50',


  		




  11
  11
  
    
  Optional[String]


  		




  12
  
  
    
    $table = 'filter',


  		




  
  12
  
    
    $table = 'inet-filter',


  		




  13
  13
  
    
  Optional[String]


  		




  14
  14
  
    
    $content = undef,


  		




  15
  15
  
    
  Optional[Variant[String,Array[String,1]]]


  		












  

    
      spec/classes/filter_spec.rb
    
  





  9
  9
  
    

  		




  10
  10
  
    
      it { is_expected.to compile }


  		




  11
  11
  
    

  		




  12
  
  
    
      it { is_expected.to contain_file('/etc/nftables/puppet/filter.nft').with(


  		




  
  12
  
    
      it { is_expected.to contain_file('/etc/nftables/puppet/inet-filter.nft').with(


  		




  13
  13
  
    
        :ensure => 'file',


  		




  14
  14
  
    
        :owner  => 'root',


  		




  15
  15
  
    
        :group  => 'root',


  		




  ......




  17
  17
  
    
      )}


  		




  18
  18
  
    

  		




  19
  19
  
    
      context 'chain input' do


  		




  20
  
  
    
        it { is_expected.to contain_concat('nftables-filter-chain-INPUT').with(


  		




  21
  
  
    
          :path           => '/etc/nftables/puppet/filter-chain-INPUT.nft',


  		




  
  20
  
    
        it { is_expected.to contain_concat('nftables-inet-filter-chain-INPUT').with(


  		




  
  21
  
    
          :path           => '/etc/nftables/puppet/inet-filter-chain-INPUT.nft',


  		




  22
  22
  
    
          :owner          => 'root',


  		




  23
  23
  
    
          :group          => 'root',


  		




  24
  24
  
    
          :mode           => '0640',


  		




  25
  25
  
    
          :ensure_newline => true,


  		




  26
  26
  
    
        )}


  		




  27
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-INPUT-header').with(


  		




  28
  
  
    
          :target  => 'nftables-filter-chain-INPUT',


  		




  
  27
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-header').with(


  		




  
  28
  
    
          :target  => 'nftables-inet-filter-chain-INPUT',


  		




  29
  29
  
    
          :content => /^chain INPUT {$/,


  		




  30
  30
  
    
          :order   => '00',


  		




  31
  31
  
    
        )}


  		




  32
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-INPUT-rule-type').with(


  		




  33
  
  
    
          :target  => 'nftables-filter-chain-INPUT',


  		




  
  32
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-type').with(


  		




  
  33
  
    
          :target  => 'nftables-inet-filter-chain-INPUT',


  		




  34
  34
  
    
          :content => /^  type filter hook input priority 0$/,


  		




  35
  35
  
    
          :order   => '01',


  		




  36
  36
  
    
        )}


  		




  37
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-INPUT-rule-policy').with(


  		




  38
  
  
    
          :target  => 'nftables-filter-chain-INPUT',


  		




  
  37
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-policy').with(


  		




  
  38
  
    
          :target  => 'nftables-inet-filter-chain-INPUT',


  		




  39
  39
  
    
          :content => /^  policy drop$/,


  		




  40
  40
  
    
          :order   => '02',


  		




  41
  41
  
    
        )}


  		




  42
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-INPUT-rule-lo').with(


  		




  43
  
  
    
          :target  => 'nftables-filter-chain-INPUT',


  		




  
  42
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-lo').with(


  		




  
  43
  
    
          :target  => 'nftables-inet-filter-chain-INPUT',


  		




  44
  44
  
    
          :content => /^  iifname lo accept$/,


  		




  45
  45
  
    
          :order   => '03',


  		




  46
  46
  
    
        )}


  		




  47
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-INPUT-rule-jump_global').with(


  		




  48
  
  
    
          :target  => 'nftables-filter-chain-INPUT',


  		




  
  47
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-jump_global').with(


  		




  
  48
  
    
          :target  => 'nftables-inet-filter-chain-INPUT',


  		




  49
  49
  
    
          :content => /^  jump global$/,


  		




  50
  50
  
    
          :order   => '04',


  		




  51
  51
  
    
        )}


  		




  52
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-INPUT-rule-jump_default_in').with(


  		




  53
  
  
    
          :target  => 'nftables-filter-chain-INPUT',


  		




  
  52
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-jump_default_in').with(


  		




  
  53
  
    
          :target  => 'nftables-inet-filter-chain-INPUT',


  		




  54
  54
  
    
          :content => /^  jump default_in$/,


  		




  55
  55
  
    
          :order   => '10',


  		




  56
  56
  
    
        )}


  		




  57
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-INPUT-rule-log_rejected').with(


  		




  58
  
  
    
          :target  => 'nftables-filter-chain-INPUT',


  		




  
  57
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-log_rejected').with(


  		




  
  58
  
    
          :target  => 'nftables-inet-filter-chain-INPUT',


  		




  59
  59
  
    
          :content => /^  log prefix \"\[nftables\] INPUT Rejected: \" flags all counter reject with icmpx type port-unreachable$/,


  		




  60
  60
  
    
          :order   => '98',


  		




  61
  61
  
    
        )}


  		




  62
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-INPUT-footer').with(


  		




  63
  
  
    
          :target  => 'nftables-filter-chain-INPUT',


  		




  
  62
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-INPUT-footer').with(


  		




  
  63
  
    
          :target  => 'nftables-inet-filter-chain-INPUT',


  		




  64
  64
  
    
          :content => /^}$/,


  		




  65
  65
  
    
          :order   => '99',


  		




  66
  66
  
    
        )}


  		




  67
  67
  
    

  		




  68
  
  
    
        it { is_expected.to contain_concat('nftables-filter-chain-default_in').with(


  		




  69
  
  
    
          :path           => '/etc/nftables/puppet/filter-chain-default_in.nft',


  		




  
  68
  
    
        it { is_expected.to contain_concat('nftables-inet-filter-chain-default_in').with(


  		




  
  69
  
    
          :path           => '/etc/nftables/puppet/inet-filter-chain-default_in.nft',


  		




  70
  70
  
    
          :owner          => 'root',


  		




  71
  71
  
    
          :group          => 'root',


  		




  72
  72
  
    
          :mode           => '0640',


  		




  73
  73
  
    
          :ensure_newline => true,


  		




  74
  74
  
    
        )}


  		




  75
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_in-header').with(


  		




  76
  
  
    
          :target  => 'nftables-filter-chain-default_in',


  		




  
  75
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_in-header').with(


  		




  
  76
  
    
          :target  => 'nftables-inet-filter-chain-default_in',


  		




  77
  77
  
    
          :content => /^chain default_in {$/,


  		




  78
  78
  
    
          :order   => '00',


  		




  79
  79
  
    
        )}


  		




  80
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_in-footer').with(


  		




  81
  
  
    
          :target  => 'nftables-filter-chain-default_in',


  		




  
  80
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_in-footer').with(


  		




  
  81
  
    
          :target  => 'nftables-inet-filter-chain-default_in',


  		




  82
  82
  
    
          :content => /^}$/,


  		




  83
  83
  
    
          :order   => '99',


  		




  84
  84
  
    
        )}


  		




  85
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_in-rule-ssh').with(


  		




  86
  
  
    
          :target  => 'nftables-filter-chain-default_in',


  		




  
  85
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_in-rule-ssh').with(


  		




  
  86
  
    
          :target  => 'nftables-inet-filter-chain-default_in',


  		




  87
  87
  
    
          :content => /^  tcp dport \{22\} accept$/,


  		




  88
  88
  
    
          :order   => '50',


  		




  89
  89
  
    
        )}


  		




  90
  90
  
    
      end


  		




  91
  91
  
    

  		




  92
  92
  
    
      context 'chain output' do


  		




  93
  
  
    
        it { is_expected.to contain_concat('nftables-filter-chain-OUTPUT').with(


  		




  94
  
  
    
          :path           => '/etc/nftables/puppet/filter-chain-OUTPUT.nft',


  		




  
  93
  
    
        it { is_expected.to contain_concat('nftables-inet-filter-chain-OUTPUT').with(


  		




  
  94
  
    
          :path           => '/etc/nftables/puppet/inet-filter-chain-OUTPUT.nft',


  		




  95
  95
  
    
          :owner          => 'root',


  		




  96
  96
  
    
          :group          => 'root',


  		




  97
  97
  
    
          :mode           => '0640',


  		




  98
  98
  
    
          :ensure_newline => true,


  		




  99
  99
  
    
        )}


  		




  100
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-OUTPUT-header').with(


  		




  101
  
  
    
          :target  => 'nftables-filter-chain-OUTPUT',


  		




  
  100
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-header').with(


  		




  
  101
  
    
          :target  => 'nftables-inet-filter-chain-OUTPUT',


  		




  102
  102
  
    
          :content => /^chain OUTPUT {$/,


  		




  103
  103
  
    
          :order   => '00',


  		




  104
  104
  
    
        )}


  		




  105
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-OUTPUT-rule-type').with(


  		




  106
  
  
    
          :target  => 'nftables-filter-chain-OUTPUT',


  		




  
  105
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-type').with(


  		




  
  106
  
    
          :target  => 'nftables-inet-filter-chain-OUTPUT',


  		




  107
  107
  
    
          :content => /^  type filter hook output priority 0$/,


  		




  108
  108
  
    
          :order   => '01',


  		




  109
  109
  
    
        )}


  		




  110
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-OUTPUT-rule-policy').with(


  		




  111
  
  
    
          :target  => 'nftables-filter-chain-OUTPUT',


  		




  
  110
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-policy').with(


  		




  
  111
  
    
          :target  => 'nftables-inet-filter-chain-OUTPUT',


  		




  112
  112
  
    
          :content => /^  policy drop$/,


  		




  113
  113
  
    
          :order   => '02',


  		




  114
  114
  
    
        )}


  		




  115
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-OUTPUT-rule-lo').with(


  		




  116
  
  
    
          :target  => 'nftables-filter-chain-OUTPUT',


  		




  
  115
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-lo').with(


  		




  
  116
  
    
          :target  => 'nftables-inet-filter-chain-OUTPUT',


  		




  117
  117
  
    
          :content => /^  oifname lo accept$/,


  		




  118
  118
  
    
          :order   => '03',


  		




  119
  119
  
    
        )}


  		




  120
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-OUTPUT-rule-jump_global').with(


  		




  121
  
  
    
          :target  => 'nftables-filter-chain-OUTPUT',


  		




  
  120
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-jump_global').with(


  		




  
  121
  
    
          :target  => 'nftables-inet-filter-chain-OUTPUT',


  		




  122
  122
  
    
          :content => /^  jump global$/,


  		




  123
  123
  
    
          :order   => '04',


  		




  124
  124
  
    
        )}


  		




  125
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-OUTPUT-rule-jump_default_out').with(


  		




  126
  
  
    
          :target  => 'nftables-filter-chain-OUTPUT',


  		




  
  125
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-jump_default_out').with(


  		




  
  126
  
    
          :target  => 'nftables-inet-filter-chain-OUTPUT',


  		




  127
  127
  
    
          :content => /^  jump default_out$/,


  		




  128
  128
  
    
          :order   => '10',


  		




  129
  129
  
    
        )}


  		




  130
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-OUTPUT-rule-log_rejected').with(


  		




  131
  
  
    
          :target  => 'nftables-filter-chain-OUTPUT',


  		




  
  130
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-log_rejected').with(


  		




  
  131
  
    
          :target  => 'nftables-inet-filter-chain-OUTPUT',


  		




  132
  132
  
    
          :content => /^  log prefix \"\[nftables\] OUTPUT Rejected: \" flags all counter reject with icmpx type port-unreachable$/,


  		




  133
  133
  
    
          :order   => '98',


  		




  134
  134
  
    
        )}


  		




  135
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-OUTPUT-footer').with(


  		




  136
  
  
    
          :target  => 'nftables-filter-chain-OUTPUT',


  		




  
  135
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-footer').with(


  		




  
  136
  
    
          :target  => 'nftables-inet-filter-chain-OUTPUT',


  		




  137
  137
  
    
          :content => /^}$/,


  		




  138
  138
  
    
          :order   => '99',


  		




  139
  139
  
    
        )}


  		




  140
  140
  
    

  		




  141
  
  
    
        it { is_expected.to contain_concat('nftables-filter-chain-default_out').with(


  		




  142
  
  
    
          :path           => '/etc/nftables/puppet/filter-chain-default_out.nft',


  		




  
  141
  
    
        it { is_expected.to contain_concat('nftables-inet-filter-chain-default_out').with(


  		




  
  142
  
    
          :path           => '/etc/nftables/puppet/inet-filter-chain-default_out.nft',


  		




  143
  143
  
    
          :owner          => 'root',


  		




  144
  144
  
    
          :group          => 'root',


  		




  145
  145
  
    
          :mode           => '0640',


  		




  146
  146
  
    
          :ensure_newline => true,


  		




  147
  147
  
    
        )}


  		




  148
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_out-header').with(


  		




  149
  
  
    
          :target  => 'nftables-filter-chain-default_out',


  		




  
  148
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-header').with(


  		




  
  149
  
    
          :target  => 'nftables-inet-filter-chain-default_out',


  		




  150
  150
  
    
          :content => /^chain default_out {$/,


  		




  151
  151
  
    
          :order   => '00',


  		




  152
  152
  
    
        )}


  		




  153
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_out-footer').with(


  		




  154
  
  
    
          :target  => 'nftables-filter-chain-default_out',


  		




  
  153
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-footer').with(


  		




  
  154
  
    
          :target  => 'nftables-inet-filter-chain-default_out',


  		




  155
  155
  
    
          :content => /^}$/,


  		




  156
  156
  
    
          :order   => '99',


  		




  157
  157
  
    
        )}


  		




  158
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_out-rule-dnsudp').with(


  		




  159
  
  
    
          :target  => 'nftables-filter-chain-default_out',


  		




  
  158
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnsudp').with(


  		




  
  159
  
    
          :target  => 'nftables-inet-filter-chain-default_out',


  		




  160
  160
  
    
          :content => /^  udp dport 53 accept$/,


  		




  161
  161
  
    
          :order   => '50',


  		




  162
  162
  
    
        )}


  		




  163
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_out-rule-dnstcp').with(


  		




  164
  
  
    
          :target  => 'nftables-filter-chain-default_out',


  		




  
  163
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-dnstcp').with(


  		




  
  164
  
    
          :target  => 'nftables-inet-filter-chain-default_out',


  		




  165
  165
  
    
          :content => /^  tcp dport 53 accept$/,


  		




  166
  166
  
    
          :order   => '50',


  		




  167
  167
  
    
        )}


  		




  168
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_out-rule-chrony').with(


  		




  169
  
  
    
          :target  => 'nftables-filter-chain-default_out',


  		




  
  168
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony').with(


  		




  
  169
  
    
          :target  => 'nftables-inet-filter-chain-default_out',


  		




  170
  170
  
    
          :content => /^  udp dport 123 accept$/,


  		




  171
  171
  
    
          :order   => '50',


  		




  172
  172
  
    
        )}


  		




  173
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_out-rule-http').with(


  		




  174
  
  
    
          :target  => 'nftables-filter-chain-default_out',


  		




  
  173
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-http').with(


  		




  
  174
  
    
          :target  => 'nftables-inet-filter-chain-default_out',


  		




  175
  175
  
    
          :content => /^  tcp dport 80 accept$/,


  		




  176
  176
  
    
          :order   => '50',


  		




  177
  177
  
    
        )}


  		




  178
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_out-rule-https').with(


  		




  179
  
  
    
          :target  => 'nftables-filter-chain-default_out',


  		




  
  178
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-https').with(


  		




  
  179
  
    
          :target  => 'nftables-inet-filter-chain-default_out',


  		




  180
  180
  
    
          :content => /^  tcp dport 443 accept$/,


  		




  181
  181
  
    
          :order   => '50',


  		




  182
  182
  
    
        )}


  		




  183
  183
  
    
      end


  		




  184
  184
  
    

  		




  185
  185
  
    
      context 'chain forward' do


  		




  186
  
  
    
        it { is_expected.to contain_concat('nftables-filter-chain-FORWARD').with(


  		




  187
  
  
    
          :path           => '/etc/nftables/puppet/filter-chain-FORWARD.nft',


  		




  
  186
  
    
        it { is_expected.to contain_concat('nftables-inet-filter-chain-FORWARD').with(


  		




  
  187
  
    
          :path           => '/etc/nftables/puppet/inet-filter-chain-FORWARD.nft',


  		




  188
  188
  
    
          :owner          => 'root',


  		




  189
  189
  
    
          :group          => 'root',


  		




  190
  190
  
    
          :mode           => '0640',


  		




  191
  191
  
    
          :ensure_newline => true,


  		




  192
  192
  
    
        )}


  		




  193
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-FORWARD-header').with(


  		




  194
  
  
    
          :target  => 'nftables-filter-chain-FORWARD',


  		




  
  193
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-header').with(


  		




  
  194
  
    
          :target  => 'nftables-inet-filter-chain-FORWARD',


  		




  195
  195
  
    
          :content => /^chain FORWARD {$/,


  		




  196
  196
  
    
          :order   => '00',


  		




  197
  197
  
    
        )}


  		




  198
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-FORWARD-rule-type').with(


  		




  199
  
  
    
          :target  => 'nftables-filter-chain-FORWARD',


  		




  
  198
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-type').with(


  		




  
  199
  
    
          :target  => 'nftables-inet-filter-chain-FORWARD',


  		




  200
  200
  
    
          :content => /^  type filter hook forward priority 0$/,


  		




  201
  201
  
    
          :order   => '01',


  		




  202
  202
  
    
        )}


  		




  203
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-FORWARD-rule-policy').with(


  		




  204
  
  
    
          :target  => 'nftables-filter-chain-FORWARD',


  		




  
  203
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-policy').with(


  		




  
  204
  
    
          :target  => 'nftables-inet-filter-chain-FORWARD',


  		




  205
  205
  
    
          :content => /^  policy drop$/,


  		




  206
  206
  
    
          :order   => '02',


  		




  207
  207
  
    
        )}


  		




  208
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-FORWARD-rule-jump_global').with(


  		




  209
  
  
    
          :target  => 'nftables-filter-chain-FORWARD',


  		




  
  208
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-jump_global').with(


  		




  
  209
  
    
          :target  => 'nftables-inet-filter-chain-FORWARD',


  		




  210
  210
  
    
          :content => /^  jump global$/,


  		




  211
  211
  
    
          :order   => '03',


  		




  212
  212
  
    
        )}


  		




  213
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-FORWARD-rule-jump_default_fwd').with(


  		




  214
  
  
    
          :target  => 'nftables-filter-chain-FORWARD',


  		




  
  213
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-jump_default_fwd').with(


  		




  
  214
  
    
          :target  => 'nftables-inet-filter-chain-FORWARD',


  		




  215
  215
  
    
          :content => /^  jump default_fwd$/,


  		




  216
  216
  
    
          :order   => '10',


  		




  217
  217
  
    
        )}


  		




  218
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-FORWARD-rule-log_rejected').with(


  		




  219
  
  
    
          :target  => 'nftables-filter-chain-FORWARD',


  		




  
  218
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-log_rejected').with(


  		




  
  219
  
    
          :target  => 'nftables-inet-filter-chain-FORWARD',


  		




  220
  220
  
    
          :content => /^  log prefix \"\[nftables\] FORWARD Rejected: \" flags all counter reject with icmpx type port-unreachable$/,


  		




  221
  221
  
    
          :order   => '98',


  		




  222
  222
  
    
        )}


  		




  223
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-FORWARD-footer').with(


  		




  224
  
  
    
          :target  => 'nftables-filter-chain-FORWARD',


  		




  
  223
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-footer').with(


  		




  
  224
  
    
          :target  => 'nftables-inet-filter-chain-FORWARD',


  		




  225
  225
  
    
          :content => /^}$/,


  		




  226
  226
  
    
          :order   => '99',


  		




  227
  227
  
    
        )}


  		




  228
  228
  
    

  		




  229
  
  
    
        it { is_expected.to contain_concat('nftables-filter-chain-default_fwd').with(


  		




  230
  
  
    
          :path           => '/etc/nftables/puppet/filter-chain-default_fwd.nft',


  		




  
  229
  
    
        it { is_expected.to contain_concat('nftables-inet-filter-chain-default_fwd').with(


  		




  
  230
  
    
          :path           => '/etc/nftables/puppet/inet-filter-chain-default_fwd.nft',


  		




  231
  231
  
    
          :owner          => 'root',


  		




  232
  232
  
    
          :group          => 'root',


  		




  233
  233
  
    
          :mode           => '0640',


  		




  234
  234
  
    
          :ensure_newline => true,


  		




  235
  235
  
    
        )}


  		




  236
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_fwd-header').with(


  		




  237
  
  
    
          :target  => 'nftables-filter-chain-default_fwd',


  		




  
  236
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-header').with(


  		




  
  237
  
    
          :target  => 'nftables-inet-filter-chain-default_fwd',


  		




  238
  238
  
    
          :content => /^chain default_fwd {$/,


  		




  239
  239
  
    
          :order   => '00',


  		




  240
  240
  
    
        )}


  		




  241
  
  
    
        it { is_expected.to contain_concat__fragment('nftables-filter-chain-default_fwd-footer').with(


  		




  242
  
  
    
          :target  => 'nftables-filter-chain-default_fwd',


  		




  
  241
  
    
        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-footer').with(


  		




  
  242
  
    
          :target  => 'nftables-inet-filter-chain-default_fwd',


  		




  243
  243
  
    
          :content => /^}$/,


  		




  244
  244
  
    
          :order   => '99',


  		




  245
  245
  
    
        )}


  		












Formats disponibles :  Unified diff