Révision 7937a13b
chrony: Allow filtering for outgoing NTP servers
| REFERENCE.md | ||
|---|---|---|
| 675 | 675 |
|
| 676 | 676 |
manage out chrony |
| 677 | 677 |
|
| 678 |
#### Parameters |
|
| 679 |
|
|
| 680 |
The following parameters are available in the `nftables::rules::out::chrony` class: |
|
| 681 |
|
|
| 682 |
* [`servers`](#servers) |
|
| 683 |
|
|
| 684 |
##### <a name="servers"></a>`servers` |
|
| 685 |
|
|
| 686 |
Data type: `Array[Stdlib::IP::Address]` |
|
| 687 |
|
|
| 688 |
single IP-Address or array of IP-addresses from NTP servers |
|
| 689 |
|
|
| 690 |
Default value: `[]` |
|
| 691 |
|
|
| 678 | 692 |
### <a name="nftablesrulesoutdhcp"></a>`nftables::rules::out::dhcp` |
| 679 | 693 |
|
| 680 | 694 |
manage out dhcp |
| manifests/rules/out/chrony.pp | ||
|---|---|---|
| 1 |
# manage out chrony |
|
| 2 |
class nftables::rules::out::chrony {
|
|
| 3 |
nftables::rule {
|
|
| 4 |
'default_out-chrony': |
|
| 5 |
content => 'udp dport 123 accept', |
|
| 1 |
# @summary manage out chrony |
|
| 2 |
# @param servers single IP-Address or array of IP-addresses from NTP servers |
|
| 3 |
class nftables::rules::out::chrony ( |
|
| 4 |
Array[Stdlib::IP::Address] $servers = [], |
|
| 5 |
) {
|
|
| 6 |
if empty($servers) {
|
|
| 7 |
nftables::rule {
|
|
| 8 |
'default_out-chrony': |
|
| 9 |
content => 'udp dport 123 accept', |
|
| 10 |
} |
|
| 11 |
} else {
|
|
| 12 |
$ipv6_servers = $servers.filter |$ip| { $ip =~ Stdlib::IP::Address::V6 }
|
|
| 13 |
$ipv4_servers = $servers.filter |$ip| { $ip =~ Stdlib::IP::Address::V4 }
|
|
| 14 |
unless empty($ipv6_servers) {
|
|
| 15 |
nftables::rule { 'default_out-chrony_v6':
|
|
| 16 |
content => "ip6 daddr {${join($ipv6_servers, ',')}} udp dport 123 accept",
|
|
| 17 |
} |
|
| 18 |
} |
|
| 19 |
unless empty($ipv4_servers) {
|
|
| 20 |
nftables::rule { 'default_out-chrony_v4':
|
|
| 21 |
content => "ip daddr {${join($ipv4_servers, ',')}} udp dport 123 accept",
|
|
| 22 |
} |
|
| 23 |
} |
|
| 6 | 24 |
} |
| 7 | 25 |
} |
| spec/classes/rules/out/chrony_spec.rb | ||
|---|---|---|
| 1 |
# frozen_string_literal: true |
|
| 2 |
|
|
| 3 |
require 'spec_helper' |
|
| 4 |
|
|
| 5 |
describe 'nftables::rules::out::chrony' do |
|
| 6 |
on_supported_os.each do |os, os_facts| |
|
| 7 |
context "on #{os}" do
|
|
| 8 |
let(:facts) { os_facts }
|
|
| 9 |
|
|
| 10 |
context 'default options' do |
|
| 11 |
it { is_expected.to compile.with_all_deps }
|
|
| 12 |
it { is_expected.to contain_nftables__rule('default_out-chrony').with_content('udp dport 123 accept') }
|
|
| 13 |
it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony') }
|
|
| 14 |
it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony_header') }
|
|
| 15 |
end |
|
| 16 |
|
|
| 17 |
context 'with two IPv4 addresses as array' do |
|
| 18 |
let(:params) do |
|
| 19 |
{ servers: ['1.2.3.4', '5.6.7.8'] }
|
|
| 20 |
end |
|
| 21 |
|
|
| 22 |
it { is_expected.to compile.with_all_deps }
|
|
| 23 |
it { is_expected.to contain_nftables__rule('default_out-chrony_v4').with_content('ip daddr {1.2.3.4,5.6.7.8} udp dport 123 accept') }
|
|
| 24 |
it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony_v4') }
|
|
| 25 |
it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony_v4_header') }
|
|
| 26 |
end |
|
| 27 |
|
|
| 28 |
context 'with ipv6 & ipv4 address as array' do |
|
| 29 |
let(:params) do |
|
| 30 |
{ servers: ['fe80::1', '1.2.3.4'] }
|
|
| 31 |
end |
|
| 32 |
|
|
| 33 |
it { is_expected.to compile.with_all_deps }
|
|
| 34 |
it { is_expected.to contain_nftables__rule('default_out-chrony_v4').with_content('ip daddr {1.2.3.4} udp dport 123 accept') }
|
|
| 35 |
it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony_v4') }
|
|
| 36 |
it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony_v4_header') }
|
|
| 37 |
it { is_expected.to contain_nftables__rule('default_out-chrony_v6').with_content('ip6 daddr {fe80::1} udp dport 123 accept') }
|
|
| 38 |
it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony_v6') }
|
|
| 39 |
it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-chrony_v6_header') }
|
|
| 40 |
end |
|
| 41 |
end |
|
| 42 |
end |
|
| 43 |
end |
|
Formats disponibles : Unified diff