Révision a528bf59
New clobber_default_config paramter
Certain OSes namely Debian and Archlinux provide default rules
with the OS.
This module has always respected those rules and appended all of
its own rules to the end of the existing rules.
The new parameter `clobber_default_config` if set `true` (default `false`)
will drop any existing OS provided rules.
Also related to acceptance tests only on Archlinux where the default
OS provided configuration requires kernel >= 6.3 we purge the default rules
if required.
| REFERENCE.md | ||
|---|---|---|
| 178 | 178 |
* [`nft_path`](#-nftables--nft_path) |
| 179 | 179 |
* [`echo`](#-nftables--echo) |
| 180 | 180 |
* [`default_config_mode`](#-nftables--default_config_mode) |
| 181 |
* [`clobber_default_config`](#-nftables--clobber_default_config) |
|
| 181 | 182 |
|
| 182 | 183 |
##### <a name="-nftables--out_all"></a>`out_all` |
| 183 | 184 |
|
| ... | ... | |
| 404 | 405 |
The default file & dir mode for configuration files and directories. The |
| 405 | 406 |
default varies depending on the system, and is set in the module's data. |
| 406 | 407 |
|
| 408 |
##### <a name="-nftables--clobber_default_config"></a>`clobber_default_config` |
|
| 409 |
|
|
| 410 |
Data type: `Boolean` |
|
| 411 |
|
|
| 412 |
Should the existing OS provided rules in the `configuration_path` be removed? If |
|
| 413 |
they are not being removed this module will add all of its configuration to the end of |
|
| 414 |
the existing rules. |
|
| 415 |
|
|
| 416 |
Default value: `false` |
|
| 417 |
|
|
| 407 | 418 |
### <a name="nftables--bridges"></a>`nftables::bridges` |
| 408 | 419 |
|
| 409 | 420 |
allow forwarding traffic on bridges |
| manifests/init.pp | ||
|---|---|---|
| 109 | 109 |
# The default file & dir mode for configuration files and directories. The |
| 110 | 110 |
# default varies depending on the system, and is set in the module's data. |
| 111 | 111 |
# |
| 112 |
# @param clobber_default_config |
|
| 113 |
# Should the existing OS provided rules in the `configuration_path` be removed? If |
|
| 114 |
# they are not being removed this module will add all of its configuration to the end of |
|
| 115 |
# the existing rules. |
|
| 116 |
# |
|
| 112 | 117 |
class nftables ( |
| 113 | 118 |
Stdlib::Unixpath $echo, |
| 114 | 119 |
Stdlib::Unixpath $configuration_path, |
| 115 | 120 |
Stdlib::Unixpath $nft_path, |
| 116 | 121 |
Stdlib::Filemode $default_config_mode, |
| 122 |
Boolean $clobber_default_config = false, |
|
| 117 | 123 |
Boolean $in_ssh = true, |
| 118 | 124 |
Boolean $in_icmp = true, |
| 119 | 125 |
Boolean $out_ntp = true, |
| ... | ... | |
| 140 | 146 |
) {
|
| 141 | 147 |
package { 'nftables':
|
| 142 | 148 |
ensure => installed, |
| 143 |
} -> file_line {
|
|
| 144 |
'enable_nftables': |
|
| 145 |
line => 'include "/etc/nftables/puppet.nft"', |
|
| 146 |
path => $configuration_path, |
|
| 147 |
notify => Service['nftables'], |
|
| 148 |
} -> file {
|
|
| 149 |
} |
|
| 150 |
|
|
| 151 |
if $clobber_default_config {
|
|
| 152 |
file { $configuration_path:
|
|
| 153 |
ensure => file, |
|
| 154 |
owner => 'root', |
|
| 155 |
group => 'root', |
|
| 156 |
mode => $default_config_mode, |
|
| 157 |
content => "#Puppet Managed\ninclude \"/etc/nftables/puppet.nft\"\n", |
|
| 158 |
require => Package['nftables'], |
|
| 159 |
before => File['/etc/nftables'], |
|
| 160 |
notify => Service['nftables'], |
|
| 161 |
} |
|
| 162 |
} else {
|
|
| 163 |
file_line { 'enable_nftables':
|
|
| 164 |
line => 'include "/etc/nftables/puppet.nft"', |
|
| 165 |
path => $configuration_path, |
|
| 166 |
require => Package['nftables'], |
|
| 167 |
before => File['/etc/nftables'], |
|
| 168 |
notify => Service['nftables'], |
|
| 169 |
} |
|
| 170 |
} |
|
| 171 |
|
|
| 172 |
file {
|
|
| 149 | 173 |
default: |
| 150 | 174 |
owner => 'root', |
| 151 | 175 |
group => 'root', |
| spec/acceptance/all_rules_spec.rb | ||
|---|---|---|
| 6 | 6 |
context 'configure all nftables rules' do |
| 7 | 7 |
it 'works idempotently with no errors' do |
| 8 | 8 |
pp = <<-EOS |
| 9 |
# Default ArchLinux rules contain "destroy" that requires kernel >= 6.3 |
|
| 10 |
# https://gitlab.archlinux.org/archlinux/packaging/packages/nftables/-/commit/f26a7145b2885d298925819782a5302905332dbe |
|
| 11 |
# When running on docker this may not be the case. |
|
| 12 |
if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
|
|
| 13 |
$_clobber_default_config = true |
|
| 14 |
} else {
|
|
| 15 |
$_clobber_default_config = undef |
|
| 16 |
} |
|
| 17 |
|
|
| 9 | 18 |
# default mask of firewalld service fails if service is not installed. |
| 10 | 19 |
# https://tickets.puppetlabs.com/browse/PUP-10814 |
| 11 | 20 |
# Disable all default rules and include below explicitly |
| 12 | 21 |
class { 'nftables':
|
| 13 |
firewalld_enable => false, |
|
| 14 |
out_ntp => false, |
|
| 15 |
out_http => false, |
|
| 16 |
out_https => false, |
|
| 17 |
out_icmp => false, |
|
| 18 |
in_ssh => false, |
|
| 19 |
in_icmp => false, |
|
| 22 |
firewalld_enable => false, |
|
| 23 |
out_ntp => false, |
|
| 24 |
out_http => false, |
|
| 25 |
out_https => false, |
|
| 26 |
out_icmp => false, |
|
| 27 |
in_ssh => false, |
|
| 28 |
in_icmp => false, |
|
| 29 |
clobber_default_config => $_clobber_default_config, |
|
| 20 | 30 |
} |
| 21 | 31 |
include nftables::rules::icmp |
| 22 | 32 |
include nftables::rules::dns |
| spec/acceptance/default_spec.rb | ||
|---|---|---|
| 6 | 6 |
context 'configure default nftables service' do |
| 7 | 7 |
it 'works idempotently with no errors' do |
| 8 | 8 |
pp = <<-EOS |
| 9 |
|
|
| 10 |
# Default ArchLinux rules contain "destroy" that requires kernel >= 6.3 |
|
| 11 |
# https://gitlab.archlinux.org/archlinux/packaging/packages/nftables/-/commit/f26a7145b2885d298925819782a5302905332dbe |
|
| 12 |
# When running on docker this may not be the case. |
|
| 13 |
if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
|
|
| 14 |
$_clobber_default_config = true |
|
| 15 |
} else {
|
|
| 16 |
$_clobber_default_config = undef |
|
| 17 |
} |
|
| 18 |
|
|
| 9 | 19 |
# default mask of firewalld service fails if service is not installed. |
| 10 | 20 |
# https://tickets.puppetlabs.com/browse/PUP-10814 |
| 11 | 21 |
class { 'nftables':
|
| 12 | 22 |
firewalld_enable => false, |
| 23 |
clobber_default_config => $_clobber_default_config, |
|
| 13 | 24 |
} |
| 14 | 25 |
$config_path = $facts['os']['family'] ? {
|
| 15 | 26 |
'Archlinux' => '/etc/nftables.conf', |
| ... | ... | |
| 61 | 72 |
context 'with bad invalid nft rules' do |
| 62 | 73 |
it 'puppet fails but should leave nft service running' do |
| 63 | 74 |
pp = <<-EOS |
| 75 |
if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
|
|
| 76 |
$_clobber_default_config = true |
|
| 77 |
} else {
|
|
| 78 |
$_clobber_default_config = undef |
|
| 79 |
} |
|
| 64 | 80 |
class{'nftables':
|
| 65 | 81 |
firewalld_enable => false, |
| 82 |
clobber_default_config => $_clobber_default_config, |
|
| 66 | 83 |
} |
| 67 | 84 |
nftables::rule{'default_out-junk':
|
| 68 | 85 |
content => 'A load of junk', |
| ... | ... | |
| 103 | 120 |
context 'with totally empty firewall' do |
| 104 | 121 |
it 'no rules validate okay' do |
| 105 | 122 |
pp = <<-EOS |
| 123 |
if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
|
|
| 124 |
$_clobber_default_config = true |
|
| 125 |
} else {
|
|
| 126 |
$_clobber_default_config = undef |
|
| 127 |
} |
|
| 106 | 128 |
class{'nftables':
|
| 107 | 129 |
firewalld_enable => false, |
| 108 | 130 |
inet_filter => false, |
| 109 | 131 |
nat => false, |
| 132 |
clobber_default_config => $_clobber_default_config, |
|
| 110 | 133 |
} |
| 111 | 134 |
$config_path = $facts['os']['family'] ? {
|
| 112 | 135 |
'Archlinux' => '/etc/nftables.conf', |
| ... | ... | |
| 144 | 167 |
context 'with custom nat_table_name' do |
| 145 | 168 |
it 'no rules validate okay' do |
| 146 | 169 |
pp = <<-EOS |
| 170 |
if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
|
|
| 171 |
$_clobber_default_config = true |
|
| 172 |
} else {
|
|
| 173 |
$_clobber_default_config = undef |
|
| 174 |
} |
|
| 147 | 175 |
class{'nftables':
|
| 148 | 176 |
firewalld_enable => false, |
| 149 | 177 |
nat => true, |
| 150 | 178 |
nat_table_name => 'mycustomtablename', |
| 179 |
clobber_default_config => $_clobber_default_config, |
|
| 151 | 180 |
} |
| 152 | 181 |
$config_path = $facts['os']['family'] ? {
|
| 153 | 182 |
'Archlinux' => '/etc/nftables.conf', |
| ... | ... | |
| 185 | 214 |
context 'with only an empty netdev table' do |
| 186 | 215 |
it 'rules validate okay' do |
| 187 | 216 |
pp = <<-EOS |
| 217 |
if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
|
|
| 218 |
$_clobber_default_config = true |
|
| 219 |
} else {
|
|
| 220 |
$_clobber_default_config = undef |
|
| 221 |
} |
|
| 188 | 222 |
class{'nftables':
|
| 189 | 223 |
firewalld_enable => false, |
| 190 | 224 |
inet_filter => false, |
| 191 | 225 |
nat => false, |
| 226 |
clobber_default_config => $_clobber_default_config, |
|
| 192 | 227 |
} |
| 193 | 228 |
nftables::config {
|
| 194 | 229 |
'netdev-filter': |
| spec/acceptance/destroy_spec.rb | ||
|---|---|---|
| 1 |
# frozen_string_literal: true |
|
| 2 |
|
|
| 3 |
require 'spec_helper_acceptance' |
|
| 4 |
|
|
| 5 |
describe 'nftables class' do |
|
| 6 |
context 'configure defaults destroyed nftables service' do |
|
| 7 |
it 'works idempotently with no errors' do |
|
| 8 |
pp = <<-EOS |
|
| 9 |
# default mask of firewalld service fails if service is not installed. |
|
| 10 |
# https://tickets.puppetlabs.com/browse/PUP-10814 |
|
| 11 |
class { 'nftables':
|
|
| 12 |
firewalld_enable => false, |
|
| 13 |
clobber_default_config => true, |
|
| 14 |
} |
|
| 15 |
$config_path = $facts['os']['family'] ? {
|
|
| 16 |
'Archlinux' => '/etc/nftables.conf', |
|
| 17 |
'Debian' => '/etc/nftables.conf', |
|
| 18 |
default => '/etc/sysconfig/nftables.conf', |
|
| 19 |
} |
|
| 20 |
$nft_path = $facts['os']['family'] ? {
|
|
| 21 |
'Archlinux' => '/usr/bin/nft', |
|
| 22 |
default => '/usr/sbin/nft', |
|
| 23 |
} |
|
| 24 |
# nftables cannot be started in docker so replace service with a validation only. |
|
| 25 |
systemd::dropin_file{"zzz_docker_nft.conf":
|
|
| 26 |
ensure => present, |
|
| 27 |
unit => "nftables.service", |
|
| 28 |
content => [ |
|
| 29 |
"[Service]", |
|
| 30 |
"ExecStart=", |
|
| 31 |
"ExecStart=${nft_path} -c -I /etc/nftables/puppet -f ${config_path}",
|
|
| 32 |
"ExecReload=", |
|
| 33 |
"ExecReload=${nft_path} -c -I /etc/nftables/puppet -f ${config_path}",
|
|
| 34 |
"", |
|
| 35 |
].join("\n"),
|
|
| 36 |
notify => Service["nftables"], |
|
| 37 |
} |
|
| 38 |
EOS |
|
| 39 |
# Run it twice and test for idempotency |
|
| 40 |
apply_manifest(pp, catch_failures: true) |
|
| 41 |
apply_manifest(pp, catch_changes: true) |
|
| 42 |
end |
|
| 43 |
|
|
| 44 |
describe package('nftables') do
|
|
| 45 |
it { is_expected.to be_installed }
|
|
| 46 |
end |
|
| 47 |
|
|
| 48 |
describe service('nftables') do
|
|
| 49 |
it { is_expected.to be_running }
|
|
| 50 |
it { is_expected.to be_enabled }
|
|
| 51 |
end |
|
| 52 |
|
|
| 53 |
describe file('/etc/nftables/puppet.nft', '/etc/systemd/system/nftables.service.d/puppet_nft.conf') do
|
|
| 54 |
it { is_expected.to be_file }
|
|
| 55 |
end |
|
| 56 |
|
|
| 57 |
describe file('/etc/nftables/puppet') do
|
|
| 58 |
it { is_expected.to be_directory }
|
|
| 59 |
end |
|
| 60 |
end |
|
| 61 |
end |
|
| spec/classes/nftables_spec.rb | ||
|---|---|---|
| 33 | 33 |
|
| 34 | 34 |
it { is_expected.to contain_package('nftables') }
|
| 35 | 35 |
|
| 36 |
context 'with clobber_default_config false' do |
|
| 37 |
let(:params) do |
|
| 38 |
{ clobber_default_config: false }
|
|
| 39 |
end |
|
| 40 |
|
|
| 41 |
it {
|
|
| 42 |
is_expected.to contain_file_line('enable_nftables').with(
|
|
| 43 |
line: 'include "/etc/nftables/puppet.nft"', |
|
| 44 |
path: nft_config |
|
| 45 |
) |
|
| 46 |
} |
|
| 47 |
|
|
| 48 |
it { is_expected.not_to contain_file(nft_config) }
|
|
| 49 |
end |
|
| 50 |
|
|
| 51 |
context 'with clobber_default_config true' do |
|
| 52 |
let(:params) do |
|
| 53 |
{ clobber_default_config: true }
|
|
| 54 |
end |
|
| 55 |
|
|
| 56 |
it {
|
|
| 57 |
is_expected.to contain_file(nft_config).with( |
|
| 58 |
ensure: 'file', |
|
| 59 |
content: %r{^include "/etc/nftables/puppet.nft"$},
|
|
| 60 |
owner: 'root', |
|
| 61 |
group: 'root' |
|
| 62 |
) |
|
| 63 |
} |
|
| 64 |
|
|
| 65 |
it { is_expected.not_to contain_file_line('enable_nftables') }
|
|
| 66 |
end |
|
| 67 |
|
|
| 36 | 68 |
it {
|
| 37 | 69 |
is_expected.to contain_file('/etc/nftables').with(
|
| 38 | 70 |
ensure: 'directory', |
Formats disponibles : Unified diff