Projet

Général

Profil

Révision a528bf59

IDa528bf593a7b3671efbadefb13bb3e81130dd29c
Parent 1331dc33
Enfant de945d0d

Ajouté par Steve Traylen il y a 11 mois

New clobber_default_config paramter

Certain OSes namely Debian and Archlinux provide default rules
with the OS.

This module has always respected those rules and appended all of
its own rules to the end of the existing rules.

The new parameter `clobber_default_config` if set `true` (default `false`)
will drop any existing OS provided rules.

Also related to acceptance tests only on Archlinux where the default
OS provided configuration requires kernel >= 6.3 we purge the default rules
if required.

Voir les différences:

spec/acceptance/all_rules_spec.rb
6 6 
  context 'configure all nftables rules' do
7 7 
    it 'works idempotently with no errors' do
8 8 
      pp = <<-EOS
9 
      # Default ArchLinux rules contain "destroy" that requires kernel >= 6.3
10 
      # https://gitlab.archlinux.org/archlinux/packaging/packages/nftables/-/commit/f26a7145b2885d298925819782a5302905332dbe
11 
      # When running on docker this may not be the case.
12 
      if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
13 
        $_clobber_default_config = true
14 
      } else {
15 
        $_clobber_default_config = undef
16 
      }
17 

  		




  9
  18
  
    
      # default mask of firewalld service fails if service is not installed.


  		




  10
  19
  
    
      # https://tickets.puppetlabs.com/browse/PUP-10814


  		




  11
  20
  
    
      # Disable all default rules and include below explicitly


  		




  12
  21
  
    
      class { 'nftables':


  		




  13
  
  
    
        firewalld_enable => false,


  		




  14
  
  
    
        out_ntp          => false,


  		




  15
  
  
    
        out_http         => false,


  		




  16
  
  
    
        out_https        => false,


  		




  17
  
  
    
        out_icmp         => false,


  		




  18
  
  
    
        in_ssh           => false,


  		




  19
  
  
    
        in_icmp          => false,


  		




  
  22
  
    
        firewalld_enable       => false,


  		




  
  23
  
    
        out_ntp                => false,


  		




  
  24
  
    
        out_http               => false,


  		




  
  25
  
    
        out_https              => false,


  		




  
  26
  
    
        out_icmp               => false,


  		




  
  27
  
    
        in_ssh                 => false,


  		




  
  28
  
    
        in_icmp                => false,


  		




  
  29
  
    
        clobber_default_config => $_clobber_default_config,


  		




  20
  30
  
    
      }


  		




  21
  31
  
    
      include nftables::rules::icmp


  		




  22
  32
  
    
      include nftables::rules::dns


  		












Formats disponibles :  Unified diff