Révision aaa37172
Implement nftables:;simplerule::daddr
| manifests/simplerule.pp | ||
|---|---|---|
| 20 | 20 |
$dport = undef, |
| 21 | 21 |
Optional[Enum['tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6']] |
| 22 | 22 |
$proto = undef, |
| 23 |
Optional[Variant[Stdlib::IP::Address::V6, Stdlib::IP::Address::V4, Pattern[/^@[-a-zA-Z0-9_]+$/]]] |
|
| 24 |
$daddr = undef, |
|
| 25 |
Enum['ip', 'ip6'] |
|
| 26 |
$set_type = 'ip6', |
|
| 23 | 27 |
){
|
| 24 | 28 |
|
| 25 | 29 |
if $dport and !$proto {
|
| ... | ... | |
| 30 | 34 |
nftables::rule{"${chain}-${rulename}":
|
| 31 | 35 |
content => epp('nftables/simplerule.epp',
|
| 32 | 36 |
{
|
| 33 |
'action' => $action, |
|
| 34 |
'comment' => $comment, |
|
| 35 |
'dport' => $dport, |
|
| 36 |
'proto' => $proto, |
|
| 37 |
'action' => $action, |
|
| 38 |
'comment' => $comment, |
|
| 39 |
'dport' => $dport, |
|
| 40 |
'proto' => $proto, |
|
| 41 |
'daddr' => $daddr, |
|
| 42 |
'set_type' => $set_type, |
|
| 37 | 43 |
} |
| 38 | 44 |
), |
| 39 | 45 |
order => $order, |
| spec/defines/simplerule_spec.rb | ||
|---|---|---|
| 38 | 38 |
dport: 333, |
| 39 | 39 |
proto: 'udp', |
| 40 | 40 |
chain: 'default_out', |
| 41 |
daddr: '2001:1458::/32', |
|
| 41 | 42 |
} |
| 42 | 43 |
end |
| 43 | 44 |
|
| 44 | 45 |
it { is_expected.to compile }
|
| 45 | 46 |
it {
|
| 46 | 47 |
is_expected.to contain_nftables__rule('default_out-my_big_rule').with(
|
| 47 |
content: 'udp dport 333 comment "this is my rule" accept',
|
|
| 48 |
content: 'udp dport 333 ip6 daddr 2001:1458::/32 accept comment "this is my rule"',
|
|
| 48 | 49 |
order: '50', |
| 49 | 50 |
) |
| 50 | 51 |
} |
| ... | ... | |
| 113 | 114 |
) |
| 114 | 115 |
} |
| 115 | 116 |
end |
| 117 |
|
|
| 118 |
describe 'with an IPv4 CIDR as daddr' do |
|
| 119 |
let(:params) do |
|
| 120 |
{
|
|
| 121 |
daddr: '192.168.0.1/24', |
|
| 122 |
dport: 33, |
|
| 123 |
proto: 'tcp', |
|
| 124 |
} |
|
| 125 |
end |
|
| 126 |
|
|
| 127 |
it { is_expected.to compile }
|
|
| 128 |
it {
|
|
| 129 |
is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
|
|
| 130 |
content: 'tcp dport 33 ip daddr 192.168.0.1/24 accept', |
|
| 131 |
) |
|
| 132 |
} |
|
| 133 |
end |
|
| 134 |
|
|
| 135 |
describe 'with an IPv6 address as daddr' do |
|
| 136 |
let(:params) do |
|
| 137 |
{
|
|
| 138 |
daddr: '2001:1458::1', |
|
| 139 |
} |
|
| 140 |
end |
|
| 141 |
|
|
| 142 |
it { is_expected.to compile }
|
|
| 143 |
it {
|
|
| 144 |
is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
|
|
| 145 |
content: 'ip6 daddr 2001:1458::1 accept', |
|
| 146 |
) |
|
| 147 |
} |
|
| 148 |
end |
|
| 149 |
|
|
| 150 |
describe 'with an IPv6 set as daddr, default set_type' do |
|
| 151 |
let(:params) do |
|
| 152 |
{
|
|
| 153 |
daddr: '@my6_set', |
|
| 154 |
} |
|
| 155 |
end |
|
| 156 |
|
|
| 157 |
it { is_expected.to compile }
|
|
| 158 |
it {
|
|
| 159 |
is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
|
|
| 160 |
content: 'ip6 daddr @my6_set accept', |
|
| 161 |
) |
|
| 162 |
} |
|
| 163 |
end |
|
| 164 |
|
|
| 165 |
describe 'with a IPv4 set as daddr' do |
|
| 166 |
let(:params) do |
|
| 167 |
{
|
|
| 168 |
daddr: '@my4_set', |
|
| 169 |
set_type: 'ip', |
|
| 170 |
} |
|
| 171 |
end |
|
| 172 |
|
|
| 173 |
it { is_expected.to compile }
|
|
| 174 |
it {
|
|
| 175 |
is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(
|
|
| 176 |
content: 'ip daddr @my4_set accept', |
|
| 177 |
) |
|
| 178 |
} |
|
| 179 |
end |
|
| 180 |
|
|
| 116 | 181 |
end |
| 117 | 182 |
end |
| 118 | 183 |
end |
| templates/simplerule.epp | ||
|---|---|---|
| 2 | 2 |
Optional[String] $comment, |
| 3 | 3 |
Optional[Variant[Array[Stdlib::Port, 1], Stdlib::Port, String]] $dport, |
| 4 | 4 |
Optional[String] $proto, |
| 5 |
Optional[Variant[Stdlib::IP::Address::V6, Stdlib::IP::Address::V4, Pattern[/^@[-a-zA-Z0-9_]+$/]]] $daddr, |
|
| 6 |
Enum['ip', 'ip6'] $set_type, |
|
| 5 | 7 |
| -%> |
| 6 | 8 |
<%- if $proto {
|
| 7 | 9 |
$_proto = $proto ? {
|
| ... | ... | |
| 16 | 18 |
} else {
|
| 17 | 19 |
$_ip_version_filter = undef |
| 18 | 20 |
} -%> |
| 21 |
<%- if $daddr {
|
|
| 22 |
if $daddr =~ Stdlib::IP::Address::V6 {
|
|
| 23 |
$_dst_hosts = "ip6 daddr ${daddr}"
|
|
| 24 |
} elsif $daddr =~ Stdlib::IP::Address::V4 {
|
|
| 25 |
$_dst_hosts = "ip daddr ${daddr}"
|
|
| 26 |
} else {
|
|
| 27 |
$_dst_hosts = $set_type ? {
|
|
| 28 |
'ip' => "ip daddr ${daddr}",
|
|
| 29 |
'ip6' => "ip6 daddr ${daddr}",
|
|
| 30 |
} |
|
| 31 |
} |
|
| 32 |
} else {
|
|
| 33 |
$_dst_hosts = undef |
|
| 34 |
} -%> |
|
| 19 | 35 |
<%- if $proto and $dport {
|
| 20 | 36 |
if $dport =~ Array {
|
| 21 |
$_destination = "${_proto} dport {${dport.join(', ')}}"
|
|
| 37 |
$_dst_port = "${_proto} dport {${dport.join(', ')}}"
|
|
| 22 | 38 |
} else {
|
| 23 |
$_destination = "${_proto} dport $dport"
|
|
| 39 |
$_dst_port = "${_proto} dport $dport"
|
|
| 24 | 40 |
} |
| 25 | 41 |
} else {
|
| 26 |
$_destination = undef
|
|
| 42 |
$_dst_port = undef
|
|
| 27 | 43 |
} -%> |
| 28 | 44 |
<%- if $comment {
|
| 29 | 45 |
$_comment = "comment \"${comment}\""
|
| 30 | 46 |
} else {
|
| 31 | 47 |
$_comment = undef |
| 32 | 48 |
} -%> |
| 33 |
<%= regsubst(strip([$_ip_version_filter, $_destination, $_comment, $action].join(' ')), '\s+', ' ', 'G') -%>
|
|
| 49 |
<%= regsubst(strip([$_ip_version_filter, $_dst_port, $_dst_hosts, $action, $_comment].join(' ')), '\s+', ' ', 'G') -%>
|
|
Formats disponibles : Unified diff