Projet

Général

Profil

Révision d1864b10

IDd1864b10a5af6bd70cedc78b0bb25b220b6930bf
Parent 5d554e75
Enfant add6257b

Ajouté par Tim Meusel il y a plus d'un an

out::icmp: simplify filtering/fix ICMP bug

Voir les différences:

manifests/rules/out/icmp.pp
16 16 
        order   => $order,
17 17 
      }
18 18 
    }
19 
  } else {
19 
  } elsif $v6_types {
20 20 
    nftables::rule { 'default_out-accept_icmpv4':
21 21 
      content => 'ip protocol icmp accept',
22 22 
      order   => $order,
......
30 30 
        order   => $order,
31 31 
      }
32 32 
    }
33 
  } else {
33 
  } elsif $v4_types {
34 
    # `ip6 nexthdr ipv6-icmp accept` doesn't match for IPv6 ICMP with extensions
35 
    # context: https://www.rfc-editor.org/rfc/rfc3810#section-5
36 
    # https://wiki.nftables.org/wiki-nftables/index.php/Matching_packet_headers#Matching_IPv6_headers
34 37 
    nftables::rule { 'default_out-accept_icmpv6':
35 
      content => 'ip6 nexthdr ipv6-icmp accept',
38 
      content => 'meta l4proto icmpv6 accept',
39 
      order   => $order,
40 
    }
41 
  }
42 

  		




  
  43
  
    
  if $v6_types == undef and $v4_types == undef {


  		




  
  44
  
    
    nftables::rule { 'default_out-accept_icmp':


  		




  
  45
  
    
      content => 'meta l4proto { icmp, icmpv6} accept',


  		




  36
  46
  
    
      order   => $order,


  		




  37
  47
  
    
    }


  		




  38
  48
  
    
  }


  		












Formats disponibles :  Unified diff