Révision d7d6d5d3
simplerule: Add support for outgoing interface filtering
| REFERENCE.md | ||
|---|---|---|
| 2265 | 2265 |
* [`saddr`](#-nftables--simplerule--saddr) |
| 2266 | 2266 |
* [`counter`](#-nftables--simplerule--counter) |
| 2267 | 2267 |
* [`iifname`](#-nftables--simplerule--iifname) |
| 2268 |
* [`oifname`](#-nftables--simplerule--oifname) |
|
| 2268 | 2269 |
|
| 2269 | 2270 |
##### <a name="-nftables--simplerule--ensure"></a>`ensure` |
| 2270 | 2271 |
|
| ... | ... | |
| 2387 | 2388 |
|
| 2388 | 2389 |
Default value: `undef` |
| 2389 | 2390 |
|
| 2391 |
##### <a name="-nftables--simplerule--oifname"></a>`oifname` |
|
| 2392 |
|
|
| 2393 |
Data type: `Optional[String[1]]` |
|
| 2394 |
|
|
| 2395 |
Optional filter for the outgoing interface |
|
| 2396 |
|
|
| 2397 |
Default value: `undef` |
|
| 2398 |
|
|
| 2390 | 2399 |
## Data types |
| 2391 | 2400 |
|
| 2392 | 2401 |
### <a name="Nftables--Addr"></a>`Nftables::Addr` |
| manifests/simplerule.pp | ||
|---|---|---|
| 55 | 55 |
# |
| 56 | 56 |
# @param iifname |
| 57 | 57 |
# Optional filter for the incoming interface |
| 58 |
# @param oifname |
|
| 59 |
# Optional filter for the outgoing interface |
|
| 58 | 60 |
define nftables::simplerule ( |
| 59 | 61 |
Enum['present','absent'] $ensure = 'present', |
| 60 | 62 |
Nftables::SimpleRuleName $rulename = $title, |
| ... | ... | |
| 71 | 73 |
Optional[Nftables::Addr] $saddr = undef, |
| 72 | 74 |
Boolean $counter = false, |
| 73 | 75 |
Optional[String[1]] $iifname = undef, |
| 76 |
Optional[String[1]] $oifname = undef, |
|
| 74 | 77 |
) {
|
| 75 | 78 |
if $dport and !$proto {
|
| 76 | 79 |
fail('Specifying a transport protocol via $proto is mandatory when passing a $dport')
|
| ... | ... | |
| 94 | 97 |
'set_type' => $set_type, |
| 95 | 98 |
'sport' => $sport, |
| 96 | 99 |
'iifname' => $iifname, |
| 100 |
'oifname' => $oifname, |
|
| 97 | 101 |
} |
| 98 | 102 |
), |
| 99 | 103 |
order => $order, |
| spec/acceptance/simple_rule_iifname_spec.rb | ||
|---|---|---|
| 3 | 3 |
require 'spec_helper_acceptance' |
| 4 | 4 |
|
| 5 | 5 |
describe 'nftables class' do |
| 6 |
context 'configure a simple rule with input interface' do
|
|
| 6 |
context 'configure a simple rule with interface' do |
|
| 7 | 7 |
it_behaves_like 'an idempotent resource' do |
| 8 | 8 |
let(:manifest) do |
| 9 | 9 |
<<-EOS |
| ... | ... | |
| 19 | 19 |
in_ssh => false, |
| 20 | 20 |
in_icmp => false, |
| 21 | 21 |
} |
| 22 |
# just incoming interface |
|
| 22 | 23 |
nftables::simplerule { 'dummyrule_in':
|
| 23 | 24 |
action => 'accept', |
| 24 | 25 |
iifname => $facts['networking']['primary'], |
| 25 | 26 |
comment => 'allow some multicast stuff', |
| 26 | 27 |
daddr => 'ff02::fb', |
| 27 | 28 |
} |
| 29 |
# just outgoing interface |
|
| 30 |
nftables::simplerule { 'dummyrule_out':
|
|
| 31 |
action => 'accept', |
|
| 32 |
oifname => $facts['networking']['primary'], |
|
| 33 |
comment => 'allow some multicast stuff', |
|
| 34 |
chain => 'default_out', |
|
| 35 |
daddr => 'ff02::fb', |
|
| 36 |
} |
|
| 37 |
# outgoing + incoming interface |
|
| 38 |
nftables::simplerule { 'dummyrule_fwd':
|
|
| 39 |
action => 'accept', |
|
| 40 |
iifname => $facts['networking']['primary'], |
|
| 41 |
oifname => 'lo', |
|
| 42 |
comment => 'allow some multicast stuff', |
|
| 43 |
chain => 'default_fwd', |
|
| 44 |
daddr => 'ff02::fb', |
|
| 45 |
} |
|
| 28 | 46 |
include nftables::rules::ssh |
| 29 | 47 |
include nftables::rules::out::dns |
| 30 | 48 |
include nftables::rules::out::ssh |
| templates/simplerule.epp | ||
|---|---|---|
| 8 | 8 |
String $set_type, |
| 9 | 9 |
Optional[Nftables::Port] $sport, |
| 10 | 10 |
Optional[String[1]] $iifname, |
| 11 |
Optional[String[1]] $oifname, |
|
| 11 | 12 |
| -%> |
| 12 | 13 |
<%- if $proto {
|
| 13 | 14 |
$_proto = $proto ? {
|
| ... | ... | |
| 75 | 76 |
} else {
|
| 76 | 77 |
$_iifname = undef |
| 77 | 78 |
} -%> |
| 78 |
<%= regsubst(strip([$_ip_version_filter, $_iifname, $_src_port, $_dst_port, $_src_hosts, $_dst_hosts, $_counter, $action, $_comment].join(' ')), '\s+', ' ', 'G') -%>
|
|
| 79 |
<%- if $oifname {
|
|
| 80 |
$_oifname = "oifname \"${oifname}\""
|
|
| 81 |
} else {
|
|
| 82 |
$_oifname = undef |
|
| 83 |
} -%> |
|
| 84 |
<%= regsubst(strip([$_ip_version_filter, $_iifname, $_oifname, $_src_port, $_dst_port, $_src_hosts, $_dst_hosts, $_counter, $action, $_comment].join(' ')), '\s+', ' ', 'G') -%>
|
|
Formats disponibles : Unified diff