Projet

Général

Profil

Révision e53053ce

IDe53053ce3df771f5fcc24f87dd86f5c49db91b46
Parent 9e5b8bf0
Enfant 61f03b47

Ajouté par Steve Traylen il y a plus de 4 ans

Add comments for all the nftable::rules entries

For each nftable::rule this adds an extra concat fragment to
add a comment containing the name and order number for the rule.

The motivation here is to make the mapping from resulting rules back
to puppet code more obvious. When adding a new rule it should be more
obvious to understand what order to choose.

An example resulting table ends up reading as:

```
HASH Start of fragment order:00 default_in header
chain default_in {
HASH Start of fragment order:50 rulename:default_in-dhcpv6_client
ip6 saddr fe80::/10 ip6 daddr fe80::/10 udp sport 547 udp dport 546 accept
HASH Start of fragment order:50 rulename:default_in-ssh
tcp dport {22} accept
HASH Start of fragment order:90 rulename:default_in-drop_broadcasts
meta pkttype broadcast counter drop
HASH Start of fragment order:99 default_in footer
}

```

In addition there is a new test `nftables::rule`. This includes
a pending test since I would assume setting source and content
on a rule should be an error however this currently not the case.

Voir les différences:

spec/classes/bridges_spec.rb
29 29 
        is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-bridge_br0_br0').with(
30 30 
          target:  'nftables-inet-filter-chain-default_fwd',
31 31 
          content: %r{^  iifname br0 oifname br0 accept$},
32 
          order:   '08',
32 
          order:   '08nftables-inet-filter-chain-default_fwd-rule-bridge_br0_br0b',
33 33 
        )
34 34 
      }
35 35 
      it {
36 36 
        is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-bridge_br1_br1').with(
37 37 
          target:  'nftables-inet-filter-chain-default_fwd',
38 38 
          content: %r{^  iifname br1 oifname br1 accept$},
39 
          order:   '08',
39 
          order:   '08nftables-inet-filter-chain-default_fwd-rule-bridge_br1_br1b',
40 40 
        )
41 41 
      }
42 42 
      it { is_expected.not_to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-bridge_br0_br1') }

Formats disponibles : Unified diff