Projet

Général

Profil

Révision fcb79d73

IDfcb79d73f30dc98983f392fdf7c774c04301ebce
Parent abcd1731
Enfant 1cdd8e24

Ajouté par Ben Morrice il y a plus de 3 ans

support a different table name for 'nat'
- Some applications (such as libvirt) still use iptables to inject firewall
rules
- iptables will refuse to update tables that were initially created with nft
- This commit allows defining the name of the 'nat' table in order to avoid
namespace conflicts

Voir les différences:

manifests/rules/docker_ce.pp
79 79 

  		




  80
  80
  
    
  if $manage_docker_chains {


  		




  81
  81
  
    
    nftables::chain {


  		




  82
  
  
    
      'DOCKER-nat':


  		




  83
  
  
    
        table => 'ip-nat',


  		




  
  82
  
    
      "DOCKER-${nftables::nat_table_name}":


  		




  
  83
  
    
        table => "ip-${nftables::nat_table_name}",


  		




  84
  84
  
    
        chain => 'DOCKER';


  		




  85
  85
  
    
    }


  		




  86
  86
  
    
  }


  		




  87
  87
  
    

  		




  88
  88
  
    
  if $manage_base_chains {


  		




  89
  89
  
    
    nftables::chain {


  		




  90
  
  
    
      'OUTPUT-nat':


  		




  91
  
  
    
        table => 'ip-nat',


  		




  
  90
  
    
      "OUTPUT-${nftables::nat_table_name}":


  		




  
  91
  
    
        table => "ip-${nftables::nat_table_name}",


  		




  92
  92
  
    
        chain => 'OUTPUT';


  		




  93
  
  
    
      'INPUT-nat':


  		




  94
  
  
    
        table => 'ip-nat',


  		




  
  93
  
    
      "INPUT-${nftables::nat_table_name}":


  		




  
  94
  
    
        table => "ip-${nftables::nat_table_name}",


  		




  95
  95
  
    
        chain => 'INPUT';


  		




  96
  96
  
    
    }


  		




  97
  97
  
    
  }


  		




  98
  98
  
    

  		




  99
  99
  
    
  nftables::rule {


  		




  100
  100
  
    
    'POSTROUTING-docker':


  		




  101
  
  
    
      table   => 'ip-nat',


  		




  
  101
  
    
      table   => "ip-${nftables::nat_table_name}",


  		




  102
  102
  
    
      content => "oifname != \"${docker_interface}\" ip saddr ${docker_prefix} counter masquerade";


  		




  103
  103
  
    
    'PREROUTING-docker':


  		




  104
  
  
    
      table   => 'ip-nat',


  		




  
  104
  
    
      table   => "ip-${nftables::nat_table_name}",


  		




  105
  105
  
    
      content => 'fib daddr type local counter jump DOCKER';


  		




  106
  
  
    
    'OUTPUT-jump_docker@ip-nat':


  		




  
  106
  
    
    "OUTPUT-jump_docker@ip-${nftables::nat_table_name}":


  		




  107
  107
  
    
      rulename => 'OUTPUT-jump_docker',


  		




  108
  
  
    
      table    => 'ip-nat',


  		




  
  108
  
    
      table    => "ip-${nftables::nat_table_name}",


  		




  109
  109
  
    
      content  => 'ip daddr != 127.0.0.0/8 fib daddr type local counter jump DOCKER';


  		




  110
  110
  
    
    'DOCKER-counter':


  		




  111
  
  
    
      table   => 'ip-nat',


  		




  
  111
  
    
      table   => "ip-${nftables::nat_table_name}",


  		




  112
  112
  
    
      content => "iifname \"${docker_interface}\" counter return";


  		




  113
  
  
    
    'INPUT-type@ip-nat':


  		




  
  113
  
    
    "INPUT-type@ip-${nftables::nat_table_name}":


  		




  114
  114
  
    
      rulename => 'INPUT-type',


  		




  115
  
  
    
      table    => 'ip-nat',


  		




  
  115
  
    
      table    => "ip-${nftables::nat_table_name}",


  		




  116
  116
  
    
      order    => '01',


  		




  117
  117
  
    
      content  => 'type nat hook input priority 100';


  		




  118
  
  
    
    'INPUT-policy@ip-nat':


  		




  
  118
  
    
    "INPUT-policy@ip-${nftables::nat_table_name}":


  		




  119
  119
  
    
      rulename => 'INPUT-policy',


  		




  120
  
  
    
      table    => 'ip-nat',


  		




  
  120
  
    
      table    => "ip-${nftables::nat_table_name}",


  		




  121
  121
  
    
      order    => '02',


  		




  122
  122
  
    
      content  => 'policy accept';


  		




  123
  123
  
    
  }


  		












Formats disponibles :  Unified diff