get_tables was failing with python3, because readline() returns bytes, which is always distinct to '', but then it failed with IndexError for empty lines. Also, line[0] was returning 42 instead of '*', so no table would be returned.
I have tested with python2 too, and decode() can be called there, it will return unicode type, and comparing with '' and '*' works
- in inspec >= 3.0.0 there are changes in schema
which require to have tests/integration dir
to contain tests, otherwise fails
- this is temporary workaround until we decide
proper fix
Change-Id: I6a1153afa5a8a7f9799347d2f2f3f1fd3d570b8f
There is a way to manage tables in rules, but there is no way to
manage tables for chains when setting policy.
Looks like pillar structure is bad from the beginning and to
not break backward compatibility, as same chain names may occur in
different tables, so it is proposed to check if 'chain.policy' is
map. And if it is, specific policies would be ensured for specific
tables, otherwise table 'filter' would be used as a fallback.
To ensure chains in specific tables we iterate over all rules in
each chain.
This hash is valid:
parameters:
iptables:
service:
enabled: true
chain:
OUTPUT:
policy: ACCEPT
FORWARD:
policy:
- table: mangle
policy: DROP
INPUT:
policy:
- table: nat
policy: ACCEPT
rules:
- jump: ACCEPT
protocol: icmp
POSTROUTING:
rules:
- jump: MASQUERADE
protocol: icmp
out_interface: ens3
table: nat
Prod-Related: CEEMCP-12
Prod-Related: EME-313
Change-Id: Ib5ba97dad165d3ef2dec7e053b391ea36a996103
If some rules references other chains that are not yet present
state fails. Make sure all chains are created before any rules by
configuring requirement constraint.
Change-Id: Iaf506919f330ff962891baab8132c3b46c49a47c
Closes-Bug: PROD-18821
* Allow custom chains to be present, other than the INPUT, FORWARD, OUTPUT default chains.
* Adding missing endif
* Require the packages to be installed first.
* Test should use rules as key, not rule.
* Making it a array list, instead of a dict.
* convert rules to a list instead of a dict.
* Only if policy is defined, include this statement.
* Only ensure chains if not container :)
* The chain is only ensured if we are not a container.
* Do not run at all for containers.
Closes: #2
* add the option to specify the family per rule to support ipv6
* include policy updates for ipv6
* update documentation to mention ipv6
* Make ipv6 optional; remove spurious tabs from the readme.
* set ipv6 policies only if ipv6 is enabled on the host and not explicitly turned off for this service
Filip Pytloun
Sergio Cambra
Ricardo Castilla
Dzmitry Stremkouski
Martin Polreich
Petr Michalec
Ondrej Smola
Sergio Lystopad
Petr Michalec
Jakub Josef
Filip Pytloun
Piotr Pieprzycki
Piotr Pieprzycki
Dennis Dmitriev
Michel Nederlof
Nitin Madhok
Dennis van Dok