salt
/
iptables-formula
форкнуто от ExternalMirrors/iptables-formula
Следить 1
В избранное 0
Форкнуть 0
Код Релизы 6 Активность
Saltstack Official IPTables Formula
Вы не можете выбрать более 25 тем Темы должны начинаться с буквы или цифры, могут содержать дефисы(-) и должны содержать не более 35 символов.
63 коммитов
2 Ветки
Дерево: 8188337922
Ветки Теги
${ item.name }
Создать ветку ${ searchTerm }
из '8188337922'
${ noResults }
iptables-formula/tests/pillar/iptables_server.sls

iptables_server.sls 592B
Исходник Normal View История

add formula tests
9 лет назад
​
​
​
​
Unhardcode tables for chains. There is a way to manage tables in rules, but there is no way to manage tables for chains when setting policy. Looks like pillar structure is bad from the beginning and to not break backward compatibility, as same chain names may occur in different tables, so it is proposed to check if 'chain.policy' is map. And if it is, specific policies would be ensured for specific tables, otherwise table 'filter' would be used as a fallback. To ensure chains in specific tables we iterate over all rules in each chain. This hash is valid: parameters: iptables: service: enabled: true chain: OUTPUT: policy: ACCEPT FORWARD: policy: - table: mangle policy: DROP INPUT: policy: - table: nat policy: ACCEPT rules: - jump: ACCEPT protocol: icmp POSTROUTING: rules: - jump: MASQUERADE protocol: icmp out_interface: ens3 table: nat Prod-Related: CEEMCP-12 Prod-Related: EME-313 Change-Id: Ib5ba97dad165d3ef2dec7e053b391ea36a996103
7 лет назад
​
​
Allow custom chains to be present (#12) * Allow custom chains to be present, other than the INPUT, FORWARD, OUTPUT default chains. * Adding missing endif * Require the packages to be installed first. * Test should use rules as key, not rule. * Making it a array list, instead of a dict. * convert rules to a list instead of a dict. * Only if policy is defined, include this statement. * Only ensure chains if not container :) * The chain is only ensured if we are not a container. * Do not run at all for containers.
7 лет назад
​
add formula tests
9 лет назад
​
​
​
​
Adding comment option to iptables rule Change-Id: I9d93052cfc197a364b42240448344d5543e8805f
7 лет назад
Unhardcode tables for chains. There is a way to manage tables in rules, but there is no way to manage tables for chains when setting policy. Looks like pillar structure is bad from the beginning and to not break backward compatibility, as same chain names may occur in different tables, so it is proposed to check if 'chain.policy' is map. And if it is, specific policies would be ensured for specific tables, otherwise table 'filter' would be used as a fallback. To ensure chains in specific tables we iterate over all rules in each chain. This hash is valid: parameters: iptables: service: enabled: true chain: OUTPUT: policy: ACCEPT FORWARD: policy: - table: mangle policy: DROP INPUT: policy: - table: nat policy: ACCEPT rules: - jump: ACCEPT protocol: icmp POSTROUTING: rules: - jump: MASQUERADE protocol: icmp out_interface: ens3 table: nat Prod-Related: CEEMCP-12 Prod-Related: EME-313 Change-Id: Ib5ba97dad165d3ef2dec7e053b391ea36a996103
7 лет назад
​
​
​
​
​
​
​
​
​
​
​
 12345678910111213141516171819202122232425262728 
  1. iptables:

  2.   service:

  3.     enabled: true

  4.     chain:

  5.       INPUT:

  6.         policy:

  7.         - table: nat

  8.           policy: ACCEPT

  9.         rules:

  10.           - position: 1

  11.             table: filter

  12.             protocol: tcp

  13.             destination_port: 8088

  14.             source_network: 127.0.0.1

  15.             jump: ACCEPT

  16.             comment: Blah

  17.       OUTPUT:

  18.         policy: ACCEPT

  19.       FORWARD:

  20.         policy:

  21.         - table: mangle

  22.           policy: DROP

  23.       POSTROUTING:

  24.         rules:

  25.         - jump: MASQUERADE

  26.           protocol: icmp

  27.           out_interface: ens3

  28.           table: nat