salt
/
iptables-formula
форк від ExternalMirrors/iptables-formula
Слідкувати 1
В обрані 0
Форк 0
Код Релізи 6 Активність
Saltstack Official IPTables Formula
Ви не можете вибрати більше 25 тем Теми мають розпочинатися з літери або цифри, можуть містити дефіси (-) і не повинні перевищувати 35 символів.
63 Коміти
2 Гілки
Дерево: 8188337922
Гілки Теги
${ item.name }
Створити гілку ${ searchTerm }
з '8188337922'
${ noResults }
iptables-formula/tests/pillar/iptables_server.sls

iptables_server.sls 592B
Неформатований Normal View Історія

add formula tests
9 роки тому
​
​
​
​
Unhardcode tables for chains. There is a way to manage tables in rules, but there is no way to manage tables for chains when setting policy. Looks like pillar structure is bad from the beginning and to not break backward compatibility, as same chain names may occur in different tables, so it is proposed to check if 'chain.policy' is map. And if it is, specific policies would be ensured for specific tables, otherwise table 'filter' would be used as a fallback. To ensure chains in specific tables we iterate over all rules in each chain. This hash is valid: parameters: iptables: service: enabled: true chain: OUTPUT: policy: ACCEPT FORWARD: policy: - table: mangle policy: DROP INPUT: policy: - table: nat policy: ACCEPT rules: - jump: ACCEPT protocol: icmp POSTROUTING: rules: - jump: MASQUERADE protocol: icmp out_interface: ens3 table: nat Prod-Related: CEEMCP-12 Prod-Related: EME-313 Change-Id: Ib5ba97dad165d3ef2dec7e053b391ea36a996103
7 роки тому
​
​
Allow custom chains to be present (#12) * Allow custom chains to be present, other than the INPUT, FORWARD, OUTPUT default chains. * Adding missing endif * Require the packages to be installed first. * Test should use rules as key, not rule. * Making it a array list, instead of a dict. * convert rules to a list instead of a dict. * Only if policy is defined, include this statement. * Only ensure chains if not container :) * The chain is only ensured if we are not a container. * Do not run at all for containers.
7 роки тому
​
add formula tests
9 роки тому
​
​
​
​
Adding comment option to iptables rule Change-Id: I9d93052cfc197a364b42240448344d5543e8805f
7 роки тому
Unhardcode tables for chains. There is a way to manage tables in rules, but there is no way to manage tables for chains when setting policy. Looks like pillar structure is bad from the beginning and to not break backward compatibility, as same chain names may occur in different tables, so it is proposed to check if 'chain.policy' is map. And if it is, specific policies would be ensured for specific tables, otherwise table 'filter' would be used as a fallback. To ensure chains in specific tables we iterate over all rules in each chain. This hash is valid: parameters: iptables: service: enabled: true chain: OUTPUT: policy: ACCEPT FORWARD: policy: - table: mangle policy: DROP INPUT: policy: - table: nat policy: ACCEPT rules: - jump: ACCEPT protocol: icmp POSTROUTING: rules: - jump: MASQUERADE protocol: icmp out_interface: ens3 table: nat Prod-Related: CEEMCP-12 Prod-Related: EME-313 Change-Id: Ib5ba97dad165d3ef2dec7e053b391ea36a996103
7 роки тому
​
​
​
​
​
​
​
​
​
​
​
 12345678910111213141516171819202122232425262728 
  1. iptables:

  2.   service:

  3.     enabled: true

  4.     chain:

  5.       INPUT:

  6.         policy:

  7.         - table: nat

  8.           policy: ACCEPT

  9.         rules:

  10.           - position: 1

  11.             table: filter

  12.             protocol: tcp

  13.             destination_port: 8088

  14.             source_network: 127.0.0.1

  15.             jump: ACCEPT

  16.             comment: Blah

  17.       OUTPUT:

  18.         policy: ACCEPT

  19.       FORWARD:

  20.         policy:

  21.         - table: mangle

  22.           policy: DROP

  23.       POSTROUTING:

  24.         rules:

  25.         - jump: MASQUERADE

  26.           protocol: icmp

  27.           out_interface: ens3

  28.           table: nat