-
Notifications
You must be signed in to change notification settings - Fork 33
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add comments for all the nftable::rules entries #13
Conversation
|
To add I did consider using the comment 'rule name order' within the rules but it is less obvious what to do with multline contents or Happy to switch to prefixing rules with comments rather than extra fragments but the input for content might have to be stricter. should probably be blocked as should since the double |
For each nftable::rule this adds an extra concat fragment to
add a comment containing the name and order number for the rule.
The motivation here is to make the mapping from resulting rules back
to puppet code more obvious. When adding a new rule it should be more
obvious to understand what order to choose.
An example resulting table ends up reading as:
```
HASH Start of fragment order:00 default_in header
chain default_in {
HASH Start of fragment order:50 rulename:default_in-dhcpv6_client
ip6 saddr fe80::/10 ip6 daddr fe80::/10 udp sport 547 udp dport 546 accept
HASH Start of fragment order:50 rulename:default_in-ssh
tcp dport {22} accept
HASH Start of fragment order:90 rulename:default_in-drop_broadcasts
meta pkttype broadcast counter drop
HASH Start of fragment order:99 default_in footer
}
```
In addition there is a new test `nftables::rule`. This includes
a pending test since I would assume setting source and content
on a rule should be an error however this currently not the case.
An advantage of using built-in comments is that they show up when executing |
There was a bad merge between * https://github.com/duritong/puppet-nftables/pull/13 * https://github.com/duritong/puppet-nftables/pull/14 correct tests.
a5f5fb1 Merge pull request voxpupuli#13 from traylenator/comment 21d0496 Merge pull request voxpupuli#14 from cernops/ct_away 7b14f6d Merge pull request voxpupuli#6 from traylenator/afs ea96d5d Move ct rules from global to INPUT and OUTPUT 61f03b4 Switch $order$fragmenta/b to $order-$fragment-a/b e53053c Add comments for all the nftable::rules entries 9785cd5 lint fix 215aee1 Add kerberos out and openafs_client out f3f2870 Add rules for afs3_callback git-subtree-dir: code git-subtree-split: a5f5fb1
For each nftable::rule this adds an extra concat fragment to
add a comment containing the name and order number for the rule.
The motivation here is to make the mapping from resulting rules back
to puppet code more obvious. When adding a new rule it should be more
obvious to understand what order to choose.
An example resulting table ends up reading as:
In addition there is a new test
nftables::rule. This includesa pending test since I would assume setting source and content
on a rule should be an error however this currently not the case.