Defined Type: nftables::chain

Defined in:
manifests/chain.pp

Overview

manage a chain

Parameters:

  • table (Pattern[/^(ip|ip6|inet|netdev|bridge)-[a-zA-Z0-9_]+$/]) (defaults to: 'inet-filter')
  • chain (Pattern[/^[a-zA-Z0-9_]+$/]) (defaults to: $title)
  • inject (Optional[Pattern[/^\d\d-[a-zA-Z0-9_]+$/]]) (defaults to: undef)
  • inject_iif (Optional[String]) (defaults to: undef)
  • inject_oif (Optional[String]) (defaults to: undef) 


2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'manifests/chain.pp', line 2

define nftables::chain (
  # lint:ignore:parameter_documentation
  Pattern[/^(ip|ip6|inet|netdev|bridge)-[a-zA-Z0-9_]+$/] $table = 'inet-filter',
  Pattern[/^[a-zA-Z0-9_]+$/] $chain = $title,
  Optional[Pattern[/^\d\d-[a-zA-Z0-9_]+$/]] $inject = undef,
  Optional[String] $inject_iif = undef,
  Optional[String] $inject_oif = undef,
  # lint:endignore
) {
  $concat_name = "nftables-${table}-chain-${chain}"

  concat {
    $concat_name:
      path           => "/etc/nftables/puppet-preflight/${table}-chain-${chain}.nft",
      owner          => root,
      group          => root,
      mode           => $nftables::default_config_mode,
      ensure_newline => true,
      require        => Package['nftables'],
  } ~> Exec['nft validate'] -> file {
    "/etc/nftables/puppet/${table}-chain-${chain}.nft":
      ensure => file,
      source => "/etc/nftables/puppet-preflight/${table}-chain-${chain}.nft",
      owner  => root,
      group  => root,
      mode   => $nftables::default_config_mode,
  } ~> Service['nftables']

  concat::fragment {
    default:
      target => $concat_name;
    "${concat_name}-header":
      order   => '00',
      content => "# Start of fragment order:00 ${chain} header\nchain ${chain} {";
    "${concat_name}-footer":
      order   => '99',
      content => "# Start of fragment order:99 ${chain} footer\n}";
  }

  if $inject {
    $data = split($inject, '-')
    $iif = $inject_iif ? {
      undef => '',
      default => "iifname ${inject_iif} ",
    }
    $oif = $inject_oif ? {
      undef => '',
      default => "oifname ${inject_oif} ",
    }
    nftables::rule { "${data[1]}-jump_${chain}":
      order   => $data[0],
      content => "${iif}${oif}jump ${chain}",
    }
  }
}