saltstack-formulas
/
firewalld-formula
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(rich-rules): add priority to rich rules 

fixes #51
This commit is contained in:
Steven Daniele 2021-06-18 12:23:06 -04:00
parent abbfe162a1
commit 9c2b41d0f9
21 changed files with 140 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
firewalld/files/zone.xml
View File

@ -4,12 +4,8 @@
Do not edit this file manually, it will be overwritten!
Modify the salt pillar for firewalld instead
-->
{%- macro rich_rule(rule) -%}
{%- if 'family' in rule %}
<rule family="{{ rule.family }}">
{%- else %}
<rule>
{%- endif %}
{%- macro rich_rule(rule) %}
<rule{% if 'family' in rule %} family="{{ rule.family }}"{% endif %}{% if 'priority' in rule %} priority="{{ rule.priority }}"{% endif %}>
{%- if 'ipset' in rule %}
<source ipset="{{ rule.ipset.name }}" />
{%- endif %}

7
pillar.example
View File

@ -167,6 +167,13 @@ firewalld:
# can be used. Special keys "ipsets" and "services", if defined, take precedence.
# They will be auto-expanded into separate rich rules per value in the list.
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

5
test/integration/default/controls/zones_spec.rb
View File

@ -63,6 +63,11 @@ control 'zones/rich_public.xml configuration' do
<zone>
<short>rich_public</short>
<description>Example</description>
<rule priority="15">
<source ipset="other-ipset" />
<service name="http" />
<accept></accept>
</rule>
<rule>
<source ipset="fail2ban-ssh" />
<service name="ssh" />

7
test/integration/default/files/_mapdata/amazonlinux-1.yaml
View File

@ -150,6 +150,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/amazonlinux-2.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/arch-base-latest.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/centos-7.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/centos-8.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/debian-10.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/debian-9.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/fedora-31.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/fedora-32.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/fedora-33.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/fedora-34.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/opensuse-15.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/oraclelinux-7.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/oraclelinux-8.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/ubuntu-16.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/ubuntu-18.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets:

7
test/integration/default/files/_mapdata/ubuntu-20.yaml
View File

@ -157,6 +157,13 @@ values:
rich_public:
description: Example
rich_rules:
http-priority:
accept: true
ipsets:
- other-ipset
priority: 15
services:
- http
ssh-csg:
accept: true
ipsets: