aboutsummaryrefslogtreecommitdiff
path: root/spec
AgeCommit message (Collapse)Author
2021-07-16delete legacy `policy` param in ferm::ruleTim Meusel
2021-06-28Enable users to the package ensureTim Meusel
2021-06-28Add support for opensuseRehan Mahmood
This however can only be done using `install_method = vcsrepo` as the ferm itself is not in the OS repos.
2021-06-28enhance spec coverageTim Meusel
2021-06-28rubocop: autofixTim Meusel
2021-02-16add test for numeric value protocolsKilian Engelhardt
2021-02-09drop unneeded manage_initfile paramTim Meusel
2021-02-09Drop EoL CentOS 6 supportTim Meusel
2020-10-28modulesync 3.1.0Tim Meusel
2020-06-30add type_aliases tests for the other ferm typesThore Bödecker
2020-06-30use proper types and validations for port handlingThore Bödecker
- implement validations for port ranges - add test cases for these scenarios
2020-06-25use verbose multiport syntax for better compatThore Bödecker
The dports/sports shortcut is only supported starting with ferm v2.5 which was released very recently. In order to support a wider range of distributions and ferm versions, this commits switches to the more verbose version of the multiport features.
2020-06-22implement multiport support for dport/sportThore Bödecker
2020-05-18add install_method parameterFabien COMBERNOUS
2020-05-07Allow adding custom ferm dsl for subchains. This is important for using ↵Rehan Mahmood
complex iptable rules that are currently not supported by this module or would be very hard to manage just using puppet.
2020-04-21make dropping of pakets marked as invalid optionalTim Meusel
2020-04-21use dedicated conntrack parametersFabien COMBERNOUS
2020-04-07Use voxpupuli-acceptanceEwoud Kohl van Wijngaarden
2020-02-11cleanup spec_helper.rbTim Meusel
2020-02-11modulesync 3.0.0Tim Meusel
2019-12-06modulesync 2.9.0Dennis Hoppe
2019-10-29revert PR81Fabien COMBERNOUS
2019-10-01implement ipset supportTim Meusel
2019-10-01disable conntrack filtering in FORWARD/OUTPUTThore Bödecker
conntrack filtering basically doesn't work in those chains, so we need to disable it.
2019-09-13fix kernel incompatibilitiesThore Bödecker
Certain kernel modules and thus iptables functionality was introduced at later releases, so we need to properly reflect that in our default chain initialization procedure. `INPUT` chain for `nat` table was introduced with 2.6.36 `ip6table_nat` kernel module for NAT functionality with IPv6 was introduced with 3.17 This commit implements the required conditional constraints and includes the rspec tests to validate it.
2019-09-12readd Debian 9/10 supportTim Meusel
2019-09-11allow using an array for $protoThore Bödecker
This enables defining ferm::rule with multiple protocols at once, because using 'all' for $proto does not allow using $dport/$sport.
2019-09-11add ability to define rules in tables != filterThore Bödecker
Previously it was neither possible to properly define custom chains nor to define rules in tables other than the default filter table. For various legitimate reasons it can be required to define rules in the raw, nat or mangle tables, e.g. to use NOTRACK or to configure DNAT/SNAT/MASQUERADE. Additionally it might come in handy to define custom chains to group certain rules and allow a more efficient evaluation for incoming packets by not cramming all rules into the filter/INPUT chain so that (worst-case) all packets need to traverse and evaluate all rules. I have tried to maintain backwards compatibility and to not change default filenames/paths so that it won't result in leftover obsolete unmaged files from previous versions of this module. In order to improve the naming schema the rule $policy has been renamed to $action, however both parameters are available and optional now, with some sanity checks that require at most one of them and issueing a warning() for users of the now deprecated $policy parameter. All previous tests have been adapted to the changes, a long with an additional set of tests for the new feature. Fixes #61
2019-09-09enable acceptanceFabien COMBERNOUS
2019-09-02allow preserving of chains in tablesThore Bödecker
2019-09-01Add Debian 10 support & make configdirectory configureableTim Meusel
2019-08-09add second pair of parenthesisKilian Engelhardt
Previously this second pair of parenthesis was part of Hiera values; e.g.: subnet01 = '( ip01/32 ip02/32 )' Now it needs to be added by ferm::rule.
2019-08-09add test for array supportKilian Engelhardt
2019-07-27modulesync 2.8.0Tim Meusel
2019-07-11add support for interface specific rulesTim Meusel
2019-07-11enhance unit testsTim Meusel
2019-04-06modulesync 2.7.0Tim Meusel
2019-04-05add test for RedHat-like to contain init scriptKilian Engelhardt
2019-01-24modulesync 2.5.1Tim Meusel
2018-12-19Implement logging to kernel logTim Meusel
2018-12-04modulesync 2.3.1Tim Meusel
2018-07-11rubocop: autofixTim Meusel
2018-07-11disable rule caching on ubuntuTim Meusel
Fixes #16. Ubuntu caches rules. This doesn't allow us to reload the daemon and to apply new rules. Also this is a ubuntu only feature, it works well on all other platforms without cache.
2018-07-11add official ubuntu supportTim Meusel
2018-05-22Remove docker nodesetsTim Meusel
2018-05-20modulesync 1.9.2Tim Meusel
2018-03-23modulesync 1.9.0TraGicCode
2018-03-17add test to verify chains do not use conntrackKilian Engelhardt
2018-03-15initial commitTim Meusel
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-17 09:37:23 +0000