diff options
| author |   Jenkins <jenkins@review.openstack.org> | 2017-05-03 07:39:07 +0000 |
|---|---|---|
| committer |   Gerrit Code Review <review@openstack.org> | 2017-05-03 07:39:07 +0000 |
| commit | 28f478444015902265acce52bb18e080713d5780 (patch) | |
| tree | a0abb45de6a26fc3f9abdcb261f199152d733c48 /manifests | |
| parent | 1b143a78208dffe124c0db5d0e190216dae7b037 (diff) | |
| parent | c0c850d598980790e57f183275bc8395ec8d495c (diff) | |
Merge "firewall: generally accept "jump" param and use tripleo:firewall for log rule"
Diffstat (limited to 'manifests')
| -rw-r--r-- | manifests/firewall/post.pp | 2 | ||||
| -rw-r--r-- | manifests/firewall/rule.pp | 16 |
2 files changed, 16 insertions, 2 deletions
diff --git a/manifests/firewall/post.pp b/manifests/firewall/post.pp index b76db75..7b5f563 100644 --- a/manifests/firewall/post.pp +++ b/manifests/firewall/post.pp @@ -36,7 +36,7 @@ class tripleo::firewall::post( if $debug { warning('debug is enabled, the traffic is not blocked.') } else { - firewall { '998 log all': + tripleo::firewall::rule{ '998 log all': proto => 'all', jump => 'LOG', } diff --git a/manifests/firewall/rule.pp b/manifests/firewall/rule.pp index 688144e..f1ea0c9 100644 --- a/manifests/firewall/rule.pp +++ b/manifests/firewall/rule.pp @@ -39,6 +39,10 @@ # (optional) The action policy associated to the rule. # Defaults to 'accept' # +# [*jump*] +# (optional) The chain to jump to. +# If present, overrides action +# # [*state*] # (optional) Array of states associated to the rule.. # Defaults to ['NEW'] @@ -75,6 +79,7 @@ define tripleo::firewall::rule ( $chain = 'INPUT', $destination = undef, $extras = {}, + $jump = undef, ) { if $port == 'all' { @@ -85,16 +90,25 @@ define tripleo::firewall::rule ( $port_real = $port } + if $jump != undef { + $jump_real = $jump + $action_real = undef + } else { + $jump_real = undef + $action_real = $action + } + $basic = { 'port' => $port_real, 'dport' => $dport, 'sport' => $sport, 'proto' => $proto, - 'action' => $action, + 'action' => $action_real, 'source' => $source, 'iniface' => $iniface, 'chain' => $chain, 'destination' => $destination, + 'jump' => $jump_real, } if $proto == 'icmp' { $ipv6 = { |