expose parameter to initialize custom chains

Previously it was not possible to define custom chains with parameter,
e.g. in order to collect them from hiera.
This commit adds this functionality, just like it was already in place for
ferm::rules.

diff --git a/REFERENCE.md b/REFERENCE.md
index 19ffae060ebb9ccd50ddebf2ea121741f4dcdd11..33327c56c746e2952056d41b4b5d88690dcbc95a 100644 (file)
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -151,6 +151,14 @@ A hash that holds all data for ferm::rule
 Default value: Empty Hash
 Allowed value: Any Hash
 
+##### `chains`
+
+Data type: `Hash`
+
+A hash that holds all data for ferm::chain
+Default value: Empty Hash
+Allowed value: Any Hash
+
 ##### `forward_log_dropped_packets`
 
 Data type: `Boolean`

diff --git a/data/common.yaml b/data/common.yaml
index d40c155dc4929c2a5a0f4aadab7b1a3930944ca7..34392e9d32a8495a5d4a1e29aabe893702340832 100644 (file)
--- a/data/common.yaml
+++ b/data/common.yaml
@@ -10,6 +10,7 @@ ferm::forward_policy: DROP
 ferm::output_policy: ACCEPT
 ferm::preserve_chains_in_tables: {}
 ferm::rules: {}
+ferm::chains: {}
 ferm::input_log_dropped_packets: false
 ferm::forward_log_dropped_packets: false
 ferm::output_log_dropped_packets: false

diff --git a/manifests/init.pp b/manifests/init.pp
index d2251c9401c0da8cd7f89c1eab69f87fa490db0f..2f5e1efeca7a97812cd7e2757eba0beed272b6fd 100644 (file)
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -55,6 +55,9 @@
 # @param rules A hash that holds all data for ferm::rule
 #   Default value: Empty Hash
 #   Allowed value: Any Hash
+# @param chains A hash that holds all data for ferm::chain
+#   Default value: Empty Hash
+#   Allowed value: Any Hash
 # @param forward_log_dropped_packets Enable/Disable logging in the FORWARD chain of packets to the kernel log, if no explicit chain matched
 #   Default value: false
 #   Allowed values: (true|false)
@@ -84,6 +87,7 @@ class ferm (
   Boolean $output_log_dropped_packets,
   Boolean $input_log_dropped_packets,
   Hash $rules,
+  Hash $chains,
   Array[Enum['ip','ip6']] $ip_versions,
   Hash[String[1],Array[String[1]]] $preserve_chains_in_tables,
 ) {
@@ -98,6 +102,12 @@ class ferm (
   Ferm::Chain <| |>
   ~> Class['ferm::service']
 
+  $chains.each |$chainname, $attributes| {
+    ferm::chain{$chainname:
+      * => $attributes,
+    }
+  }
+
   $rules.each |$rulename, $attributes| {
     ferm::rule{$rulename:
       * => $attributes,