kunsi/bundlewrap
1
0
Fork 0
Code Issues 1 Pull requests 2 Releases Activity

bundles/nftables: store rules in dedicated files instead of nftables.conf
All checks were successful
kunsi/bundlewrap/pipeline/pr-main This commit looks good
Details
kunsi/bundlewrap/pipeline/head This commit looks good
Details

Browse source
This commit is contained in:
Franzi 2021-12-14 14:03:13 +01:00
parent 1742f51778
commit 0101e0c92d
Signed by: kunsi
GPG key ID: 12E3D2136B818350
11 changed files with 77 additions and 102 deletions
Download patch file Download diff file Expand all files Collapse all files

10
bundles/dhcpd/metadata.py
View file

@ -37,20 +37,18 @@ def get_static_allocations(metadata):
@metadata_reactor.provides(
'nftables/rules/input/dhcpd',
'nftables/rules/10-dhcpd',
)
def nftables(metadata):
rules = set()
for iface in node.metadata.get('dhcpd/subnets', {}):
rules.add(f'udp dport {{ 67, 68 }} iif {iface} accept')
rules.add(f'inet filter input udp dport {{ 67, 68 }} iif {iface} accept')
return {
'nftables': {
'rules': {
'input': {
# can't use port_rules here, because we're generating interface based rules.
'dhcpd': sorted(rules),
},
# can't use port_rules here, because we're generating interface based rules.
'10-dhcpd': sorted(rules),
},
}
}