fw4: support automatic includes
authorJo-Philipp Wich <jo@mein.io>
Thu, 11 Aug 2022 11:48:14 +0000 (13:48 +0200)
committerJo-Philipp Wich <jo@mein.io>
Fri, 12 Aug 2022 12:35:58 +0000 (14:35 +0200)
commita4484d4612931800583a7219271b63224491244c
treef9277bbbb027aa1107a0c108c3e990b996f61310
parentca7e3a1ab6798581ecdcd5f1df991fe355a265b4
fw4: support automatic includes

Introduce a new directory tree /usr/share/nftables.d/ which may contain
partial nftables files being included into the rendered ruleset.

The include position is derived from the file path;

 - Files in .../nftables.d/table-pre/ and .../nftables.d/table-post/ are
   included before and after the `table inet fw4 { ... }` declaration
   respectively

 - Files in .../nftables.d/ruleset-pre/ and .../nftables.d/ruleset-post/
   are included before the first chain and after the last chain
   declaration within the fw4 table respectively

 - Files in .../nftables.d/chain-pre/${chain}/ and .../chain-post/${chain}/
   are included before the first and after the last rule within the mentioned
   chain of the fw4 table respectively

Automatic includes can be disabled by setting the `auto_includes` option to
`0` in the global defaults section.

Also adjust testcases accordingly.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
15 files changed:
root/usr/share/nftables.d/README [new file with mode: 0644]
root/usr/share/ucode/fw4.uc
tests/01_configuration/01_ruleset
tests/01_configuration/02_rule_order
tests/05_includes/04_disabled_include [new file with mode: 0644]
tests/lib/mocklib/fs.uc
tests/mocks/fs/glob~_usr_share_nftables_d_ruleset-post_nft.json [new file with mode: 0644]
tests/mocks/fs/glob~_usr_share_nftables_d_ruleset-pre_nft.json [new file with mode: 0644]
tests/mocks/fs/glob~_usr_share_nftables_d_table-post_nft.json [new file with mode: 0644]
tests/mocks/fs/glob~_usr_share_nftables_d_table-pre_nft.json [new file with mode: 0644]
tests/mocks/fs/opendir~_usr_share_nftables_d_chain-post.json [new file with mode: 0644]
tests/mocks/fs/opendir~_usr_share_nftables_d_chain-pre.json [new file with mode: 0644]
tests/mocks/fs/open~_sys_class_net_br-lan_uevent.txt [new file with mode: 0644]
tests/mocks/fs/open~_sys_class_net_eth0_uevent.txt [new file with mode: 0644]
tests/mocks/fs/open~_sys_class_net_eth1_uevent.txt [new file with mode: 0644]