Merge remote branch 'riseup/master'

Conflicts:
	files/debian/default
	manifests/init.pp
	templates/debian/default
	templates/debian_default.erb

README

+modules/shorewall/manifests/init.pp - manage firewalling with shorewall 3.x
+
 Puppet Module for Shorewall
 ---------------------------
 This module manages the configuration of Shorewall (http://www.shorewall.net/)
 
-Versions
---------
-- forked from http://git.puppet.immerda.ch/?p=module-shorewall.git;a=summary
+Copyright
+---------
+
+Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at>
+adapted by immerda project group - admin+puppet(at)immerda.ch
+adapted by Puzzle ITC - haerry+puppet(at)puzzle.ch
+Copyright (c) 2009 Riseup Networks - micah(shift+2)riseup.net
+Copyright (c) 2010 intrigeri - intrigeri(at)boum.org
+See LICENSE for the full license granted to you.
+
+Based on the work of ADNET Ghislain <gadnet@aqueos.com> from AQUEOS
+at https://reductivelabs.com/trac/puppet/wiki/AqueosShorewall
+
+Merged from:
+- git://git.puppet.immerda.ch/module-shorewall.git
+- git://labs.riseup.net/module_shorewall
 
 Todo
 ----
 - check if shorewall compiles without errors, otherwise fail !
 
+Configuration
+-------------
+
+If you need to install a specific version of shorewall other than
+the default one that would be installed by 'ensure => present', then
+you can set the following variable and that specific version will be
+installed instead:
+
+    $shorewall_ensure_version = "4.0.15-1"
+
 Documentation
 -------------
 

files/boilerplate/clear.footer

+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

files/boilerplate/clear.header

+#
+# Shorewall version 4 - Clear
+#
+# /etc/shorewall/stop
+#
+#       Add commands below that you want to be executed at the beginning of a
+#       "shorewall stop" command.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

files/boilerplate/continue.footer

+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

files/boilerplate/continue.header

+#
+# Shorewall version 4 - Continue File
+#
+#  /etc/shorewall/continue
+#
+#	Add commands below that you want to be executed after shorewall has
+#	cleared any existing Netfilter rules and has enabled existing
+#	connections.
+#
+# For additional information, see
+# http://shorewall.net/shorewall_extension_scripts.htm
+#
+###############################################################################
+

files/boilerplate/init.footer

+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

files/boilerplate/init.header

+#
+# Shorewall version 4 - Init File
+#
+# /etc/shorewall/init
+#
+#	Add commands below that you want to be executed at the beginning of
+#	a "shorewall start" or "shorewall restart" command.
+#
+# For additional information, see
+# http://shorewall.net/shorewall_extension_scripts.htm
+#
+###############################################################################
+

files/boilerplate/initdone.footer

+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

files/boilerplate/initdone.header

+#
+# Shorewall version 4 - Initdone File
+#
+# /etc/shorewall/initdone
+#
+#	Add commands below that you want to be executed during
+#	"shorewall start" or "shorewall restart" commands at the point where
+#	Shorewall has not yet added any perminent rules to the builtin chains.
+#
+# For additional information, see
+# http://shorewall.net/shorewall_extension_scripts.htm
+#
+###############################################################################
+

files/boilerplate/maclog.footer

+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

files/boilerplate/maclog.header

+#
+# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5)
+#
+# /etc/shorewall/start
+#
+#	Add commands below that you want executed while mac filtering rules are
+#	being created. These will be executed once for each interface having
+#	'maclist' speciied and it is invoked just before the logging rule is 
+#	added to the current chain (the name of that chain will be in $CHAIN)
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################

files/boilerplate/start.footer

+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

files/boilerplate/start.header

+#
+# Shorewall version 4 - Start File
+#
+# /etc/shorewall/start
+#
+#	Add commands below that you want to be executed after shorewall has
+#	been started or restarted.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################

files/boilerplate/started.footer

+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

files/boilerplate/started.header

+#
+# Shorewall version 4 - Started File
+#
+# /etc/shorewall/started
+#
+#	Add commands below that you want to be executed after shorewall has
+#	been completely started or restarted. The difference between this
+#	extension script and /etc/shorewall/start is that this one is invoked
+#	after delayed loading of the blacklist (DELAYBLACKLISTLOAD=Yes) and
+#	after the 'shorewall' chain has been created (thus signaling that the
+#	firewall is completely up).
+#
+#	This script should not change the firewall configuration directly but
+#	may do so indirectly by running /sbin/shorewall with the 'nolock'
+#	option.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################

files/boilerplate/stop.footer

+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

files/boilerplate/stop.header

+#
+# Shorewall version 4 - Stop File
+#
+# /etc/shorewall/stop
+#
+#	Add commands below that you want to be executed at the beginning of a
+#	"shorewall stop" command.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

files/boilerplate/stopped.footer

+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

files/boilerplate/stopped.header

+#
+# Shorewall version 4 - Stopped File
+#
+# /etc/shorewall/stopped
+#
+#	Add commands below that you want to be executed at the completion of a
+#	"shorewall stop" command.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE

files/boilerplate/tcclasses.footer

+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

files/boilerplate/tcclasses.header

+#
+# Shorewall version 4 - Tcclasses File
+#
+# For information about entries in this file, type "man shorewall-tcclasses"
+#
+# See http://shorewall.net/traffic_shaping.htm for additional information.
+#
+###############################################################################
+#INTERFACE:CLASS        MARK    RATE    CEIL    PRIORITY        OPTIONS

files/boilerplate/tcdevices.footer

+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

files/boilerplate/tcdevices.header

+#
+# Shorewall version 4 - Tcdevices File
+#
+# For information about entries in this file, type "man shorewall-tcdevices"
+#
+# See http://shorewall.net/traffic_shaping.htm for additional information.
+#
+###############################################################################
+#NUMBER:        IN-BANDWITH     OUT-BANDWIDTH   OPTIONS         REDIRECTED
+#INTERFACE                                                      INTERFACES

files/boilerplate/tcrules.footer

+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

files/boilerplate/tcrules.header

+#
+# Shorewall version 4 - Tcrules File
+#
+# For information about entries in this file, type "man shorewall-tcrules"
+#
+# See http://shorewall.net/traffic_shaping.htm for additional information.
+# For usage in selecting among multiple ISPs, see
+# http://shorewall.net/MultiISP.html
+#
+# See http://shorewall.net/PacketMarking.html for a detailed description of
+# the Netfilter/Shorewall packet marking mechanism.
+######################################################################################################################
+#MARK   SOURCE          DEST            PROTO   DEST    SOURCE  USER    TEST    LENGTH  TOS   CONNBYTES         HELPER
+#                                               PORT(S) PORT(S)
+

manifests/base.pp

 class shorewall::base {
     package { 'shorewall':
-        ensure => present,
+        ensure => $shorewall_ensure_version,
     }
 
     # This file has to be managed in place, so shorewall can find it
@@ -38,7 +38,10 @@ class shorewall::base {
             File["/var/lib/puppet/modules/shorewall/blacklist"],
             File["/var/lib/puppet/modules/shorewall/rfc1918"],
             File["/var/lib/puppet/modules/shorewall/routestopped"],
-            File["/var/lib/puppet/modules/shorewall/params"]
+            File["/var/lib/puppet/modules/shorewall/params"],
+            File["/var/lib/puppet/modules/shorewall/tcdevices"],
+            File["/var/lib/puppet/modules/shorewall/tcrules"],
+            File["/var/lib/puppet/modules/shorewall/tcclasses"],
         ],
         require => Package[shorewall],
     }

manifests/blacklist.pp

@@ -3,7 +3,7 @@ define shorewall::blacklist(
     $port = '-',
     $order='100'
 ){
-    shorewall::entry{"blacklist.d/${order}-${name}":
+    shorewall::entry{"blacklist.d/${order}-${title}":
         line => "${name} ${proto} ${port}",
     }           
 }

manifests/debian.pp

@@ -3,7 +3,6 @@ class shorewall::debian inherits shorewall::base {
       '': { $shorewall_startup = "1" }
     }
     file{'/etc/default/shorewall':
-        #source => "puppet:///modules/shorewall/debian/default",
         content => template("shorewall/debian_default.erb"),
         require => Package['shorewall'],
         notify => Service['shorewall'],

manifests/extension_script.pp

+# See http://shorewall.net/shorewall_extension_scripts.htm
+define extension_script($script = '') {
+    case $name {
+        'init', 'initdone', 'start', 'started', 'stop', 'stopped', 'clear', 'refresh', 'continue', 'maclog': {
+            shorewall::managed_file { "${name}": }
+            shorewall::entry { "${name}.d/500-${hostname}":
+                line => "${script}\n";
+            }
+        }
+        '', default: {
+            err("${name}: unknown shorewall extension script")
+        }
+    }
+}

manifests/host.pp

@@ -3,7 +3,7 @@ define shorewall::host(
     $options = 'tcpflags,blacklist,norfc1918',
     $order='100'
 ){
-    shorewall::entry{"hosts.d/${order}-${name}":
+    shorewall::entry{"hosts.d/${order}-${title}":
         line => "${zone} ${name} ${options}"
     }
 }

manifests/init.pp

@@ -15,7 +15,7 @@ class shorewall {
     }
     default: {
       notice "unknown operatingsystem: $operatingsystem" 
-		  include shorewall::base
+      include shorewall::base
     }
   }
 
@@ -49,4 +49,11 @@ class shorewall {
   shorewall::managed_file { routestopped: }
   # See http://www.shorewall.net/3.0/Documentation.htm#Variables 
   shorewall::managed_file { params: }
+  # See http://www.shorewall.net/3.0/traffic_shaping.htm
+  shorewall::managed_file { tcdevices: }
+  # See http://www.shorewall.net/3.0/traffic_shaping.htm
+  shorewall::managed_file { tcrules: }
+  # See http://www.shorewall.net/3.0/traffic_shaping.htm
+  shorewall::managed_file { tcclasses: }
+  
 }

manifests/interface.pp

@@ -20,7 +20,7 @@ define shorewall::interface(
         }
     }
 
-    shorewall::entry { "interfaces.d/${order}-${name}":
+    shorewall::entry { "interfaces.d/${order}-${title}":
         line => "${zone} ${name} ${broadcast} ${options_real}",
     }
 }

manifests/masq.pp

@@ -10,7 +10,7 @@ define shorewall::masq(
     $mark = '',
     $order='100'
 ){
-    shorewall::entry{"masq.d/${order}-${name}":
+    shorewall::entry{"masq.d/${order}-${title}":
         line => "# ${name}\n${interface} ${source} ${address} ${proto} ${port} ${ipsec} ${mark}"
     }
 }

manifests/nat.pp

@@ -5,7 +5,7 @@ define shorewall::nat(
     $local = 'yes',
     $order='100'
 ){
-    shorewall::entry{"nat.d/${order}-${name}":
+    shorewall::entry{"nat.d/${order}-${title}":
         line => "${name} ${interface} ${internal} ${all} ${local}"
     }           
 }

manifests/params.pp

 define shorewall::params($value, $order='100'){
-    shorewall::entry{"params.d/${order}-${name}":
+    shorewall::entry{"params.d/${order}-${title}":
         line => "${name}=${value}",
     }
 }

manifests/policy.pp

@@ -5,7 +5,7 @@ define shorewall::policy(
     $limitburst = '-',
     $order
 ){
-    shorewall::entry{"policy.d/${order}-${name}":
+    shorewall::entry{"policy.d/${order}-${title}":
         line => "# ${name}\n${sourcezone} ${destinationzone} ${policy} ${shloglevel} ${limitburst}",
     }
 }

manifests/proxyarp.pp

@@ -5,7 +5,7 @@ define shorewall::proxyarp(
     $persistent = no,
     $order='100'
     ){
-    shorewall::entry{"proxyarp.d/${order}-${name}":
+    shorewall::entry{"proxyarp.d/${order}-${title}":
         line => "# ${name}\n${name} ${interface} ${external} ${haveroute} ${persistent}"
     }
 }

manifests/rfc1918.pp

@@ -2,7 +2,7 @@ define shorewall::rfc1918(
     $action = 'logdrop',
     $order='100'
 ){
-    shorewall::entry{"rfc1918.d/${order}-${name}":
+    shorewall::entry{"rfc1918.d/${order}-${title}":
         line => "${name} ${action}"
     }   
 }

manifests/routestopped.pp

@@ -8,7 +8,7 @@ define shorewall::routestopped(
         '' => $name,
         default => $interface,
     }   
-    shorewall::entry{"routestopped.d/${order}-${name}":
+    shorewall::entry{"routestopped.d/${order}-${title}":
         line => "${real_interface} ${host} ${options}",
     }           
 }

manifests/rule.pp

@@ -13,7 +13,7 @@ define shorewall::rule(
     $mark = '',
     $order
 ){
-    shorewall::entry{"rules.d/${order}-${name}":
+    shorewall::entry{"rules.d/${order}-${title}":
         ensure => $ensure,
         line => "# ${name}\n${action} ${source} ${destination} ${proto} ${destinationport} ${sourceport} ${originaldest} ${ratelimit} ${user} ${mark}",
     }

manifests/rule_section.pp

 define shorewall::rule_section(
     $order
 ){
-    shorewall::entry{"rules.d/${order}-${name}":
+    shorewall::entry{"rules.d/${order}-${title}":
         line => "SECTION ${name}",
     }       
 }

manifests/tcclasses.pp

+define shorewall::tcclasses(
+    $interface,
+    $rate,
+    $ceil,
+    $priority,
+    $options = '',
+    $order = '1'
+){
+    shorewall::entry { "tcclasses.d/${order}-${title}":
+        line => "# ${name}\n${interface} ${order} ${rate} ${ceil} ${priority} ${options}",
+    }
+}

manifests/tcdevices.pp

+define shorewall::tcdevices(
+    $in_bandwidth,
+    $out_bandwidth,
+    $options = '',
+    $redirected_interfaces = '',
+    $order = '100'
+){
+    shorewall::entry { "tcdevices.d/${order}-${title}":
+        line => "${name} ${in_bandwidth} ${out_bandwidth} ${options} ${redirected_interfaces}",
+    }
+}

manifests/tcrules.pp

+define shorewall::tcrules(
+    $source,
+    $destination,
+    $protocol = 'all',
+    $ports,
+    $client_ports = '',
+    $order = '1'
+){
+    shorewall::entry { "tcrules.d/${order}-${title}":
+        line => "# ${name}\n${order} ${source} ${destination} ${protocol} ${ports} ${client_ports}",
+    }
+}

manifests/zone.pp

@@ -7,7 +7,7 @@ define shorewall::zone(
     $order = 100
 ){
     $real_name = $parent ? { '-' => $name, default => "${name}:${parent}" }
-    shorewall::entry { "zones.d/${order}-${name}":
+    shorewall::entry { "zones.d/${order}-${title}":
         line => "${real_name} ${type} ${options} ${in} ${out}"
     }
 }