Commit f79bf97e authored by intrigeri's avatar intrigeri

Merge remote branch 'riseup/master'

Conflicts:
	files/debian/default
	manifests/init.pp
	templates/debian/default
	templates/debian_default.erb
parents f9c1086a c49625a4
modules/shorewall/manifests/init.pp - manage firewalling with shorewall 3.x
Puppet Module for Shorewall
---------------------------
This module manages the configuration of Shorewall (http://www.shorewall.net/)
Versions
--------
- forked from http://git.puppet.immerda.ch/?p=module-shorewall.git;a=summary
Copyright
---------
Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at>
adapted by immerda project group - admin+puppet(at)immerda.ch
adapted by Puzzle ITC - haerry+puppet(at)puzzle.ch
Copyright (c) 2009 Riseup Networks - micah(shift+2)riseup.net
Copyright (c) 2010 intrigeri - intrigeri(at)boum.org
See LICENSE for the full license granted to you.
Based on the work of ADNET Ghislain <gadnet@aqueos.com> from AQUEOS
at https://reductivelabs.com/trac/puppet/wiki/AqueosShorewall
Merged from:
- git://git.puppet.immerda.ch/module-shorewall.git
- git://labs.riseup.net/module_shorewall
Todo
----
- check if shorewall compiles without errors, otherwise fail !
Configuration
-------------
If you need to install a specific version of shorewall other than
the default one that would be installed by 'ensure => present', then
you can set the following variable and that specific version will be
installed instead:
$shorewall_ensure_version = "4.0.15-1"
Documentation
-------------
......
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
#
# Shorewall version 4 - Clear
#
# /etc/shorewall/stop
#
# Add commands below that you want to be executed at the beginning of a
# "shorewall stop" command.
#
# See http://shorewall.net/shorewall_extension_scripts.htm for additional
# information.
#
###############################################################################
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
#
# Shorewall version 4 - Continue File
#
# /etc/shorewall/continue
#
# Add commands below that you want to be executed after shorewall has
# cleared any existing Netfilter rules and has enabled existing
# connections.
#
# For additional information, see
# http://shorewall.net/shorewall_extension_scripts.htm
#
###############################################################################
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
#
# Shorewall version 4 - Init File
#
# /etc/shorewall/init
#
# Add commands below that you want to be executed at the beginning of
# a "shorewall start" or "shorewall restart" command.
#
# For additional information, see
# http://shorewall.net/shorewall_extension_scripts.htm
#
###############################################################################
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
#
# Shorewall version 4 - Initdone File
#
# /etc/shorewall/initdone
#
# Add commands below that you want to be executed during
# "shorewall start" or "shorewall restart" commands at the point where
# Shorewall has not yet added any perminent rules to the builtin chains.
#
# For additional information, see
# http://shorewall.net/shorewall_extension_scripts.htm
#
###############################################################################
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
#
# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5)
#
# /etc/shorewall/start
#
# Add commands below that you want executed while mac filtering rules are
# being created. These will be executed once for each interface having
# 'maclist' speciied and it is invoked just before the logging rule is
# added to the current chain (the name of that chain will be in $CHAIN)
#
# See http://shorewall.net/shorewall_extension_scripts.htm for additional
# information.
#
###############################################################################
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
#
# Shorewall version 4 - Start File
#
# /etc/shorewall/start
#
# Add commands below that you want to be executed after shorewall has
# been started or restarted.
#
# See http://shorewall.net/shorewall_extension_scripts.htm for additional
# information.
#
###############################################################################
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
#
# Shorewall version 4 - Started File
#
# /etc/shorewall/started
#
# Add commands below that you want to be executed after shorewall has
# been completely started or restarted. The difference between this
# extension script and /etc/shorewall/start is that this one is invoked
# after delayed loading of the blacklist (DELAYBLACKLISTLOAD=Yes) and
# after the 'shorewall' chain has been created (thus signaling that the
# firewall is completely up).
#
# This script should not change the firewall configuration directly but
# may do so indirectly by running /sbin/shorewall with the 'nolock'
# option.
#
# See http://shorewall.net/shorewall_extension_scripts.htm for additional
# information.
#
###############################################################################
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
#
# Shorewall version 4 - Stop File
#
# /etc/shorewall/stop
#
# Add commands below that you want to be executed at the beginning of a
# "shorewall stop" command.
#
# See http://shorewall.net/shorewall_extension_scripts.htm for additional
# information.
#
###############################################################################
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
#
# Shorewall version 4 - Stopped File
#
# /etc/shorewall/stopped
#
# Add commands below that you want to be executed at the completion of a
# "shorewall stop" command.
#
# See http://shorewall.net/shorewall_extension_scripts.htm for additional
# information.
#
###############################################################################
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
#
# Shorewall version 4 - Tcclasses File
#
# For information about entries in this file, type "man shorewall-tcclasses"
#
# See http://shorewall.net/traffic_shaping.htm for additional information.
#
###############################################################################
#INTERFACE:CLASS MARK RATE CEIL PRIORITY OPTIONS
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
#
# Shorewall version 4 - Tcdevices File
#
# For information about entries in this file, type "man shorewall-tcdevices"
#
# See http://shorewall.net/traffic_shaping.htm for additional information.
#
###############################################################################
#NUMBER: IN-BANDWITH OUT-BANDWIDTH OPTIONS REDIRECTED
#INTERFACE INTERFACES
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
#
# Shorewall version 4 - Tcrules File
#
# For information about entries in this file, type "man shorewall-tcrules"
#
# See http://shorewall.net/traffic_shaping.htm for additional information.
# For usage in selecting among multiple ISPs, see
# http://shorewall.net/MultiISP.html
#
# See http://shorewall.net/PacketMarking.html for a detailed description of
# the Netfilter/Shorewall packet marking mechanism.
######################################################################################################################
#MARK SOURCE DEST PROTO DEST SOURCE USER TEST LENGTH TOS CONNBYTES HELPER
# PORT(S) PORT(S)
class shorewall::base {
package { 'shorewall':
ensure => present,
ensure => $shorewall_ensure_version,
}
# This file has to be managed in place, so shorewall can find it
......@@ -38,7 +38,10 @@ class shorewall::base {
File["/var/lib/puppet/modules/shorewall/blacklist"],
File["/var/lib/puppet/modules/shorewall/rfc1918"],
File["/var/lib/puppet/modules/shorewall/routestopped"],
File["/var/lib/puppet/modules/shorewall/params"]
File["/var/lib/puppet/modules/shorewall/params"],
File["/var/lib/puppet/modules/shorewall/tcdevices"],
File["/var/lib/puppet/modules/shorewall/tcrules"],
File["/var/lib/puppet/modules/shorewall/tcclasses"],
],
require => Package[shorewall],
}
......
......@@ -3,7 +3,7 @@ define shorewall::blacklist(
$port = '-',
$order='100'
){
shorewall::entry{"blacklist.d/${order}-${name}":
shorewall::entry{"blacklist.d/${order}-${title}":
line => "${name} ${proto} ${port}",
}
}
......@@ -3,7 +3,6 @@ class shorewall::debian inherits shorewall::base {
'': { $shorewall_startup = "1" }
}
file{'/etc/default/shorewall':
#source => "puppet:///modules/shorewall/debian/default",
content => template("shorewall/debian_default.erb"),
require => Package['shorewall'],
notify => Service['shorewall'],
......
# See http://shorewall.net/shorewall_extension_scripts.htm
define extension_script($script = '') {
case $name {
'init', 'initdone', 'start', 'started', 'stop', 'stopped', 'clear', 'refresh', 'continue', 'maclog': {
shorewall::managed_file { "${name}": }
shorewall::entry { "${name}.d/500-${hostname}":
line => "${script}\n";
}
}
'', default: {
err("${name}: unknown shorewall extension script")
}
}
}
......@@ -3,7 +3,7 @@ define shorewall::host(
$options = 'tcpflags,blacklist,norfc1918',
$order='100'
){
shorewall::entry{"hosts.d/${order}-${name}":
shorewall::entry{"hosts.d/${order}-${title}":
line => "${zone} ${name} ${options}"
}
}
......
......@@ -15,7 +15,7 @@ class shorewall {
}
default: {
notice "unknown operatingsystem: $operatingsystem"
include shorewall::base
include shorewall::base
}
}
......@@ -49,4 +49,11 @@ class shorewall {
shorewall::managed_file { routestopped: }
# See http://www.shorewall.net/3.0/Documentation.htm#Variables
shorewall::managed_file { params: }
# See http://www.shorewall.net/3.0/traffic_shaping.htm
shorewall::managed_file { tcdevices: }
# See http://www.shorewall.net/3.0/traffic_shaping.htm
shorewall::managed_file { tcrules: }
# See http://www.shorewall.net/3.0/traffic_shaping.htm
shorewall::managed_file { tcclasses: }
}
......@@ -20,7 +20,7 @@ define shorewall::interface(
}
}
shorewall::entry { "interfaces.d/${order}-${name}":
shorewall::entry { "interfaces.d/${order}-${title}":
line => "${zone} ${name} ${broadcast} ${options_real}",
}
}
......
......@@ -10,7 +10,7 @@ define shorewall::masq(
$mark = '',
$order='100'
){
shorewall::entry{"masq.d/${order}-${name}":
shorewall::entry{"masq.d/${order}-${title}":
line => "# ${name}\n${interface} ${source} ${address} ${proto} ${port} ${ipsec} ${mark}"
}
}
......
......@@ -5,7 +5,7 @@ define shorewall::nat(
$local = 'yes',
$order='100'
){
shorewall::entry{"nat.d/${order}-${name}":
shorewall::entry{"nat.d/${order}-${title}":
line => "${name} ${interface} ${internal} ${all} ${local}"
}
}
define shorewall::params($value, $order='100'){
shorewall::entry{"params.d/${order}-${name}":
shorewall::entry{"params.d/${order}-${title}":
line => "${name}=${value}",
}
}
......@@ -5,7 +5,7 @@ define shorewall::policy(
$limitburst = '-',
$order
){
shorewall::entry{"policy.d/${order}-${name}":
shorewall::entry{"policy.d/${order}-${title}":
line => "# ${name}\n${sourcezone} ${destinationzone} ${policy} ${shloglevel} ${limitburst}",
}
}
......
......@@ -5,7 +5,7 @@ define shorewall::proxyarp(
$persistent = no,
$order='100'
){
shorewall::entry{"proxyarp.d/${order}-${name}":
shorewall::entry{"proxyarp.d/${order}-${title}":
line => "# ${name}\n${name} ${interface} ${external} ${haveroute} ${persistent}"
}
}
......@@ -2,7 +2,7 @@ define shorewall::rfc1918(
$action = 'logdrop',
$order='100'
){
shorewall::entry{"rfc1918.d/${order}-${name}":
shorewall::entry{"rfc1918.d/${order}-${title}":
line => "${name} ${action}"
}
}
......@@ -8,7 +8,7 @@ define shorewall::routestopped(
'' => $name,
default => $interface,
}
shorewall::entry{"routestopped.d/${order}-${name}":
shorewall::entry{"routestopped.d/${order}-${title}":
line => "${real_interface} ${host} ${options}",
}
}
......@@ -13,7 +13,7 @@ define shorewall::rule(
$mark = '',
$order
){
shorewall::entry{"rules.d/${order}-${name}":
shorewall::entry{"rules.d/${order}-${title}":
ensure => $ensure,
line => "# ${name}\n${action} ${source} ${destination} ${proto} ${destinationport} ${sourceport} ${originaldest} ${ratelimit} ${user} ${mark}",
}
......
define shorewall::rule_section(
$order
){
shorewall::entry{"rules.d/${order}-${name}":
shorewall::entry{"rules.d/${order}-${title}":
line => "SECTION ${name}",
}
}
define shorewall::tcclasses(
$interface,
$rate,
$ceil,
$priority,
$options = '',
$order = '1'
){
shorewall::entry { "tcclasses.d/${order}-${title}":
line => "# ${name}\n${interface} ${order} ${rate} ${ceil} ${priority} ${options}",
}
}
define shorewall::tcdevices(
$in_bandwidth,
$out_bandwidth,
$options = '',
$redirected_interfaces = '',
$order = '100'
){
shorewall::entry { "tcdevices.d/${order}-${title}":
line => "${name} ${in_bandwidth} ${out_bandwidth} ${options} ${redirected_interfaces}",
}
}
define shorewall::tcrules(
$source,
$destination,
$protocol = 'all',
$ports,
$client_ports = '',
$order = '1'
){
shorewall::entry { "tcrules.d/${order}-${title}":
line => "# ${name}\n${order} ${source} ${destination} ${protocol} ${ports} ${client_ports}",
}
}
......@@ -7,7 +7,7 @@ define shorewall::zone(
$order = 100
){
$real_name = $parent ? { '-' => $name, default => "${name}:${parent}" }
shorewall::entry { "zones.d/${order}-${name}":
shorewall::entry { "zones.d/${order}-${title}":
line => "${real_name} ${type} ${options} ${in} ${out}"
}
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment