diff options
| author | Kilian Engelhardt <kilian.engelhardt@godaddy.com> | 2018-03-16 16:49:00 +0100 |
|---|---|---|
| committer | Kilian Engelhardt <kilian.engelhardt@godaddy.com> | 2018-03-17 15:10:36 +0100 |
| commit | b1deffa5ddf26c14bd8ef404237f79e4ed4f94d3 (patch) | |
| tree | 100fb2a5648a5b5b98f99ac529b4e64c994b3bc6 | |
| parent | aadcd554e91188ecaabb70b70a456bb5baa328e0 (diff) | |
| download | puppet-ferm-b1deffa5ddf26c14bd8ef404237f79e4ed4f94d3.tar.gz puppet-ferm-b1deffa5ddf26c14bd8ef404237f79e4ed4f94d3.tar.bz2 | |
introduce parameter disable_conntrack
Default value of disable_conntrack is 'false'. Existing installations
are not affected by this change.
| -rw-r--r-- | data/common.yaml | 1 | ||||
| -rw-r--r-- | manifests/chain.pp | 9 | ||||
| -rw-r--r-- | manifests/config.pp | 9 | ||||
| -rw-r--r-- | manifests/init.pp | 4 | ||||
| -rw-r--r-- | templates/ferm_chain_header.conf.epp | 3 |
5 files changed, 22 insertions, 4 deletions
diff --git a/data/common.yaml b/data/common.yaml index 2618909..57509c5 100644 --- a/data/common.yaml +++ b/data/common.yaml @@ -1,6 +1,7 @@ --- ferm::manage_service: false ferm::manage_configfile: false +ferm::disable_conntrack: false ferm::configfile: /etc/ferm.conf ferm::input_policy: DROP ferm::forward_policy: DROP diff --git a/manifests/chain.pp b/manifests/chain.pp index 6f2ee1d..5b21912 100644 --- a/manifests/chain.pp +++ b/manifests/chain.pp @@ -1,8 +1,10 @@ # defined resource which creates all rules for one chain # @param policy [Ferm::Policies] Set the default policy for a CHAIN +# @param disable_conntrack [Boolean] disable/enable usage of conntrack # @param chain [Ferm::Chains] name of the chain that should be managed define ferm::chain ( Ferm::Policies $policy, + Boolean $disable_conntrack, Ferm::Chains $chain = $name, ) { @@ -14,7 +16,12 @@ define ferm::chain ( concat::fragment{"${chain}-policy": target => "/etc/ferm.d/chains/${chain}.conf", - content => epp("${module_name}/ferm_chain_header.conf.epp", {'policy' => $policy }), + content => epp( + "${module_name}/ferm_chain_header.conf.epp", { + 'policy' => $policy, + 'disable_conntrack' => $disable_conntrack, + } + ), order => '01', } } diff --git a/manifests/config.pp b/manifests/config.pp index 43c68ee..ff69c06 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -35,12 +35,15 @@ class ferm::config { } ferm::chain{'INPUT': - policy => $ferm::input_policy, + policy => $ferm::input_policy, + disable_conntrack => $ferm::disable_conntrack, } ferm::chain{'FORWARD': - policy => $ferm::forward_policy, + policy => $ferm::forward_policy, + disable_conntrack => $ferm::disable_conntrack, } ferm::chain{'OUTPUT': - policy => $ferm::output_policy, + policy => $ferm::output_policy, + disable_conntrack => $ferm::disable_conntrack, } } diff --git a/manifests/init.pp b/manifests/init.pp index 17ebeff..0096c3a 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -16,6 +16,9 @@ # @param configfile [Stdlib::Absolutepath] path to the config file # Default value: /etc/ferm.conf # Allowed values: Stdlib::Absolutepath +# @param disable_conntrack [Boolean] disable/enable the generation of conntrack rules +# Default value: false +# Allowed values: (true|false) # @param forward_policy [Ferm::Policies] default policy for the FORWARD chain # Default value: DROP # Allowed values: (ACCEPT|DROP|REJECT) @@ -32,6 +35,7 @@ class ferm ( Boolean $manage_service, Boolean $manage_configfile, Stdlib::Absolutepath $configfile, + Boolean $disable_conntrack, Ferm::Policies $forward_policy, Ferm::Policies $output_policy, Ferm::Policies $input_policy, diff --git a/templates/ferm_chain_header.conf.epp b/templates/ferm_chain_header.conf.epp index b8c444c..e2c30e6 100644 --- a/templates/ferm_chain_header.conf.epp +++ b/templates/ferm_chain_header.conf.epp @@ -1,8 +1,11 @@ <%- | Ferm::Policies $policy, + Boolean $disable_conntrack, | -%> # Default policy for this chain policy <%= $policy %>; +<% unless $disable_conntrack { -%> # connection tracking mod state state INVALID DROP; mod state state (ESTABLISHED RELATED) ACCEPT; +<% } -%> |