diff options
| author | Tim Meusel <tim@bastelfreak.de> | 2018-12-19 09:48:29 +0100 |
|---|---|---|
| committer | Tim Meusel <tim@bastelfreak.de> | 2018-12-19 13:13:52 +0100 |
| commit | 750675333fdbe6c40b63c75b53e360151780fa24 (patch) | |
| tree | 2493e3100ef8ed61c4c5783a65ab0e1964cd1a28 /manifests | |
| parent | 0a25439016f4e99d4f73457c9f19436329608ca6 (diff) | |
| download | puppet-ferm-750675333fdbe6c40b63c75b53e360151780fa24.tar.gz puppet-ferm-750675333fdbe6c40b63c75b53e360151780fa24.tar.bz2 | |
Implement logging to kernel log
Diffstat (limited to 'manifests')
| -rw-r--r-- | manifests/chain.pp | 10 | ||||
| -rw-r--r-- | manifests/config.pp | 15 | ||||
| -rw-r--r-- | manifests/init.pp | 12 |
3 files changed, 31 insertions, 6 deletions
diff --git a/manifests/chain.pp b/manifests/chain.pp index 5b21912..f9722cf 100644 --- a/manifests/chain.pp +++ b/manifests/chain.pp @@ -2,9 +2,11 @@ # @param policy [Ferm::Policies] Set the default policy for a CHAIN # @param disable_conntrack [Boolean] disable/enable usage of conntrack # @param chain [Ferm::Chains] name of the chain that should be managed +# @param log_dropped_packets [Boolean] boolean to enable/disable logging of packets to the kernel log, if no explicit chain matched define ferm::chain ( Ferm::Policies $policy, Boolean $disable_conntrack, + Boolean $log_dropped_packets, Ferm::Chains $chain = $name, ) { @@ -24,4 +26,12 @@ define ferm::chain ( ), order => '01', } + + if $log_dropped_packets { + concat::fragment{"${chain}-footer": + target => "/etc/ferm.d/chains/${chain}.conf", + content => epp("${module_name}/ferm_chain_footer.conf.epp", { 'chain' => $chain }), + order => '99', + } + } } diff --git a/manifests/config.pp b/manifests/config.pp index ff69c06..1736fa6 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -35,15 +35,18 @@ class ferm::config { } ferm::chain{'INPUT': - policy => $ferm::input_policy, - disable_conntrack => $ferm::disable_conntrack, + policy => $ferm::input_policy, + disable_conntrack => $ferm::disable_conntrack, + log_dropped_packets => $ferm::input_log_dropped_packets, } ferm::chain{'FORWARD': - policy => $ferm::forward_policy, - disable_conntrack => $ferm::disable_conntrack, + policy => $ferm::forward_policy, + disable_conntrack => $ferm::disable_conntrack, + log_dropped_packets => $ferm::forward_log_dropped_packets, } ferm::chain{'OUTPUT': - policy => $ferm::output_policy, - disable_conntrack => $ferm::disable_conntrack, + policy => $ferm::output_policy, + disable_conntrack => $ferm::disable_conntrack, + log_dropped_packets => $ferm::output_log_dropped_packets, } } diff --git a/manifests/init.pp b/manifests/init.pp index 0096c3a..c9f2a48 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -31,6 +31,15 @@ # @param rules a hash that holds all data for ferm::rule # Default value: Empty Hash # Allowed value: Any Hash +# @param forward_log_dropped_packets boolean to enable/disable logging in the FORWARD chain of packets to the kernel log, if no explicit chain matched +# Default value: false +# Allowed values: (true|false) +# @param output_log_dropped_packets boolean to enable/disable logging in the OUTPUT chain of packets to the kernel log, if no explicit chain matched +# Default value: false +# Allowed values: (true|false) +# @param input_log_dropped_packets boolean to enable/disable logging in the INPUT chain of packets to the kernel log, if no explicit chain matched +# Default value: false +# Allowed values: (true|false) class ferm ( Boolean $manage_service, Boolean $manage_configfile, @@ -39,6 +48,9 @@ class ferm ( Ferm::Policies $forward_policy, Ferm::Policies $output_policy, Ferm::Policies $input_policy, + Boolean $forward_log_dropped_packets, + Boolean $output_log_dropped_packets, + Boolean $input_log_dropped_packets, Hash $rules, ) { contain ferm::install |