aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--REFERENCE.md44
-rw-r--r--data/common.yaml1
-rw-r--r--manifests/config.pp5
-rw-r--r--manifests/init.pp34
-rw-r--r--spec/classes/ferm_spec.rb28
-rw-r--r--templates/ferm.conf.epp9
6 files changed, 105 insertions, 16 deletions
diff --git a/REFERENCE.md b/REFERENCE.md
index 44d7034..39ba310 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -7,7 +7,7 @@
_Public Classes_
-* [`ferm`](#ferm): Class: ferm This class manages ferm installation and rule generation on modern linux systems class{'ferm': manage_service => true, ip_v
+* [`ferm`](#ferm): This class manages ferm installation and rule generation on modern linux systems
_Private Classes_
@@ -31,19 +31,38 @@ _Private Classes_
Class: ferm
-This class manages ferm installation and rule generation on modern linux systems
+#### Examples
-class{'ferm':
- manage_service => true,
- ip_versions => ['ip6'],
-}
+##### deploy ferm without any configured rules, but also don't start the service or modify existing config files
-#### Examples
+```puppet
+include ferm
+```
-##### deploy ferm and start it, on node with only ipv6 enabled
+##### deploy ferm and start it, on nodes with only ipv6 enabled
```puppet
+class{'ferm':
+ manage_service => true,
+ ip_versions => ['ip6'],
+}
+```
+##### deploy ferm and don't touch chains from other software, like fail2ban and docker
+
+```puppet
+class{'ferm':
+ manage_service => true,
+ preserve_chains_in_tables => {
+ 'filter' => [
+ 'f2b-sshd',
+ 'DOCKER',
+ 'DOCKER-ISOLATION-STAGE-1',
+ 'DOCKER-ISOLATION-STAGE-2',
+ 'DOCKER-USER',
+ ]
+ }
+}
```
#### Parameters
@@ -161,6 +180,15 @@ Data type: `Array[Enum['ip','ip6']]`
Set list of versions of ip we want ot use.
Default value: ['ip', 'ip6']
+##### `preserve_chains_in_tables`
+
+Data type: `Hash[String[1],Array[String[1]]]`
+
+Hash with table:chains[] to use ferm @preserve for
+Default value: Empty Hash
+Allowed values: Hash with a list of tables and chains in it to preserve
+Example: {'nat' => ['PREROUTING', 'POSTROUTING']}
+
## Defined types
### ferm::chain
diff --git a/data/common.yaml b/data/common.yaml
index e68d41a..d40c155 100644
--- a/data/common.yaml
+++ b/data/common.yaml
@@ -8,6 +8,7 @@ ferm::configdirectory: /etc/ferm.d
ferm::input_policy: DROP
ferm::forward_policy: DROP
ferm::output_policy: ACCEPT
+ferm::preserve_chains_in_tables: {}
ferm::rules: {}
ferm::input_log_dropped_packets: false
ferm::forward_log_dropped_packets: false
diff --git a/manifests/config.pp b/manifests/config.pp
index 88fff15..25607ad 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -33,8 +33,9 @@ class ferm::config {
target => $ferm::configfile,
content => epp(
"${module_name}/ferm.conf.epp", {
- 'ip' => $_ip,
- 'configdirectory' => $ferm::configdirectory,
+ 'ip' => $_ip,
+ 'configdirectory' => $ferm::configdirectory,
+ 'preserve_chains_in_tables' => $ferm::preserve_chains_in_tables,
}
),
order => '50',
diff --git a/manifests/init.pp b/manifests/init.pp
index f1f9aa9..221e148 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -1,12 +1,29 @@
# Class: ferm
#
-# This class manages ferm installation and rule generation on modern linux systems
+# @summary This class manages ferm installation and rule generation on modern linux systems
#
-# @example deploy ferm and start it, on node with only ipv6 enabled
-# class{'ferm':
-# manage_service => true,
-# ip_versions => ['ip6'],
-# }
+# @example deploy ferm without any configured rules, but also don't start the service or modify existing config files
+# include ferm
+#
+# @example deploy ferm and start it, on nodes with only ipv6 enabled
+# class{'ferm':
+# manage_service => true,
+# ip_versions => ['ip6'],
+# }
+#
+# @example deploy ferm and don't touch chains from other software, like fail2ban and docker
+# class{'ferm':
+# manage_service => true,
+# preserve_chains_in_tables => {
+# 'filter' => [
+# 'f2b-sshd',
+# 'DOCKER',
+# 'DOCKER-ISOLATION-STAGE-1',
+# 'DOCKER-ISOLATION-STAGE-2',
+# 'DOCKER-USER',
+# ]
+# }
+# }
#
# @param manage_service Disable/Enable the management of the ferm daemon
# Default value: false
@@ -49,6 +66,10 @@
# Allowed values: (true|false)
# @param ip_versions Set list of versions of ip we want ot use.
# Default value: ['ip', 'ip6']
+# @param preserve_chains_in_tables Hash with table:chains[] to use ferm @preserve for
+# Default value: Empty Hash
+# Allowed values: Hash with a list of tables and chains in it to preserve
+# Example: {'nat' => ['PREROUTING', 'POSTROUTING']}
class ferm (
Boolean $manage_service,
Boolean $manage_configfile,
@@ -64,6 +85,7 @@ class ferm (
Boolean $input_log_dropped_packets,
Hash $rules,
Array[Enum['ip','ip6']] $ip_versions,
+ Hash[String[1],Array[String[1]]] $preserve_chains_in_tables,
) {
contain ferm::install
contain ferm::config
diff --git a/spec/classes/ferm_spec.rb b/spec/classes/ferm_spec.rb
index 55e6739..e5669b8 100644
--- a/spec/classes/ferm_spec.rb
+++ b/spec/classes/ferm_spec.rb
@@ -59,6 +59,11 @@ describe 'ferm' do
it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_concat__fragment('ferm_header.conf') }
it { is_expected.to contain_concat__fragment('ferm.conf') }
+ # the following string exists only if we preserve chains
+ it do
+ is_expected.to contain_concat__fragment('ferm.conf'). \
+ without_content(%r{@preserve;})
+ end
end
context 'with managed initfile' do
let :params do
@@ -88,6 +93,29 @@ describe 'ferm' do
it { is_expected.to contain_ferm__chain('OUTPUT') }
it { is_expected.to contain_ferm__chain('INPUT') }
end
+
+ context 'it preserves chains' do
+ let :params do
+ {
+ manage_configfile: true,
+ preserve_chains_in_tables: { 'nat' => %w[PREROUTING POSTROUTING] }
+ }
+ end
+
+ it { is_expected.to compile.with_all_deps }
+ it do
+ is_expected.to contain_concat__fragment('ferm.conf'). \
+ with_content(%r{domain \(ip ip6\) table nat \{})
+ end
+ it do
+ is_expected.to contain_concat__fragment('ferm.conf'). \
+ with_content(%r{chain PREROUTING @preserve;})
+ end
+ it do
+ is_expected.to contain_concat__fragment('ferm.conf'). \
+ with_content(%r{chain POSTROUTING @preserve;})
+ end
+ end
end
end
end
diff --git a/templates/ferm.conf.epp b/templates/ferm.conf.epp
index b3aa0ce..0245a70 100644
--- a/templates/ferm.conf.epp
+++ b/templates/ferm.conf.epp
@@ -1,8 +1,17 @@
<%- | String[1] $ip,
Stdlib::Absolutepath $configdirectory,
+Hash[String[1], Array[String[1]]] $preserve_chains_in_tables,
| -%>
# End custom section
+<%- $preserve_chains_in_tables.each |$table, $chains| { -%>
+domain (<%= $ip %>) table <%= $table %> {
+ <%- $chains.each |$chain| { -%>
+ chain <%= $chain %> @preserve;
+ <%- } -%>
+}
+<%- } -%>
+
domain (<%= $ip %>) table filter {
chain INPUT {
interface lo ACCEPT;