diff options
Diffstat (limited to 'manifests')
| -rw-r--r-- | manifests/chain.pp | 17 | ||||
| -rw-r--r-- | manifests/config.pp | 7 | ||||
| -rw-r--r-- | manifests/init.pp | 2 |
3 files changed, 16 insertions, 10 deletions
diff --git a/manifests/chain.pp b/manifests/chain.pp index 0593cc8..54eb455 100644 --- a/manifests/chain.pp +++ b/manifests/chain.pp @@ -8,6 +8,7 @@ # } # # @param disable_conntrack Disable/Enable usage of conntrack. By default, we enable conntrack only for the filter INPUT chain +# @param drop_invalid_packets_with_conntrack Enable/Disable the `mod conntrack ctstate INVALID DROP` statement. Only works if `$disable_conntrack` is `false` in this chain. You can set this to false if your policy is DROP. # @param log_dropped_packets Enable/Disable logging of packets to the kernel log, if no explicit chain matched # @param policy Set the default policy for CHAIN (works only for builtin chains) # Allowed values: (ACCEPT|DROP) (see Ferm::Policies type) @@ -19,11 +20,12 @@ # define ferm::chain ( Boolean $log_dropped_packets, - Boolean $disable_conntrack = true, - String[1] $chain = $name, - Optional[Ferm::Policies] $policy = undef, - Ferm::Tables $table = 'filter', - Array[Enum['ip','ip6']] $ip_versions = $ferm::ip_versions, + Boolean $drop_invalid_packets_with_conntrack = false, + Boolean $disable_conntrack = true, + String[1] $chain = $name, + Optional[Ferm::Policies] $policy = undef, + Ferm::Tables $table = 'filter', + Array[Enum['ip','ip6']] $ip_versions = $ferm::ip_versions, ) { # prevent unmanaged files due to new naming schema # keep the default "filter" chains in the original location @@ -54,8 +56,9 @@ define ferm::chain ( target => $filename, content => epp( "${module_name}/ferm_chain_header.conf.epp", { - 'policy' => $policy, - 'disable_conntrack' => $disable_conntrack, + 'policy' => $policy, + 'disable_conntrack' => $disable_conntrack, + 'drop_invalid_packets_with_conntrack' => $drop_invalid_packets_with_conntrack, } ), order => '01', diff --git a/manifests/config.pp b/manifests/config.pp index bd08e96..5876bd7 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -46,9 +46,10 @@ class ferm::config { } ferm::chain{'INPUT': - policy => $ferm::input_policy, - disable_conntrack => $ferm::input_disable_conntrack, - log_dropped_packets => $ferm::input_log_dropped_packets, + policy => $ferm::input_policy, + disable_conntrack => $ferm::input_disable_conntrack, + log_dropped_packets => $ferm::input_log_dropped_packets, + drop_invalid_packets_with_conntrack => $ferm::input_drop_invalid_packets_with_conntrack, } ferm::chain{'FORWARD': policy => $ferm::forward_policy, diff --git a/manifests/init.pp b/manifests/init.pp index 4c69452..b1d051e 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -38,6 +38,7 @@ # @param forward_policy Default policy for the FORWARD chain # @param output_policy Default policy for the OUTPUT chain # @param input_policy Default policy for the INPUT chain +# @param input_drop_invalid_packets_with_conntrack Enable/Disable the `mod conntrack ctstate INVALID DROP` statement. Only works if `$disable_conntrack` is `false`. You can set this to false if your policy is DROP. This only effects the INPUT chain. # @param rules A hash that holds all data for ferm::rule # @param chains A hash that holds all data for ferm::chain # @param forward_log_dropped_packets Enable/Disable logging in the FORWARD chain of packets to the kernel log, if no explicit chain matched @@ -61,6 +62,7 @@ class ferm ( Boolean $forward_log_dropped_packets = false, Boolean $output_log_dropped_packets = false, Boolean $input_log_dropped_packets = false, + Boolean $input_drop_invalid_packets_with_conntrack = false, Hash $rules = {}, Hash $chains = {}, Array[Enum['ip','ip6']] $ip_versions = ['ip','ip6'], |