From 91fa3bcde36896eedade89911df93bbf58b6609b Mon Sep 17 00:00:00 2001
From: Fabien COMBERNOUS <fabien.combernous@adullact.org>
Date: Fri, 1 Nov 2019 14:12:30 +0100
Subject: use dedicated conntrack parameters

---
 manifests/chain.pp  | 4 ++--
 manifests/config.pp | 6 +++---
 manifests/init.pp   | 8 ++++++--
 3 files changed, 11 insertions(+), 7 deletions(-)

(limited to 'manifests')

diff --git a/manifests/chain.pp b/manifests/chain.pp
index b66ef7f..0593cc8 100644
--- a/manifests/chain.pp
+++ b/manifests/chain.pp
@@ -7,7 +7,7 @@
 #     log_dropped_packets => true,
 #   }
 #
-# @param disable_conntrack Disable/Enable usage of conntrack
+# @param disable_conntrack Disable/Enable usage of conntrack. By default, we enable conntrack only for the filter INPUT chain
 # @param log_dropped_packets Enable/Disable logging of packets to the kernel log, if no explicit chain matched
 # @param policy Set the default policy for CHAIN (works only for builtin chains)
 #   Allowed values: (ACCEPT|DROP) (see Ferm::Policies type)
@@ -18,8 +18,8 @@
 # @param ip_versions Set list of versions of ip we want ot use.
 #
 define ferm::chain (
-  Boolean $disable_conntrack,
   Boolean $log_dropped_packets,
+  Boolean $disable_conntrack           = true,
   String[1] $chain                     = $name,
   Optional[Ferm::Policies] $policy     = undef,
   Ferm::Tables $table                  = 'filter',
diff --git a/manifests/config.pp b/manifests/config.pp
index acc58d6..bd08e96 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -47,17 +47,17 @@ class ferm::config {
 
   ferm::chain{'INPUT':
     policy              => $ferm::input_policy,
-    disable_conntrack   => $ferm::disable_conntrack,
+    disable_conntrack   => $ferm::input_disable_conntrack,
     log_dropped_packets => $ferm::input_log_dropped_packets,
   }
   ferm::chain{'FORWARD':
     policy              => $ferm::forward_policy,
-    disable_conntrack   => $ferm::disable_conntrack,
+    disable_conntrack   => $ferm::forward_disable_conntrack,
     log_dropped_packets => $ferm::forward_log_dropped_packets,
   }
   ferm::chain{'OUTPUT':
     policy              => $ferm::output_policy,
-    disable_conntrack   => $ferm::disable_conntrack,
+    disable_conntrack   => $ferm::output_disable_conntrack,
     log_dropped_packets => $ferm::output_log_dropped_packets,
   }
 
diff --git a/manifests/init.pp b/manifests/init.pp
index ecaa391..4c69452 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -32,7 +32,9 @@
 # @param manage_initfile Disable/Enable the management of the ferm init script for RedHat-based OS
 # @param configfile Path to the config file
 # @param configdirectory Path to the directory where the module stores ferm configuration files
-# @param disable_conntrack Disable/Enable the generation of conntrack rules
+# @param forward_disable_conntrack Enable/Disable the generation of conntrack rules for the FORWARD chain
+# @param output_disable_conntrack Enable/Disable the generation of conntrack rules for the OUTPUT chain
+# @param input_disable_conntrack Enable/Disable the generation of conntrack rules for the INPUT chain
 # @param forward_policy Default policy for the FORWARD chain
 # @param output_policy Default policy for the OUTPUT chain
 # @param input_policy Default policy for the INPUT chain
@@ -50,7 +52,9 @@ class ferm (
   Boolean $manage_service = false,
   Boolean $manage_configfile = false,
   Boolean $manage_initfile = false,
-  Boolean $disable_conntrack = false,
+  Boolean $forward_disable_conntrack = true,
+  Boolean $output_disable_conntrack = true,
+  Boolean $input_disable_conntrack = false,
   Ferm::Policies $forward_policy = 'DROP',
   Ferm::Policies $output_policy = 'ACCEPT',
   Ferm::Policies $input_policy = 'DROP',
-- 
cgit v1.2.3