From cd38691675da20ff4f38f18b2505955694ea56e4 Mon Sep 17 00:00:00 2001
From: Tim Meusel <tim@bastelfreak.de>
Date: Wed, 15 Apr 2020 09:57:09 +0200
Subject: make dropping of pakets marked as invalid optional

---
 manifests/chain.pp  | 17 ++++++++++-------
 manifests/config.pp |  7 ++++---
 manifests/init.pp   |  2 ++
 3 files changed, 16 insertions(+), 10 deletions(-)

(limited to 'manifests')

diff --git a/manifests/chain.pp b/manifests/chain.pp
index 0593cc8..54eb455 100644
--- a/manifests/chain.pp
+++ b/manifests/chain.pp
@@ -8,6 +8,7 @@
 #   }
 #
 # @param disable_conntrack Disable/Enable usage of conntrack. By default, we enable conntrack only for the filter INPUT chain
+# @param drop_invalid_packets_with_conntrack Enable/Disable the `mod conntrack ctstate INVALID DROP` statement. Only works if `$disable_conntrack` is `false` in this chain. You can set this to false if your policy is DROP.
 # @param log_dropped_packets Enable/Disable logging of packets to the kernel log, if no explicit chain matched
 # @param policy Set the default policy for CHAIN (works only for builtin chains)
 #   Allowed values: (ACCEPT|DROP) (see Ferm::Policies type)
@@ -19,11 +20,12 @@
 #
 define ferm::chain (
   Boolean $log_dropped_packets,
-  Boolean $disable_conntrack           = true,
-  String[1] $chain                     = $name,
-  Optional[Ferm::Policies] $policy     = undef,
-  Ferm::Tables $table                  = 'filter',
-  Array[Enum['ip','ip6']] $ip_versions = $ferm::ip_versions,
+  Boolean $drop_invalid_packets_with_conntrack = false,
+  Boolean $disable_conntrack                   = true,
+  String[1] $chain                             = $name,
+  Optional[Ferm::Policies] $policy             = undef,
+  Ferm::Tables $table                          = 'filter',
+  Array[Enum['ip','ip6']] $ip_versions         = $ferm::ip_versions,
 ) {
   # prevent unmanaged files due to new naming schema
   # keep the default "filter" chains in the original location
@@ -54,8 +56,9 @@ define ferm::chain (
     target  => $filename,
     content => epp(
       "${module_name}/ferm_chain_header.conf.epp", {
-        'policy'            => $policy,
-        'disable_conntrack' => $disable_conntrack,
+        'policy'                              => $policy,
+        'disable_conntrack'                   => $disable_conntrack,
+        'drop_invalid_packets_with_conntrack' => $drop_invalid_packets_with_conntrack,
       }
     ),
     order   => '01',
diff --git a/manifests/config.pp b/manifests/config.pp
index bd08e96..5876bd7 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -46,9 +46,10 @@ class ferm::config {
   }
 
   ferm::chain{'INPUT':
-    policy              => $ferm::input_policy,
-    disable_conntrack   => $ferm::input_disable_conntrack,
-    log_dropped_packets => $ferm::input_log_dropped_packets,
+    policy                              => $ferm::input_policy,
+    disable_conntrack                   => $ferm::input_disable_conntrack,
+    log_dropped_packets                 => $ferm::input_log_dropped_packets,
+    drop_invalid_packets_with_conntrack => $ferm::input_drop_invalid_packets_with_conntrack,
   }
   ferm::chain{'FORWARD':
     policy              => $ferm::forward_policy,
diff --git a/manifests/init.pp b/manifests/init.pp
index 4c69452..b1d051e 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -38,6 +38,7 @@
 # @param forward_policy Default policy for the FORWARD chain
 # @param output_policy Default policy for the OUTPUT chain
 # @param input_policy Default policy for the INPUT chain
+# @param input_drop_invalid_packets_with_conntrack Enable/Disable the `mod conntrack ctstate INVALID DROP` statement. Only works if `$disable_conntrack` is `false`. You can set this to false if your policy is DROP. This only effects the INPUT chain.
 # @param rules A hash that holds all data for ferm::rule
 # @param chains A hash that holds all data for ferm::chain
 # @param forward_log_dropped_packets Enable/Disable logging in the FORWARD chain of packets to the kernel log, if no explicit chain matched
@@ -61,6 +62,7 @@ class ferm (
   Boolean $forward_log_dropped_packets = false,
   Boolean $output_log_dropped_packets = false,
   Boolean $input_log_dropped_packets = false,
+  Boolean $input_drop_invalid_packets_with_conntrack = false,
   Hash $rules = {},
   Hash $chains = {},
   Array[Enum['ip','ip6']] $ip_versions = ['ip','ip6'],
-- 
cgit v1.2.3