Feat: major refactor

13 files changed, 143 insertions, 415 deletions

diff --git a/manifests/router/gitd.pp b/manifests/router/gitd.pp
index ee54cea..f866c75 100644
--- a/manifests/router/gitd.pp
+++ b/manifests/router/gitd.pp
@@ -1,22 +1,10 @@
-class firewall::router::gitd($destination, $zone = 'loc', $originaldest = $ipaddress) {
-  shorewall::rule { 'git-daemon-1':
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:9418",
-    proto           => 'tcp',
-    destinationport => '9418',
-    ratelimit       => '-',
-    order           => 800,
-  }
-
-  shorewall::rule { 'git-daemon-2':
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:9418",
-    proto           => 'tcp',
-    destinationport => '9418',
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => 801,
+class firewall::router::gitd(
+  $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+  $destination, $zone = 'loc', $originaldest = $ipaddress,
+) {
+  class { "firewall::implementations::${implementation}::router::gitd":
+    destination  => $destination,
+    zone         => $zone,
+    originaldest => $originaldest,
   }
 }
diff --git a/manifests/router/gobby.pp b/manifests/router/gobby.pp
index 3d648ef..9e1932f 100644
--- a/manifests/router/gobby.pp
+++ b/manifests/router/gobby.pp
@@ -1,22 +1,10 @@
-class firewall::router::gobby($destination, $zone = 'loc', $originaldest = $ipaddress) {
-  shorewall::rule { 'gobby-route-1':
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:6523",
-    proto           => 'tcp',
-    destinationport => '6523',
-    ratelimit       => '-',
-    order           => 600,
-  }
-
-  shorewall::rule { 'gobby-route-2':
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "fw:$destination:6523",
-    proto           => 'tcp',
-    destinationport => '6523',
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => 601,
+class firewall::router::gobby(
+  $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+  $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+  class { "firewall::implementations::${implementation}::router::gobby":
+    destination  => $destination,
+    zone         => $zone,
+    originaldest => $originaldest,
   }
 }
diff --git a/manifests/router/hairpinning.pp b/manifests/router/hairpinning.pp
index 21a8d9d..96fac1e 100644
--- a/manifests/router/hairpinning.pp
+++ b/manifests/router/hairpinning.pp
@@ -1,29 +1,27 @@
 # See http://www.shorewall.net/FAQ.htm#faq2
-define firewall::router::hairpinning($order = '5000', $proto = 'tcp', $port = 'www',
-                                     $external_ip = '$ETH0_IP', $interface = 'eth1',
-                                     $destination = '192.168.1.100', $source = 'eth1',
-                                     $source_zone = 'loc', $dest_zone = 'loc',
-                                     $port_dest = '') {
-  shorewall::masq { "routeback-$name":
-    interface => "$interface:$destination",
-    source    => $source,
-    address   => $external_ip,
-    proto     => $proto,
-    port      => $port,
-    order     => $order,
-  }
-
-  shorewall::rule { "routeback-$name":
-    action          => 'DNAT',
-    source          => $source_zone,
-    destination     => $port_dest ? {
-      ''      => "$dest_zone:$destination",
-      default => "$dest_zone:$destination:$port_dest",
-    },
-    proto           => $proto,
-    destinationport => $port,
-    ratelimit       => '-',
-    order           => $order,
-    originaldest    => $external_ip,
+define firewall::router::hairpinning(
+  $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+  $order          = '5000',
+  $proto          = 'tcp',
+  $port           = 'www',
+  $external_ip    = '$ETH0_IP',
+  $interface      = 'eth1',
+  $destination    = '192.168.1.100',
+  $source         = 'eth1',
+  $source_zone    = 'loc',
+  $dest_zone      = 'loc',
+  $port_dest      = ''
+) {
+  class { "firewall::implementations::${implementation}::router::hairpinning":
+    order       => $order,
+    proto       => $proto,
+    port        => $port,
+    external_ip => $external_ip,
+    interface   => $interface,
+    destination => $destination,
+    source      => $source,
+    source_zone => $source_zone,
+    dest_zone   => $dest_zone,
+    port_dest   => $port_dest,
   }
 }
diff --git a/manifests/router/http.pp b/manifests/router/http.pp
index 8833116..6b4eb90 100644
--- a/manifests/router/http.pp
+++ b/manifests/router/http.pp
@@ -1,22 +1,10 @@
-class firewall::router::http($destination, $zone = 'loc', $originaldest = $ipaddress) {
-  shorewall::rule { 'http-route-1':
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:80",
-    proto           => 'tcp',
-    destinationport => '80',
-    ratelimit       => '-',
-    order           => 600,
-  }
-
-  shorewall::rule { 'http-route-2':
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "fw:$destination:80",
-    proto           => 'tcp',
-    destinationport => '80',
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => 601,
+class firewall::router::http(
+  $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+  $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+  class { "firewall::implementations::${implementation}::router::http":
+    destination  => $destination,
+    zone         => $zone,
+    originaldest => $originaldest,
   }
 }
diff --git a/manifests/router/https.pp b/manifests/router/https.pp
index 064c694..d683761 100644
--- a/manifests/router/https.pp
+++ b/manifests/router/https.pp
@@ -1,22 +1,10 @@
-class firewall::router::https($destination, $zone = 'loc', $originaldest = $ipaddress) {
-  shorewall::rule { 'https-route-1':
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:443",
-    proto           => 'tcp',
-    destinationport => '443',
-    ratelimit       => '-',
-    order           => 602,
-  }
-
-  shorewall::rule { 'https-route-2':
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "fw:$destination:443",
-    proto           => 'tcp',
-    destinationport => '443',
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => 602,
+class firewall::router::https(
+  $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+  $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+  class { "firewall::implementations::${implementation}::router::https":
+    destination  => $destination,
+    zone         => $zone,
+    originaldest => $originaldest,
   }
 }
diff --git a/manifests/router/icecast.pp b/manifests/router/icecast.pp
index cb98e6a..b0c01b9 100644
--- a/manifests/router/icecast.pp
+++ b/manifests/router/icecast.pp
@@ -1,22 +1,10 @@
-class firewall::router::icecast($destination, $zone = 'loc', $originaldest = $ipaddress) {
-  shorewall::rule { 'icecast-1':
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:8000",
-    proto           => 'tcp',
-    destinationport => '8000',
-    ratelimit       => '-',
-    order           => 900,
-  }
-
-  shorewall::rule { 'icecast-2':
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:8000",
-    proto           => 'tcp',
-    destinationport => '8000',
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => 901,
+class firewall::router::icecast(
+  $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+  $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+  class { "firewall::implementations::${implementation}::router::icecast":
+    destination  => $destination,
+    zone         => $zone,
+    originaldest => $originaldest,
   }
 }
diff --git a/manifests/router/mail.pp b/manifests/router/mail.pp
index 403579d..5efde58 100644
--- a/manifests/router/mail.pp
+++ b/manifests/router/mail.pp
@@ -1,64 +1,10 @@
-class firewall::router::mail($destination, $zone = 'loc', $originaldest = $ipaddress) {
-  shorewall::rule { 'mail-1':
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:25",
-    proto           => 'tcp',
-    destinationport => '25',
-    ratelimit       => '-',
-    order           => 1000,
-  }
-
-  shorewall::rule { 'mail-2':
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:25",
-    proto           => 'tcp',
-    destinationport => '25',
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => 1001,
-  }
-
-  shorewall::rule { 'mail-3':
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:993",
-    proto           => 'tcp',
-    destinationport => '993',
-    ratelimit       => '-',
-    order           => 1002,
-  }
-
-  shorewall::rule { 'mail-4':
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:993",
-    proto           => 'tcp',
-    destinationport => '993',
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => 1003,
-  }
-
-  shorewall::rule { 'mail-5':
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:587",
-    proto           => 'tcp',
-    destinationport => '587',
-    ratelimit       => '-',
-    order           => 1004,
-  }
-
-  shorewall::rule { 'mail-6':
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:587",
-    proto           => 'tcp',
-    destinationport => '587',
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => 1005,
+class firewall::router::mail(i
+  $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+  $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+  class { "firewall::implementations::${implementation}::router::mail":
+    destination  => $destination,
+    zone         => $zone,
+    originaldest => $originaldest,
   }
 }
diff --git a/manifests/router/mumble.pp b/manifests/router/mumble.pp
index 6c96976..1f1a85c 100644
--- a/manifests/router/mumble.pp
+++ b/manifests/router/mumble.pp
@@ -1,22 +1,10 @@
-class firewall::router::mumble($destination, $zone = 'loc', $originaldest = $::ipaddress) {
-  shorewall::rule { 'mumble-0':
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:64738",
-    proto           => 'tcp',
-    destinationport => '64738',
-    ratelimit       => '-',
-    order           => 2300,
-  }
-
-  shorewall::rule { 'mumble-1':
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:64738",
-    proto           => 'udp',
-    destinationport => '64738',
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => 2301,
+class firewall::router::mumble(
+  $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+  $destination, $zone = 'loc', $originaldest = $::ipaddress
+) {
+  class { "firewall::implementations::${implementation}::router::mumble":
+    destination  => $destination,
+    zone         => $zone,
+    originaldest => $originaldest,
   }
 }
diff --git a/manifests/router/munin.pp b/manifests/router/munin.pp
index 7ca136d..4fd33fd 100644
--- a/manifests/router/munin.pp
+++ b/manifests/router/munin.pp
@@ -1,29 +1,18 @@
-define firewall::router::munin($destination, $port_orig, $port_dest = '', $zone = 'loc',
-                               $order = '400', $originaldest = $ipaddress) {
-  shorewall::rule { "munin-$name-1":
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => $port_dest ? {
-      ''      => "$zone:$destination",
-      default => "$zone:$destination:$port_dest",
-    },
-    proto           => 'tcp',
-    destinationport => "$port_orig",
-    ratelimit       => '-',
-    order           => $order,
-  }
-
-  shorewall::rule { "munin-$name-2":
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => $port_dest ? {
-      ''      => "$zone:$destination",
-      default => "$zone:$destination:$port_dest",
-    },
-    proto           => 'tcp',
-    destinationport => "$port_orig",
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => $order,
+define firewall::router::munin(
+   $destination,
+   $port_orig,
+   $port_dest      = '',
+   $zone           = 'loc',
+   $order          = '400',
+   $originaldest   = $ipaddress
+   $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+  class { "firewall::implementations::${implementation}::router::munin":
+    destination  => $destination,
+    port_orig    => $port_orig,
+    port_dest    => $port_dest,
+    zone         => $zone,
+    order        => $order,
+    originaldest => $originaldest,
   }
 }
diff --git a/manifests/router/rsync.pp b/manifests/router/rsync.pp
index 71faf86..9e36f85 100644
--- a/manifests/router/rsync.pp
+++ b/manifests/router/rsync.pp
@@ -1,29 +1,17 @@
-class firewall::router::rsync($destination, $port_orig = '873', $port_dest = '', $zone = 'loc',
-                              $originaldest = $ipaddress) {
-  shorewall::rule { "rsync-$name-1":
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => $port_dest ? {
-      ''      => "$zone:$destination",
-      default => "$zone:$destination:$port_dest",
-    },
-    proto           => 'tcp',
-    destinationport => "$port_orig",
-    ratelimit       => '-',
-    order           => "26$port_orig",
-  }
-
-  shorewall::rule { "rsync-$name-2":
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => $port_dest ? {
-      ''      => "$zone:$destination",
-      default => "$zone:$destination:$port_dest",
-    },
-    proto           => 'tcp',
-    destinationport => "$port_orig",
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => "26$port_orig",
+class firewall::router::rsync(
+   $destination,
+   $port_orig     = '873',
+   $port_dest     = '',
+   $zone          = 'loc',
+   $originaldest  = $ipaddress
+   $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+  class { "firewall::implementations::${implementation}::router::rsync":
+    destination  => $destination,
+    port_orig    => $port_orig,
+    port_dest    => $port_dest,
+    zone         => $zone,
+    order        => $order,
+    originaldest => $originaldest,
   }
 }
diff --git a/manifests/router/ssh.pp b/manifests/router/ssh.pp
index a37b61f..6f1a640 100644
--- a/manifests/router/ssh.pp
+++ b/manifests/router/ssh.pp
@@ -1,29 +1,17 @@
-define firewall::router::ssh($destination, $port_orig = '22', $port_dest = '', $zone = 'loc',
-                             $originaldest = $ipaddress) {
-  shorewall::rule { "ssh-$name-1":
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => $port_dest ? {
-      ''      => "$zone:$destination",
-      default => "$zone:$destination:$port_dest",
-    },
-    proto           => 'tcp',
-    destinationport => "$port_orig",
-    ratelimit       => '-',
-    order           => "2$port_orig",
-  }
-
-  shorewall::rule { "ssh-$name-2":
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => $port_dest ? {
-      ''      => "$zone:$destination",
-      default => "$zone:$destination:$port_dest",
-    },
-    proto           => 'tcp',
-    destinationport => "$port_orig",
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => "2$port_orig",
+define firewall::router::ssh(
+  $destination,
+  $port_orig      = '22',
+  $port_dest      = '',
+  $zone           = 'loc',
+  $originaldest   = $ipaddress,
+  $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+) {
+  class { "firewall::implementations::${implementation}::router::ssh":
+    destination  => $destination,
+    port_orig    => $port_orig,
+    port_dest    => $port_dest,
+    zone         => $zone,
+    order        => $order,
+    originaldest => $originaldest,
   }
 }
diff --git a/manifests/router/tor.pp b/manifests/router/tor.pp
index cf5cc58..b93ea05 100644
--- a/manifests/router/tor.pp
+++ b/manifests/router/tor.pp
@@ -1,85 +1,10 @@
-define firewall::router::tor($destination, $zone = 'loc', $originaldest = $ipaddress) {
-  shorewall::rule { "tor-$name-1":
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:9000",
-    proto           => 'tcp',
-    destinationport => "9000",
-    ratelimit       => '-',
-    order           => "29000",
-  }
-
-  shorewall::rule { "tor-$name-2":
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:9000",
-    proto           => 'tcp',
-    destinationport => "9000",
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => "29000",
-  }
-
-  shorewall::rule { "tor-$name-3":
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:9001",
-    proto           => 'tcp',
-    destinationport => "9001",
-    ratelimit       => '-',
-    order           => "29001",
-  }
-
-  shorewall::rule { "tor-$name-4":
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:9001",
-    proto           => 'tcp',
-    destinationport => "9001",
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => "29001",
-  }
-
-  shorewall::rule { "tor-$name-5":
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:9100",
-    proto           => 'tcp',
-    destinationport => "9100",
-    ratelimit       => '-',
-    order           => "29100",
-  }
-
-  shorewall::rule { "tor-$name-6":
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:9100",
-    proto           => 'tcp',
-    destinationport => "9100",
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => "29100",
-  }
-
-  shorewall::rule { "tor-$name-7":
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination:9101",
-    proto           => 'tcp',
-    destinationport => "9101",
-    ratelimit       => '-',
-    order           => "29101",
-  }
-
-  shorewall::rule { "tor-$name-8":
-    action          => 'DNAT',
-    source          => '$FW',
-    destination     => "$zone:$destination:9101",
-    proto           => 'tcp',
-    destinationport => "9101",
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => "29101",
+define firewall::router::tor(
+  $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
+  $destination, $zone = 'loc', $originaldest = $ipaddress
+) {
+  class { "firewall::implementations::${implementation}::router::tor":
+    destination  => $destination,
+    zone         => $zone,
+    originaldest => $originaldest,
   }
 }
diff --git a/manifests/router/torrent.pp b/manifests/router/torrent.pp
index 08f4c7e..b5ac97d 100644
--- a/manifests/router/torrent.pp
+++ b/manifests/router/torrent.pp
@@ -1,48 +1,14 @@
 class firewall::router::torrent(
   $destination,
-  $zone         = 'loc',
-  $originaldest = $ipaddress,
-  $range        = lookup('firewall::torrent::range', undef, undef, '6881:6999')
+  $zone           = 'loc',
+  $originaldest   = $ipaddress,
+  $range          = lookup('firewall::torrent::range', undef, undef, '6881:6999')
+  $implementation = lookup('firewall::implementation', undef, undef, 'shorewall'),
 ) {
-  shorewall::rule { "torrent-tcp-1":
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination",
-    proto           => 'tcp',
-    destinationport => "$range",
-    ratelimit       => '-',
-    order           => 200,
-  }
-
-  shorewall::rule { "torrent-tcp-2":
-    action          => 'DNAT',
-    source          => 'all',
-    destination     => "$zone:$destination",
-    proto           => 'tcp',
-    destinationport => "$range",
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => 200,
-  }
-
-  shorewall::rule { "torrent-udp-1":
-    action          => 'DNAT',
-    source          => 'net',
-    destination     => "$zone:$destination",
-    proto           => 'udp',
-    destinationport => "$range",
-    ratelimit       => '-',
-    order           => 201,
-  }
-
-  shorewall::rule { "torrent-udp-2":
-    action          => 'DNAT',
-    source          => 'all',
-    destination     => "$zone:$destination",
-    proto           => 'udp',
-    destinationport => "6881:6999",
-    originaldest    => "$originaldest",
-    ratelimit       => '-',
-    order           => 201,
+  class { "firewall::implementations::${implementation}::router::torrent":
+    destination  => $destination,
+    zone         => $zone,
+    originaldest => $originaldest,
+    range        => $range,
   }
 }