Support exempting some users from torification measures.

8 files changed, 45 insertions, 26 deletions

diff --git a/README b/README
index 648eaf7..c20227e 100644
--- a/README
+++ b/README
@@ -88,8 +88,11 @@ When no destination is provided traffic directed to RFC1918 addresses
 is by default allowed and (obviously) not torified. This behaviour can
 be changed by setting the allow_rfc1918 parameter to false.
 
-Torify any outgoing TCP traffic but connections to RFC1918 addresses:
+Torify any outgoing TCP traffic but
+  - connections to RFC1918 addresses
+  - connections from users bob and alice:
 
+  $non_torified_users = [ 'bob', 'alice' ]
   shorewall::rules::torify {
     'torify-everything-but-lan':
   }
diff --git a/manifests/init.pp b/manifests/init.pp
index f69a6f2..e5456d0 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -34,6 +34,10 @@ class shorewall {
       default => $dist_tor_user,
     }
   }
+  case $non_torified_users {
+    '': { $non_torified_users = [] }
+  }
+  $real_non_torified_users = uniq_flatten([ $tor_user, $non_torified_users ])
 
   file {"/var/lib/puppet/modules/shorewall":
     ensure => directory,
diff --git a/manifests/rules/torify.pp b/manifests/rules/torify.pp
index f6e62d8..b393a2a 100644
--- a/manifests/rules/torify.pp
+++ b/manifests/rules/torify.pp
@@ -18,6 +18,8 @@ define shorewall::rules::torify(
   $allow_rfc1918 = true
 ){
 
+  include shorewall::rules::torify::non_torified_users
+
   $originaldest = join($destinations,',')
 
   shorewall::rules::torify::user {
diff --git a/manifests/rules/torify/allow_tor_user.pp b/manifests/rules/torify/allow_tor_user.pp
deleted file mode 100644
index f44c1f0..0000000
--- a/manifests/rules/torify/allow_tor_user.pp
+++ /dev/null
@@ -1,15 +0,0 @@
-class shorewall::rules::torify::allow_tor_user {
-
-  $whitelist_rule = "allow-from-tor-user"
-  if !defined(Shorewall::Rule["$whitelist_rule"]) {
-    shorewall::rule {
-      "$whitelist_rule":
-        source      => '$FW',
-        destination => 'all',
-        user        => $shorewall::tor_user,
-        order       => 101,
-        action      => 'ACCEPT';
-    }
-  }
-
-}
diff --git a/manifests/rules/torify/non_torified_user.pp b/manifests/rules/torify/non_torified_user.pp
new file mode 100644
index 0000000..34e4db7
--- /dev/null
+++ b/manifests/rules/torify/non_torified_user.pp
@@ -0,0 +1,25 @@
+define shorewall::rules::torify::non_torified_user() {
+
+  $user = $name
+
+  $whitelist_rule = "allow-from-user=${user}"
+  shorewall::rule {
+    "$whitelist_rule":
+      source      => '$FW',
+      destination => 'all',
+      user        => $user,
+      order       => 101,
+      action      => 'ACCEPT';
+  }
+
+  $nonat_rule = "dont-redirect-to-tor-user=${user}"
+  shorewall::rule {
+    "$nonat_rule":
+      source       => '$FW',
+      destination  => '-',
+      user         => $user,
+      order        => 106,
+      action       => 'NONAT';
+  }
+
+}
diff --git a/manifests/rules/torify/non_torified_users.pp b/manifests/rules/torify/non_torified_users.pp
new file mode 100644
index 0000000..582dfed
--- /dev/null
+++ b/manifests/rules/torify/non_torified_users.pp
@@ -0,0 +1,9 @@
+class shorewall::rules::torify::non_torified_users {
+
+  $real_non_torified_users = $shorewall::real_non_torified_users
+
+  shorewall::rules::torify::non_torified_user {
+    $real_non_torified_users:
+  }
+
+}
diff --git a/manifests/rules/torify/redirect_tcp_to_tor.pp b/manifests/rules/torify/redirect_tcp_to_tor.pp
index 2bee658..fe1c5fe 100644
--- a/manifests/rules/torify/redirect_tcp_to_tor.pp
+++ b/manifests/rules/torify/redirect_tcp_to_tor.pp
@@ -14,11 +14,6 @@ define shorewall::rules::torify::redirect_tcp_to_tor(
       default => $originaldest,
     }
 
-    $user_real = $user ? {
-      '-'     => "!${shorewall::tor_user}",
-      default => $user,
-    }
-
     $destzone = $shorewall::tor_transparent_proxy_host ? {
       '127.0.0.1' => '$FW',
       default     => 'net'
@@ -30,7 +25,7 @@ define shorewall::rules::torify::redirect_tcp_to_tor(
         destination  => "${destzone}:${shorewall::tor_transparent_proxy_host}:${shorewall::tor_transparent_proxy_port}",
         proto        => 'tcp:syn',
         originaldest => $originaldest_real,
-        user         => $user_real,
+        user         => $user,
         order        => 110,
         action       => 'DNAT';
     }
diff --git a/manifests/rules/torify/user.pp b/manifests/rules/torify/user.pp
index 5caccfd..49c0b34 100644
--- a/manifests/rules/torify/user.pp
+++ b/manifests/rules/torify/user.pp
@@ -7,10 +7,6 @@ define shorewall::rules::torify::user(
 
   include shorewall::rules::torify::allow_tor_transparent_proxy
 
-  if $originaldest == '-' and $user == '-' {
-    include shorewall::rules::torify::allow_tor_user
-  }
-
   shorewall::rules::torify::redirect_tcp_to_tor {
     "redirect-to-tor-user=${user}-to=${originaldest}":
       user         => $user,