diff options
| author | Jerome Charaoui <jcharaoui@cmaisonneuve.qc.ca> | 2015-03-02 15:37:31 +0000 |
|---|---|---|
| committer | Jerome Charaoui <jcharaoui@cmaisonneuve.qc.ca> | 2015-03-02 15:37:31 +0000 |
| commit | 4e86d81936a54fdaa3cdbec71efd25297f9ede4e (patch) | |
| tree | 67c111f9ce533105b84c86003947f1b46d2eb41a | |
| parent | 06c5058752f7c1856380766784f48e077c3194ed (diff) | |
| parent | d97171b8e04812c617d126a82f913b987ad292fd (diff) | |
| download | puppet-shorewall-4e86d81936a54fdaa3cdbec71efd25297f9ede4e.tar.gz puppet-shorewall-4e86d81936a54fdaa3cdbec71efd25297f9ede4e.tar.bz2 | |
Merge branch 'feature/Add_support_for_mangle_table' into 'master'
Add support for mangle table.
When using the kernel from Debian Wheezy-backports (3.16.0-0.bpo.4-amd64), we encoutered a bug where shorewall was breaking the libvirt DHCP if restarted after it.
It seems that one has to add a rule in the POSTROUTING chain of the mangle table to --checksum-fill the DHCP packets for them to be properly catch by the VMs DHCP clients.
So we had to add support of the mangle table to the shared puppet module to fix that.
This patch does just that, and is meant to be used by the other branch I'll propose after.
See merge request !1
| -rw-r--r-- | files/boilerplate/mangle.footer | 1 | ||||
| -rw-r--r-- | files/boilerplate/mangle.header | 7 | ||||
| -rw-r--r-- | manifests/init.pp | 2 | ||||
| -rw-r--r-- | manifests/mangle.pp | 19 |
4 files changed, 29 insertions, 0 deletions
diff --git a/files/boilerplate/mangle.footer b/files/boilerplate/mangle.footer new file mode 100644 index 0000000..6bebc05 --- /dev/null +++ b/files/boilerplate/mangle.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE diff --git a/files/boilerplate/mangle.header b/files/boilerplate/mangle.header new file mode 100644 index 0000000..7a7b12a --- /dev/null +++ b/files/boilerplate/mangle.header @@ -0,0 +1,7 @@ +# +# Shorewall - Mangle File +# +# For additional information, see http://shorewall.net/manpages/shorewall-mangle.html +# +####################################################################################### +#ACTION SOURCE DESTINATION PROTO DSTPORT SRCPORT USER TEST LENGTH TOS CONNBYTES HELPER HEADERS diff --git a/manifests/init.pp b/manifests/init.pp index cd6488b..a567564 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -68,6 +68,8 @@ class shorewall( 'tunnel', # See http://www.shorewall.net/MultiISP.html 'rtrules', + # See http://www.shorewall.net/manpages/shorewall-mangle.html + 'mangle', ]:; } } diff --git a/manifests/mangle.pp b/manifests/mangle.pp new file mode 100644 index 0000000..e3fd1b3 --- /dev/null +++ b/manifests/mangle.pp @@ -0,0 +1,19 @@ +define shorewall::mangle( + $source, + $destination, + $proto = '-', + $destinationport = '-', + $sourceport = '-', + $user = '-', + $test = '-', + $length = '-', + $tos = '-', + $connbytes = '-', + $helper = '-', + $headers = '-', + $order = '100' +){ + shorewall::entry{"mangle-${order}-${name}": + line => "${name} ${source} ${destination} ${proto} ${destinationport} ${sourceport} ${user} ${test} ${length} ${tos} ${connbytes} ${helper} ${headers}" + } +} |