diff options
author | intrigeri <intrigeri@boum.org> | 2012-11-11 23:12:41 +0100 |
---|---|---|
committer | intrigeri <intrigeri@boum.org> | 2012-11-11 23:12:41 +0100 |
commit | e31f901dc4a40b87611871d0cd783bbcec1ba4ed (patch) | |
tree | 489f62edc01ded9a88e39cdc9c84d5f7c7351e1c /manifests/rules | |
parent | 6c29c55b9cc35a3ba06704e34dd3483a33c85898 (diff) | |
parent | 6bc54f031b9ae12fe428c83e70733c8b2ff4c67a (diff) | |
download | puppet-shorewall-e31f901dc4a40b87611871d0cd783bbcec1ba4ed.tar.gz puppet-shorewall-e31f901dc4a40b87611871d0cd783bbcec1ba4ed.tar.bz2 |
Merge branch 'feature/torification-exception' into old-master
Diffstat (limited to 'manifests/rules')
-rw-r--r-- | manifests/rules/torify.pp | 2 | ||||
-rw-r--r-- | manifests/rules/torify/allow_tor_user.pp | 15 | ||||
-rw-r--r-- | manifests/rules/torify/non_torified_user.pp | 25 | ||||
-rw-r--r-- | manifests/rules/torify/non_torified_users.pp | 9 | ||||
-rw-r--r-- | manifests/rules/torify/redirect_tcp_to_tor.pp | 7 | ||||
-rw-r--r-- | manifests/rules/torify/user.pp | 4 |
6 files changed, 37 insertions, 25 deletions
diff --git a/manifests/rules/torify.pp b/manifests/rules/torify.pp index f6e62d8..b393a2a 100644 --- a/manifests/rules/torify.pp +++ b/manifests/rules/torify.pp @@ -18,6 +18,8 @@ define shorewall::rules::torify( $allow_rfc1918 = true ){ + include shorewall::rules::torify::non_torified_users + $originaldest = join($destinations,',') shorewall::rules::torify::user { diff --git a/manifests/rules/torify/allow_tor_user.pp b/manifests/rules/torify/allow_tor_user.pp deleted file mode 100644 index f44c1f0..0000000 --- a/manifests/rules/torify/allow_tor_user.pp +++ /dev/null @@ -1,15 +0,0 @@ -class shorewall::rules::torify::allow_tor_user { - - $whitelist_rule = "allow-from-tor-user" - if !defined(Shorewall::Rule["$whitelist_rule"]) { - shorewall::rule { - "$whitelist_rule": - source => '$FW', - destination => 'all', - user => $shorewall::tor_user, - order => 101, - action => 'ACCEPT'; - } - } - -} diff --git a/manifests/rules/torify/non_torified_user.pp b/manifests/rules/torify/non_torified_user.pp new file mode 100644 index 0000000..34e4db7 --- /dev/null +++ b/manifests/rules/torify/non_torified_user.pp @@ -0,0 +1,25 @@ +define shorewall::rules::torify::non_torified_user() { + + $user = $name + + $whitelist_rule = "allow-from-user=${user}" + shorewall::rule { + "$whitelist_rule": + source => '$FW', + destination => 'all', + user => $user, + order => 101, + action => 'ACCEPT'; + } + + $nonat_rule = "dont-redirect-to-tor-user=${user}" + shorewall::rule { + "$nonat_rule": + source => '$FW', + destination => '-', + user => $user, + order => 106, + action => 'NONAT'; + } + +} diff --git a/manifests/rules/torify/non_torified_users.pp b/manifests/rules/torify/non_torified_users.pp new file mode 100644 index 0000000..582dfed --- /dev/null +++ b/manifests/rules/torify/non_torified_users.pp @@ -0,0 +1,9 @@ +class shorewall::rules::torify::non_torified_users { + + $real_non_torified_users = $shorewall::real_non_torified_users + + shorewall::rules::torify::non_torified_user { + $real_non_torified_users: + } + +} diff --git a/manifests/rules/torify/redirect_tcp_to_tor.pp b/manifests/rules/torify/redirect_tcp_to_tor.pp index 2bee658..fe1c5fe 100644 --- a/manifests/rules/torify/redirect_tcp_to_tor.pp +++ b/manifests/rules/torify/redirect_tcp_to_tor.pp @@ -14,11 +14,6 @@ define shorewall::rules::torify::redirect_tcp_to_tor( default => $originaldest, } - $user_real = $user ? { - '-' => "!${shorewall::tor_user}", - default => $user, - } - $destzone = $shorewall::tor_transparent_proxy_host ? { '127.0.0.1' => '$FW', default => 'net' @@ -30,7 +25,7 @@ define shorewall::rules::torify::redirect_tcp_to_tor( destination => "${destzone}:${shorewall::tor_transparent_proxy_host}:${shorewall::tor_transparent_proxy_port}", proto => 'tcp:syn', originaldest => $originaldest_real, - user => $user_real, + user => $user, order => 110, action => 'DNAT'; } diff --git a/manifests/rules/torify/user.pp b/manifests/rules/torify/user.pp index 5caccfd..49c0b34 100644 --- a/manifests/rules/torify/user.pp +++ b/manifests/rules/torify/user.pp @@ -7,10 +7,6 @@ define shorewall::rules::torify::user( include shorewall::rules::torify::allow_tor_transparent_proxy - if $originaldest == '-' and $user == '-' { - include shorewall::rules::torify::allow_tor_user - } - shorewall::rules::torify::redirect_tcp_to_tor { "redirect-to-tor-user=${user}-to=${originaldest}": user => $user, |