aboutsummaryrefslogtreecommitdiff
path: root/manifests
diff options
context:
space:
mode:
authorintrigeri <intrigeri@boum.org>2012-11-11 23:12:41 +0100
committerintrigeri <intrigeri@boum.org>2012-11-11 23:12:41 +0100
commite31f901dc4a40b87611871d0cd783bbcec1ba4ed (patch)
tree489f62edc01ded9a88e39cdc9c84d5f7c7351e1c /manifests
parent6c29c55b9cc35a3ba06704e34dd3483a33c85898 (diff)
parent6bc54f031b9ae12fe428c83e70733c8b2ff4c67a (diff)
downloadpuppet-shorewall-e31f901dc4a40b87611871d0cd783bbcec1ba4ed.tar.gz
puppet-shorewall-e31f901dc4a40b87611871d0cd783bbcec1ba4ed.tar.bz2
Merge branch 'feature/torification-exception' into old-master
Diffstat (limited to 'manifests')
-rw-r--r--manifests/init.pp4
-rw-r--r--manifests/rules/torify.pp2
-rw-r--r--manifests/rules/torify/allow_tor_user.pp15
-rw-r--r--manifests/rules/torify/non_torified_user.pp25
-rw-r--r--manifests/rules/torify/non_torified_users.pp9
-rw-r--r--manifests/rules/torify/redirect_tcp_to_tor.pp7
-rw-r--r--manifests/rules/torify/user.pp4
7 files changed, 41 insertions, 25 deletions
diff --git a/manifests/init.pp b/manifests/init.pp
index 3b4b3b2..dd28767 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -33,6 +33,10 @@ class shorewall(
default => $dist_tor_user,
}
}
+ case $non_torified_users {
+ '': { $non_torified_users = [] }
+ }
+ $real_non_torified_users = uniq_flatten([ $tor_user, $non_torified_users ])
# See http://www.shorewall.net/3.0/Documentation.htm#Zones
shorewall::managed_file{ zones: }
diff --git a/manifests/rules/torify.pp b/manifests/rules/torify.pp
index f6e62d8..b393a2a 100644
--- a/manifests/rules/torify.pp
+++ b/manifests/rules/torify.pp
@@ -18,6 +18,8 @@ define shorewall::rules::torify(
$allow_rfc1918 = true
){
+ include shorewall::rules::torify::non_torified_users
+
$originaldest = join($destinations,',')
shorewall::rules::torify::user {
diff --git a/manifests/rules/torify/allow_tor_user.pp b/manifests/rules/torify/allow_tor_user.pp
deleted file mode 100644
index f44c1f0..0000000
--- a/manifests/rules/torify/allow_tor_user.pp
+++ /dev/null
@@ -1,15 +0,0 @@
-class shorewall::rules::torify::allow_tor_user {
-
- $whitelist_rule = "allow-from-tor-user"
- if !defined(Shorewall::Rule["$whitelist_rule"]) {
- shorewall::rule {
- "$whitelist_rule":
- source => '$FW',
- destination => 'all',
- user => $shorewall::tor_user,
- order => 101,
- action => 'ACCEPT';
- }
- }
-
-}
diff --git a/manifests/rules/torify/non_torified_user.pp b/manifests/rules/torify/non_torified_user.pp
new file mode 100644
index 0000000..34e4db7
--- /dev/null
+++ b/manifests/rules/torify/non_torified_user.pp
@@ -0,0 +1,25 @@
+define shorewall::rules::torify::non_torified_user() {
+
+ $user = $name
+
+ $whitelist_rule = "allow-from-user=${user}"
+ shorewall::rule {
+ "$whitelist_rule":
+ source => '$FW',
+ destination => 'all',
+ user => $user,
+ order => 101,
+ action => 'ACCEPT';
+ }
+
+ $nonat_rule = "dont-redirect-to-tor-user=${user}"
+ shorewall::rule {
+ "$nonat_rule":
+ source => '$FW',
+ destination => '-',
+ user => $user,
+ order => 106,
+ action => 'NONAT';
+ }
+
+}
diff --git a/manifests/rules/torify/non_torified_users.pp b/manifests/rules/torify/non_torified_users.pp
new file mode 100644
index 0000000..582dfed
--- /dev/null
+++ b/manifests/rules/torify/non_torified_users.pp
@@ -0,0 +1,9 @@
+class shorewall::rules::torify::non_torified_users {
+
+ $real_non_torified_users = $shorewall::real_non_torified_users
+
+ shorewall::rules::torify::non_torified_user {
+ $real_non_torified_users:
+ }
+
+}
diff --git a/manifests/rules/torify/redirect_tcp_to_tor.pp b/manifests/rules/torify/redirect_tcp_to_tor.pp
index 2bee658..fe1c5fe 100644
--- a/manifests/rules/torify/redirect_tcp_to_tor.pp
+++ b/manifests/rules/torify/redirect_tcp_to_tor.pp
@@ -14,11 +14,6 @@ define shorewall::rules::torify::redirect_tcp_to_tor(
default => $originaldest,
}
- $user_real = $user ? {
- '-' => "!${shorewall::tor_user}",
- default => $user,
- }
-
$destzone = $shorewall::tor_transparent_proxy_host ? {
'127.0.0.1' => '$FW',
default => 'net'
@@ -30,7 +25,7 @@ define shorewall::rules::torify::redirect_tcp_to_tor(
destination => "${destzone}:${shorewall::tor_transparent_proxy_host}:${shorewall::tor_transparent_proxy_port}",
proto => 'tcp:syn',
originaldest => $originaldest_real,
- user => $user_real,
+ user => $user,
order => 110,
action => 'DNAT';
}
diff --git a/manifests/rules/torify/user.pp b/manifests/rules/torify/user.pp
index 5caccfd..49c0b34 100644
--- a/manifests/rules/torify/user.pp
+++ b/manifests/rules/torify/user.pp
@@ -7,10 +7,6 @@ define shorewall::rules::torify::user(
include shorewall::rules::torify::allow_tor_transparent_proxy
- if $originaldest == '-' and $user == '-' {
- include shorewall::rules::torify::allow_tor_user
- }
-
shorewall::rules::torify::redirect_tcp_to_tor {
"redirect-to-tor-user=${user}-to=${originaldest}":
user => $user,