From 6394b517154c6b6cab4f73c9d0baff4c1f7bcf55 Mon Sep 17 00:00:00 2001 From: mh Date: Thu, 28 Feb 2013 19:28:28 +0100 Subject: with the latest updates on EL6 this is needed --- manifests/centos.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifests/centos.pp b/manifests/centos.pp index f671bc9..b7fc24a 100644 --- a/manifests/centos.pp +++ b/manifests/centos.pp @@ -1,6 +1,6 @@ # things needed on centos class shorewall::centos inherits shorewall::base { - if $::lsbmajdistrelease > 5 { + if $::operatingsystemmajrelease == '6' { augeas{'enable_shorewall': context => '/files/etc/sysconfig/shorewall', changes => 'set startup 1', -- cgit v1.2.3 From 315060cd357d6dffbb32e44ca1eb02ce3711608a Mon Sep 17 00:00:00 2001 From: mh Date: Thu, 28 Feb 2013 19:45:41 +0100 Subject: use the centos class on centos based systems --- manifests/centos.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifests/centos.pp b/manifests/centos.pp index b7fc24a..95b7759 100644 --- a/manifests/centos.pp +++ b/manifests/centos.pp @@ -1,6 +1,6 @@ # things needed on centos class shorewall::centos inherits shorewall::base { - if $::operatingsystemmajrelease == '6' { + if versioncmp($::operatingsystemmajrelease,'5') > 0 { augeas{'enable_shorewall': context => '/files/etc/sysconfig/shorewall', changes => 'set startup 1', -- cgit v1.2.3 From a4f0b91e9418af052cf269aef02b0b4db719ae02 Mon Sep 17 00:00:00 2001 From: mh Date: Thu, 28 Feb 2013 20:38:07 +0100 Subject: only manage the config_path if we do not manage the config file --- manifests/base.pp | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/manifests/base.pp b/manifests/base.pp index 7959f01..bde572a 100644 --- a/manifests/base.pp +++ b/manifests/base.pp @@ -27,15 +27,15 @@ class shorewall::base { } } else { - Class['augeas'] -> Class['shorewall::base'] + Class['augeas'] -> Class['shorewall::base'] - augeas { 'shorewall_module_config_path': - changes => 'set /files/etc/shorewall/shorewall.conf/CONFIG_PATH \'"/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall"\'', - lens => 'Shellvars.lns', - incl => '/etc/shorewall/shorewall.conf', - notify => Service['shorewall'], - require => Package['shorewall']; - } + augeas { 'shorewall_module_config_path': + changes => 'set /files/etc/shorewall/shorewall.conf/CONFIG_PATH \'"/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall"\'', + lens => 'Shellvars.lns', + incl => '/etc/shorewall/shorewall.conf', + notify => Service['shorewall'], + require => Package['shorewall']; + } } service{'shorewall': -- cgit v1.2.3 From b7d335f210277fa080cfece12d379d33d6714eec Mon Sep 17 00:00:00 2001 From: mh Date: Sat, 10 Aug 2013 15:15:17 +0200 Subject: migrate ipsec rules to a define so we can specify multiple zones --- manifests/rules/ipsec.pp | 62 ++++++++++++++++++++++++------------------------ 1 file changed, 31 insertions(+), 31 deletions(-) diff --git a/manifests/rules/ipsec.pp b/manifests/rules/ipsec.pp index 82adff0..54284b9 100644 --- a/manifests/rules/ipsec.pp +++ b/manifests/rules/ipsec.pp @@ -1,32 +1,32 @@ -class shorewall::rules::ipsec( - $source = 'net' -) { - shorewall::rule { - 'net-me-ipsec-udp': - source => $shorewall::rules::ipsec::source, - destination => '$FW', - proto => 'udp', - destinationport => '500', - order => 240, - action => 'ACCEPT'; - 'me-net-ipsec-udp': - source => '$FW', - destination => $shorewall::rules::ipsec::source, - proto => 'udp', - destinationport => '500', - order => 240, - action => 'ACCEPT'; - 'net-me-ipsec': - source => $shorewall::rules::ipsec::source, - destination => '$FW', - proto => 'esp', - order => 240, - action => 'ACCEPT'; - 'me-net-ipsec': - source => '$FW', - destination => $shorewall::rules::ipsec::source, - proto => 'esp', - order => 240, - action => 'ACCEPT'; - } +# manage ipsec rules for zone specified in +# $name +define shorewall::rules::ipsec() { + shorewall::rule { + "${name}-me-ipsec-udp": + source => $name, + destination => '$FW', + proto => 'udp', + destinationport => '500', + order => 240, + action => 'ACCEPT'; + "me-${name}-ipsec-udp": + source => '$FW', + destination => $name + proto => 'udp', + destinationport => '500', + order => 240, + action => 'ACCEPT'; + "${name}-me-ipsec": + source => $name + destination => '$FW', + proto => 'esp', + order => 240, + action => 'ACCEPT'; + "me-${name}-ipsec": + source => '$FW', + destination => $name, + proto => 'esp', + order => 240, + action => 'ACCEPT'; + } } -- cgit v1.2.3 From 71daf23d40cdbe3e0aa8aa2229e86a3204d4230a Mon Sep 17 00:00:00 2001 From: mh Date: Sat, 10 Aug 2013 15:19:36 +0200 Subject: fix define --- manifests/rules/ipsec.pp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/manifests/rules/ipsec.pp b/manifests/rules/ipsec.pp index 54284b9..413406e 100644 --- a/manifests/rules/ipsec.pp +++ b/manifests/rules/ipsec.pp @@ -11,13 +11,13 @@ define shorewall::rules::ipsec() { action => 'ACCEPT'; "me-${name}-ipsec-udp": source => '$FW', - destination => $name + destination => $name, proto => 'udp', destinationport => '500', order => 240, action => 'ACCEPT'; "${name}-me-ipsec": - source => $name + source => $name, destination => '$FW', proto => 'esp', order => 240, -- cgit v1.2.3 From 3df8cae233b50bd836eeb347c13efe22f771573c Mon Sep 17 00:00:00 2001 From: Sylvain Veyrié Date: Tue, 20 Aug 2013 15:36:49 +0200 Subject: The augeas module is not needed, but the concat module is --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index cd6fe4f..d078b8e 100644 --- a/README.md +++ b/README.md @@ -5,8 +5,8 @@ This module manages the configuration of Shorewall (http://www.shorewall.net/) Requirements ------------ -This module requires the augeas module, you can find that here: -https://labs.riseup.net/code/projects/shared-augeas +This module requires the concat module, you can find that here: +https://github.com/puppetlabs/puppetlabs-concat.git Copyright --------- -- cgit v1.2.3 From 1d1a46aa9e16de851c88e76b033e1a1aa00e8c2c Mon Sep 17 00:00:00 2001 From: mh Date: Sun, 25 Aug 2013 18:44:45 +0200 Subject: make it easier to override behaviour of the dns rules --- manifests/rules/dns.pp | 20 ++++---------------- manifests/rules/dns/disable.pp | 7 ++++--- manifests/rules/dns_rules.pp | 22 ++++++++++++++++++++++ 3 files changed, 30 insertions(+), 19 deletions(-) create mode 100644 manifests/rules/dns_rules.pp diff --git a/manifests/rules/dns.pp b/manifests/rules/dns.pp index 99311ca..e775eee 100644 --- a/manifests/rules/dns.pp +++ b/manifests/rules/dns.pp @@ -1,18 +1,6 @@ +# open dns port class shorewall::rules::dns { - shorewall::rule { - 'net-me-tcp_dns': - source => 'net', - destination => '$FW', - proto => 'tcp', - destinationport => '53', - order => 240, - action => 'ACCEPT'; - 'net-me-udp_dns': - source => 'net', - destination => '$FW', - proto => 'udp', - destinationport => '53', - order => 240, - action => 'ACCEPT'; - } + shorewall::rules::dns_rules{ + 'net': + } } diff --git a/manifests/rules/dns/disable.pp b/manifests/rules/dns/disable.pp index 36541da..7de923b 100644 --- a/manifests/rules/dns/disable.pp +++ b/manifests/rules/dns/disable.pp @@ -1,5 +1,6 @@ +# disable dns acccess class shorewall::rules::dns::disable inherits shorewall::rules::dns { - Shorewall::Rule['net-me-tcp_dns', 'net-me-udp_dns']{ - action => 'DROP', - } + Shorewall::Rules::Dns_rules['net']{ + action => 'DROP', + } } diff --git a/manifests/rules/dns_rules.pp b/manifests/rules/dns_rules.pp new file mode 100644 index 0000000..abe0eb5 --- /dev/null +++ b/manifests/rules/dns_rules.pp @@ -0,0 +1,22 @@ +# open dns port +define shorewall::rules::dns_rules( + $source = $name, + $action = 'ACCEPT', +) { + shorewall::rule { + "${source}-me-tcp_dns": + source => $source, + destination => '$FW', + proto => 'tcp', + destinationport => '53', + order => 240, + action => $action; + "${source}-me-udp_dns": + source => $source, + destination => '$FW', + proto => 'udp', + destinationport => '53', + order => 240, + action => $action; + } +} -- cgit v1.2.3 From b962d72a0b3004805c333e2417018bde487ed956 Mon Sep 17 00:00:00 2001 From: mh Date: Sun, 22 Sep 2013 18:12:09 +0200 Subject: add rules for pyzor --- manifests/rules/out/pyzor.pp | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 manifests/rules/out/pyzor.pp diff --git a/manifests/rules/out/pyzor.pp b/manifests/rules/out/pyzor.pp new file mode 100644 index 0000000..f4f5151 --- /dev/null +++ b/manifests/rules/out/pyzor.pp @@ -0,0 +1,12 @@ +# pyzor calls out on 24441 +# https://wiki.apache.org/spamassassin/NetTestFirewallIssues +class shorewall::rules::out::pyzor { + shorewall::rule { 'me-net-udp_pyzor': + source => '$FW', + destination => 'net', + proto => 'udp', + destinationport => '24441', + order => 240, + action => 'ACCEPT'; + } +} -- cgit v1.2.3 From 589f32d74a791138277583ed57c05e581a073c58 Mon Sep 17 00:00:00 2001 From: mh Date: Sat, 28 Sep 2013 15:16:21 +0200 Subject: manage new and legacy ports of managesieve --- manifests/rules/managesieve.pp | 30 ++++++++++++++++++++++-------- manifests/rules/out/managesieve.pp | 30 ++++++++++++++++++++++-------- 2 files changed, 44 insertions(+), 16 deletions(-) diff --git a/manifests/rules/managesieve.pp b/manifests/rules/managesieve.pp index 63fafcb..ce1c321 100644 --- a/manifests/rules/managesieve.pp +++ b/manifests/rules/managesieve.pp @@ -1,11 +1,25 @@ -class shorewall::rules::managesieve { +# manage managesieve ports +class shorewall::rules::managesieve( + $legacy_port = false, +) { + shorewall::rule { + 'net-me-tcp_managesieve': + source => 'net', + destination => '$FW', + proto => 'tcp', + destinationport => '4190', + order => 260, + action => 'ACCEPT'; + } + if $legacy_port { shorewall::rule { - 'net-me-tcp_managesieve': - source => 'net', - destination => '$FW', - proto => 'tcp', - destinationport => '2000', - order => 260, - action => 'ACCEPT'; + 'net-me-tcp_managesieve_legacy': + source => 'net', + destination => '$FW', + proto => 'tcp', + destinationport => '2000', + order => 260, + action => 'ACCEPT'; } + } } diff --git a/manifests/rules/out/managesieve.pp b/manifests/rules/out/managesieve.pp index b0e1c3d..c4147d4 100644 --- a/manifests/rules/out/managesieve.pp +++ b/manifests/rules/out/managesieve.pp @@ -1,11 +1,25 @@ -class shorewall::rules::out::managesieve { +# manage outgoing traffic to managesieve +class shorewall::rules::out::managesieve( + $legacy_port = false +) { + shorewall::rule { + 'me-net-tcp_managesieve': + source => '$FW', + destination => 'net', + proto => 'tcp', + destinationport => '4190', + order => 260, + action => 'ACCEPT'; + } + if $legacy_port { shorewall::rule { - 'me-net-tcp_managesieve': - source => '$FW', - destination => 'net', - proto => 'tcp', - destinationport => '2000', - order => 260, - action => 'ACCEPT'; + 'me-net-tcp_managesieve_legacy': + source => '$FW', + destination => 'net', + proto => 'tcp', + destinationport => '2000', + order => 260, + action => 'ACCEPT'; } + } } -- cgit v1.2.3 From bf36b2b0553bfd0dafccffaa5a30c9fdaf08c1ae Mon Sep 17 00:00:00 2001 From: o Date: Thu, 19 Dec 2013 19:51:45 +0100 Subject: add rule for openvpn --- manifests/rules/openvpn.pp | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 manifests/rules/openvpn.pp diff --git a/manifests/rules/openvpn.pp b/manifests/rules/openvpn.pp new file mode 100644 index 0000000..55a20d2 --- /dev/null +++ b/manifests/rules/openvpn.pp @@ -0,0 +1,18 @@ +class shorewall::rules::openvpn { + shorewall::rule { 'net-me-openvpn-udp': + source => 'net', + destination => '$FW', + proto => 'udp', + destinationport => '1194', + order => 240, + action => 'ACCEPT'; + } + shorewall::rule { 'me-net-openvpn-udp': + source => '$FW', + destination => 'net', + proto => 'udp', + destinationport => '1194', + order => 240, + action => 'ACCEPT'; + } +} -- cgit v1.2.3 From cc4d815e207a7e67b97613b893f53ac1c6bf3020 Mon Sep 17 00:00:00 2001 From: o Date: Wed, 11 Jun 2014 22:15:39 +0200 Subject: add rule for stun --- manifests/rules/jabberserver.pp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/manifests/rules/jabberserver.pp b/manifests/rules/jabberserver.pp index 3b38b29..dd51ca4 100644 --- a/manifests/rules/jabberserver.pp +++ b/manifests/rules/jabberserver.pp @@ -7,6 +7,13 @@ class shorewall::rules::jabberserver { destinationport => '5222,5223,5269', order => 240, action => 'ACCEPT'; + 'net-me-udp_jabber': + source => 'net', + destination => '$FW', + proto => 'udp', + destinationport => '3478', + order => 240, + action => 'ACCEPT'; 'me-net-tcp_jabber_s2s': source => '$FW', destination => 'net', -- cgit v1.2.3 From 5f5d84d3c52fa8f5c0292d2235cc5a3c5aedfe74 Mon Sep 17 00:00:00 2001 From: mh Date: Fri, 13 Jun 2014 09:37:54 +0200 Subject: a cleaner naming --- manifests/rules/jabberserver.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifests/rules/jabberserver.pp b/manifests/rules/jabberserver.pp index dd51ca4..0495f61 100644 --- a/manifests/rules/jabberserver.pp +++ b/manifests/rules/jabberserver.pp @@ -7,7 +7,7 @@ class shorewall::rules::jabberserver { destinationport => '5222,5223,5269', order => 240, action => 'ACCEPT'; - 'net-me-udp_jabber': + 'net-me-udp_jabber_stun_server': source => 'net', destination => '$FW', proto => 'udp', -- cgit v1.2.3 From 6c8ff8ead1c8f1c2d37956886738e3d4f7fabd93 Mon Sep 17 00:00:00 2001 From: mh Date: Fri, 13 Jun 2014 09:38:36 +0200 Subject: linting --- manifests/rules/jabberserver.pp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/manifests/rules/jabberserver.pp b/manifests/rules/jabberserver.pp index 0495f61..14666a0 100644 --- a/manifests/rules/jabberserver.pp +++ b/manifests/rules/jabberserver.pp @@ -1,3 +1,5 @@ +# open ports used by a jabberserver +# in and outbound. class shorewall::rules::jabberserver { shorewall::rule { 'net-me-tcp_jabber': -- cgit v1.2.3 From d3784c34e285c7bb8c16ef0f957ec4bc4b908207 Mon Sep 17 00:00:00 2001 From: mh Date: Fri, 13 Jun 2014 09:39:38 +0200 Subject: there might be people who don't have a stun server --- manifests/rules/jabberserver.pp | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/manifests/rules/jabberserver.pp b/manifests/rules/jabberserver.pp index 14666a0..0b10420 100644 --- a/manifests/rules/jabberserver.pp +++ b/manifests/rules/jabberserver.pp @@ -1,6 +1,8 @@ # open ports used by a jabberserver # in and outbound. -class shorewall::rules::jabberserver { +class shorewall::rules::jabberserver( + $open_stun = true, +) { shorewall::rule { 'net-me-tcp_jabber': source => 'net', @@ -9,13 +11,6 @@ class shorewall::rules::jabberserver { destinationport => '5222,5223,5269', order => 240, action => 'ACCEPT'; - 'net-me-udp_jabber_stun_server': - source => 'net', - destination => '$FW', - proto => 'udp', - destinationport => '3478', - order => 240, - action => 'ACCEPT'; 'me-net-tcp_jabber_s2s': source => '$FW', destination => 'net', @@ -25,4 +20,15 @@ class shorewall::rules::jabberserver { action => 'ACCEPT'; } + if $open_stun { + shorewall::rule { + 'net-me-udp_jabber_stun_server': + source => 'net', + destination => '$FW', + proto => 'udp', + destinationport => '3478', + order => 240, + action => 'ACCEPT'; + } + } } -- cgit v1.2.3 From d153d86fb344c3a780b0efcc180cd3f7c0a75076 Mon Sep 17 00:00:00 2001 From: mh Date: Fri, 13 Jun 2014 09:40:09 +0200 Subject: indentation --- manifests/rules/jabberserver.pp | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/manifests/rules/jabberserver.pp b/manifests/rules/jabberserver.pp index 0b10420..226d627 100644 --- a/manifests/rules/jabberserver.pp +++ b/manifests/rules/jabberserver.pp @@ -5,30 +5,30 @@ class shorewall::rules::jabberserver( ) { shorewall::rule { 'net-me-tcp_jabber': - source => 'net', - destination => '$FW', - proto => 'tcp', - destinationport => '5222,5223,5269', - order => 240, - action => 'ACCEPT'; + source => 'net', + destination => '$FW', + proto => 'tcp', + destinationport => '5222,5223,5269', + order => 240, + action => 'ACCEPT'; 'me-net-tcp_jabber_s2s': - source => '$FW', - destination => 'net', - proto => 'tcp', - destinationport => '5260,5269,5270,5271,5272', - order => 240, - action => 'ACCEPT'; + source => '$FW', + destination => 'net', + proto => 'tcp', + destinationport => '5260,5269,5270,5271,5272', + order => 240, + action => 'ACCEPT'; } if $open_stun { shorewall::rule { 'net-me-udp_jabber_stun_server': - source => 'net', - destination => '$FW', - proto => 'udp', - destinationport => '3478', - order => 240, - action => 'ACCEPT'; + source => 'net', + destination => '$FW', + proto => 'udp', + destinationport => '3478', + order => 240, + action => 'ACCEPT'; } } } -- cgit v1.2.3 From fb07ae738445e524d7f15747f36f8092236f2f48 Mon Sep 17 00:00:00 2001 From: mh Date: Wed, 9 Jul 2014 23:25:46 +0200 Subject: get rid off lsb facts --- manifests/init.pp | 11 +---------- manifests/ubuntu/karmic.pp | 5 ----- 2 files changed, 1 insertion(+), 15 deletions(-) delete mode 100644 manifests/ubuntu/karmic.pp diff --git a/manifests/init.pp b/manifests/init.pp index a567564..9f7edd2 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -13,17 +13,8 @@ class shorewall( case $::operatingsystem { gentoo: { include shorewall::gentoo } - debian: { - include shorewall::debian - $dist_tor_user = 'debian-tor' - } + debian,ubuntu: { centos: { include shorewall::centos } - ubuntu: { - case $::lsbdistcodename { - karmic: { include shorewall::ubuntu::karmic } - default: { include shorewall::debian } - } - } default: { notice "unknown operatingsystem: ${::operatingsystem}" include shorewall::base diff --git a/manifests/ubuntu/karmic.pp b/manifests/ubuntu/karmic.pp deleted file mode 100644 index 0df3789..0000000 --- a/manifests/ubuntu/karmic.pp +++ /dev/null @@ -1,5 +0,0 @@ -class shorewall::ubuntu::karmic inherits shorewall::debian { - Package['shorewall']{ - name => 'shorewall-shell', - } -} -- cgit v1.2.3 From eaa7ecbe280952fc7ad58bc5e17d18f2df33d4ad Mon Sep 17 00:00:00 2001 From: mh Date: Fri, 11 Jul 2014 16:36:58 +0200 Subject: fix the missing include --- manifests/init.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifests/init.pp b/manifests/init.pp index 9f7edd2..f413684 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -13,7 +13,7 @@ class shorewall( case $::operatingsystem { gentoo: { include shorewall::gentoo } - debian,ubuntu: { + debian,ubuntu: { include shorewall::debian } centos: { include shorewall::centos } default: { notice "unknown operatingsystem: ${::operatingsystem}" -- cgit v1.2.3 From 00f318e85c274b4bcd8f5265274be1b097c12349 Mon Sep 17 00:00:00 2001 From: Sylvain Veyrié Date: Tue, 16 Sep 2014 15:28:50 +0200 Subject: Non string mode is now deprecated --- manifests/debian.pp | 2 +- manifests/managed_file.pp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/manifests/debian.pp b/manifests/debian.pp index c7ed607..2ff88c8 100644 --- a/manifests/debian.pp +++ b/manifests/debian.pp @@ -3,7 +3,7 @@ class shorewall::debian inherits shorewall::base { content => template("shorewall/debian_default.erb"), require => Package['shorewall'], notify => Service['shorewall'], - owner => root, group => 0, mode => 0644; + owner => root, group => 0, mode => '0644'; } Service['shorewall']{ status => '/sbin/shorewall status' diff --git a/manifests/managed_file.pp b/manifests/managed_file.pp index d564daa..9c5758d 100644 --- a/manifests/managed_file.pp +++ b/manifests/managed_file.pp @@ -2,7 +2,7 @@ define shorewall::managed_file () { concat{ "/etc/shorewall/puppet/${name}": notify => Service['shorewall'], require => File['/etc/shorewall/puppet'], - owner => root, group => 0, mode => 0600; + owner => root, group => 0, mode => '0600'; } concat::fragment { "${name}-header": -- cgit v1.2.3 From e5f4b5ace6dca7fae6c27eab269dec97a77c806c Mon Sep 17 00:00:00 2001 From: Sylvain Veyrié Date: Tue, 16 Sep 2014 15:40:38 +0200 Subject: Deprecated --- manifests/base.pp | 8 ++++---- manifests/debian.pp | 2 +- manifests/managed_file.pp | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/manifests/base.pp b/manifests/base.pp index bde572a..b5899fc 100644 --- a/manifests/base.pp +++ b/manifests/base.pp @@ -10,14 +10,14 @@ class shorewall::base { '/etc/shorewall/shorewall.conf': require => Package[shorewall], notify => Service[shorewall], - owner => root, - group => 0, + owner => 'root', + group => 'root', mode => '0644'; '/etc/shorewall/puppet': ensure => directory, require => Package[shorewall], - owner => root, - group => 0, + owner => 'root', + group => 'root', mode => '0644'; } diff --git a/manifests/debian.pp b/manifests/debian.pp index 2ff88c8..01d108f 100644 --- a/manifests/debian.pp +++ b/manifests/debian.pp @@ -3,7 +3,7 @@ class shorewall::debian inherits shorewall::base { content => template("shorewall/debian_default.erb"), require => Package['shorewall'], notify => Service['shorewall'], - owner => root, group => 0, mode => '0644'; + owner => 'root', group => 'root', mode => '0644'; } Service['shorewall']{ status => '/sbin/shorewall status' diff --git a/manifests/managed_file.pp b/manifests/managed_file.pp index 9c5758d..7061721 100644 --- a/manifests/managed_file.pp +++ b/manifests/managed_file.pp @@ -2,7 +2,7 @@ define shorewall::managed_file () { concat{ "/etc/shorewall/puppet/${name}": notify => Service['shorewall'], require => File['/etc/shorewall/puppet'], - owner => root, group => 0, mode => '0600'; + owner => 'root', group => 'root', mode => '0600'; } concat::fragment { "${name}-header": -- cgit v1.2.3 From 89942a86bfbd1daa49f9ca5116be5844b074f5ad Mon Sep 17 00:00:00 2001 From: mh Date: Fri, 17 Oct 2014 12:30:38 +0200 Subject: update a few headers --- files/boilerplate/interfaces.header | 4 ++-- files/boilerplate/policy.header | 8 +++++--- files/boilerplate/zones.header | 11 ++++++----- 3 files changed, 13 insertions(+), 10 deletions(-) diff --git a/files/boilerplate/interfaces.header b/files/boilerplate/interfaces.header index 2027523..663e436 100644 --- a/files/boilerplate/interfaces.header +++ b/files/boilerplate/interfaces.header @@ -1,10 +1,10 @@ # -# Shorewall version 3.4 - Interfaces File +# Shorewall version 4 - Interfaces File # # For information about entries in this file, type "man shorewall-interfaces" # # For additional information, see -# http://shorewall.net/Documentation.htm#Interfaces +# http://www.shorewall.net/manpages/shorewall-interfaces.html # ############################################################################### #ZONE INTERFACE BROADCAST OPTIONS diff --git a/files/boilerplate/policy.header b/files/boilerplate/policy.header index a0c5d5d..cc9781f 100644 --- a/files/boilerplate/policy.header +++ b/files/boilerplate/policy.header @@ -1,9 +1,11 @@ # -# Shorewall version 3.4 - Policy File +# Shorewall version 4 - Policy File # # For information about entries in this file, type "man shorewall-policy" # -# See http://shorewall.net/Documentation.htm#Policy for additional information. +# The manpage is also online at +# http://www.shorewall.net/manpages/shorewall-policy.html # ############################################################################### -#SOURCE DEST POLICY LOG LIMIT:BURST +#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT: +# LEVEL BURST MASK diff --git a/files/boilerplate/zones.header b/files/boilerplate/zones.header index 8b82c2e..5dada52 100644 --- a/files/boilerplate/zones.header +++ b/files/boilerplate/zones.header @@ -1,11 +1,12 @@ # -# Shorewall version 3.4 - Zones File +# Shorewall version 4 - Zones File # # For information about this file, type "man shorewall-zones" # -# For more information, see http://www.shorewall.net/Documentation.htm#Zones +# The manpage is also online at +# http://www.shorewall.net/manpages/shorewall-zones.html # ############################################################################### -#ZONE TYPE OPTIONS IN OUT -# OPTIONS OPTIONS -fw firewall +#ZONE TYPE OPTIONS IN OUT +# OPTIONS OPTIONS +fw firewall -- cgit v1.2.3 From 598ef5555c1c204f9eeeb3cba8c85a02dc5e63b9 Mon Sep 17 00:00:00 2001 From: mh Date: Fri, 17 Oct 2014 12:44:51 +0200 Subject: make it possible to create resources from hiera --- manifests/init.pp | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 57 insertions(+), 1 deletion(-) diff --git a/manifests/init.pp b/manifests/init.pp index f413684..cfca3c3 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -8,7 +8,43 @@ class shorewall( $tor_user = $::operatingsystem ? { 'Debian' => 'debian-tor', default => 'tor' - } + }, + $zones = {}, + $zones_defaults = {}, + $interfaces = {}, + $interfaces_defaults = {}, + $hosts = {}, + $hosts_defaults = {}, + $policy = {}, + $policy_defaults = {}, + $rules = {}, + $rules_defaults = {}, + $rulesections = {}, + $rulesections_defaults = {}, + $masq = {}, + $masq_defaults = {}, + $proxyarp = {}, + $proxyarp_defaults = {}, + $nat = {}, + $nat_defaults = {}, + $blacklist = {}, + $blacklist_defaults = {}, + $rfc1918 = {}, + $rfc1918_defaults = {}, + $routestopped = {}, + $routestopped_defaults = {}, + $params = {}, + $params_defaults = {}, + $tcdevices = {}, + $tcdevices_defaults = {}, + $tcrules = {}, + $tcrules_defaults = {}, + $tcclasses = {}, + $tcclasses_defaults = {}, + $tunnels = {}, + $tunnels_defaults = {}, + $rtrules = {}, + $rtrules_defaults = {}, ) { case $::operatingsystem { @@ -63,4 +99,24 @@ class shorewall( 'mangle', ]:; } + + create_resources('shorewall::zone',$zones,$zones_defaults) + create_resources('shorewall::interface',$interfaces,$interfaces_defaults) + create_resources('shorewall::host',$hosts,$hosts_defaults) + create_resources('shorewall::policy',$policy,$policy_defaults) + create_resources('shorewall::rule',$rules,$rules_defaults) + create_resources('shorewall::rule_section',$rulesections,$rulesections_defaults) + create_resources('shorewall::masq',$masq,$masq_defaults) + create_resources('shorewall::proxyarp',$proxyarp,$proxyarp_defaults) + create_resources('shorewall::nat',$nat,$nat_defaults) + create_resources('shorewall::blacklist',$blacklist,$blacklist_defaults) + create_resources('shorewall::rfc1918',$rfc1918,$rfc1918_defaults) + create_resources('shorewall::routestopped',$routestopped, + $routestopped_defaults) + create_resources('shorewall::params',$params,$params_defaults) + create_resources('shorewall::tcdevices',$tcdevices,$tcdevices_defaults) + create_resources('shorewall::tcrules',$tcrules,$tcrules_defaults) + create_resources('shorewall::tcclasses',$tcclasses,$tcclasses_defaults) + create_resources('shorewall::tunnel',$tunnels,$tunnels_defaults) + create_resources('shorewall::rtrules',$rtrules,$rtrules_defaults) } -- cgit v1.2.3 From 353492eaa1c9047547b17161df4aa58ea3bf0a87 Mon Sep 17 00:00:00 2001 From: mh Date: Tue, 7 Apr 2015 14:32:07 +0200 Subject: add razor rules --- manifests/rules/out/razor.pp | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 manifests/rules/out/razor.pp diff --git a/manifests/rules/out/razor.pp b/manifests/rules/out/razor.pp new file mode 100644 index 0000000..1f8397c --- /dev/null +++ b/manifests/rules/out/razor.pp @@ -0,0 +1,12 @@ +# razor calls out on 2703 +# https://wiki.apache.org/spamassassin/NetTestFirewallIssues +class shorewall::rules::out::razor { + shorewall::rule { 'me-net-tcp_razor': + source => '$FW', + destination => 'net', + proto => 'tcp', + destinationport => '2703', + order => 240, + action => 'ACCEPT'; + } +} -- cgit v1.2.3 From 220d7af45dc4b1c334e2d3f50f2bc8ab54139093 Mon Sep 17 00:00:00 2001 From: mh Date: Fri, 20 Nov 2015 22:43:06 +0100 Subject: make service restart more failsafe --- manifests/base.pp | 13 +++++++++---- manifests/centos.pp | 2 +- manifests/debian.pp | 4 ++-- manifests/extension_script.pp | 2 +- manifests/managed_file.pp | 13 ++++++++----- 5 files changed, 21 insertions(+), 13 deletions(-) diff --git a/manifests/base.pp b/manifests/base.pp index b5899fc..db6852a 100644 --- a/manifests/base.pp +++ b/manifests/base.pp @@ -8,14 +8,14 @@ class shorewall::base { # This file has to be managed in place, so shorewall can find it file { '/etc/shorewall/shorewall.conf': - require => Package[shorewall], - notify => Service[shorewall], + require => Package['shorewall'], + notify => Exec['shorewall_check'], owner => 'root', group => 'root', mode => '0644'; '/etc/shorewall/puppet': ensure => directory, - require => Package[shorewall], + require => Package['shorewall'], owner => 'root', group => 'root', mode => '0644'; @@ -33,11 +33,16 @@ class shorewall::base { changes => 'set /files/etc/shorewall/shorewall.conf/CONFIG_PATH \'"/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall"\'', lens => 'Shellvars.lns', incl => '/etc/shorewall/shorewall.conf', - notify => Service['shorewall'], + notify => Exec['shorewall_check'], require => Package['shorewall']; } } + exec{'shorewall_check': + command => 'shorewall check', + refreshonly => true, + notify => Service['shorewall'], + } service{'shorewall': ensure => running, enable => true, diff --git a/manifests/centos.pp b/manifests/centos.pp index 95b7759..1f8b37d 100644 --- a/manifests/centos.pp +++ b/manifests/centos.pp @@ -7,7 +7,7 @@ class shorewall::centos inherits shorewall::base { lens => 'Shellvars.lns', incl => '/etc/sysconfig/shorewall', require => Package['shorewall'], - notify => Service['shorewall'], + notify => Exec['shorewall_check'], } } } diff --git a/manifests/debian.pp b/manifests/debian.pp index 01d108f..326b42b 100644 --- a/manifests/debian.pp +++ b/manifests/debian.pp @@ -2,8 +2,8 @@ class shorewall::debian inherits shorewall::base { file{'/etc/default/shorewall': content => template("shorewall/debian_default.erb"), require => Package['shorewall'], - notify => Service['shorewall'], - owner => 'root', group => 'root', mode => '0644'; + notify => Exec['shorewall_check'], + owner => 'root', group => 'root', mode => '0644'; } Service['shorewall']{ status => '/sbin/shorewall status' diff --git a/manifests/extension_script.pp b/manifests/extension_script.pp index 569fcbf..4abc6b1 100644 --- a/manifests/extension_script.pp +++ b/manifests/extension_script.pp @@ -4,7 +4,7 @@ define shorewall::extension_script($script = '') { 'init', 'initdone', 'start', 'started', 'stop', 'stopped', 'clear', 'refresh', 'continue', 'maclog': { file { "/etc/shorewall/puppet/${name}": content => "${script}\n", - notify => Service[shorewall]; + notify => Exec['shorewall_check']; } } '', default: { diff --git a/manifests/managed_file.pp b/manifests/managed_file.pp index 7061721..b353814 100644 --- a/manifests/managed_file.pp +++ b/manifests/managed_file.pp @@ -1,17 +1,20 @@ -define shorewall::managed_file () { +# manage a certain file +define shorewall::managed_file() { concat{ "/etc/shorewall/puppet/${name}": - notify => Service['shorewall'], + notify => Exec['shorewall_check'], require => File['/etc/shorewall/puppet'], - owner => 'root', group => 'root', mode => '0600'; + owner => 'root', + group => 'root', + mode => '0600'; } concat::fragment { "${name}-header": source => "puppet:///modules/shorewall/boilerplate/${name}.header", target => "/etc/shorewall/puppet/${name}", - order => '000'; + order => '000'; "${name}-footer": source => "puppet:///modules/shorewall/boilerplate/${name}.footer", target => "/etc/shorewall/puppet/${name}", - order => '999'; + order => '999'; } } -- cgit v1.2.3 From bbd82b23d8d5d7ef41f05bc6f4afc5ba400a91f4 Mon Sep 17 00:00:00 2001 From: mh Date: Fri, 20 Nov 2015 22:45:59 +0100 Subject: linting --- manifests/base.pp | 10 +++++----- manifests/debian.pp | 10 +++++----- manifests/extension_script.pp | 24 +++++++++++++----------- 3 files changed, 23 insertions(+), 21 deletions(-) diff --git a/manifests/base.pp b/manifests/base.pp index db6852a..41348ef 100644 --- a/manifests/base.pp +++ b/manifests/base.pp @@ -44,10 +44,10 @@ class shorewall::base { notify => Service['shorewall'], } service{'shorewall': - ensure => running, - enable => true, - hasstatus => true, - hasrestart => true, - require => Package['shorewall'], + ensure => running, + enable => true, + hasstatus => true, + hasrestart => true, + require => Package['shorewall'], } } diff --git a/manifests/debian.pp b/manifests/debian.pp index 326b42b..07176a3 100644 --- a/manifests/debian.pp +++ b/manifests/debian.pp @@ -1,11 +1,11 @@ +# debian specific things class shorewall::debian inherits shorewall::base { file{'/etc/default/shorewall': - content => template("shorewall/debian_default.erb"), + content => template('shorewall/debian_default.erb'), require => Package['shorewall'], notify => Exec['shorewall_check'], - owner => 'root', group => 'root', mode => '0644'; - } - Service['shorewall']{ - status => '/sbin/shorewall status' + owner => 'root', + group => 'root', + mode => '0644'; } } diff --git a/manifests/extension_script.pp b/manifests/extension_script.pp index 4abc6b1..80b83d3 100644 --- a/manifests/extension_script.pp +++ b/manifests/extension_script.pp @@ -1,14 +1,16 @@ # See http://shorewall.net/shorewall_extension_scripts.htm -define shorewall::extension_script($script = '') { - case $name { - 'init', 'initdone', 'start', 'started', 'stop', 'stopped', 'clear', 'refresh', 'continue', 'maclog': { - file { "/etc/shorewall/puppet/${name}": - content => "${script}\n", - notify => Exec['shorewall_check']; - } - } - '', default: { - err("${name}: unknown shorewall extension script") - } +define shorewall::extension_script( + $script +) { + case $name { + 'init', 'initdone', 'start', 'started', 'stop', 'stopped', 'clear', 'refresh', 'continue', 'maclog': { + file { "/etc/shorewall/puppet/${name}": + content => "${script}\n", + notify => Exec['shorewall_check']; + } } + default: { + err("${name}: unknown shorewall extension script") + } + } } -- cgit v1.2.3 From 77ef3216c06b3c501dd63a8df9a7e5561ffc7992 Mon Sep 17 00:00:00 2001 From: mh Date: Fri, 20 Nov 2015 23:01:37 +0100 Subject: check shorewall daily on problems to alert if a rule won't compile --- manifests/base.pp | 24 ++++++++++++++++++++++++ manifests/init.pp | 1 + 2 files changed, 25 insertions(+) diff --git a/manifests/base.pp b/manifests/base.pp index 41348ef..0cf3dc6 100644 --- a/manifests/base.pp +++ b/manifests/base.pp @@ -50,4 +50,28 @@ class shorewall::base { hasrestart => true, require => Package['shorewall'], } + + file{'/etc/cron.daily/shorewall_check':} + if $shorewall::daily_check { + File['/etc/cron.daily/shorewall_check']{ + content => '#!/bin/bash + +output=$(shorewall check 2>&1) +if [ $? -gt 0 ]; then + echo "Error while checking firewall!" + echo $output + exit 1 +fi +exit 0 +', + owner => root, + group => 0, + mode => '0700', + require => Service['shorewall'], + } + } else { + File['/etc/cron.daily/shorewall_check']{ + ensure => absent, + } + } } diff --git a/manifests/init.pp b/manifests/init.pp index cfca3c3..27f9c4c 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -45,6 +45,7 @@ class shorewall( $tunnels_defaults = {}, $rtrules = {}, $rtrules_defaults = {}, + $daily_check = true, ) { case $::operatingsystem { -- cgit v1.2.3 From 6bca4007a104cc7f1736613679b171f19a706685 Mon Sep 17 00:00:00 2001 From: mh Date: Sat, 28 Nov 2015 17:41:51 +0100 Subject: linting for future parser --- manifests/init.pp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/manifests/init.pp b/manifests/init.pp index 27f9c4c..d6b2d2a 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -49,12 +49,12 @@ class shorewall( ) { case $::operatingsystem { - gentoo: { include shorewall::gentoo } - debian,ubuntu: { include shorewall::debian } - centos: { include shorewall::centos } + 'Gentoo': { include ::shorewall::gentoo } + 'Debian','Ubuntu': { include ::shorewall::debian } + 'CentOS': { include ::shorewall::centos } default: { notice "unknown operatingsystem: ${::operatingsystem}" - include shorewall::base + include ::shorewall::base } } -- cgit v1.2.3