From 7633322b490c02e2ba44faa1a0fd534577df6d82 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 7 Apr 2009 18:47:08 -0400 Subject: add extension script headers and footers --- files/boilerplate/clear.footer | 1 + files/boilerplate/clear.header | 13 +++++++++++++ files/boilerplate/continue.footer | 1 + files/boilerplate/continue.header | 14 ++++++++++++++ files/boilerplate/init.footer | 1 + files/boilerplate/init.header | 13 +++++++++++++ files/boilerplate/initdone.footer | 1 + files/boilerplate/initdone.header | 14 ++++++++++++++ files/boilerplate/maclog.footer | 14 ++++++++++++++ files/boilerplate/maclog.header | 14 ++++++++++++++ files/boilerplate/start.footer | 14 ++++++++++++++ files/boilerplate/start.header | 12 ++++++++++++ files/boilerplate/started.footer | 14 ++++++++++++++ files/boilerplate/started.header | 20 ++++++++++++++++++++ files/boilerplate/stop.footer | 14 ++++++++++++++ files/boilerplate/stop.header | 13 +++++++++++++ files/boilerplate/stopped.footer | 14 ++++++++++++++ files/boilerplate/stopped.header | 13 +++++++++++++ 18 files changed, 200 insertions(+) create mode 100644 files/boilerplate/clear.footer create mode 100644 files/boilerplate/clear.header create mode 100644 files/boilerplate/continue.footer create mode 100644 files/boilerplate/continue.header create mode 100644 files/boilerplate/init.footer create mode 100644 files/boilerplate/init.header create mode 100644 files/boilerplate/initdone.footer create mode 100644 files/boilerplate/initdone.header create mode 100644 files/boilerplate/maclog.footer create mode 100644 files/boilerplate/maclog.header create mode 100644 files/boilerplate/start.footer create mode 100644 files/boilerplate/start.header create mode 100644 files/boilerplate/started.footer create mode 100644 files/boilerplate/started.header create mode 100644 files/boilerplate/stop.footer create mode 100644 files/boilerplate/stop.header create mode 100644 files/boilerplate/stopped.footer create mode 100644 files/boilerplate/stopped.header (limited to 'files') diff --git a/files/boilerplate/clear.footer b/files/boilerplate/clear.footer new file mode 100644 index 0000000..662ac1c --- /dev/null +++ b/files/boilerplate/clear.footer @@ -0,0 +1 @@ +#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE diff --git a/files/boilerplate/clear.header b/files/boilerplate/clear.header new file mode 100644 index 0000000..6a39b0b --- /dev/null +++ b/files/boilerplate/clear.header @@ -0,0 +1,13 @@ +# +# Shorewall version 4 - Clear +# +# /etc/shorewall/stop +# +# Add commands below that you want to be executed at the beginning of a +# "shorewall stop" command. +# +# See http://shorewall.net/shorewall_extension_scripts.htm for additional +# information. +# +############################################################################### +#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE diff --git a/files/boilerplate/continue.footer b/files/boilerplate/continue.footer new file mode 100644 index 0000000..662ac1c --- /dev/null +++ b/files/boilerplate/continue.footer @@ -0,0 +1 @@ +#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE diff --git a/files/boilerplate/continue.header b/files/boilerplate/continue.header new file mode 100644 index 0000000..d2ee48a --- /dev/null +++ b/files/boilerplate/continue.header @@ -0,0 +1,14 @@ +# +# Shorewall version 4 - Continue File +# +# /etc/shorewall/continue +# +# Add commands below that you want to be executed after shorewall has +# cleared any existing Netfilter rules and has enabled existing +# connections. +# +# For additional information, see +# http://shorewall.net/shorewall_extension_scripts.htm +# +############################################################################### + diff --git a/files/boilerplate/init.footer b/files/boilerplate/init.footer new file mode 100644 index 0000000..662ac1c --- /dev/null +++ b/files/boilerplate/init.footer @@ -0,0 +1 @@ +#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE diff --git a/files/boilerplate/init.header b/files/boilerplate/init.header new file mode 100644 index 0000000..cbb0393 --- /dev/null +++ b/files/boilerplate/init.header @@ -0,0 +1,13 @@ +# +# Shorewall version 4 - Init File +# +# /etc/shorewall/init +# +# Add commands below that you want to be executed at the beginning of +# a "shorewall start" or "shorewall restart" command. +# +# For additional information, see +# http://shorewall.net/shorewall_extension_scripts.htm +# +############################################################################### + diff --git a/files/boilerplate/initdone.footer b/files/boilerplate/initdone.footer new file mode 100644 index 0000000..662ac1c --- /dev/null +++ b/files/boilerplate/initdone.footer @@ -0,0 +1 @@ +#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE diff --git a/files/boilerplate/initdone.header b/files/boilerplate/initdone.header new file mode 100644 index 0000000..9252a3b --- /dev/null +++ b/files/boilerplate/initdone.header @@ -0,0 +1,14 @@ +# +# Shorewall version 4 - Initdone File +# +# /etc/shorewall/initdone +# +# Add commands below that you want to be executed during +# "shorewall start" or "shorewall restart" commands at the point where +# Shorewall has not yet added any perminent rules to the builtin chains. +# +# For additional information, see +# http://shorewall.net/shorewall_extension_scripts.htm +# +############################################################################### + diff --git a/files/boilerplate/maclog.footer b/files/boilerplate/maclog.footer new file mode 100644 index 0000000..b0c382a --- /dev/null +++ b/files/boilerplate/maclog.footer @@ -0,0 +1,14 @@ +# +# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5) +# +# /etc/shorewall/start +# +# Add commands below that you want executed while mac filtering rules are +# being created. These will be executed once for each interface having +# 'maclist' speciied and it is invoked just before the logging rule is +# added to the current chain (the name of that chain will be in $CHAIN) +# +# See http://shorewall.net/shorewall_extension_scripts.htm for additional +# information. +# +############################################################################### diff --git a/files/boilerplate/maclog.header b/files/boilerplate/maclog.header new file mode 100644 index 0000000..b0c382a --- /dev/null +++ b/files/boilerplate/maclog.header @@ -0,0 +1,14 @@ +# +# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5) +# +# /etc/shorewall/start +# +# Add commands below that you want executed while mac filtering rules are +# being created. These will be executed once for each interface having +# 'maclist' speciied and it is invoked just before the logging rule is +# added to the current chain (the name of that chain will be in $CHAIN) +# +# See http://shorewall.net/shorewall_extension_scripts.htm for additional +# information. +# +############################################################################### diff --git a/files/boilerplate/start.footer b/files/boilerplate/start.footer new file mode 100644 index 0000000..b0c382a --- /dev/null +++ b/files/boilerplate/start.footer @@ -0,0 +1,14 @@ +# +# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5) +# +# /etc/shorewall/start +# +# Add commands below that you want executed while mac filtering rules are +# being created. These will be executed once for each interface having +# 'maclist' speciied and it is invoked just before the logging rule is +# added to the current chain (the name of that chain will be in $CHAIN) +# +# See http://shorewall.net/shorewall_extension_scripts.htm for additional +# information. +# +############################################################################### diff --git a/files/boilerplate/start.header b/files/boilerplate/start.header new file mode 100644 index 0000000..689dff1 --- /dev/null +++ b/files/boilerplate/start.header @@ -0,0 +1,12 @@ +# +# Shorewall version 4 - Start File +# +# /etc/shorewall/start +# +# Add commands below that you want to be executed after shorewall has +# been started or restarted. +# +# See http://shorewall.net/shorewall_extension_scripts.htm for additional +# information. +# +############################################################################### diff --git a/files/boilerplate/started.footer b/files/boilerplate/started.footer new file mode 100644 index 0000000..b0c382a --- /dev/null +++ b/files/boilerplate/started.footer @@ -0,0 +1,14 @@ +# +# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5) +# +# /etc/shorewall/start +# +# Add commands below that you want executed while mac filtering rules are +# being created. These will be executed once for each interface having +# 'maclist' speciied and it is invoked just before the logging rule is +# added to the current chain (the name of that chain will be in $CHAIN) +# +# See http://shorewall.net/shorewall_extension_scripts.htm for additional +# information. +# +############################################################################### diff --git a/files/boilerplate/started.header b/files/boilerplate/started.header new file mode 100644 index 0000000..b7704db --- /dev/null +++ b/files/boilerplate/started.header @@ -0,0 +1,20 @@ +# +# Shorewall version 4 - Started File +# +# /etc/shorewall/started +# +# Add commands below that you want to be executed after shorewall has +# been completely started or restarted. The difference between this +# extension script and /etc/shorewall/start is that this one is invoked +# after delayed loading of the blacklist (DELAYBLACKLISTLOAD=Yes) and +# after the 'shorewall' chain has been created (thus signaling that the +# firewall is completely up). +# +# This script should not change the firewall configuration directly but +# may do so indirectly by running /sbin/shorewall with the 'nolock' +# option. +# +# See http://shorewall.net/shorewall_extension_scripts.htm for additional +# information. +# +############################################################################### diff --git a/files/boilerplate/stop.footer b/files/boilerplate/stop.footer new file mode 100644 index 0000000..b0c382a --- /dev/null +++ b/files/boilerplate/stop.footer @@ -0,0 +1,14 @@ +# +# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5) +# +# /etc/shorewall/start +# +# Add commands below that you want executed while mac filtering rules are +# being created. These will be executed once for each interface having +# 'maclist' speciied and it is invoked just before the logging rule is +# added to the current chain (the name of that chain will be in $CHAIN) +# +# See http://shorewall.net/shorewall_extension_scripts.htm for additional +# information. +# +############################################################################### diff --git a/files/boilerplate/stop.header b/files/boilerplate/stop.header new file mode 100644 index 0000000..0088abe --- /dev/null +++ b/files/boilerplate/stop.header @@ -0,0 +1,13 @@ +# +# Shorewall version 4 - Stop File +# +# /etc/shorewall/stop +# +# Add commands below that you want to be executed at the beginning of a +# "shorewall stop" command. +# +# See http://shorewall.net/shorewall_extension_scripts.htm for additional +# information. +# +############################################################################### +#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE diff --git a/files/boilerplate/stopped.footer b/files/boilerplate/stopped.footer new file mode 100644 index 0000000..b0c382a --- /dev/null +++ b/files/boilerplate/stopped.footer @@ -0,0 +1,14 @@ +# +# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5) +# +# /etc/shorewall/start +# +# Add commands below that you want executed while mac filtering rules are +# being created. These will be executed once for each interface having +# 'maclist' speciied and it is invoked just before the logging rule is +# added to the current chain (the name of that chain will be in $CHAIN) +# +# See http://shorewall.net/shorewall_extension_scripts.htm for additional +# information. +# +############################################################################### diff --git a/files/boilerplate/stopped.header b/files/boilerplate/stopped.header new file mode 100644 index 0000000..438e5e0 --- /dev/null +++ b/files/boilerplate/stopped.header @@ -0,0 +1,13 @@ +# +# Shorewall version 4 - Stopped File +# +# /etc/shorewall/stopped +# +# Add commands below that you want to be executed at the completion of a +# "shorewall stop" command. +# +# See http://shorewall.net/shorewall_extension_scripts.htm for additional +# information. +# +############################################################################### +#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE -- cgit v1.2.3 From ec529be6e985ea1fcd835069d1ef48680e0a980d Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Tue, 7 Apr 2009 22:07:02 -0400 Subject: replace footers with actual footers, previous addition accidentally added them as headers --- files/boilerplate/maclog.footer | 15 +-------------- files/boilerplate/start.footer | 15 +-------------- files/boilerplate/started.footer | 15 +-------------- files/boilerplate/stop.footer | 15 +-------------- files/boilerplate/stopped.footer | 15 +-------------- 5 files changed, 5 insertions(+), 70 deletions(-) (limited to 'files') diff --git a/files/boilerplate/maclog.footer b/files/boilerplate/maclog.footer index b0c382a..5e12d1d 100644 --- a/files/boilerplate/maclog.footer +++ b/files/boilerplate/maclog.footer @@ -1,14 +1 @@ -# -# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5) -# -# /etc/shorewall/start -# -# Add commands below that you want executed while mac filtering rules are -# being created. These will be executed once for each interface having -# 'maclist' speciied and it is invoked just before the logging rule is -# added to the current chain (the name of that chain will be in $CHAIN) -# -# See http://shorewall.net/shorewall_extension_scripts.htm for additional -# information. -# -############################################################################### +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/start.footer b/files/boilerplate/start.footer index b0c382a..5e12d1d 100644 --- a/files/boilerplate/start.footer +++ b/files/boilerplate/start.footer @@ -1,14 +1 @@ -# -# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5) -# -# /etc/shorewall/start -# -# Add commands below that you want executed while mac filtering rules are -# being created. These will be executed once for each interface having -# 'maclist' speciied and it is invoked just before the logging rule is -# added to the current chain (the name of that chain will be in $CHAIN) -# -# See http://shorewall.net/shorewall_extension_scripts.htm for additional -# information. -# -############################################################################### +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/started.footer b/files/boilerplate/started.footer index b0c382a..5e12d1d 100644 --- a/files/boilerplate/started.footer +++ b/files/boilerplate/started.footer @@ -1,14 +1 @@ -# -# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5) -# -# /etc/shorewall/start -# -# Add commands below that you want executed while mac filtering rules are -# being created. These will be executed once for each interface having -# 'maclist' speciied and it is invoked just before the logging rule is -# added to the current chain (the name of that chain will be in $CHAIN) -# -# See http://shorewall.net/shorewall_extension_scripts.htm for additional -# information. -# -############################################################################### +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/stop.footer b/files/boilerplate/stop.footer index b0c382a..5e12d1d 100644 --- a/files/boilerplate/stop.footer +++ b/files/boilerplate/stop.footer @@ -1,14 +1 @@ -# -# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5) -# -# /etc/shorewall/start -# -# Add commands below that you want executed while mac filtering rules are -# being created. These will be executed once for each interface having -# 'maclist' speciied and it is invoked just before the logging rule is -# added to the current chain (the name of that chain will be in $CHAIN) -# -# See http://shorewall.net/shorewall_extension_scripts.htm for additional -# information. -# -############################################################################### +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/stopped.footer b/files/boilerplate/stopped.footer index b0c382a..5e12d1d 100644 --- a/files/boilerplate/stopped.footer +++ b/files/boilerplate/stopped.footer @@ -1,14 +1 @@ -# -# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5) -# -# /etc/shorewall/start -# -# Add commands below that you want executed while mac filtering rules are -# being created. These will be executed once for each interface having -# 'maclist' speciied and it is invoked just before the logging rule is -# added to the current chain (the name of that chain will be in $CHAIN) -# -# See http://shorewall.net/shorewall_extension_scripts.htm for additional -# information. -# -############################################################################### +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE -- cgit v1.2.3 From eda4f69cce2f2cd62f3288bdee9d8459c4673ce9 Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Mon, 24 Aug 2009 15:24:14 -0300 Subject: Adding boilerplate files and minor fixes --- files/boilerplate/tcclasses.footer | 1 + files/boilerplate/tcclasses.header | 9 +++++++++ files/boilerplate/tcdevices.footer | 1 + files/boilerplate/tcdevices.header | 10 ++++++++++ files/boilerplate/tcrules.footer | 1 + files/boilerplate/tcrules.header | 15 +++++++++++++++ manifests/init.pp | 12 ++++++------ 7 files changed, 43 insertions(+), 6 deletions(-) create mode 100644 files/boilerplate/tcclasses.footer create mode 100644 files/boilerplate/tcclasses.header create mode 100644 files/boilerplate/tcdevices.footer create mode 100644 files/boilerplate/tcdevices.header create mode 100644 files/boilerplate/tcrules.footer create mode 100644 files/boilerplate/tcrules.header (limited to 'files') diff --git a/files/boilerplate/tcclasses.footer b/files/boilerplate/tcclasses.footer new file mode 100644 index 0000000..5e12d1d --- /dev/null +++ b/files/boilerplate/tcclasses.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/tcclasses.header b/files/boilerplate/tcclasses.header new file mode 100644 index 0000000..025415b --- /dev/null +++ b/files/boilerplate/tcclasses.header @@ -0,0 +1,9 @@ +# +# Shorewall version 4 - Tcclasses File +# +# For information about entries in this file, type "man shorewall-tcclasses" +# +# See http://shorewall.net/traffic_shaping.htm for additional information. +# +############################################################################### +#INTERFACE:CLASS MARK RATE CEIL PRIORITY OPTIONS diff --git a/files/boilerplate/tcdevices.footer b/files/boilerplate/tcdevices.footer new file mode 100644 index 0000000..5e12d1d --- /dev/null +++ b/files/boilerplate/tcdevices.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/tcdevices.header b/files/boilerplate/tcdevices.header new file mode 100644 index 0000000..fe7c3d1 --- /dev/null +++ b/files/boilerplate/tcdevices.header @@ -0,0 +1,10 @@ +# +# Shorewall version 4 - Tcdevices File +# +# For information about entries in this file, type "man shorewall-tcdevices" +# +# See http://shorewall.net/traffic_shaping.htm for additional information. +# +############################################################################### +#NUMBER: IN-BANDWITH OUT-BANDWIDTH OPTIONS REDIRECTED +#INTERFACE INTERFACES diff --git a/files/boilerplate/tcrules.footer b/files/boilerplate/tcrules.footer new file mode 100644 index 0000000..5e12d1d --- /dev/null +++ b/files/boilerplate/tcrules.footer @@ -0,0 +1 @@ +#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE diff --git a/files/boilerplate/tcrules.header b/files/boilerplate/tcrules.header new file mode 100644 index 0000000..e0e7adc --- /dev/null +++ b/files/boilerplate/tcrules.header @@ -0,0 +1,15 @@ +# +# Shorewall version 4 - Tcrules File +# +# For information about entries in this file, type "man shorewall-tcrules" +# +# See http://shorewall.net/traffic_shaping.htm for additional information. +# For usage in selecting among multiple ISPs, see +# http://shorewall.net/MultiISP.html +# +# See http://shorewall.net/PacketMarking.html for a detailed description of +# the Netfilter/Shorewall packet marking mechanism. +###################################################################################################################### +#MARK SOURCE DEST PROTO DEST SOURCE USER TEST LENGTH TOS CONNBYTES HELPER +# PORT(S) PORT(S) + diff --git a/manifests/init.pp b/manifests/init.pp index 84ce030..20093e9 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -204,25 +204,25 @@ class shorewall { # See http://www.shorewall.net/3.0/traffic_shaping.htm managed_file { tcdevices: } - define tcdevices($in_bandwidth, $out_bandwidth, $order='100'){ + define tcdevices($in_bandwidth, $out_bandwidth, $options = '-', $redirected_interfaces = '', $order='100'){ entry { "tcdevices.d/${order}-${title}": - line => "${name} ${in_bandwidth} ${out_bandwidth}", + line => "${name} ${in_bandwidth} ${out_bandwidth} ${options} ${redirected_interfaces}", } } # See http://www.shorewall.net/3.0/traffic_shaping.htm managed_file { tcrules: } - define tcrules($source, $destination, $protocol, $ports , $order='1'){ + define tcrules($source, $destination, $protocol = 'all', $ports, $client_ports = '-', $order='1'){ entry { "tcrules.d/${order}-${title}": - line => "# ${name}\n${order} ${source} ${destination} ${protocol} ${ports}", + line => "# ${name}\n${order} ${source} ${destination} ${protocol} ${ports} ${client_ports}", } } # See http://www.shorewall.net/3.0/traffic_shaping.htm managed_file { tcclasses: } - define tcclasses($rate, $ceil, $priority, $options , $order='1'){ + define tcclasses($interface, $rate, $ceil, $priority, $options = '' , $order='1'){ entry { "tcclasses.d/${order}-${title}": - line => "${name} ${order} ${rate} ${ceil} ${priority} ${options}", + line => "# ${name}\n${interface} ${order} ${rate} ${ceil} ${priority} ${options}", } } -- cgit v1.2.3 From d39943732684a1e216419b65d86fed86566b1d83 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Mon, 14 Sep 2009 10:15:10 -0400 Subject: move debian/default from files to templates template out the startup value in the debian/default so that it can be specified in puppet make it possible to specify a different shorewall version if desired, default is to use 'present' add additional documentation and move copyright information up to the top --- files/debian/default | 24 ------------------------ manifests/init.pp | 47 ++++++++++++++++++++++++++++++++++++++--------- templates/debian/default | 25 +++++++++++++++++++++++++ 3 files changed, 63 insertions(+), 33 deletions(-) delete mode 100644 files/debian/default create mode 100644 templates/debian/default (limited to 'files') diff --git a/files/debian/default b/files/debian/default deleted file mode 100644 index ba89cdc..0000000 --- a/files/debian/default +++ /dev/null @@ -1,24 +0,0 @@ -# prevent startup with default configuration -# set the following varible to 1 in order to allow Shorewall to start - -startup=1 - -# if your Shorewall configuration requires detection of the ip address of a ppp -# interface, you must list such interfaces in "wait_interface" to get Shorewall to -# wait until the interface is configured. Otherwise the script will fail because -# it won't be able to detect the IP address. -# -# Example: -# wait_interface="ppp0" -# or -# wait_interface="ppp0 ppp1" -# or, if you have defined in /etc/shorewall/params -# wait_interface= - -# -# Startup options -# - -OPTIONS="" - -# EOF diff --git a/manifests/init.pp b/manifests/init.pp index 4e44547..444aa94 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -1,12 +1,37 @@ # # modules/shorewall/manifests/init.pp - manage firewalling with shorewall 3.x # Copyright (C) 2007 David Schmitt +# adapted by immerda project group - admin+puppet(at)immerda.ch +# adapted by Puzzle ITC - haerry+puppet(at)puzzle.ch +# Copyright (c) 2009 Riseup Networks - micah(shift+2)riseup.net # See LICENSE for the full license granted to you. # # Based on the work of ADNET Ghislain from AQUEOS # at https://reductivelabs.com/trac/puppet/wiki/AqueosShorewall # +# +# If you need to install a specific version of shorewall other than +# the default one that would be installed by 'ensure => present', then +# you can set the following variable and that specific version will be +# installed instead: +# +# $shorewall_ensure_version = "4.0.15-1" +# +# Debian specific settings: +# +# To set any of the following, simply set them as variables in y our manifests +# before the class is included, for example: +# +# $shorewall_startboot = 1 +# +# shorewall_startboot: specify if shorewall should be enabled at boot +# valid options are: 1 (start at boot), 0 (do not start), +# Default: 1 -> start at boot +# # Changes: +# * added Debian support to specify if shorewall should be enabled on boot or not +# * added support for specifying shorewall package version +# * updated indentation and formatting to standardize on puppet emacs/vim modes # * added support for traffic shapping: http://www.shorewall.net/traffic_shaping.htm # * added extension_script define: http://shorewall.net/shorewall_extension_scripts.htm # * FHS Layout: put configuration in /var/lib/puppet/modules/shorewall and @@ -17,9 +42,6 @@ # * add 000-header and 999-footer files for all managed_files # * added rule_section define and a few more parameters for rules # * add managing for masq, proxyarp, blacklist, nat, rfc1918 -# adapted by immerda project group - admin+puppet(at)immerda.ch -# adapted by Puzzle ITC - haerry+puppet(at)puzzle.ch -# adapted by Riseup Networks - micah(shift+2)riseup.net module_dir { "shorewall": } @@ -244,11 +266,12 @@ class shorewall { } class shorewall::base { - + + if $shorewall_ensure_version == '' { $shorewall_ensure_version = 'present' } package { 'shorewall': - ensure => present, + ensure => $shorewall_ensure_version, } - + # This file has to be managed in place, so shorewall can find it file { "/etc/shorewall/shorewall.conf": # use OS specific defaults, but use Default if no other is found @@ -300,13 +323,19 @@ class shorewall::gentoo inherits shorewall::base { } class shorewall::debian inherits shorewall::base { - file{'/etc/default/shorewall': - source => "puppet://$server/shorewall/debian/default", + + # prepare variables to use in templates + case $shorewall_startboot { + '': { $shorewall_startboot = '1' } + } + + file { '/etc/default/shorewall': + content => template("shorewall/debian/default"), require => Package['shorewall'], notify => Service['shorewall'], owner => root, group => 0, mode => 0644; } - Service['shorewall']{ + Service['shorewall'] { status => '/sbin/shorewall status' } } diff --git a/templates/debian/default b/templates/debian/default new file mode 100644 index 0000000..1aaad8c --- /dev/null +++ b/templates/debian/default @@ -0,0 +1,25 @@ +# prevent startup with default configuration +# set the following varible to 1 in order to allow Shorewall to start + + +startup=<%=shorewall_startboot -%> + +# if your Shorewall configuration requires detection of the ip address of a ppp +# interface, you must list such interfaces in "wait_interface" to get Shorewall to +# wait until the interface is configured. Otherwise the script will fail because +# it won't be able to detect the IP address. +# +# Example: +# wait_interface="ppp0" +# or +# wait_interface="ppp0 ppp1" +# or, if you have defined in /etc/shorewall/params +# wait_interface= + +# +# Startup options +# + +OPTIONS="" + +# EOF -- cgit v1.2.3