Skip to content
Snippets Groups Projects
Unverified Commit 1f530aea authored by Max Adamo's avatar Max Adamo
Browse files

code clean-up

parent e15e71e4
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
manifests/chains.pp
+ 35
− 59
View file @ 1f530aea
...@@ -12,54 +12,67 @@ ...@@ -12,54 +12,67 @@
# === Examples # === Examples
# #
class fw_builder::chains ( class fw_builder::chains (
$ipv4_enable, $ipv4_enable = $fw_builder::params::ipv4_enable,
$ipv6_enable $ipv6_enable = $fw_builder::params::ipv6_enable
) { ) {
assert_private() assert_private()
if ($ipv4_enable) { $fw_builder::ip_proto_array.each | String $provider | {
['udp', 'tcp', 'trust', 'public'].each | $chain | { $trusted_net = $provider ? {
firewallchain { "INPUT_${chain}:filter:IPv4": 'iptables' => 'trusted_networks_v4',
ensure => present; 'ip6tables' => 'trusted_networks_v6',
} }
$icmp_proto = $provider ? {
'iptables' => 'icmp',
'ip6tables' => 'ipv6-icmp',
}
firewall { "001 accept all inbound to localhost for ${provider}":
chain => 'INPUT',
proto => all,
iniface => 'lo',
action => accept,
provider => $provider;
} }
firewall { firewall {
default: default:
chain => 'INPUT', chain => 'INPUT',
action => accept, action => accept,
provider => 'iptables'; provider => 'iptables';
'010 accept all icmp for provider iptables': "010 accept all icmp for ${provider}":
proto => 'icmp'; proto => $icmp_proto;
'003 accept inbound related established rules for provider iptables': "003 accept inbound related established rules for ${provider}":
proto => all, proto => all,
state => ['RELATED', 'ESTABLISHED']; state => ['RELATED', 'ESTABLISHED'];
} }
firewall { firewall {
default: default:
chain => 'INPUT', chain => 'INPUT',
jump => 'INPUT_public', jump => 'INPUT_public',
state => ['NEW'], state => ['NEW'],
provider => 'ip6tables'; provider => $provider;
'090 IPv4 UDP INPUT_public for all public services': "090 UDP INPUT_public for all public services for ${provider}":
proto => 'udp'; proto => 'udp';
'090 IPv4 TCP INPUT_public for all public services': "090 TCP INPUT_public for all public services for ${provider}":
proto => 'tcp'; proto => 'tcp';
} }
firewall { '095 IPv4 INPUT_trust this is for all ip ranges (mostly internal)': firewall { "095 INPUT_trust this is for all ip ranges (mostly internal) for ${provider}":
chain => 'INPUT', chain => 'INPUT',
proto => all, proto => all,
state => ['NEW'], state => ['NEW'],
jump => 'INPUT_trust', jump => 'INPUT_trust',
ipset => 'trusted_networks_v4 src', ipset => "${trusted_net} src",
provider => 'iptables'; provider => $provider;
} }
firewall { '001 IPv4 accept all inbound to localhost':
chain => 'INPUT', }
proto => all,
iniface => 'lo', if ($ipv4_enable) {
action => accept, ['udp', 'tcp', 'trust', 'public'].each | $chain | {
provider => 'iptables'; firewallchain { "INPUT_${chain}:filter:IPv4":
ensure => present;
}
} }
} }
...@@ -69,43 +82,6 @@ class fw_builder::chains ( ...@@ -69,43 +82,6 @@ class fw_builder::chains (
ensure => present, ensure => present,
} }
} }
firewall {
default:
chain => 'INPUT',
action => accept,
provider => 'ip6tables';
'010 accept all icmp for provider ip6tables':
proto => 'ipv6-icmp';
'003 accept inbound related established rules for provider ip6tables':
proto => all,
state => ['RELATED', 'ESTABLISHED'];
}
firewall {
default:
chain => 'INPUT',
jump => 'INPUT_public',
state => ['NEW'],
provider => 'ip6tables';
'090 IPv6 UDP INPUT_public for all public services':
proto => 'udp';
'090 IPv6 TCP INPUT_public for all public services':
proto => 'tcp';
}
firewall { '095 IPv6 INPUT_trust this is for all ip ranges (mostly internal)':
chain => 'INPUT',
proto => all,
state => ['NEW'],
jump => 'INPUT_trust',
ipset => 'trusted_networks_v6 src',
provider => 'ip6tables';
}
firewall { '001 IPv6 accept all inbound to localhost6':
chain => 'INPUT',
proto => all,
iniface => 'lo',
action => accept,
provider => 'ip6tables';
}
} }
} }
......
manifests/docker.pp
+ 5
− 6
View file @ 1f530aea
...@@ -11,15 +11,14 @@ ...@@ -11,15 +11,14 @@
# #
# === Examples # === Examples
# #
class fw_builder::docker ( # === ToDo
$manage_docker, #
$ipv4_enable, # ADD SUPPORT FOR IPv6
$ipv6_enable #
) { class fw_builder::docker {
assert_private() assert_private()
# IPv6 IS STILL MISSING
firewallchain { ['INPUT:filter:IPv4', 'OUTPUT:filter:IPv4']: firewallchain { ['INPUT:filter:IPv4', 'OUTPUT:filter:IPv4']:
purge => true, purge => true,
......
manifests/init.pp
+ 45
− 40
View file @ 1f530aea
# == Class: fw_builder # == Class: fw_builder
# #
# == Parameters
#
# [*trusted_networks*] Fw_builder::Iplist
# Array of ipv4 and/or ipv6 CIDR
#
# [*purge_rules*] Boolean
# Purge rules not defined via Puppet
#
# [*manage_docker*] Boolean
# If purge rules is set to true, avoid purging rules set by Docker
#
# [*ipv4_enable*] Boolean
# enable iptables provider
#
# [*ipv6_enable*] Boolean
# enable ip6tables provider
#
# [*logging*] Boolean
# enable logging
#
# [*log_rotation_days*] Integer
# define log retention in days
#
# [*ipset_package_ensure*] String
# ipset version
#
# [*limit*] Variant[Undef, String]
# define limit for RST and Dropped connection on post.pp
#
# == Authors: # == Authors:
# #
# Pete Pedersen<pete.pedersen@geant.org> # Pete Pedersen<pete.pedersen@geant.org>
...@@ -7,21 +36,19 @@ ...@@ -7,21 +36,19 @@
# #
class fw_builder ( class fw_builder (
Fw_builder::Iplist $trusted_networks, Fw_builder::Iplist $trusted_networks,
Boolean $manage_docker = false, Boolean $manage_docker = $fw_builder::params::manage_docker,
Boolean $ipv4_enable = true, Boolean $ipv4_enable = $fw_builder::params::ipv4_enable,
Boolean $ipv6_enable = true, Boolean $ipv6_enable = $fw_builder::params::ipv6_enable,
Boolean $logging = true, Boolean $logging = $fw_builder::params::logging,
Boolean $purge_rules = true, Boolean $purge_rules = $fw_builder::params::purge_rules,
Integer $log_rotation_days = '7', Integer $log_rotation_days = $fw_builder::params::log_rotation_days,
$ipset_package_ensure = 'present', Optional[String] $limit = $fw_builder::params::limit,
$limit = '1000/sec' $ipset_package_ensure = $fw_builder::params::ipset_package_ensure
) { ) {
if ! ($purge_rules) and ($manage_docker) { if ! ($purge_rules) and ($manage_docker) {
fail('cannot set purge_rules to false and manage_docker to true') fail('cannot set purge_rules to false and manage_docker to true')
} } elsif ! ($ipv4_enable) and ! ($ipv6_enable) {
if ! ($ipv4_enable) and ! ($ipv6_enable) {
fail('you cannot disable ipv4 and ipv6 at the same time') fail('you cannot disable ipv4 and ipv6 at the same time')
} }
...@@ -33,34 +60,14 @@ class fw_builder ( ...@@ -33,34 +60,14 @@ class fw_builder (
$ip_proto_array = ['iptables'] $ip_proto_array = ['iptables']
} }
anchor { 'fw_builder::begin': } anchor { 'fw_builder::begin': }
-> class { -> class { 'firewall':; }
'firewall':; -> class { 'fw_builder::ipset':; }
} -> class { 'fw_builder::chains':; }
-> class { 'fw_builder::ipset': -> class { 'fw_builder::post':; }
ipset_package_ensure => $ipset_package_ensure,
trusted_networks => $trusted_networks,
ipv4_enable => $ipv4_enable,
ipv6_enable => $ipv6_enable,
require => Class['firewall'];
}
-> class { 'fw_builder::chains':
ipv4_enable => $ipv4_enable,
ipv6_enable => $ipv6_enable,
require => Class['fw_builder::ipset'];
}
-> class { 'fw_builder::post':
ipv4_enable => $ipv4_enable,
ipv6_enable => $ipv6_enable,
limit => $limit;
}
-> anchor { 'fw_builder::end': } -> anchor { 'fw_builder::end': }
class { 'fw_builder::logrotate': include fw_builder::logrotate
logging => $logging,
log_rotation_days => $log_rotation_days,
}
if ($purge_rules) { if ($purge_rules) {
if ($facts['fw_builder_is_docker']) and ($manage_docker) { if ($facts['fw_builder_is_docker']) and ($manage_docker) {
...@@ -71,10 +78,8 @@ class fw_builder ( ...@@ -71,10 +78,8 @@ class fw_builder (
purge => false; purge => false;
} }
class { 'fw_builder::docker': class { 'fw_builder::docker':
ipv4_enable => $ipv4_enable, before => Class['fw_builder::post'],
ipv6_enable => $ipv6_enable, require => Class['fw_builder::ipset'];
before => Class['fw_builder::post'],
require => Class['fw_builder::ipset'];
} }
} else { } else {
if ($ipv4_enable) { if ($ipv4_enable) {
......
manifests/ipset.pp
+ 7
− 7
View file @ 1f530aea
...@@ -2,14 +2,14 @@ ...@@ -2,14 +2,14 @@
# #
# #
class fw_builder::ipset ( class fw_builder::ipset (
$trusted_networks, $ipv4_enable = $fw_builder::params::ipv4_enable,
$ipset_package_ensure, $ipv6_enable = $fw_builder::params::ipv6_enable
$ipv4_enable,
$ipv6_enable
) { ) {
assert_private() assert_private()
$trusted_net = $fw_builder::trusted_networks
$firewall_service = $facts['os']['family'] ? { $firewall_service = $facts['os']['family'] ? {
'Debian' => 'netfilter-persistent.service', 'Debian' => 'netfilter-persistent.service',
default => undef default => undef
...@@ -22,12 +22,12 @@ class fw_builder::ipset ( ...@@ -22,12 +22,12 @@ class fw_builder::ipset (
class { 'ipset': class { 'ipset':
packages => $packages, packages => $packages,
package_ensure => $ipset_package_ensure, package_ensure => $fw_builder::ipset_package_ensure,
firewall_service => $firewall_service firewall_service => $firewall_service
} }
if ($ipv4_enable) { if ($ipv4_enable) {
$trusted_networks_v4 = $trusted_networks.filter |$ip_range| { $ip_range =~ Stdlib::IP::Address::V4 } $trusted_networks_v4 = $trusted_net.filter |$ip_range| { $ip_range =~ Stdlib::IP::Address::V4 }
ipset::set { 'trusted_networks_v4': ipset::set { 'trusted_networks_v4':
ensure => 'present', ensure => 'present',
type => 'hash:net', type => 'hash:net',
...@@ -36,7 +36,7 @@ class fw_builder::ipset ( ...@@ -36,7 +36,7 @@ class fw_builder::ipset (
} }
if ($ipv6_enable) { if ($ipv6_enable) {
$trusted_networks_v6 = $trusted_networks.filter |$ip_range| { $ip_range =~ Stdlib::IP::Address::V6 } $trusted_networks_v6 = $trusted_net.filter |$ip_range| { $ip_range =~ Stdlib::IP::Address::V6 }
ipset::set { 'trusted_networks_v6': ipset::set { 'trusted_networks_v6':
ensure => 'present', ensure => 'present',
type => 'hash:net', type => 'hash:net',
......
manifests/logrotate.pp
+ 3
− 3
View file @ 1f530aea
...@@ -6,15 +6,15 @@ ...@@ -6,15 +6,15 @@
# Massimiliano Adamo<massimiliano.adamo@geant.org> # Massimiliano Adamo<massimiliano.adamo@geant.org>
# #
class fw_builder::logrotate ( class fw_builder::logrotate (
$logging, $logging = $fw_builder::params::logging,
$log_rotation_days, $log_rotation_days = $fw_builder::params::log_rotation_days
) { ) {
assert_private() assert_private()
file { ['/var/log/iptables.log', '/var/log/ip6tables.log']: ensure => file; } file { ['/var/log/iptables.log', '/var/log/ip6tables.log']: ensure => file; }
if ($logging) { if ($fw_builder::logging) {
logrotate::rule { 'iptables': logrotate::rule { 'iptables':
rotate => $log_rotation_days, rotate => $log_rotation_days,
dateext => true, dateext => true,
......
manifests/params.pp 0 → 100644
+ 34
− 0
View file @ 1f530aea
# == Class: fw_builder
#
# == Authors:
#
# Pete Pedersen<pete.pedersen@geant.org>
# Massimiliano Adamo<massimiliano.adamo@geant.org>
#
class fw_builder::params {
# whether to purge rule not defined in puppet
$purge_rules = true
# avoid that docker rules are being overwritten if purge is set to true
$manage_docker = false
# enable iptables provider
$ipv4_enable = true
# enable ip6tables provider
$ipv6_enable = true
# enable logging
$logging = true
# define log retention daysn
$log_rotation_days = 7
# ipset package version
$ipset_package_ensure = 'present'
# whether to limit RST and dropped connections on post.pp
$limit = '1000/sec'
}
manifests/post.pp
+ 2
− 5
View file @ 1f530aea
# == Class: fw_builder::post # == Class: fw_builder::post
# #
class fw_builder::post ( class fw_builder::post (
$ipv4_enable, $logging = $fw_builder::params::logging
$ipv6_enable,
$logging,
$limit
) { ) {
assert_private() assert_private()
...@@ -16,7 +13,7 @@ class fw_builder::post ( ...@@ -16,7 +13,7 @@ class fw_builder::post (
chain => 'INPUT', chain => 'INPUT',
provider => $provider, provider => $provider,
jump => 'LOG', jump => 'LOG',
limit => $limit, limit => $fw_builder::limit,
log_level => '4'; log_level => '4';
"889 log RST dropped inbound chain for provider ${provider}": "889 log RST dropped inbound chain for provider ${provider}":
log_prefix => "[${provider.upcase()} RST RST] dropped"; log_prefix => "[${provider.upcase()} RST RST] dropped";
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment