Skip to content

Commit b0daa9d

Browse files
cmurphycmurphy
committed
Merge pull request #435 from mhaskel/squash_433
MODULES-1469 MODULES-1470 Support alias (eth0:0), negation for iniface, ...
2 parents 6b30817 + b6e58ba commit b0daa9d

File tree

6 files changed

+96
-11
lines changed

6 files changed

+96
-11
lines changed

‎README.markdown

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,13 @@ The rules in the `pre` and `post` classes are fairly general. These two classes
8686
iniface => 'lo',
8787
action => 'accept',
8888
}->
89-
firewall { '002 accept related established rules':
89+
firewall { "002 reject local traffic not on loopback interface":
90+
iniface => '! lo',
91+
proto => 'all',
92+
destination => '127.0.0.1/8',
93+
action => 'reject',
94+
}->
95+
firewall { '003 accept related established rules':
9096
proto => 'all',
9197
state => ['RELATED', 'ESTABLISHED'],
9298
action => 'accept',
@@ -201,7 +207,7 @@ class profile::apache {
201207
###Rule inversion
202208
Firewall rules may be inverted by prefixing the value of a parameter by "! ". If the value is an array, then every item in the array must be prefixed as iptables does not understand inverting a single value.
203209

204-
Parameters that understand inversion are: connmark, ctstate, destination, dport, dst\_range, dst\_type, port, proto, source, sport, src\_range, src\_type, and state.
210+
Parameters that understand inversion are: connmark, ctstate, destination, dport, dst\_range, dst\_type, iniface, outiface, port, proto, source, sport, src\_range, src\_type, and state.
205211

206212
Examples:
207213

@@ -440,7 +446,7 @@ If Puppet is managing the iptables or iptables-persistent packages, and the prov
440446

441447
* `icmp`: When matching ICMP packets, this indicates the type of ICMP packet to match. A value of 'any' is not supported. To match any type of ICMP packet, the parameter should be omitted or undefined. Requires the `icmp_match` feature.
442448

443-
* `iniface`: Input interface to filter on. Values must match '/^[a-zA-Z0-9\-\._\+]+$/'. Requires the `interface_match` feature.
449+
* `iniface`: Input interface to filter on. Values must match '/^!?\s?[a-zA-Z0-9\-\._\+\:]+$/'. Requires the `interface_match` feature. Supports interface alias (eth0:0) and negation.
444450

445451
* `ipsec_dir`: Sets the ipsec policy direction. Valid values are 'in', 'out'. Requires the `ipsec_dir` feature.
446452

@@ -485,7 +491,7 @@ firewall { '999 this runs last':
485491

486492
Depending on the provider, the name of the rule can be stored using the comment feature of the underlying firewall subsystem. Values must match '/^\d+[[:alpha:][:digit:][:punct:][:space:]]+$/'.
487493

488-
* `outiface`: Output interface to filter on. Values must match '/^[a-zA-Z0-9\-\._\+]+$/'. Requires the `interface_match` feature.
494+
* `outiface`: Output interface to filter on. Values must match '/^!?\s?[a-zA-Z0-9\-\._\+\:]+$/'. Requires the `interface_match` feature. Supports interface alias (eth0:0) and negation.
489495

490496
* `pkttype`: Sets the packet type to match. Valid values are: 'unicast', 'broadcast', and'multicast'. Requires the `pkttype` feature.
491497

‎lib/puppet/type/firewall.rb

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -428,16 +428,24 @@ def should_to_s(value)
428428
# Interface specific matching properties
429429
newproperty(:iniface, :required_features => :interface_match) do
430430
desc <<-EOS
431-
Input interface to filter on.
431+
Input interface to filter on. Supports interface alias like eth0:0.
432+
To negate the match try this:
433+
434+
iniface => '! lo',
435+
432436
EOS
433-
newvalues(/^[a-zA-Z0-9\-\._\+]+$/)
437+
newvalues(/^!?\s?[a-zA-Z0-9\-\._\+\:]+$/)
434438
end
435439

436440
newproperty(:outiface, :required_features => :interface_match) do
437441
desc <<-EOS
438-
Output interface to filter on.
442+
Output interface to filter on. Supports interface alias like eth0:0.
443+
To negate the match try this:
444+
445+
outiface => '! lo',
446+
439447
EOS
440-
newvalues(/^[a-zA-Z0-9\-\._\+]+$/)
448+
newvalues(/^!?\s?[a-zA-Z0-9\-\._\+\:]+$/)
441449
end
442450

443451
# NAT specific properties

‎spec/acceptance/rules_spec.rb

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,12 @@ class { '::firewall': }
146146
action => 'accept',
147147
before => Firewallchain['INPUT:filter:IPv4'],
148148
}
149+
firewall { "011 reject local traffic not on loopback interface":
150+
iniface => '! lo',
151+
proto => 'all',
152+
destination => '127.0.0.1/8',
153+
action => 'reject',
154+
}
149155
firewall { '012 accept loopback':
150156
iniface => 'lo',
151157
action => 'accept',
@@ -158,7 +164,14 @@ class { '::firewall': }
158164
action => 'accept',
159165
before => Firewallchain['INPUT:filter:IPv4'],
160166
}
161-
167+
firewall { '025 smtp':
168+
outiface => '! eth0:2',
169+
chain => 'OUTPUT',
170+
proto => 'tcp',
171+
dport => '25',
172+
state => 'NEW',
173+
action => 'accept',
174+
}
162175
firewall { '013 icmp echo-request':
163176
proto => 'icmp',
164177
icmp => 'echo-request',
@@ -175,12 +188,18 @@ class { '::firewall': }
175188
icmp => 'time-exceeded',
176189
action => 'accept',
177190
}
191+
firewall { '443 ssl on aliased interface':
192+
proto => 'tcp',
193+
dport => '443',
194+
state => 'NEW',
195+
action => 'accept',
196+
iniface => 'eth0:3',
197+
}
178198
firewall { '999 reject':
179199
action => 'reject',
180200
reject => 'icmp-host-prohibited',
181201
}
182202
183-
184203
firewallchain { 'LOCAL_INPUT_PRE:filter:IPv4': }
185204
firewall { '001 LOCAL_INPUT_PRE':
186205
jump => 'LOCAL_INPUT_PRE',
@@ -238,11 +257,14 @@ class { '::firewall': }
238257
/LOCAL_INPUT_PRE/,
239258
/-A INPUT -m comment --comment \"001 LOCAL_INPUT_PRE\" -j LOCAL_INPUT_PRE/,
240259
/-A INPUT -m comment --comment \"010 INPUT allow established and related\" -m state --state RELATED,ESTABLISHED -j ACCEPT/,
260+
/-A INPUT -d 127.0.0.0\/8 ! -i lo -m comment --comment \"011 reject local traffic not on loopback interface\" -j REJECT --reject-with icmp-port-unreachable/,
241261
/-A INPUT -i lo -m comment --comment \"012 accept loopback\" -j ACCEPT/,
242262
/-A INPUT -p icmp -m comment --comment \"013 icmp destination-unreachable\" -m icmp --icmp-type 3 -j ACCEPT/,
243263
/-A INPUT -s 10.0.0.0\/(8|255\.0\.0\.0) -p icmp -m comment --comment \"013 icmp echo-request\" -m icmp --icmp-type 8 -j ACCEPT/,
244264
/-A INPUT -p icmp -m comment --comment \"013 icmp time-exceeded\" -m icmp --icmp-type 11 -j ACCEPT/,
245265
/-A INPUT -p tcp -m multiport --dports 22 -m comment --comment \"020 ssh\" -m state --state NEW -j ACCEPT/,
266+
/-A OUTPUT ! -o eth0:2 -p tcp -m multiport --dports 25 -m comment --comment \"025 smtp\" -m state --state NEW -j ACCEPT/,
267+
/-A INPUT -i eth0:3 -p tcp -m multiport --dports 443 -m comment --comment \"443 ssl on aliased interface\" -m state --state NEW -j ACCEPT/,
246268
/-A INPUT -m comment --comment \"900 LOCAL_INPUT\" -j LOCAL_INPUT/,
247269
/-A INPUT -m comment --comment \"999 reject\" -j REJECT --reject-with icmp-host-prohibited/,
248270
/-A FORWARD -m comment --comment \"010 allow established and related\" -m state --state RELATED,ESTABLISHED -j ACCEPT/

‎spec/acceptance/standard_usage_spec.rb

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,12 @@ class my_fw::pre {
1919
iniface => 'lo',
2020
action => 'accept',
2121
}->
22-
firewall { '002 accept related established rules':
22+
firewall { "0002 reject local traffic not on loopback interface":
23+
iniface => '! lo',
24+
destination => '127.0.0.1/8',
25+
action => 'reject',
26+
}->
27+
firewall { '003 accept related established rules':
2328
proto => 'all',
2429
ctstate => ['RELATED', 'ESTABLISHED'],
2530
action => 'accept',

‎spec/fixtures/iptables/conversion_hash.rb

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -328,6 +328,24 @@
328328
:iniface => 'eth0',
329329
},
330330
},
331+
'iniface_1_negated' => {
332+
:line => '-A INPUT ! -i eth0 -m comment --comment "060 iniface" -j DROP',
333+
:table => 'filter',
334+
:params => {
335+
:action => 'drop',
336+
:chain => 'INPUT',
337+
:iniface => '! eth0',
338+
},
339+
},
340+
'iniface_1_aliased' => {
341+
:line => '-A INPUT -i eth0:1 -m comment --comment "060 iniface" -j DROP',
342+
:table => 'filter',
343+
:params => {
344+
:action => 'drop',
345+
:chain => 'INPUT',
346+
:iniface => 'eth0:1',
347+
},
348+
},
331349
'iniface_with_vlans_1' => {
332350
:line => '-A INPUT -i eth0.234 -m comment --comment "060 iniface" -j DROP',
333351
:table => 'filter',
@@ -355,6 +373,24 @@
355373
:outiface => 'eth0',
356374
},
357375
},
376+
'outiface_1_negated' => {
377+
:line => '-A OUTPUT ! -o eth0 -m comment --comment "060 outiface" -j DROP',
378+
:table => 'filter',
379+
:params => {
380+
:action => 'drop',
381+
:chain => 'OUTPUT',
382+
:outiface => '! eth0',
383+
},
384+
},
385+
'outiface_1_aliased' => {
386+
:line => '-A OUTPUT -o eth0:2 -m comment --comment "060 outiface" -j DROP',
387+
:table => 'filter',
388+
:params => {
389+
:action => 'drop',
390+
:chain => 'OUTPUT',
391+
:outiface => 'eth0:2',
392+
},
393+
},
358394
'outiface_with_vlans_1' => {
359395
:line => '-A OUTPUT -o eth0.234 -m comment --comment "060 outiface" -j DROP',
360396
:table => 'filter',

‎spec/unit/puppet/type/firewall_spec.rb

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,14 @@
208208
@resource[iface] = 'eth1'
209209
@resource[iface].should == 'eth1'
210210
end
211+
it "should accept a negated #{iface} value as a string" do
212+
@resource[iface] = '! eth1'
213+
@resource[iface].should == '! eth1'
214+
end
215+
it "should accept an interface alias for the #{iface} value as a string" do
216+
@resource[iface] = 'eth1:2'
217+
@resource[iface].should == 'eth1:2'
218+
end
211219
end
212220
end
213221

0 commit comments

Comments
 (0)