From 9a46d35148fffc23ecd7db90d325b143052eabfb Mon Sep 17 00:00:00 2001 From: Ruben Kerkhof Date: Tue, 30 Aug 2011 13:08:57 +0200 Subject: [PATCH 1/3] Make module work on Scientific Linux --- lib/puppet/type/iptables.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/puppet/type/iptables.rb b/lib/puppet/type/iptables.rb index 1b73431..8a8910b 100644 --- a/lib/puppet/type/iptables.rb +++ b/lib/puppet/type/iptables.rb @@ -468,7 +468,7 @@ def finalize # Run iptables save to persist rules. The behaviour is to do nothing # if we no nothing of the operating system. persist_cmd = case Facter.value(:operatingsystem).downcase - when "fedora", "redhat", "centos" + when "fedora", "redhat", "centos", "scientific" then "/sbin/service iptables save" when "ubuntu", "debian" then "/sbin/iptables-save > /etc/iptables.rules" From 0dd684a9dbfbe7af63c5bdc5f60d9d0b0ff05959 Mon Sep 17 00:00:00 2001 From: Ruben Kerkhof Date: Tue, 30 Aug 2011 14:23:21 +0200 Subject: [PATCH 2/3] Enable use of the NOTRACK target in the raw table This allows you to disable connection tracking for a certain port. --- lib/puppet/type/iptables.rb | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/lib/puppet/type/iptables.rb b/lib/puppet/type/iptables.rb index 8a8910b..9c1ad9e 100644 --- a/lib/puppet/type/iptables.rb +++ b/lib/puppet/type/iptables.rb @@ -75,10 +75,10 @@ module Puppet newparam(:jump) do desc "holds value of iptables --jump target - Possible values are: 'ACCEPT', 'DROP', 'REJECT', 'DNAT', 'SNAT', 'LOG', 'MASQUERADE', 'REDIRECT'. + Possible values are: 'ACCEPT', 'DROP', 'REJECT', 'DNAT', 'SNAT', 'LOG', 'MASQUERADE', 'REDIRECT', 'NOTRACK'. Default value is 'ACCEPT'. While this is not the accepted norm, this is the more commonly used jump target. Users should ensure they do an explicit DROP for all packets after all the ACCEPT rules are specified." - newvalues(:ACCEPT, :DROP, :REJECT, :DNAT, :SNAT, :LOG, :MASQUERADE, :REDIRECT) + newvalues(:ACCEPT, :DROP, :REJECT, :DNAT, :SNAT, :LOG, :MASQUERADE, :REDIRECT, :NOTRACK) defaultto "ACCEPT" end @@ -362,7 +362,7 @@ def matched(data) nil end - # Load a file and using the passed in rules hash load the + # Load a file and using the passed in rules hash load the # rules contained therein. def load_rules_from_file(rules, file_name, action) if File.exist?(file_name) @@ -814,7 +814,7 @@ def initialize(args) end if value(:uid_owner).to_s != "" - strings[:uid_owner] = " -m owner --uid-owner " + value(:uid_owner).to_s + strings[:uid_owner] = " -m owner --uid-owner " + value(:uid_owner).to_s end if value(:limit).to_s != "" @@ -900,13 +900,18 @@ def initialize(args) if value(:redirect).to_s != "" strings[:redirect] = " --to-ports " + value(:redirect).to_s end + elsif value(:jump).to_s == "NOTRACK" + if value(:table).to_s != "raw" + invalidrule = true + err("NOTRACK only applies to table 'raw'.") + end end chain_prio = @@chain_order[value(:chain).to_s] # Generate a rule entry for each source permutation. sources.each { |source| - + # Build a string of arguments in the required order. rule_string = "%s" * 21 % [ strings[:table], @@ -932,7 +937,7 @@ def initialize(args) strings[:log_prefix], strings[:redirect] ] - + debug("iptables param: #{rule_string}") if invalidrule != true @@rules[table].push({ From 7d042b091b11f7021cad242e44f38a0942857689 Mon Sep 17 00:00:00 2001 From: Ruben Kerkhof Date: Tue, 30 Aug 2011 18:46:07 +0200 Subject: [PATCH 3/3] Fix match on limit module --- lib/puppet/type/iptables.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/puppet/type/iptables.rb b/lib/puppet/type/iptables.rb index 9c1ad9e..7c12824 100644 --- a/lib/puppet/type/iptables.rb +++ b/lib/puppet/type/iptables.rb @@ -292,7 +292,7 @@ def load_current_rules(numbered = false) name = self.matched(l.scan(/--comment (\S+)/)) - limit = self.matched(l.scan(/--limit (\S+)/)) + limit = self.matched(l.scan(/-m --limit (\S+)/)) limit = "" unless limit burst = self.matched(l.scan(/--limit-burst (\S+)/))