diff options
author | Micah <micah@leap.se> | 2016-05-24 10:19:26 -0400 |
---|---|---|
committer | Micah <micah@leap.se> | 2016-05-24 10:19:26 -0400 |
commit | b77078c4bac8dd2ecc00001696455c34c378f636 (patch) | |
tree | 9c35002726240c23243f9bfff78300d4f33550aa /puppet/modules/shorewall/manifests/rules/torify/reject_non_tor.pp | |
parent | 33640f86db0da8830bc8af1c56fc96ad465f7bf4 (diff) | |
parent | b0e1e4c82db3c70ddc67639a9b983de89b415477 (diff) |
Merge commit 'b0e1e4c82db3c70ddc67639a9b983de89b415477' as 'puppet/modules/shorewall'
Diffstat (limited to 'puppet/modules/shorewall/manifests/rules/torify/reject_non_tor.pp')
-rw-r--r-- | puppet/modules/shorewall/manifests/rules/torify/reject_non_tor.pp | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/puppet/modules/shorewall/manifests/rules/torify/reject_non_tor.pp b/puppet/modules/shorewall/manifests/rules/torify/reject_non_tor.pp new file mode 100644 index 00000000..80240ec7 --- /dev/null +++ b/puppet/modules/shorewall/manifests/rules/torify/reject_non_tor.pp @@ -0,0 +1,32 @@ +define shorewall::rules::torify::reject_non_tor( + $user = '-', + $originaldest = '-', + $allow_rfc1918 = true +){ + + # hash the destination as it may contain slashes + $originaldest_sha1 = sha1($originaldest) + $rule = "reject-non-tor-from-${user}-to=${originaldest_sha1}" + + if $originaldest == '-' { + $originaldest_real = $allow_rfc1918 ? { + false => '!127.0.0.1', + default => '!127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16', + } + } else { + $originaldest_real = $originaldest + } + + if !defined(Shorewall::Rule["$rule"]) { + shorewall::rule { + "$rule": + source => '$FW', + destination => 'all', + originaldest => $originaldest_real, + user => $user, + order => 120, + action => 'REJECT'; + } + } + +} |