git subrepo clone --force https://leap.se/git/puppet_shorewall puppet/modules/shorewall

subrepo:
  subdir:   "puppet/modules/shorewall"
  merged:   "06e89ed"
upstream:
  origin:   "https://leap.se/git/puppet_shorewall"
  branch:   "master"
  commit:   "06e89ed"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo.git"
  commit:   "cb2995b"

11 files changed, 177 insertions, 80 deletions

diff --git a/puppet/modules/shorewall/manifests/rules/dns.pp b/puppet/modules/shorewall/manifests/rules/dns.pp
index 99311cae..e775eeed 100644
--- a/puppet/modules/shorewall/manifests/rules/dns.pp
+++ b/puppet/modules/shorewall/manifests/rules/dns.pp
@@ -1,18 +1,6 @@
+# open dns port
 class shorewall::rules::dns {
-    shorewall::rule {
-        'net-me-tcp_dns':
-                        source          =>      'net',
-                        destination     =>      '$FW',
-                        proto           =>      'tcp',
-                        destinationport =>      '53',
-                        order           =>      240,
-                        action          =>      'ACCEPT';
-        'net-me-udp_dns':
-                        source          =>      'net',
-                        destination     =>      '$FW',
-                        proto           =>      'udp',
-                        destinationport =>      '53',
-                        order           =>      240,
-                        action          =>      'ACCEPT';
-    }
+  shorewall::rules::dns_rules{
+    'net':
+  }
 }
diff --git a/puppet/modules/shorewall/manifests/rules/dns/disable.pp b/puppet/modules/shorewall/manifests/rules/dns/disable.pp
index 36541da4..7de923bd 100644
--- a/puppet/modules/shorewall/manifests/rules/dns/disable.pp
+++ b/puppet/modules/shorewall/manifests/rules/dns/disable.pp
@@ -1,5 +1,6 @@
+# disable dns acccess
 class shorewall::rules::dns::disable inherits shorewall::rules::dns {
-  Shorewall::Rule['net-me-tcp_dns', 'net-me-udp_dns']{
-        action  => 'DROP',
-    }
+  Shorewall::Rules::Dns_rules['net']{
+    action  => 'DROP',
+  }
 }
diff --git a/puppet/modules/shorewall/manifests/rules/dns_rules.pp b/puppet/modules/shorewall/manifests/rules/dns_rules.pp
new file mode 100644
index 00000000..abe0eb5a
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/dns_rules.pp
@@ -0,0 +1,22 @@
+# open dns port
+define shorewall::rules::dns_rules(
+  $source = $name,
+  $action = 'ACCEPT',
+) {
+  shorewall::rule {
+    "${source}-me-tcp_dns":
+      source          => $source,
+      destination     => '$FW',
+      proto           => 'tcp',
+      destinationport => '53',
+      order           => 240,
+      action          => $action;
+    "${source}-me-udp_dns":
+      source          => $source,
+      destination     => '$FW',
+      proto           => 'udp',
+      destinationport => '53',
+      order           => 240,
+      action          => $action;
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/ipsec.pp b/puppet/modules/shorewall/manifests/rules/ipsec.pp
index 82adff09..413406e1 100644
--- a/puppet/modules/shorewall/manifests/rules/ipsec.pp
+++ b/puppet/modules/shorewall/manifests/rules/ipsec.pp
@@ -1,32 +1,32 @@
-class shorewall::rules::ipsec(
-  $source = 'net'
-) {
-    shorewall::rule {
-      'net-me-ipsec-udp':
-        source          => $shorewall::rules::ipsec::source,
-        destination     => '$FW',
-        proto           => 'udp',
-        destinationport => '500',
-        order           => 240,
-        action          => 'ACCEPT';
-      'me-net-ipsec-udp':
-        source          => '$FW',
-        destination     => $shorewall::rules::ipsec::source,
-        proto           => 'udp',
-        destinationport => '500',
-        order           => 240,
-        action          => 'ACCEPT';
-      'net-me-ipsec':
-        source          => $shorewall::rules::ipsec::source,
-        destination     => '$FW',
-        proto           => 'esp',
-        order           => 240,
-        action          => 'ACCEPT';
-      'me-net-ipsec':
-        source          => '$FW',
-        destination     => $shorewall::rules::ipsec::source,
-        proto           => 'esp',
-        order           => 240,
-        action          => 'ACCEPT';
-    }
+# manage ipsec rules for zone specified in
+# $name
+define shorewall::rules::ipsec() {
+  shorewall::rule {
+    "${name}-me-ipsec-udp":
+      source          => $name,
+      destination     => '$FW',
+      proto           => 'udp',
+      destinationport => '500',
+      order           => 240,
+      action          => 'ACCEPT';
+    "me-${name}-ipsec-udp":
+      source          => '$FW',
+      destination     => $name,
+      proto           => 'udp',
+      destinationport => '500',
+      order           => 240,
+      action          => 'ACCEPT';
+    "${name}-me-ipsec":
+      source          => $name,
+      destination     => '$FW',
+      proto           => 'esp',
+      order           => 240,
+      action          => 'ACCEPT';
+    "me-${name}-ipsec":
+      source          => '$FW',
+      destination     => $name,
+      proto           => 'esp',
+      order           => 240,
+      action          => 'ACCEPT';
+  }
 }
diff --git a/puppet/modules/shorewall/manifests/rules/jabberserver.pp b/puppet/modules/shorewall/manifests/rules/jabberserver.pp
index 3b38b294..226d6274 100644
--- a/puppet/modules/shorewall/manifests/rules/jabberserver.pp
+++ b/puppet/modules/shorewall/manifests/rules/jabberserver.pp
@@ -1,19 +1,34 @@
-class shorewall::rules::jabberserver {
+# open ports used by a jabberserver
+# in and outbound.
+class shorewall::rules::jabberserver(
+  $open_stun = true,
+) {
   shorewall::rule {
     'net-me-tcp_jabber':
-            source          => 'net',
-            destination     => '$FW',
-            proto           => 'tcp',
-            destinationport => '5222,5223,5269',
-            order           => 240,
-            action          => 'ACCEPT';
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '5222,5223,5269',
+        order           => 240,
+        action          => 'ACCEPT';
     'me-net-tcp_jabber_s2s':
-            source          => '$FW',
-            destination     => 'net',
-            proto           => 'tcp',
-            destinationport => '5260,5269,5270,5271,5272',
-            order           => 240,
-            action          => 'ACCEPT';
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '5260,5269,5270,5271,5272',
+        order           => 240,
+        action          => 'ACCEPT';
   }
 
+  if $open_stun {
+    shorewall::rule {
+      'net-me-udp_jabber_stun_server':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '3478',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+  }
 }
diff --git a/puppet/modules/shorewall/manifests/rules/libvirt/host.pp b/puppet/modules/shorewall/manifests/rules/libvirt/host.pp
index c2268659..dc3970d1 100644
--- a/puppet/modules/shorewall/manifests/rules/libvirt/host.pp
+++ b/puppet/modules/shorewall/manifests/rules/libvirt/host.pp
@@ -52,7 +52,8 @@ class shorewall::rules::libvirt::host (
   }
 
   if $accept_dhcp {
-    shorewall::mangle { 'CHECKSUM:T':
+    shorewall::mangle { "CHECKSUM:T_${vmz_iface}":
+      action          => 'CHECKSUM:T',
       source          => '-',
       destination     => $vmz_iface,
       proto           => 'udp',
diff --git a/puppet/modules/shorewall/manifests/rules/managesieve.pp b/puppet/modules/shorewall/manifests/rules/managesieve.pp
index 63fafcb6..ce1c321f 100644
--- a/puppet/modules/shorewall/manifests/rules/managesieve.pp
+++ b/puppet/modules/shorewall/manifests/rules/managesieve.pp
@@ -1,11 +1,25 @@
-class shorewall::rules::managesieve {
+# manage managesieve ports
+class shorewall::rules::managesieve(
+  $legacy_port = false,
+) {
+  shorewall::rule {
+    'net-me-tcp_managesieve':
+      source          =>      'net',
+      destination     =>      '$FW',
+      proto           =>      'tcp',
+      destinationport =>      '4190',
+      order           =>      260,
+      action          =>      'ACCEPT';
+  }
+  if $legacy_port {
     shorewall::rule {
-        'net-me-tcp_managesieve':
-            source          =>      'net',
-            destination     =>      '$FW',
-            proto           =>      'tcp',
-            destinationport =>      '2000',
-            order           =>      260,
-            action          =>      'ACCEPT';
+      'net-me-tcp_managesieve_legacy':
+        source          =>      'net',
+        destination     =>      '$FW',
+        proto           =>      'tcp',
+        destinationport =>      '2000',
+        order           =>      260,
+        action          =>      'ACCEPT';
     }
+  }
 }
diff --git a/puppet/modules/shorewall/manifests/rules/openvpn.pp b/puppet/modules/shorewall/manifests/rules/openvpn.pp
new file mode 100644
index 00000000..55a20d2d
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/openvpn.pp
@@ -0,0 +1,18 @@
+class shorewall::rules::openvpn {
+    shorewall::rule { 'net-me-openvpn-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '1194',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'me-net-openvpn-udp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'udp',
+        destinationport => '1194',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/managesieve.pp b/puppet/modules/shorewall/manifests/rules/out/managesieve.pp
index b0e1c3da..c4147d4b 100644
--- a/puppet/modules/shorewall/manifests/rules/out/managesieve.pp
+++ b/puppet/modules/shorewall/manifests/rules/out/managesieve.pp
@@ -1,11 +1,25 @@
-class shorewall::rules::out::managesieve {
+# manage outgoing traffic to managesieve
+class shorewall::rules::out::managesieve(
+  $legacy_port = false
+) {
+  shorewall::rule {
+    'me-net-tcp_managesieve':
+      source          =>      '$FW',
+      destination     =>      'net',
+      proto           =>      'tcp',
+      destinationport =>      '4190',
+      order           =>      260,
+      action          =>      'ACCEPT';
+  }
+  if $legacy_port {
     shorewall::rule {
-        'me-net-tcp_managesieve':
-            source          =>      '$FW',
-            destination     =>      'net',
-            proto           =>      'tcp',
-            destinationport =>      '2000',
-            order           =>      260,
-            action          =>      'ACCEPT';
+      'me-net-tcp_managesieve_legacy':
+        source          =>      '$FW',
+        destination     =>      'net',
+        proto           =>      'tcp',
+        destinationport =>      '2000',
+        order           =>      260,
+        action          =>      'ACCEPT';
     }
+  }
 }
diff --git a/puppet/modules/shorewall/manifests/rules/out/pyzor.pp b/puppet/modules/shorewall/manifests/rules/out/pyzor.pp
new file mode 100644
index 00000000..f4f5151a
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/pyzor.pp
@@ -0,0 +1,12 @@
+# pyzor calls out on 24441
+# https://wiki.apache.org/spamassassin/NetTestFirewallIssues
+class shorewall::rules::out::pyzor {
+  shorewall::rule { 'me-net-udp_pyzor':
+    source          => '$FW',
+    destination     => 'net',
+    proto           => 'udp',
+    destinationport => '24441',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/razor.pp b/puppet/modules/shorewall/manifests/rules/out/razor.pp
new file mode 100644
index 00000000..1f8397ce
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/razor.pp
@@ -0,0 +1,12 @@
+# razor calls out on 2703
+# https://wiki.apache.org/spamassassin/NetTestFirewallIssues
+class shorewall::rules::out::razor {
+  shorewall::rule { 'me-net-tcp_razor':
+    source          => '$FW',
+    destination     => 'net',
+    proto           => 'tcp',
+    destinationport => '2703',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}