Merge branch 'develop' (0.5.0)

Conflicts:
	.gitignore

Change-Id: I778f3e1f1f4832f5894bc149ead67e9a4becf304

5 files changed, 97 insertions, 3 deletions

diff --git a/puppet/modules/site_shorewall/manifests/defaults.pp b/puppet/modules/site_shorewall/manifests/defaults.pp
index c62c9307..8f56ac42 100644
--- a/puppet/modules/site_shorewall/manifests/defaults.pp
+++ b/puppet/modules/site_shorewall/manifests/defaults.pp
@@ -1,9 +1,12 @@
 class site_shorewall::defaults {
+
   include shorewall
   include site_config::params
 
   # be safe for development
-  #if ( $::virtual == 'virtualbox') { $shorewall_startup='0' }
+  # if ( $::site_config::params::environment == 'local' ) {
+  #  $shorewall_startup='0'
+  # }
 
   # If you want logging:
   shorewall::params {
@@ -18,8 +21,6 @@ class site_shorewall::defaults {
     options   => 'tcpflags,blacklist,nosmurfs';
   }
 
-  shorewall::routestopped { $site_config::params::interface: }
-
   shorewall::policy {
     'fw-to-all':
       sourcezone      => 'fw',
@@ -42,5 +43,32 @@ class site_shorewall::defaults {
         order       => 200;
   }
 
+  package { 'shorewall-init':
+    ensure => installed
+  }
+
+  augeas {
+    # stop instead of clear firewall on shutdown
+    'shorewall_SAFESTOP':
+      changes => 'set /files/etc/shorewall/shorewall.conf/SAFESTOP Yes',
+      lens    => 'Shellvars.lns',
+      incl    => '/etc/shorewall/shorewall.conf',
+      require => Package['shorewall'],
+      notify  => Service[shorewall];
+    # require that the interface exist
+    'shorewall_REQUIRE_INTERFACE':
+      changes => 'set /files/etc/shorewall/shorewall.conf/REQUIRE_INTERFACE Yes',
+      lens    => 'Shellvars.lns',
+      incl    => '/etc/shorewall/shorewall.conf',
+      require => Package['shorewall'],
+      notify  => Service[shorewall];
+    # configure shorewall-init
+    'shorewall-init':
+      changes => 'set /files/etc/default/shorewall-init/PRODUCTS shorewall',
+      lens    => 'Shellvars.lns',
+      incl    => '/etc/default/shorewall-init',
+      require => [ Package['shorewall-init'], Service['shorewall'] ]
+  }
+
   include site_shorewall::sshd
 }
diff --git a/puppet/modules/site_shorewall/manifests/mx.pp b/puppet/modules/site_shorewall/manifests/mx.pp
new file mode 100644
index 00000000..332f164e
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/mx.pp
@@ -0,0 +1,24 @@
+class site_shorewall::mx {
+
+  include site_shorewall::defaults
+
+  $smtpd_ports = '25,465,587'
+
+  # define macro for incoming services
+  file { '/etc/shorewall/macro.leap_mx':
+    content => "PARAM   -       -       tcp    ${smtpd_ports} ",
+    notify  => Service['shorewall'],
+    require => Package['shorewall']
+  }
+
+
+  shorewall::rule {
+      'net2fw-mx':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'leap_mx(ACCEPT)',
+        order       => 200;
+  }
+
+  include site_shorewall::service::smtp
+}
diff --git a/puppet/modules/site_shorewall/manifests/service/smtp.pp b/puppet/modules/site_shorewall/manifests/service/smtp.pp
new file mode 100644
index 00000000..7fbdf14e
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/service/smtp.pp
@@ -0,0 +1,13 @@
+class site_shorewall::service::smtp {
+
+  include site_shorewall::defaults
+
+  shorewall::rule {
+      'fw2net-http':
+        source      => '$FW',
+        destination => 'net',
+        action      => 'SMTP(ACCEPT)',
+        order       => 200;
+  }
+
+}
diff --git a/puppet/modules/site_shorewall/manifests/soledad.pp b/puppet/modules/site_shorewall/manifests/soledad.pp
new file mode 100644
index 00000000..518d8689
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/soledad.pp
@@ -0,0 +1,23 @@
+class site_shorewall::soledad {
+
+  $soledad      = hiera('soledad')
+  $soledad_port = $soledad['port']
+
+  include site_shorewall::defaults
+
+  # define macro for incoming services
+  file { '/etc/shorewall/macro.leap_soledad':
+    content => "PARAM   -       -       tcp    ${soledad_port}",
+    notify  => Service['shorewall'],
+    require => Package['shorewall']
+  }
+
+  shorewall::rule {
+    'net2fw-soledad':
+      source      => 'net',
+      destination => '$FW',
+      action      => 'leap_soledad(ACCEPT)',
+      order       => 200;
+  }
+}
+
diff --git a/puppet/modules/site_shorewall/manifests/sshd.pp b/puppet/modules/site_shorewall/manifests/sshd.pp
index a8e09e42..88b4102c 100644
--- a/puppet/modules/site_shorewall/manifests/sshd.pp
+++ b/puppet/modules/site_shorewall/manifests/sshd.pp
@@ -21,4 +21,10 @@ class site_shorewall::sshd {
         action      => 'leap_sshd(ACCEPT)',
         order       => 200;
   }
+
+  # setup a routestopped rule to allow ssh when shorewall is stopped
+  shorewall::routestopped { $site_config::params::interface:
+    options => "-   tcp   ${ssh_port}"
+  }
+
 }