diff options
| author | Micah Anderson <micah@riseup.net> | 2015-05-08 16:07:30 -0400 |
|---|---|---|
| committer | Micah Anderson <micah@riseup.net> | 2015-05-08 16:07:30 -0400 |
| commit | 77ce0b926b7418703223b4a6c489067f9d9bc4f5 (patch) | |
| tree | 26892e3f801b3f32444a2bb494823f0e37c305e0 /manifests | |
| parent | 8a549b74ff01e4b8076f9e183526ba385c9d8f5a (diff) | |
| parent | 74ea10a6a1d4f4c1624d85d3d3795eaf819df10c (diff) | |
Merge branch 'master' into riseup
Diffstat (limited to 'manifests')
| -rw-r--r-- | manifests/init.pp | 2 | ||||
| -rw-r--r-- | manifests/mangle.pp | 19 | ||||
| -rw-r--r-- | manifests/rules/libvirt/host.pp | 11 | ||||
| -rw-r--r-- | manifests/rules/munin.pp | 4 |
4 files changed, 34 insertions, 2 deletions
diff --git a/manifests/init.pp b/manifests/init.pp index cd6488b..a567564 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -68,6 +68,8 @@ class shorewall( 'tunnel', # See http://www.shorewall.net/MultiISP.html 'rtrules', + # See http://www.shorewall.net/manpages/shorewall-mangle.html + 'mangle', ]:; } } diff --git a/manifests/mangle.pp b/manifests/mangle.pp new file mode 100644 index 0000000..e3fd1b3 --- /dev/null +++ b/manifests/mangle.pp @@ -0,0 +1,19 @@ +define shorewall::mangle( + $source, + $destination, + $proto = '-', + $destinationport = '-', + $sourceport = '-', + $user = '-', + $test = '-', + $length = '-', + $tos = '-', + $connbytes = '-', + $helper = '-', + $headers = '-', + $order = '100' +){ + shorewall::entry{"mangle-${order}-${name}": + line => "${name} ${source} ${destination} ${proto} ${destinationport} ${sourceport} ${user} ${test} ${length} ${tos} ${connbytes} ${helper} ${headers}" + } +} diff --git a/manifests/rules/libvirt/host.pp b/manifests/rules/libvirt/host.pp index dfb753c..c226865 100644 --- a/manifests/rules/libvirt/host.pp +++ b/manifests/rules/libvirt/host.pp @@ -2,6 +2,8 @@ class shorewall::rules::libvirt::host ( $vmz = 'vmz', $masq_iface = 'eth0', $debproxy_port = 8000, + $accept_dhcp = true, + $vmz_iface = 'virbr0', ) { define shorewall::rule::accept::from_vmz ( @@ -49,6 +51,15 @@ class shorewall::rules::libvirt::host ( action => 'ACCEPT'; } + if $accept_dhcp { + shorewall::mangle { 'CHECKSUM:T': + source => '-', + destination => $vmz_iface, + proto => 'udp', + destinationport => '68'; + } + } + if $debproxy_port { shorewall::rule::accept::from_vmz { 'accept_debproxy_from_vmz': proto => 'tcp', diff --git a/manifests/rules/munin.pp b/manifests/rules/munin.pp index 0c86abe..a20a4e0 100644 --- a/manifests/rules/munin.pp +++ b/manifests/rules/munin.pp @@ -1,10 +1,10 @@ class shorewall::rules::munin( $munin_port = '4949', - $munin_collector = '127.0.0.1', + $munin_collector = ['127.0.0.1'], $collector_source = 'net' ){ shorewall::params { 'MUNINPORT': value => $munin_port } - shorewall::params { 'MUNINCOLLECTOR': value => join($munin_collector,',') } + shorewall::params { 'MUNINCOLLECTOR': value => join(any2array($munin_collector),',') } shorewall::rule{'net-me-munin-tcp': source => "${collector_source}:\$MUNINCOLLECTOR", destination => '$FW', |