summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--README126
-rw-r--r--files/boilerplate/clear.footer1
-rw-r--r--files/boilerplate/clear.header13
-rw-r--r--files/boilerplate/continue.footer1
-rw-r--r--files/boilerplate/continue.header14
-rw-r--r--files/boilerplate/init.footer1
-rw-r--r--files/boilerplate/init.header13
-rw-r--r--files/boilerplate/initdone.footer1
-rw-r--r--files/boilerplate/initdone.header14
-rw-r--r--files/boilerplate/maclog.footer1
-rw-r--r--files/boilerplate/maclog.header14
-rw-r--r--files/boilerplate/start.footer1
-rw-r--r--files/boilerplate/start.header12
-rw-r--r--files/boilerplate/started.footer1
-rw-r--r--files/boilerplate/started.header20
-rw-r--r--files/boilerplate/stop.footer1
-rw-r--r--files/boilerplate/stop.header13
-rw-r--r--files/boilerplate/stopped.footer1
-rw-r--r--files/boilerplate/stopped.header13
-rw-r--r--files/boilerplate/tcclasses.footer1
-rw-r--r--files/boilerplate/tcclasses.header9
-rw-r--r--files/boilerplate/tcdevices.footer1
-rw-r--r--files/boilerplate/tcdevices.header10
-rw-r--r--files/boilerplate/tcrules.footer1
-rw-r--r--files/boilerplate/tcrules.header15
-rw-r--r--files/shorewall.conf.Debian.wheezy216
-rw-r--r--manifests/base.pp2
-rw-r--r--manifests/extension_script.pp14
-rw-r--r--manifests/init.pp40
-rw-r--r--manifests/interface.pp28
-rw-r--r--manifests/routestopped.pp8
-rw-r--r--manifests/rules/libvirt/host.pp46
-rw-r--r--manifests/rules/mdns.pp8
-rw-r--r--manifests/rules/torify.pp31
-rw-r--r--manifests/rules/torify/allow_tor_transparent_proxy.pp21
-rw-r--r--manifests/rules/torify/non_torified_user.pp25
-rw-r--r--manifests/rules/torify/non_torified_users.pp9
-rw-r--r--manifests/rules/torify/redirect_dns_to_tor.pp38
-rw-r--r--manifests/rules/torify/redirect_tcp_to_tor.pp35
-rw-r--r--manifests/rules/torify/reject_non_tor.pp32
-rw-r--r--manifests/rules/torify/user.pp23
-rw-r--r--manifests/tcclasses.pp12
-rw-r--r--manifests/tcdevices.pp11
-rw-r--r--manifests/tcrules.pp12
44 files changed, 880 insertions, 29 deletions
diff --git a/README b/README
index f6d9b99..07c50f2 100644
--- a/README
+++ b/README
@@ -1,20 +1,128 @@
+modules/shorewall/manifests/init.pp - manage firewalling with shorewall 3.x
+
Puppet Module for Shorewall
---------------------------
This module manages the configuration of Shorewall (http://www.shorewall.net/)
-Versions
---------
-- forked from http://git.puppet.immerda.ch/?p=module-shorewall.git;a=summary
+Copyright
+---------
+
+Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at>
+adapted by immerda project group - admin+puppet(at)immerda.ch
+adapted by Puzzle ITC - haerry+puppet(at)puzzle.ch
+Copyright (c) 2009 Riseup Networks - micah(shift+2)riseup.net
+Copyright (c) 2010 intrigeri - intrigeri(at)boum.org
+See LICENSE for the full license granted to you.
+
+Based on the work of ADNET Ghislain <gadnet@aqueos.com> from AQUEOS
+at https://reductivelabs.com/trac/puppet/wiki/AqueosShorewall
+
+Merged from:
+- git://git.puppet.immerda.ch/module-shorewall.git
+- git://labs.riseup.net/module_shorewall
Todo
----
- check if shorewall compiles without errors, otherwise fail !
+Configuration
+-------------
+
+If you need to install a specific version of shorewall other than
+the default one that would be installed by 'ensure => present', then
+you can set the following variable and that specific version will be
+installed instead:
+
+ $shorewall_ensure_version = "4.0.15-1"
+
Documentation
-------------
see also: http://reductivelabs.com/trac/puppet/wiki/Recipes/AqueosShorewall
-
+
+Torify
+------
+
+The shorewall::rules::torify define can be used to force some outgoing
+TCP traffic through the Tor transparent proxy. The corresponding
+non-TCP traffic is rejected accordingly.
+
+Beware! This define only is part of a torified setup. DNS requests and
+IPv6, amongst others, might leak network activity you would prefer not
+to. You really need to read proper documentation about these matters
+before using this feature e.g.:
+
+ https://www.torproject.org/download/download.html.en#warning
+
+The Tor transparent proxy location defaults to 127.0.0.1:9040 and can
+be configured by setting the $tor_transparent_proxy_host and
+$tor_transparent_proxy_port variables before including the main
+shorewall class.
+
+Example usage follows.
+
+Torify any outgoing TCP traffic originating from user bob or alice and
+aimed at 6.6.6.6 or 7.7.7.7:
+
+ shorewall::rules::torify {
+ 'torify-some-bits':
+ users => [ 'bob', 'alice' ],
+ destinations => [ '6.6.6.6', '7.7.7.7' ];
+ }
+
+Torify any outgoing TCP traffic to 8.8.8.8:
+
+ shorewall::rules::torify {
+ 'torify-to-this-host':
+ destinations => [ '8.8.8.8' ];
+ }
+
+When no destination nor user is provided any outgoing TCP traffic (see
+restrictions bellow) is torified. In that case the user running the
+Tor client ($tor_user) is whitelisted; this variable defaults to
+"debian-tor" on Debian systems and to "tor" on others. if this does
+not suit your configuration you need to set the $tor_user variable
+before including the main shorewall class.
+
+When no destination is provided traffic directed to RFC1918 addresses
+is by default allowed and (obviously) not torified. This behaviour can
+be changed by setting the allow_rfc1918 parameter to false.
+
+Torify any outgoing TCP traffic but
+ - connections to RFC1918 addresses
+ - connections from users bob and alice:
+
+ $non_torified_users = [ 'bob', 'alice' ]
+ shorewall::rules::torify {
+ 'torify-everything-but-lan':
+ }
+
+Torify any outgoing TCP traffic:
+
+ shorewall::rules::torify {
+ 'torify-everything:
+ allow_rfc1918 => false;
+ }
+
+In some cases (e.g. when providing no specific destination nor user
+and denying access to RFC1918 addresses) UDP DNS requests may be
+rejected. This is intentional: it does not make sense leaking -via DNS
+requests- network activity that would otherwise be torified. In that
+case you probably want to read proper documentation about such
+matters, enable the Tor DNS resolver and redirect DNS requests through
+it,
+
+either globally:
+
+ shorewall::rules::torify::redirect_dns_to_tor { '-': }
+
+or for specific users:
+
+ shorewall::rules::torify::redirect_dns_to_tor { ['bob', 'alice' ]: }
+
+The $tor_dns_host and $tor_dns_port variables must be set before
+these defines are setup.
+
Example
-------
@@ -25,10 +133,10 @@ node xy {
startup => "0" # create shorewall ruleset but don't startup
}
shorewall::rule {
- 'incoming-ssh': source => 'all', destination => '$FW', action => 'SSH/ACCEPT', order => 200;
- 'incoming-puppetmaster': source => 'all', destination => '$FW', action => 'Puppetmaster/ACCEPT', order => 300;
- 'incoming-imap': source => 'all', destination => '$FW', action => 'IMAP/ACCEPT', order => 300;
- 'incoming-smtp': source => 'all', destination => '$FW', action => 'SMTP/ACCEPT', order => 300;
+ 'incoming-ssh': source => 'all', destination => '$FW', action => 'SSH(ACCEPT)', order => 200;
+ 'incoming-puppetmaster': source => 'all', destination => '$FW', action => 'Puppetmaster(ACCEPT)', order => 300;
+ 'incoming-imap': source => 'all', destination => '$FW', action => 'IMAP(ACCEPT)', order => 300;
+ 'incoming-smtp': source => 'all', destination => '$FW', action => 'SMTP(ACCEPT)', order => 300;
}
}
@@ -84,7 +192,7 @@ class config::site_shorewall($startup = '1') {
source => 'all',
destination => '$FW',
order => 200,
- action => 'AllowICMPs/ACCEPT';
+ action => 'AllowICMPs/(ACCEPT)';
}
}
diff --git a/files/boilerplate/clear.footer b/files/boilerplate/clear.footer
new file mode 100644
index 0000000..662ac1c
--- /dev/null
+++ b/files/boilerplate/clear.footer
@@ -0,0 +1 @@
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/files/boilerplate/clear.header b/files/boilerplate/clear.header
new file mode 100644
index 0000000..6a39b0b
--- /dev/null
+++ b/files/boilerplate/clear.header
@@ -0,0 +1,13 @@
+#
+# Shorewall version 4 - Clear
+#
+# /etc/shorewall/stop
+#
+# Add commands below that you want to be executed at the beginning of a
+# "shorewall stop" command.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/files/boilerplate/continue.footer b/files/boilerplate/continue.footer
new file mode 100644
index 0000000..662ac1c
--- /dev/null
+++ b/files/boilerplate/continue.footer
@@ -0,0 +1 @@
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/files/boilerplate/continue.header b/files/boilerplate/continue.header
new file mode 100644
index 0000000..d2ee48a
--- /dev/null
+++ b/files/boilerplate/continue.header
@@ -0,0 +1,14 @@
+#
+# Shorewall version 4 - Continue File
+#
+# /etc/shorewall/continue
+#
+# Add commands below that you want to be executed after shorewall has
+# cleared any existing Netfilter rules and has enabled existing
+# connections.
+#
+# For additional information, see
+# http://shorewall.net/shorewall_extension_scripts.htm
+#
+###############################################################################
+
diff --git a/files/boilerplate/init.footer b/files/boilerplate/init.footer
new file mode 100644
index 0000000..662ac1c
--- /dev/null
+++ b/files/boilerplate/init.footer
@@ -0,0 +1 @@
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/files/boilerplate/init.header b/files/boilerplate/init.header
new file mode 100644
index 0000000..cbb0393
--- /dev/null
+++ b/files/boilerplate/init.header
@@ -0,0 +1,13 @@
+#
+# Shorewall version 4 - Init File
+#
+# /etc/shorewall/init
+#
+# Add commands below that you want to be executed at the beginning of
+# a "shorewall start" or "shorewall restart" command.
+#
+# For additional information, see
+# http://shorewall.net/shorewall_extension_scripts.htm
+#
+###############################################################################
+
diff --git a/files/boilerplate/initdone.footer b/files/boilerplate/initdone.footer
new file mode 100644
index 0000000..662ac1c
--- /dev/null
+++ b/files/boilerplate/initdone.footer
@@ -0,0 +1 @@
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/files/boilerplate/initdone.header b/files/boilerplate/initdone.header
new file mode 100644
index 0000000..9252a3b
--- /dev/null
+++ b/files/boilerplate/initdone.header
@@ -0,0 +1,14 @@
+#
+# Shorewall version 4 - Initdone File
+#
+# /etc/shorewall/initdone
+#
+# Add commands below that you want to be executed during
+# "shorewall start" or "shorewall restart" commands at the point where
+# Shorewall has not yet added any perminent rules to the builtin chains.
+#
+# For additional information, see
+# http://shorewall.net/shorewall_extension_scripts.htm
+#
+###############################################################################
+
diff --git a/files/boilerplate/maclog.footer b/files/boilerplate/maclog.footer
new file mode 100644
index 0000000..5e12d1d
--- /dev/null
+++ b/files/boilerplate/maclog.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/files/boilerplate/maclog.header b/files/boilerplate/maclog.header
new file mode 100644
index 0000000..b0c382a
--- /dev/null
+++ b/files/boilerplate/maclog.header
@@ -0,0 +1,14 @@
+#
+# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5)
+#
+# /etc/shorewall/start
+#
+# Add commands below that you want executed while mac filtering rules are
+# being created. These will be executed once for each interface having
+# 'maclist' speciied and it is invoked just before the logging rule is
+# added to the current chain (the name of that chain will be in $CHAIN)
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
diff --git a/files/boilerplate/start.footer b/files/boilerplate/start.footer
new file mode 100644
index 0000000..5e12d1d
--- /dev/null
+++ b/files/boilerplate/start.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/files/boilerplate/start.header b/files/boilerplate/start.header
new file mode 100644
index 0000000..689dff1
--- /dev/null
+++ b/files/boilerplate/start.header
@@ -0,0 +1,12 @@
+#
+# Shorewall version 4 - Start File
+#
+# /etc/shorewall/start
+#
+# Add commands below that you want to be executed after shorewall has
+# been started or restarted.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
diff --git a/files/boilerplate/started.footer b/files/boilerplate/started.footer
new file mode 100644
index 0000000..5e12d1d
--- /dev/null
+++ b/files/boilerplate/started.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/files/boilerplate/started.header b/files/boilerplate/started.header
new file mode 100644
index 0000000..b7704db
--- /dev/null
+++ b/files/boilerplate/started.header
@@ -0,0 +1,20 @@
+#
+# Shorewall version 4 - Started File
+#
+# /etc/shorewall/started
+#
+# Add commands below that you want to be executed after shorewall has
+# been completely started or restarted. The difference between this
+# extension script and /etc/shorewall/start is that this one is invoked
+# after delayed loading of the blacklist (DELAYBLACKLISTLOAD=Yes) and
+# after the 'shorewall' chain has been created (thus signaling that the
+# firewall is completely up).
+#
+# This script should not change the firewall configuration directly but
+# may do so indirectly by running /sbin/shorewall with the 'nolock'
+# option.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
diff --git a/files/boilerplate/stop.footer b/files/boilerplate/stop.footer
new file mode 100644
index 0000000..5e12d1d
--- /dev/null
+++ b/files/boilerplate/stop.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/files/boilerplate/stop.header b/files/boilerplate/stop.header
new file mode 100644
index 0000000..0088abe
--- /dev/null
+++ b/files/boilerplate/stop.header
@@ -0,0 +1,13 @@
+#
+# Shorewall version 4 - Stop File
+#
+# /etc/shorewall/stop
+#
+# Add commands below that you want to be executed at the beginning of a
+# "shorewall stop" command.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/files/boilerplate/stopped.footer b/files/boilerplate/stopped.footer
new file mode 100644
index 0000000..5e12d1d
--- /dev/null
+++ b/files/boilerplate/stopped.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/files/boilerplate/stopped.header b/files/boilerplate/stopped.header
new file mode 100644
index 0000000..438e5e0
--- /dev/null
+++ b/files/boilerplate/stopped.header
@@ -0,0 +1,13 @@
+#
+# Shorewall version 4 - Stopped File
+#
+# /etc/shorewall/stopped
+#
+# Add commands below that you want to be executed at the completion of a
+# "shorewall stop" command.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/files/boilerplate/tcclasses.footer b/files/boilerplate/tcclasses.footer
new file mode 100644
index 0000000..5e12d1d
--- /dev/null
+++ b/files/boilerplate/tcclasses.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/files/boilerplate/tcclasses.header b/files/boilerplate/tcclasses.header
new file mode 100644
index 0000000..025415b
--- /dev/null
+++ b/files/boilerplate/tcclasses.header
@@ -0,0 +1,9 @@
+#
+# Shorewall version 4 - Tcclasses File
+#
+# For information about entries in this file, type "man shorewall-tcclasses"
+#
+# See http://shorewall.net/traffic_shaping.htm for additional information.
+#
+###############################################################################
+#INTERFACE:CLASS MARK RATE CEIL PRIORITY OPTIONS
diff --git a/files/boilerplate/tcdevices.footer b/files/boilerplate/tcdevices.footer
new file mode 100644
index 0000000..5e12d1d
--- /dev/null
+++ b/files/boilerplate/tcdevices.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/files/boilerplate/tcdevices.header b/files/boilerplate/tcdevices.header
new file mode 100644
index 0000000..fe7c3d1
--- /dev/null
+++ b/files/boilerplate/tcdevices.header
@@ -0,0 +1,10 @@
+#
+# Shorewall version 4 - Tcdevices File
+#
+# For information about entries in this file, type "man shorewall-tcdevices"
+#
+# See http://shorewall.net/traffic_shaping.htm for additional information.
+#
+###############################################################################
+#NUMBER: IN-BANDWITH OUT-BANDWIDTH OPTIONS REDIRECTED
+#INTERFACE INTERFACES
diff --git a/files/boilerplate/tcrules.footer b/files/boilerplate/tcrules.footer
new file mode 100644
index 0000000..5e12d1d
--- /dev/null
+++ b/files/boilerplate/tcrules.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/files/boilerplate/tcrules.header b/files/boilerplate/tcrules.header
new file mode 100644
index 0000000..e0e7adc
--- /dev/null
+++ b/files/boilerplate/tcrules.header
@@ -0,0 +1,15 @@
+#
+# Shorewall version 4 - Tcrules File
+#
+# For information about entries in this file, type "man shorewall-tcrules"
+#
+# See http://shorewall.net/traffic_shaping.htm for additional information.
+# For usage in selecting among multiple ISPs, see
+# http://shorewall.net/MultiISP.html
+#
+# See http://shorewall.net/PacketMarking.html for a detailed description of
+# the Netfilter/Shorewall packet marking mechanism.
+######################################################################################################################
+#MARK SOURCE DEST PROTO DEST SOURCE USER TEST LENGTH TOS CONNBYTES HELPER
+# PORT(S) PORT(S)
+
diff --git a/files/shorewall.conf.Debian.wheezy b/files/shorewall.conf.Debian.wheezy
new file mode 100644
index 0000000..09693a6
--- /dev/null
+++ b/files/shorewall.conf.Debian.wheezy
@@ -0,0 +1,216 @@
+####
+#### Managed by puppet, modify only on the puppetmaster
+####
+
+###############################################################################
+#
+# Shorewall Version 4 -- /etc/shorewall/shorewall.conf
+#
+# For information about the settings in this file, type "man shorewall.conf"
+#
+# Manpage also online at http://www.shorewall.net/manpages/shorewall.conf.html
+###############################################################################
+# S T A R T U P E N A B L E D
+###############################################################################
+
+STARTUP_ENABLED=Yes
+
+###############################################################################
+# V E R B O S I T Y
+###############################################################################
+
+VERBOSITY=1
+
+###############################################################################
+# L O G G I N G
+###############################################################################
+
+LOGFILE=/var/log/messages
+
+STARTUP_LOG=/var/log/shorewall-init.log
+
+LOG_VERBOSITY=2
+
+LOGFORMAT="Shorewall:%s:%s:"
+
+LOGTAGONLY=No
+
+LOGLIMIT=
+
+LOGALLNEW=
+
+BLACKLIST_LOGLEVEL=
+
+MACLIST_LOG_LEVEL=info
+
+TCP_FLAGS_LOG_LEVEL=info
+
+SMURF_LOG_LEVEL=info
+
+LOG_MARTIANS=Yes
+
+###############################################################################
+# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S
+###############################################################################
+
+IPTABLES=
+
+IP=
+
+TC=
+
+IPSET=
+
+PERL=/usr/bin/perl
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
+
+SHOREWALL_SHELL=/bin/sh
+
+SUBSYSLOCK=""
+
+MODULESDIR=
+
+# add puppet delivered files in front
+CONFIG_PATH=/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall
+
+RESTOREFILE=
+
+IPSECFILE=zones
+
+LOCKFILE=
+
+###############################################################################
+# D E F A U L T A C T I O N S / M A C R O S
+###############################################################################
+
+DROP_DEFAULT="Drop"
+REJECT_DEFAULT="Reject"
+ACCEPT_DEFAULT="none"
+QUEUE_DEFAULT="none"
+NFQUEUE_DEFAULT="none"
+
+###############################################################################
+# R S H / R C P C O M M A N D S
+###############################################################################
+
+RSH_COMMAND='ssh ${root}@${system} ${command}'
+RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
+
+###############################################################################
+# F I R E W A L L O P T I O N S
+###############################################################################
+
+IP_FORWARDING=Keep
+
+ADD_IP_ALIASES=No
+
+ADD_SNAT_ALIASES=No
+
+RETAIN_ALIASES=No
+
+TC_ENABLED=Internal
+
+TC_EXPERT=No
+
+TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
+
+CLEAR_TC=Yes
+
+MARK_IN_FORWARD_CHAIN=No
+
+CLAMPMSS=No
+
+ROUTE_FILTER=Yes
+
+DETECT_DNAT_IPADDRS=No
+
+MUTEX_TIMEOUT=60
+
+ADMINISABSENTMINDED=Yes
+
+BLACKLISTNEWONLY=Yes
+
+MODULE_SUFFIX=ko
+
+DISABLE_IPV6=No
+
+DYNAMIC_ZONES=No
+
+PKTTYPE=Yes
+
+NULL_ROUTE_RFC1918=No
+
+MACLIST_TABLE=filter
+
+MACLIST_TTL=
+
+SAVE_IPSETS=No
+
+MAPOLDACTIONS=No
+
+FASTACCEPT=No
+
+IMPLICIT_CONTINUE=No
+
+HIGH_ROUTE_MARKS=No
+
+USE_ACTIONS=Yes
+
+OPTIMIZE=0
+
+EXPORTPARAMS=Yes
+
+EXPAND_POLICIES=Yes
+
+KEEP_RT_TABLES=No
+
+DELETE_THEN_ADD=Yes
+
+MULTICAST=No
+
+DONT_LOAD=
+
+AUTO_COMMENT=Yes
+
+MANGLE_ENABLED=Yes
+
+USE_DEFAULT_RT=No
+
+RESTORE_DEFAULT_ROUTE=Yes
+
+AUTOMAKE=No
+
+WIDE_TC_MARKS=No
+
+TRACK_PROVIDERS=No
+
+ZONE2ZONE=2
+
+ACCOUNTING=Yes
+
+DYNAMIC_BLACKLIST=Yes
+
+OPTIMIZE_ACCOUNTING=No
+
+LOAD_HELPERS_ONLY=No
+
+REQUIRE_INTERFACE=No
+
+FORWARD_CLEAR_MARK=
+
+COMPLETE=No
+
+EXPORTMODULES=Yes
+
+###############################################################################
+# P A C K E T D I S P O S I T I O N
+###############################################################################
+
+BLACKLIST_DISPOSITION=DROP
+
+MACLIST_DISPOSITION=REJECT
+
+TCP_FLAGS_DISPOSITION=DROP
+
+#LAST LINE -- DO NOT REMOVE
diff --git a/manifests/base.pp b/manifests/base.pp
index 709f4b7..937b83b 100644
--- a/manifests/base.pp
+++ b/manifests/base.pp
@@ -1,6 +1,6 @@
class shorewall::base {
package { 'shorewall':
- ensure => present,
+ ensure => $shorewall_ensure_version,
}
# This file has to be managed in place, so shorewall can find it
diff --git a/manifests/extension_script.pp b/manifests/extension_script.pp
new file mode 100644
index 0000000..569fcbf
--- /dev/null
+++ b/manifests/extension_script.pp
@@ -0,0 +1,14 @@
+# See http://shorewall.net/shorewall_extension_scripts.htm
+define shorewall::extension_script($script = '') {
+ case $name {
+ 'init', 'initdone', 'start', 'started', 'stop', 'stopped', 'clear', 'refresh', 'continue', 'maclog': {
+ file { "/etc/shorewall/puppet/${name}":
+ content => "${script}\n",
+ notify => Service[shorewall];
+ }
+ }
+ '', default: {
+ err("${name}: unknown shorewall extension script")
+ }
+ }
+}
diff --git a/manifests/init.pp b/manifests/init.pp
index 17ff12d..a446253 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -4,8 +4,11 @@ class shorewall(
case $::operatingsystem {
gentoo: { include shorewall::gentoo }
- debian: { include shorewall::debian }
- centos: { include shorewall::centos }
+ debian: {
+ include shorewall::debian
+ $dist_tor_user = 'debian-tor'
+ }
+ centos: { include shorewall::base }
ubuntu: {
case $::lsbdistcodename {
karmic: { include shorewall::ubuntu::karmic }
@@ -13,11 +16,34 @@ class shorewall(
}
}
default: {
- notice "unknown operatingsystem: ${::operatingsystem}"
- include shorewall::base
+ notice "unknown operatingsystem: ${::operatingsystem}"
+ include shorewall::base
}
}
+ case $tor_transparent_proxy_host {
+ '': { $tor_transparent_proxy_host = '127.0.0.1' }
+ }
+ case $tor_transparent_proxy_port {
+ '': { $tor_transparent_proxy_port = '9040' }
+ }
+ case $tor_dns_host {
+ '': { $tor_dns_host = '127.0.0.1' }
+ }
+ case $tor_dns_port {
+ '': { $tor_dns_port = '8853' }
+ }
+ if $tor_user == '' {
+ $tor_user = $dist_tor_user ? {
+ '' => 'tor',
+ default => $dist_tor_user,
+ }
+ }
+ case $non_torified_users {
+ '': { $non_torified_users = [] }
+ }
+ $real_non_torified_users = uniq_flatten([ $tor_user, $non_torified_users ])
+
# See http://www.shorewall.net/3.0/Documentation.htm#Zones
shorewall::managed_file{ zones: }
# See http://www.shorewall.net/3.0/Documentation.htm#Interfaces
@@ -42,6 +68,12 @@ class shorewall(
shorewall::managed_file { routestopped: }
# See http://www.shorewall.net/3.0/Documentation.htm#Variables
shorewall::managed_file { params: }
+ # See http://www.shorewall.net/3.0/traffic_shaping.htm
+ shorewall::managed_file { tcdevices: }
+ # See http://www.shorewall.net/3.0/traffic_shaping.htm
+ shorewall::managed_file { tcrules: }
+ # See http://www.shorewall.net/3.0/traffic_shaping.htm
+ shorewall::managed_file { tcclasses: }
# http://www.shorewall.net/manpages/shorewall-providers.html
shorewall::managed_file { providers: }
}
diff --git a/manifests/interface.pp b/manifests/interface.pp
index 1716a7e..403ee74 100644
--- a/manifests/interface.pp
+++ b/manifests/interface.pp
@@ -2,26 +2,28 @@ define shorewall::interface(
$zone,
$broadcast = 'detect',
$options = 'tcpflags,blacklist,routefilter,nosmurfs,logmartians',
+ $add_options = '',
$rfc1918 = false,
$dhcp = false,
$order = 100
){
- if $rfc1918 {
- if $dhcp {
- $options_real = "${options},dhcp"
- } else {
- $options_real = $options
- }
- } else {
- if $dhcp {
- $options_real = "${options},norfc1918,dhcp"
- } else {
- $options_real = "${options},norfc1918"
- }
+ $added_opts = $add_options ? {
+ '' => '',
+ default => ",${add_options}",
+ }
+
+ $dhcp_opt = $dhcp ? {
+ false => '',
+ default => ',dhcp',
+ }
+
+ $rfc1918_opt = $rfc1918 ? {
+ false => ',norfc1918',
+ default => '',
}
shorewall::entry { "interfaces-${order}-${name}":
- line => "${zone} ${name} ${broadcast} ${options_real}",
+ line => "${zone} ${name} ${broadcast} ${options}${dhcp_opt}${rfc1918_opt}${added_opts}",
}
}
diff --git a/manifests/routestopped.pp b/manifests/routestopped.pp
index cd39762..aca57b5 100644
--- a/manifests/routestopped.pp
+++ b/manifests/routestopped.pp
@@ -4,7 +4,11 @@ define shorewall::routestopped(
$options = '',
$order='100'
){
+ $real_interface = $interface ? {
+ '' => $name,
+ default => $interface,
+ }
shorewall::entry{"routestopped-${order}-${name}":
- line => "${interface} ${host} ${options}",
- }
+ line => "${real_interface} ${host} ${options}",
+ }
}
diff --git a/manifests/rules/libvirt/host.pp b/manifests/rules/libvirt/host.pp
new file mode 100644
index 0000000..aaecd9d
--- /dev/null
+++ b/manifests/rules/libvirt/host.pp
@@ -0,0 +1,46 @@
+class shorewall::rules::libvirt::host (
+ $vmz = 'vmz',
+ $masq_iface = 'eth0',
+ ) {
+
+ define shorewall::rule::accept::from_vmz (
+ $proto = '-', $destinationport = '-', $action = 'ACCEPT' ) {
+ shorewall::rule { "$name":
+ source => $vmz, destination => '$FW', order => 300,
+ proto => $proto, destinationport => $destinationport, action => $action;
+ }
+ }
+
+ shorewall::policy {
+ 'fw-to-vmz':
+ sourcezone => '$FW',
+ destinationzone => $vmz,
+ policy => 'ACCEPT',
+ order => 110;
+ 'vmz-to-net':
+ sourcezone => $vmz,
+ destinationzone => 'net',
+ policy => 'ACCEPT',
+ order => 200;
+ 'vmz-to-all':
+ sourcezone => $vmz,
+ destinationzone => 'all',
+ policy => 'DROP',
+ shloglevel => 'info',
+ order => 800;
+ }
+
+ shorewall::rule::accept::from_vmz {
+ 'accept_dns_from_vmz': action => 'DNS(ACCEPT)';
+ 'accept_tftp_from_vmz': action => 'TFTP(ACCEPT)';
+ 'accept_debproxy_from_vmz': proto => 'tcp', destinationport => '8000', action => 'ACCEPT';
+ 'accept_puppet_from_vmz': proto => 'tcp', destinationport => '8140', action => 'ACCEPT';
+ }
+
+ shorewall::masq {
+ "masq-${masq_iface}":
+ interface => "$masq_iface",
+ source => '10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16';
+ }
+
+}
diff --git a/manifests/rules/mdns.pp b/manifests/rules/mdns.pp
new file mode 100644
index 0000000..76b1fd9
--- /dev/null
+++ b/manifests/rules/mdns.pp
@@ -0,0 +1,8 @@
+class shorewall::rules::mdns {
+ shorewall::rule { 'net-me-mdns':
+ source => 'net',
+ destination => '$FW',
+ order => 240,
+ action => 'mDNS(ACCEPT)';
+ }
+}
diff --git a/manifests/rules/torify.pp b/manifests/rules/torify.pp
new file mode 100644
index 0000000..b393a2a
--- /dev/null
+++ b/manifests/rules/torify.pp
@@ -0,0 +1,31 @@
+# shorewall::rules::torify
+#
+# Note: shorewall::rules::torify cannot be used several times with the
+# same user listed in the $users array. This restriction applies to
+# using this define multiple times without providing a $users
+# parameter.
+#
+# Parameters:
+#
+# - users: every element of this array must be valid in shorewall
+# rules user/group column.
+# - destinations: every element of this array must be valid in
+# shorewall rules original destination column.
+
+define shorewall::rules::torify(
+ $users = ['-'],
+ $destinations = ['-'],
+ $allow_rfc1918 = true
+){
+
+ include shorewall::rules::torify::non_torified_users
+
+ $originaldest = join($destinations,',')
+
+ shorewall::rules::torify::user {
+ $users:
+ originaldest => $originaldest,
+ allow_rfc1918 => $allow_rfc1918;
+ }
+
+}
diff --git a/manifests/rules/torify/allow_tor_transparent_proxy.pp b/manifests/rules/torify/allow_tor_transparent_proxy.pp
new file mode 100644
index 0000000..3c18db6
--- /dev/null
+++ b/manifests/rules/torify/allow_tor_transparent_proxy.pp
@@ -0,0 +1,21 @@
+class shorewall::rules::torify::allow_tor_transparent_proxy {
+
+ $rule = "allow-tor-transparent-proxy"
+
+ if !defined(Shorewall::Rule["$rule"]) {
+ # A weirdness in shorewall forces us to explicitly allow traffic to
+ # net:$tor_transparent_proxy_host:$tor_transparent_proxy_port even
+ # if $FW->$FW traffic is allowed. This anyway avoids us special-casing
+ # the remote Tor transparent proxy situation.
+ shorewall::rule {
+ "$rule":
+ source => '$FW',
+ destination => "net:${shorewall::tor_transparent_proxy_host}",
+ proto => 'tcp',
+ destinationport => $shorewall::tor_transparent_proxy_port,
+ order => 100,
+ action => 'ACCEPT';
+ }
+ }
+
+}
diff --git a/manifests/rules/torify/non_torified_user.pp b/manifests/rules/torify/non_torified_user.pp
new file mode 100644
index 0000000..34e4db7
--- /dev/null
+++ b/manifests/rules/torify/non_torified_user.pp
@@ -0,0 +1,25 @@
+define shorewall::rules::torify::non_torified_user() {
+
+ $user = $name
+
+ $whitelist_rule = "allow-from-user=${user}"
+ shorewall::rule {
+ "$whitelist_rule":
+ source => '$FW',
+ destination => 'all',
+ user => $user,
+ order => 101,
+ action => 'ACCEPT';
+ }
+
+ $nonat_rule = "dont-redirect-to-tor-user=${user}"
+ shorewall::rule {
+ "$nonat_rule":
+ source => '$FW',
+ destination => '-',
+ user => $user,
+ order => 106,
+ action => 'NONAT';
+ }
+
+}
diff --git a/manifests/rules/torify/non_torified_users.pp b/manifests/rules/torify/non_torified_users.pp
new file mode 100644
index 0000000..582dfed
--- /dev/null
+++ b/manifests/rules/torify/non_torified_users.pp
@@ -0,0 +1,9 @@
+class shorewall::rules::torify::non_torified_users {
+
+ $real_non_torified_users = $shorewall::real_non_torified_users
+
+ shorewall::rules::torify::non_torified_user {
+ $real_non_torified_users:
+ }
+
+}
diff --git a/manifests/rules/torify/redirect_dns_to_tor.pp b/manifests/rules/torify/redirect_dns_to_tor.pp
new file mode 100644
index 0000000..9c71204
--- /dev/null
+++ b/manifests/rules/torify/redirect_dns_to_tor.pp
@@ -0,0 +1,38 @@
+define shorewall::rules::torify::redirect_dns_to_tor() {
+
+ $user = $name
+
+ $destzone = $shorewall::tor_dns_host ? {
+ '127.0.0.1' => '$FW',
+ default => 'net'
+ }
+
+ $tcp_rule = "redirect-tcp-dns-to-tor-user=${user}"
+ if !defined(Shorewall::Rule["$tcp_rule"]) {
+ shorewall::rule {
+ "$tcp_rule":
+ source => '$FW',
+ destination => "${destzone}:${shorewall::tor_dns_host}:${shorewall::tor_dns_port}",
+ proto => 'tcp',
+ destinationport => 'domain',
+ user => $user,
+ order => 108,
+ action => 'DNAT';
+ }
+ }
+
+ $udp_rule = "redirect-udp-dns-to-tor-user=${user}"
+ if !defined(Shorewall::Rule["$udp_rule"]) {
+ shorewall::rule {
+ "$udp_rule":
+ source => '$FW',
+ destination => "${destzone}:${shorewall::tor_dns_host}:${shorewall::tor_dns_port}",
+ proto => 'udp',
+ destinationport => 'domain',
+ user => $user,
+ order => 108,
+ action => 'DNAT';
+ }
+ }
+
+}
diff --git a/manifests/rules/torify/redirect_tcp_to_tor.pp b/manifests/rules/torify/redirect_tcp_to_tor.pp
new file mode 100644
index 0000000..fe1c5fe
--- /dev/null
+++ b/manifests/rules/torify/redirect_tcp_to_tor.pp
@@ -0,0 +1,35 @@
+define shorewall::rules::torify::redirect_tcp_to_tor(
+ $user = '-',
+ $originaldest = '-'
+){
+
+ # hash the destination as it may contain slashes
+ $originaldest_sha1 = sha1($originaldest)
+ $rule = "redirect-to-tor-user=${user}-to=${originaldest_sha1}"
+
+ if !defined(Shorewall::Rule["$rule"]) {
+
+ $originaldest_real = $originaldest ? {
+ '-' => '!127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16',
+ default => $originaldest,
+ }
+
+ $destzone = $shorewall::tor_transparent_proxy_host ? {
+ '127.0.0.1' => '$FW',
+ default => 'net'
+ }
+
+ shorewall::rule {
+ "$rule":
+ source => '$FW',
+ destination => "${destzone}:${shorewall::tor_transparent_proxy_host}:${shorewall::tor_transparent_proxy_port}",
+ proto => 'tcp:syn',
+ originaldest => $originaldest_real,
+ user => $user,
+ order => 110,
+ action => 'DNAT';
+ }
+
+ }
+
+}
diff --git a/manifests/rules/torify/reject_non_tor.pp b/manifests/rules/torify/reject_non_tor.pp
new file mode 100644
index 0000000..80240ec
--- /dev/null
+++ b/manifests/rules/torify/reject_non_tor.pp
@@ -0,0 +1,32 @@
+define shorewall::rules::torify::reject_non_tor(
+ $user = '-',
+ $originaldest = '-',
+ $allow_rfc1918 = true
+){
+
+ # hash the destination as it may contain slashes
+ $originaldest_sha1 = sha1($originaldest)
+ $rule = "reject-non-tor-from-${user}-to=${originaldest_sha1}"
+
+ if $originaldest == '-' {
+ $originaldest_real = $allow_rfc1918 ? {
+ false => '!127.0.0.1',
+ default => '!127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16',
+ }
+ } else {
+ $originaldest_real = $originaldest
+ }
+
+ if !defined(Shorewall::Rule["$rule"]) {
+ shorewall::rule {
+ "$rule":
+ source => '$FW',
+ destination => 'all',
+ originaldest => $originaldest_real,
+ user => $user,
+ order => 120,
+ action => 'REJECT';
+ }
+ }
+
+}
diff --git a/manifests/rules/torify/user.pp b/manifests/rules/torify/user.pp
new file mode 100644
index 0000000..49c0b34
--- /dev/null
+++ b/manifests/rules/torify/user.pp
@@ -0,0 +1,23 @@
+define shorewall::rules::torify::user(
+ $originaldest = '-',
+ $allow_rfc1918 = true
+){
+
+ $user = $name
+
+ include shorewall::rules::torify::allow_tor_transparent_proxy
+
+ shorewall::rules::torify::redirect_tcp_to_tor {
+ "redirect-to-tor-user=${user}-to=${originaldest}":
+ user => $user,
+ originaldest => $originaldest
+ }
+
+ shorewall::rules::torify::reject_non_tor {
+ "reject-non-tor-user=${user}-to=${originaldest}":
+ user => "$user",
+ originaldest => $originaldest,
+ allow_rfc1918 => $allow_rfc1918;
+ }
+
+}
diff --git a/manifests/tcclasses.pp b/manifests/tcclasses.pp
new file mode 100644
index 0000000..4e30a55
--- /dev/null
+++ b/manifests/tcclasses.pp
@@ -0,0 +1,12 @@
+define shorewall::tcclasses(
+ $interface,
+ $rate,
+ $ceil,
+ $priority,
+ $options = '',
+ $order = '1'
+){
+ shorewall::entry { "tcclasses-${order}-${name}":
+ line => "# ${name}\n${interface} ${order} ${rate} ${ceil} ${priority} ${options}",
+ }
+}
diff --git a/manifests/tcdevices.pp b/manifests/tcdevices.pp
new file mode 100644
index 0000000..f4e88d8
--- /dev/null
+++ b/manifests/tcdevices.pp
@@ -0,0 +1,11 @@
+define shorewall::tcdevices(
+ $in_bandwidth,
+ $out_bandwidth,
+ $options = '',
+ $redirected_interfaces = '',
+ $order = '100'
+){
+ shorewall::entry { "tcdevices-${order}-${name}":
+ line => "${name} ${in_bandwidth} ${out_bandwidth} ${options} ${redirected_interfaces}",
+ }
+}
diff --git a/manifests/tcrules.pp b/manifests/tcrules.pp
new file mode 100644
index 0000000..b9ab4a9
--- /dev/null
+++ b/manifests/tcrules.pp
@@ -0,0 +1,12 @@
+define shorewall::tcrules(
+ $source,
+ $destination,
+ $protocol = 'all',
+ $ports,
+ $client_ports = '',
+ $order = '1'
+){
+ shorewall::entry { "tcrules-${order}-${name}":
+ line => "# ${name}\n${order} ${source} ${destination} ${protocol} ${ports} ${client_ports}",
+ }
+}