Marco Fretz [Fri, 23 Dec 2016 12:05:57 +0000 (13:05 +0100)]
(MODULES-3572) Ip6tables service is not managed in the redhat family. (#641)
* Manage ip6tables service in RHEL. Add parameter to specify service_name for iptables and ip6tables. update README
For the redhat OS family the service for managing ip6tables is called
ip6tables. This service is currently not managed with this module.
This commit fixes this issue by introducing an additional parameter
$service_name_v6 for the ipv6 version of the service.
* remove validate_string, no stdlib
David Schmitt [Sat, 19 Nov 2016 14:25:35 +0000 (15:25 +0100)]
(MODULES-4093) Tighten SELinux permissions on persistent files
RHEL7's /usr/libexec/iptables/iptables.init creates the /etc/sysconfig/iptables
file with the wrong selinux parameters, causing spurious changes on the next
run:
[root@ns57zjx0zb7s0b5 ~]# rm -f /etc/sysconfig/iptables
[root@ns57zjx0zb7s0b5 ~]# ls -la /etc/sysconfig/iptables
ls: cannot access /etc/sysconfig/iptables: No such file or directory
[root@ns57zjx0zb7s0b5 ~]# iptables -A INPUT --source 8.8.8.8 -j REJECT
[root@ns57zjx0zb7s0b5 ~]# /usr/libexec/iptables/iptables.init save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
[root@ns57zjx0zb7s0b5 ~]# ls -la /etc/sysconfig/iptables
-rw-------. 1 root root 259 Nov 19 06:02 /etc/sysconfig/iptables
[root@ns57zjx0zb7s0b5 ~]# /opt/puppetlabs/bin/puppet apply --verbose selinux.pp
Notice: Compiled catalog for ns57zjx0zb7s0b5.delivery.puppetlabs.net in environment production in 0.08 seconds
Info: Applying configuration version '1479564151'
Notice: /Stage[main]/Main/File[/etc/sysconfig/iptables]/seluser: seluser changed 'unconfined_u' to 'system_u'
Notice: /Stage[main]/Main/File[/etc/sysconfig/iptables]/seltype: seltype changed 'etc_t' to 'system_conf_t'
Notice: Applied catalog in 0.03 seconds
[root@ns57zjx0zb7s0b5 ~]# X Error of failed request: RenderBadPicture (invalid Picture parameter)
To fix this, this patch changes the order in which puppet checks the resources.
Instead of managing the persistence file before the service, now we manage the
file after all firewall rules. The firewall provider persists the rules to disk
causing the /etc/sysconfig/iptables file to be created. Managing its
permissions afterwards leads to one-run idempotency.
To see why this change is legal, consider the possible initial states for a
moment:
* fresh install: the /etc/sysconfig/iptables file does not exist
in the previous implementation, puppet would create it empty with the correct
permissions, only to have it overwritten when persisting the firewall rules
* fixed point: the /etc/sysconfig/iptables file already exists with the correct
permissions, and nothing has changed. The order of resource application is
irrelevant
* a firewall rule has changed: the firewall type will persist the rules
changing the permissions to a invalid state, puppet will fix it in the same
agent run.
* the /etc/sysconfig/iptables file is in an invalid state: this might be the
most annoying case. In the original version, puppet would have fixed the file
before touching the service. Now the service could arguably fail to start if
the permissions are really bad. Puppet will still fix the issue, and start
the service on the next run, so I do not consider this to be a big problem.
Hailee Kenney [Mon, 17 Oct 2016 16:09:09 +0000 (17:09 +0100)]
(maint) Add node yaml file for oracle5
Prior to this commit the firewall module did not have a node file
for oracle5 so it was failing in CI. In order to fix this, add the
appropriate config file so tests can be run on oracle5.
Alex Schultz [Mon, 15 Aug 2016 17:01:50 +0000 (11:01 -0600)]
Add --wait to iptables commands
This change adds the --wait flag to the insert/update/delete iptables
actions to prevent failures from occuring when iptables is running
outside of puppet. Previously if a script or a user is running iptables
commands while puppet is running, there may be failures in the firewall
provider if iptables cannot get a lock. By default, iptables will just
fail with an error so using --wait will make it wait until a lock can be
established. The --wait is only added for iptables >= 1.4.20.
Lev Popov [Tue, 8 Mar 2016 22:07:01 +0000 (01:07 +0300)]
support for multiple ipsets in a rule
Support for multiple ipsets in a single rule. This feature is very handy
if you need to match source and destination from different ipsets.
Iptables arguments are a bit wierd, but it works, details are in
https://utcc.utoronto.ca/~cks/space/blog/linux/IptablesIpsetsMultipleMatches
Code Review / puppet-modules / puppetlabs-firewall.git / log