Justin Stoller [Sat, 15 Feb 2014 06:20:35 +0000 (22:20 -0800)]
Remove acceptance/basic_spec
This removes the legacy "basic_spec" that was used as an introduction to
module testing. It assumes the FOSS path for the module dir. Since the
default module dir changes in PE depending on whether or not the module
is distributed with PE or not, these basic specs have been removed from
other modules.
Hunter Haugen [Fri, 14 Feb 2014 21:19:54 +0000 (13:19 -0800)]
Use iptables-save and parse the output
`iptables -S` didn't work on older OSs, so the tests have been adapted
for that.
There was one test for the NAT table that I'm not sure what the purpose
was, since it seemed to be testing munge instead. I edited it to get it
to pass.
Hunter Haugen [Mon, 10 Feb 2014 23:53:42 +0000 (15:53 -0800)]
Release 0.5.0
Summary:
This is a bigger release that brings in "recent" connection limiting (think
"port knocking"), firewall chain purging on a per-chain/per-table basis, and
support for a few other use cases. This release also fixes a major bug which
could cause modifications to the wrong rules when unmanaged rules are present.
New Features:
* Add "recent" limiting via parameters `rdest`, `reap`, `recent`, `rhitcount`,
`rname`, `rseconds`, `rsource`, and `rttl`
* Add negation support for source and destination
* Add per-chain/table purging support to `firewallchain`
* IPv4 specific
* Add random port forwarding support
* Add ipsec policy matching via `ipsec_dir` and `ipsec_policy`
* IPv6 specific
* Add support for hop limiting via `hop_limit` parameter
* Add fragmentation matchers via `ishasmorefrags`, `islastfrag`, and `isfirstfrag`
* Add support for conntrack stateful firewall matching via `ctstate`
Bugfixes:
- Boolean fixups allowing false values
- Better detection of unmanaged rules
- Fix multiport rule detection
- Fix sport/dport rule detection
- Make INPUT, OUTPUT, and FORWARD not autorequired for firewall chain filter
- Allow INPUT with the nat table
- Fix `src_range` & `dst_range` order detection
- Documentation clarifications
- Fixes to spec tests
Hunter Haugen [Thu, 6 Feb 2014 23:47:27 +0000 (15:47 -0800)]
Fix for #286 for pre-existing rules at the start of a chain
In #286 we fixed rule offset detection for existing managed and
unmanaged rules, but in the case where the first rule in a chain was
unmanaged, managed rules were still being inserted under it.
This patch changes it so that if the first rule detected for offset is
unmanaged, then we should insert before that for more consistent
behavior.
Hunter Haugen [Thu, 6 Feb 2014 20:42:46 +0000 (12:42 -0800)]
Fix #300 for match extension protocol
So... #300 fixed matching `-m (tcp|udp)` at the beginning of `-m
multiport` or `--dport` or `--sport` rules, but broke actual *creation*
of those rules because `-m (tcp|udp)` was used as an iptables argument,
which it is not.
This change removes the problematic argument from `@resource_map` and
instead just substitutes `-m (tcp|udp)` out of any existing rules before
matching. The `-m tcp` match extension arguments are optional anyway,
and not needed for iptables functionality and don't change the semantics
at all.
Hunter Haugen [Thu, 6 Feb 2014 00:02:56 +0000 (16:02 -0800)]
(MODULES-451) Match extension protocol for multiport
The `-m (tcp|udp)` match extension flag before multiport `--sport` and
`--dport` flags is considered optional, but may be present on some
rules. This patches the provides recognition of those rules.
Hunter Haugen [Fri, 31 Jan 2014 21:19:27 +0000 (13:19 -0800)]
(MODULES-442) Correct boolean properties behavior
The boolean properties had a few things incorrect with them.
- Any value passed was considered `true`. This was compounded further by
the next issue.
- When the read property was false, it was set to 'nil'. This caused
`<property> => false` to not work after the previous was fixed.
Random other fixes to tests that were failing or poorly implemented are
also included
Hunter Haugen [Wed, 29 Jan 2014 02:08:42 +0000 (18:08 -0800)]
(MODULES-441) Helpfully fail when modifying chains
It is not intended for chains to be modified using the firewall
resource, but it would still try and result in obscure incorrect errors.
This raises a more helpful error
Hunter Haugen [Tue, 28 Jan 2014 01:31:22 +0000 (17:31 -0800)]
(MODULES-439) Work around existing rules
The firewall resource is not intended to be used with rules that are not
also managed by puppet; the behavior when doing so was undefined. This
is an attempt to make it more defined.
The behavior is that any rule added by puppet will be inserted in its
given order in relation to the other rules managed by puppet, but ahead
of any rules not managed by puppet.
Colin Shea [Wed, 16 Oct 2013 01:37:26 +0000 (18:37 -0700)]
Support conntrack stateful firewall matching
Since Linux 3.7+ the "state" module has been removed from the kernel, leaving
only the "conntrack" module. This patch adds support for the conntrack module in
iptables by adding a new parameter to the firewall type, 'ctstate'.
Updates the README to demonstrate using the ctstate parameter instead of state
to nudge people to use it instead. This is safe as far as back to Linux kernel
2.6.18, so long as CONFIG_NF_CONNTRACK is enabled.
Code Review / puppet-modules / puppetlabs-firewall.git / log