Merge branch 'feature/__iptables_rule/ipv6' into 'master'
__iptables*: add IPv6 support See merge request ungleich-public/cdist!959
This commit is contained in:
commit
a1987fe410
5 changed files with 157 additions and 32 deletions
|
|
@ -1,7 +1,4 @@
|
|||
#!/bin/sh
|
||||
# Nico Schottelius
|
||||
# Zürisee, Mon Sep 2 18:38:27 CEST 2013
|
||||
#
|
||||
### BEGIN INIT INFO
|
||||
# Provides: iptables
|
||||
# Required-Start: $local_fs $remote_fs
|
||||
|
|
@ -14,34 +11,72 @@
|
|||
# and saves/restores previous status
|
||||
### END INIT INFO
|
||||
|
||||
# Originally written by:
|
||||
# Nico Schottelius
|
||||
# Zürisee, Mon Sep 2 18:38:27 CEST 2013
|
||||
#
|
||||
# 2013 Nico Schottelius (nico-cdist at schottelius.org)
|
||||
# 2020 Matthias Stecher (matthiasstecher at gmx.de)
|
||||
#
|
||||
# This file is distributed with cdist and licenced under the
|
||||
# GNU GPLv3+ WITHOUT ANY WARRANTY.
|
||||
|
||||
|
||||
# Read files and execute the content with the given commands
|
||||
#
|
||||
# Arguments:
|
||||
# 1: Directory
|
||||
# 2..n: Commands which should be used to execute the file content
|
||||
gothrough() {
|
||||
cd "$1" || return
|
||||
shift
|
||||
|
||||
# iterate through all rules and continue if it's not a file
|
||||
for rule in *; do
|
||||
[ -f "$rule" ] || continue
|
||||
echo "Appling iptables rule $rule ..."
|
||||
|
||||
# execute it with all commands specificed
|
||||
ruleparam="$(cat "$rule")"
|
||||
for cmd in "$@"; do
|
||||
# Command and Rule should be split.
|
||||
# shellcheck disable=SC2046
|
||||
command $cmd $ruleparam
|
||||
done
|
||||
done
|
||||
}
|
||||
|
||||
# Shortcut for iptables command to do IPv4 and v6
|
||||
# only applies to the "reset" target
|
||||
iptables() {
|
||||
command iptables "$@"
|
||||
command ip6tables "$@"
|
||||
}
|
||||
|
||||
basedir=/etc/iptables.d
|
||||
status="${basedir}/.pre-start"
|
||||
status4="${basedir}/.pre-start"
|
||||
status6="${basedir}/.pre-start6"
|
||||
|
||||
case $1 in
|
||||
start)
|
||||
# Save status
|
||||
iptables-save > "$status"
|
||||
iptables-save > "$status4"
|
||||
ip6tables-save > "$status6"
|
||||
|
||||
# Apply our ruleset
|
||||
cd "$basedir" || exit
|
||||
count="$(find . ! -name . -prune | wc -l)"
|
||||
|
||||
# Only do something if there are rules
|
||||
if [ "$count" -ge 1 ]; then
|
||||
for rule in *; do
|
||||
echo "Applying iptables rule $rule ..."
|
||||
# Rule should be split.
|
||||
# shellcheck disable=SC2046
|
||||
iptables $(cat "$rule")
|
||||
done
|
||||
fi
|
||||
gothrough "$basedir" iptables
|
||||
#gothrough "$basedir/v4" iptables # conflicts with $basedir
|
||||
gothrough "$basedir/v6" ip6tables
|
||||
gothrough "$basedir/all" iptables ip6tables
|
||||
;;
|
||||
|
||||
stop)
|
||||
# Restore from status before, if there is something to restore
|
||||
if [ -f "$status" ]; then
|
||||
iptables-restore < "$status"
|
||||
if [ -f "$status4" ]; then
|
||||
iptables-restore < "$status4"
|
||||
fi
|
||||
if [ -f "$status6" ]; then
|
||||
ip6tables-restore < "$status6"
|
||||
fi
|
||||
;;
|
||||
restart)
|
||||
|
|
|
|||
|
|
@ -10,7 +10,24 @@ DESCRIPTION
|
|||
-----------
|
||||
This cdist type deploys an init script that triggers
|
||||
the configured rules and also re-applies them on
|
||||
configuration.
|
||||
configuration. Rules are written from __iptables_rule
|
||||
into the folder ``/etc/iptables.d/``.
|
||||
|
||||
It reads all rules from the base folder as rules for IPv4.
|
||||
Rules in the subfolder ``v6/`` are IPv6 rules. Rules in
|
||||
the subfolder ``all/`` are applied to both rule tables. All
|
||||
files contain the arguments for a single ``iptables`` and/or
|
||||
``ip6tables`` command.
|
||||
|
||||
Rules are applied in the following order:
|
||||
1. All IPv4 rules
|
||||
2. All IPv6 rules
|
||||
2. All rules that should be applied to both tables
|
||||
|
||||
The order of the rules that will be applied are definite
|
||||
from the result the shell glob returns, which should be
|
||||
alphabetical. If rules must be applied in a special order,
|
||||
prefix them with a number like ``02-some-rule``.
|
||||
|
||||
|
||||
REQUIRED PARAMETERS
|
||||
|
|
@ -24,7 +41,7 @@ None
|
|||
EXAMPLES
|
||||
--------
|
||||
|
||||
None (__iptables_apply is used by __iptables_rule)
|
||||
None (__iptables_apply is used by __iptables_rule automatically)
|
||||
|
||||
|
||||
SEE ALSO
|
||||
|
|
@ -35,11 +52,13 @@ SEE ALSO
|
|||
AUTHORS
|
||||
-------
|
||||
Nico Schottelius <nico-cdist--@--schottelius.org>
|
||||
Matthias Stecher <matthiasstecher--@--gmx.de>
|
||||
|
||||
|
||||
COPYING
|
||||
-------
|
||||
Copyright \(C) 2013 Nico Schottelius. You can redistribute it
|
||||
and/or modify it under the terms of the GNU General Public License as
|
||||
published by the Free Software Foundation, either version 3 of the
|
||||
License, or (at your option) any later version.
|
||||
Copyright \(C) 2013 Nico Schottelius.
|
||||
Copyright \(C) 2020 Matthias Stecher.
|
||||
You can redistribute it and/or modify it under the terms of the GNU
|
||||
General Public License as published by the Free Software Foundation,
|
||||
either version 3 of the License, or (at your option) any later version.
|
||||
|
|
|
|||
|
|
@ -11,6 +11,10 @@ DESCRIPTION
|
|||
This cdist type allows you to manage iptable rules
|
||||
in a distribution independent manner.
|
||||
|
||||
See :strong:`cdist-type__iptables_apply`\ (7) for the
|
||||
execution order of these rules. It will be executed
|
||||
automaticly to apply all rules non-volaite.
|
||||
|
||||
|
||||
REQUIRED PARAMETERS
|
||||
-------------------
|
||||
|
|
@ -25,6 +29,24 @@ state
|
|||
'present' or 'absent', defaults to 'present'
|
||||
|
||||
|
||||
BOOLEAN PARAMETERS
|
||||
------------------
|
||||
All rules without any of these parameters will be treated like ``--v4`` because
|
||||
of backward compatibility.
|
||||
|
||||
v4
|
||||
Explicitly set it as rule for IPv4. If IPv6 is set, too, it will be
|
||||
threaten like ``--all``. Will be the default if nothing else is set.
|
||||
|
||||
v6
|
||||
Explicitly set it as rule for IPv6. If IPv4 is set, too, it will be
|
||||
threaten like ``--all``.
|
||||
|
||||
all
|
||||
Set the rule for both IPv4 and IPv6. It will be saved separately from the
|
||||
other rules.
|
||||
|
||||
|
||||
EXAMPLES
|
||||
--------
|
||||
|
||||
|
|
@ -48,6 +70,16 @@ EXAMPLES
|
|||
--state absent
|
||||
|
||||
|
||||
# IPv4-only rule for ICMPv4
|
||||
__iptables_rule icmp-v4 --v4 --rule "-A INPUT -p icmp -j ACCEPT"
|
||||
# IPv6-only rule for ICMPv6
|
||||
__iptables_rule icmp-v6 --v6 --rule "-A INPUT -p icmpv6 -j ACCEPT"
|
||||
|
||||
# doing something for the dual stack
|
||||
__iptables_rule fwd-eth0-eth1 --v4 --v6 --rule "-A INPUT -i eth0 -o eth1 -j ACCEPT"
|
||||
__iptables_rule fwd-eth1-eth0 --all --rule "-A -o eth1 -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT"
|
||||
|
||||
|
||||
SEE ALSO
|
||||
--------
|
||||
:strong:`cdist-type__iptables_apply`\ (7), :strong:`iptables`\ (8)
|
||||
|
|
@ -56,11 +88,13 @@ SEE ALSO
|
|||
AUTHORS
|
||||
-------
|
||||
Nico Schottelius <nico-cdist--@--schottelius.org>
|
||||
Matthias Stecher <matthiasstecher--@--gmx.de>
|
||||
|
||||
|
||||
COPYING
|
||||
-------
|
||||
Copyright \(C) 2013 Nico Schottelius. You can redistribute it
|
||||
and/or modify it under the terms of the GNU General Public License as
|
||||
published by the Free Software Foundation, either version 3 of the
|
||||
License, or (at your option) any later version.
|
||||
Copyright \(C) 2013 Nico Schottelius.
|
||||
Copyright \(C) 2020 Matthias Stecher.
|
||||
You can redistribute it and/or modify it under the terms of the GNU
|
||||
General Public License as published by the Free Software Foundation,
|
||||
either version 3 of the License, or (at your option) any later version.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
#!/bin/sh -e
|
||||
#
|
||||
# 2013 Nico Schottelius (nico-cdist at schottelius.org)
|
||||
# 2020 Matthias Stecher (matthiasstecher at gmx.de)
|
||||
#
|
||||
# This file is part of cdist.
|
||||
#
|
||||
|
|
@ -24,12 +25,36 @@ base_dir=/etc/iptables.d
|
|||
name="$__object_id"
|
||||
state="$(cat "$__object/parameter/state")"
|
||||
|
||||
if [ -f "$__object/parameter/v4" ]; then
|
||||
only_v4="yes"
|
||||
# $specific_dir is $base_dir
|
||||
fi
|
||||
if [ -f "$__object/parameter/v6" ]; then
|
||||
only_v6="yes"
|
||||
specific_dir="$base_dir/v6"
|
||||
fi
|
||||
# If rules should be set for both protocols
|
||||
if { [ "$only_v4" = "yes" ] && [ "$only_v6" = "yes" ]; } ||
|
||||
[ -f "$__object/parameter/all" ]; then
|
||||
|
||||
# all to a specific directory
|
||||
specific_dir="$base_dir/all"
|
||||
fi
|
||||
|
||||
# set rule directory based on if it's the base or subdirectory
|
||||
rule_dir="${specific_dir:-$base_dir}"
|
||||
|
||||
################################################################################
|
||||
# Basic setup
|
||||
#
|
||||
|
||||
__directory "$base_dir" --state present
|
||||
|
||||
# sub-directory if required
|
||||
if [ "$specific_dir" ]; then
|
||||
require="__directory/$base_dir" __directory "$specific_dir" --state present
|
||||
fi
|
||||
|
||||
# Have apply do the real job
|
||||
require="$__object_name" __iptables_apply
|
||||
|
||||
|
|
@ -37,6 +62,15 @@ require="$__object_name" __iptables_apply
|
|||
# The rule
|
||||
#
|
||||
|
||||
require="__directory/$base_dir" __file "$base_dir/${name}" \
|
||||
for dir in "$base_dir" "$base_dir/v6" "$base_dir/all"; do
|
||||
# defaults to absent except the directory that should contain the file
|
||||
if [ "$rule_dir" = "$dir" ]; then
|
||||
curr_state="$state"
|
||||
else
|
||||
curr_state="absent"
|
||||
fi
|
||||
|
||||
require="__directory/$rule_dir" __file "$dir/$name" \
|
||||
--source "$__object/parameter/rule" \
|
||||
--state "$state"
|
||||
--state "$curr_state"
|
||||
done
|
||||
|
|
|
|||
3
cdist/conf/type/__iptables_rule/parameter/boolean
Normal file
3
cdist/conf/type/__iptables_rule/parameter/boolean
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
all
|
||||
v4
|
||||
v6
|
||||
Loading…
Reference in a new issue