Browse Source
Conflicts: conf/type/__package/man.text conf/type/__package_apt/man.text conf/type/__package_luarocks/gencode-remote conf/type/__package_luarocks/man.text conf/type/__package_pacman/gencode-remote conf/type/__package_pacman/man.text conf/type/__package_pkg_openbsd/gencode-remote conf/type/__package_pkg_openbsd/man.text conf/type/__package_rubygem/gencode-remote conf/type/__package_rubygem/man.text conf/type/__package_yum/gencode-remote conf/type/__package_yum/man.text Signed-off-by: Nico Schottelius <nico@brief.schottelius.org>feature_files_export
Nico Schottelius
11 years ago
62 changed files with 520 additions and 50 deletions
@ -1,2 +1,3 @@
|
||||
name |
||||
flavor |
||||
state |
||||
|
||||
@ -0,0 +1,36 @@
|
||||
#!/bin/sh |
||||
# |
||||
# 2012 Jake Guffey (jake.guffey at eprotex.com) |
||||
# |
||||
# This file is part of cdist. |
||||
# |
||||
# cdist is free software: you can redistribute it and/or modify |
||||
# it under the terms of the GNU General Public License as published by |
||||
# the Free Software Foundation, either version 3 of the License, or |
||||
# (at your option) any later version. |
||||
# |
||||
# cdist is distributed in the hope that it will be useful, |
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
# GNU General Public License for more details. |
||||
# |
||||
# You should have received a copy of the GNU General Public License |
||||
# along with cdist. If not, see <http://www.gnu.org/licenses/>. |
||||
# |
||||
# |
||||
# Get the location of the pf ruleset on the target host. |
||||
# |
||||
|
||||
# Debug |
||||
#exec >&2 |
||||
#set -x |
||||
|
||||
# Check /etc/rc.conf for pf's configuration file name. Default to /etc/pf.conf |
||||
|
||||
RC="/etc/rc.conf" |
||||
PFCONF="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')" |
||||
echo ${PFCONF:-"/etc/pf.conf"} |
||||
|
||||
# Debug |
||||
#set +x |
||||
|
||||
@ -0,0 +1,51 @@
|
||||
#!/bin/sh |
||||
# |
||||
# 2012 Jake Guffey (jake.guffey at eprotex.com) |
||||
# |
||||
# This file is part of cdist. |
||||
# |
||||
# cdist is free software: you can redistribute it and/or modify |
||||
# it under the terms of the GNU General Public License as published by |
||||
# the Free Software Foundation, either version 3 of the License, or |
||||
# (at your option) any later version. |
||||
# |
||||
# cdist is distributed in the hope that it will be useful, |
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
# GNU General Public License for more details. |
||||
# |
||||
# You should have received a copy of the GNU General Public License |
||||
# along with cdist. If not, see <http://www.gnu.org/licenses/>. |
||||
# |
||||
# |
||||
# Apply pf(4) ruleset on *BSD |
||||
# |
||||
|
||||
# Debug |
||||
#exec >&2 |
||||
#set -x |
||||
|
||||
rcvar=$(cat "$__object/explorer/rcvar") |
||||
|
||||
cat <<EOF |
||||
if [ -f "${rcvar}.old" ]; then # rcvar.old exists, we must need to disable pf |
||||
# Disable pf |
||||
# If it already is disabled, pfctl -d returns 1, go on with life |
||||
pfctl -d || true |
||||
# Cleanup |
||||
rm -f "${rcvar}.old" |
||||
elif [ -f "${rcvar}.new" ]; then # rcvar.new exists, we must need to apply it |
||||
# Ensure that pf is enabled in the first place |
||||
# If it already is enabled, pfctl -e returns 1, go on with life |
||||
mv "${rcvar}.new" "${rcvar}" |
||||
pfctl -e || true |
||||
pfctl -f "${rcvar}" |
||||
if [ "\$?" -ne "0" ]; then # failed to configure new ruleset |
||||
echo "Failed to configure the new ruleset on ${__target_host}!" >&2 |
||||
fi |
||||
fi |
||||
EOF |
||||
|
||||
# Debug |
||||
#set +x |
||||
|
||||
@ -0,0 +1,52 @@
|
||||
cdist-type__pf_apply(7) |
||||
================================== |
||||
Jake Guffey <jake.guffey--@--eprotex.com> |
||||
|
||||
|
||||
NAME |
||||
---- |
||||
cdist-type__pf_apply - Apply pf(4) ruleset on *BSD |
||||
|
||||
|
||||
DESCRIPTION |
||||
----------- |
||||
This type is used on *BSD systems to manage the pf firewall's active ruleset. |
||||
|
||||
|
||||
REQUIRED PARAMETERS |
||||
------------------- |
||||
NONE |
||||
|
||||
|
||||
OPTIONAL PARAMETERS |
||||
------------------- |
||||
NONE |
||||
|
||||
|
||||
EXAMPLES |
||||
-------- |
||||
|
||||
-------------------------------------------------------------------------------- |
||||
# Modify the ruleset on $__target_host: |
||||
__pf_ruleset --state present --source /my/pf/ruleset.conf |
||||
require="__pf_ruleset" \ |
||||
__pf_apply |
||||
|
||||
# Remove the ruleset on $__target_host (implies disabling pf(4): |
||||
__pf_ruleset --state absent |
||||
require="__pf_ruleset" \ |
||||
__pf_apply |
||||
-------------------------------------------------------------------------------- |
||||
|
||||
|
||||
SEE ALSO |
||||
-------- |
||||
- cdist-type(7) |
||||
- cdist-type__pf_ruleset(7) |
||||
- pf(4) |
||||
|
||||
|
||||
COPYING |
||||
------- |
||||
Copyright \(C) 2012 Jake Guffey. Free use of this software is |
||||
granted under the terms of the GNU General Public License version 3 (GPLv3). |
||||
@ -0,0 +1,41 @@
|
||||
#!/bin/sh |
||||
# |
||||
# 2012 Jake Guffey (jake.guffey at eprotex.com) |
||||
# |
||||
# This file is part of cdist. |
||||
# |
||||
# cdist is free software: you can redistribute it and/or modify |
||||
# it under the terms of the GNU General Public License as published by |
||||
# the Free Software Foundation, either version 3 of the License, or |
||||
# (at your option) any later version. |
||||
# |
||||
# cdist is distributed in the hope that it will be useful, |
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
# GNU General Public License for more details. |
||||
# |
||||
# You should have received a copy of the GNU General Public License |
||||
# along with cdist. If not, see <http://www.gnu.org/licenses/>. |
||||
# |
||||
# |
||||
# Get the 256 bit SHA2 checksum of the pf ruleset on the target host. |
||||
# |
||||
|
||||
# Debug |
||||
#exec >&2 |
||||
#set -x |
||||
|
||||
# Check /etc/rc.conf for pf's configuration file name. Default to /etc/pf.conf |
||||
# See if file exists and if so, get checksum |
||||
|
||||
RC="/etc/rc.conf" |
||||
TMP="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')" |
||||
PFCONF="${TMP:-"/etc/pf.conf"}" |
||||
|
||||
if [ -f "${PFCONF}" ]; then # The pf config file exists, find its cksum. |
||||
cksum -o 1 ${PFCONF} | cut -d= -f2 | awk '{print $1}' |
||||
fi |
||||
|
||||
# Debug |
||||
#set +x |
||||
|
||||
@ -0,0 +1,36 @@
|
||||
#!/bin/sh |
||||
# |
||||
# 2012 Jake Guffey (jake.guffey at eprotex.com) |
||||
# |
||||
# This file is part of cdist. |
||||
# |
||||
# cdist is free software: you can redistribute it and/or modify |
||||
# it under the terms of the GNU General Public License as published by |
||||
# the Free Software Foundation, either version 3 of the License, or |
||||
# (at your option) any later version. |
||||
# |
||||
# cdist is distributed in the hope that it will be useful, |
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
# GNU General Public License for more details. |
||||
# |
||||
# You should have received a copy of the GNU General Public License |
||||
# along with cdist. If not, see <http://www.gnu.org/licenses/>. |
||||
# |
||||
# |
||||
# Get the location of the pf ruleset on the target host. |
||||
# |
||||
|
||||
# Debug |
||||
#exec >&2 |
||||
#set -x |
||||
|
||||
# Check /etc/rc.conf for pf's configuration file name. Default to /etc/pf.conf |
||||
|
||||
RC="/etc/rc.conf" |
||||
PFCONF="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')" |
||||
echo ${PFCONF:-"/etc/pf.conf"} |
||||
|
||||
# Debug |
||||
#set +x |
||||
|
||||
@ -0,0 +1,73 @@
|
||||
#!/bin/sh |
||||
# |
||||
# 2012 Jake Guffey (jake.guffey at eprotex.com) |
||||
# |
||||
# This file is part of cdist. |
||||
# |
||||
# cdist is free software: you can redistribute it and/or modify |
||||
# it under the terms of the GNU General Public License as published by |
||||
# the Free Software Foundation, either version 3 of the License, or |
||||
# (at your option) any later version. |
||||
# |
||||
# cdist is distributed in the hope that it will be useful, |
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
# GNU General Public License for more details. |
||||
# |
||||
# You should have received a copy of the GNU General Public License |
||||
# along with cdist. If not, see <http://www.gnu.org/licenses/>. |
||||
# |
||||
# |
||||
# Manage pf(4) on *BSD |
||||
# |
||||
|
||||
# Debug |
||||
#exec >&2 |
||||
#set -x |
||||
|
||||
# Send files to $__target_host via $__remote_copy |
||||
|
||||
uname=$(uname) # Need to know what the cdist host is running so we know how to compute the ruleset's checksum |
||||
state=$(cat "$__object/parameter/state") |
||||
|
||||
if [ "$state" = "absent" ]; then # There is nothing more for a *local* script to do |
||||
exit 0 |
||||
fi |
||||
|
||||
if [ -f "$__object/parameter/source" ]; then |
||||
source=$(cat "$__object/parameter/source") |
||||
fi |
||||
|
||||
rcvar=$(cat "$__object/explorer/rcvar") |
||||
cksum=$(cat "$__object/explorer/cksum") |
||||
|
||||
|
||||
cat <<EOF |
||||
case $uname in |
||||
Darwin) |
||||
currentSum=\$(cksum -o 1 ${source} | cut '-d ' -f1) |
||||
;; |
||||
Linux) |
||||
currentSum=\$(cksum ${source} | cut '-d ' -f1) |
||||
;; |
||||
FreeBSD) |
||||
currentSum=\$(cksum -o 1 ${source} | cut -d= -f2 | sed 's/ //g') |
||||
;; |
||||
*) |
||||
echo "Sorry, I do not know how to find a cksum on ${UNAME}." >&2 |
||||
exit 1 |
||||
;; |
||||
esac |
||||
|
||||
if [ -n "${cksum}" ]; then |
||||
if [ ! "\${currentSum}" = "${cksum}" ]; then |
||||
$__remote_copy "${source}" "$__target_host:${rcvar}.new" |
||||
fi |
||||
else # File just doesn't exist yet |
||||
$__remote_copy "${source}" "$__target_host:${rcvar}.new" |
||||
fi |
||||
EOF |
||||
|
||||
# Debug |
||||
#exec +x |
||||
|
||||
@ -0,0 +1,49 @@
|
||||
#!/bin/sh |
||||
# |
||||
# 2012 Jake Guffey (jake.guffey at eprotex.com) |
||||
# |
||||
# This file is part of cdist. |
||||
# |
||||
# cdist is free software: you can redistribute it and/or modify |
||||
# it under the terms of the GNU General Public License as published by |
||||
# the Free Software Foundation, either version 3 of the License, or |
||||
# (at your option) any later version. |
||||
# |
||||
# cdist is distributed in the hope that it will be useful, |
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
# GNU General Public License for more details. |
||||
# |
||||
# You should have received a copy of the GNU General Public License |
||||
# along with cdist. If not, see <http://www.gnu.org/licenses/>. |
||||
# |
||||
# |
||||
# Manage pf(4) on *BSD |
||||
# |
||||
|
||||
# Debug |
||||
#exec >&2 |
||||
#set -x |
||||
|
||||
# Remove ${rcvar} in the case of --state absent |
||||
|
||||
state=$(cat "$__object/parameter/state") |
||||
rcvar=$(cat "$__object/explorer/rcvar") |
||||
|
||||
if [ "$state" = "present" ]; then # There is nothing more for a *remote* script to do |
||||
exit 0 |
||||
elif [ "$state" = "absent" ]; then |
||||
# --state absent, so ensure that .new doesn't exist and that conf is renamed to .old |
||||
cat <<EOF |
||||
if [ -f "${rcvar}.new" ]; then |
||||
rm "${rcvar}.new" |
||||
fi |
||||
if [ -f "${rcvar}" ]; then |
||||
mv "${rcvar}" "${rcvar}.old" |
||||
fi |
||||
EOF |
||||
else |
||||
echo "Unknown state ${state}!" >&2 |
||||
exit 1 |
||||
fi |
||||
|
||||
@ -0,0 +1,51 @@
|
||||
cdist-type__pf_ruleset(7) |
||||
================================== |
||||
Jake Guffey <jake.guffey--@--eprotex.com> |
||||
|
||||
|
||||
NAME |
||||
---- |
||||
cdist-type__pf_ruleset - Copy a pf(4) ruleset to $__target_host |
||||
|
||||
|
||||
DESCRIPTION |
||||
----------- |
||||
This type is used on *BSD systems to manage the pf firewall's ruleset. |
||||
|
||||
|
||||
REQUIRED PARAMETERS |
||||
------------------- |
||||
state:: |
||||
Either "absent" (no ruleset at all) or "present" |
||||
|
||||
|
||||
OPTIONAL PARAMETERS |
||||
------------------- |
||||
source:: |
||||
If supplied, use to define the ruleset to load onto the $__target_host for pf(4). |
||||
Note that this type is almost useless without a ruleset defined, but it's technically not |
||||
needed, e.g. for the case of disabling the firewall temporarily. |
||||
|
||||
EXAMPLES |
||||
-------- |
||||
|
||||
-------------------------------------------------------------------------------- |
||||
# Remove the current ruleset in place |
||||
__pf_ruleset --state absent |
||||
|
||||
# Enable the firewall with the ruleset defined in $__manifest/files/pf.conf |
||||
__pf_ruleset --state present --source $__manifest/files/pf.conf |
||||
|
||||
-------------------------------------------------------------------------------- |
||||
|
||||
|
||||
SEE ALSO |
||||
-------- |
||||
- cdist-type(7) |
||||
- pf(4) |
||||
|
||||
|
||||
COPYING |
||||
------- |
||||
Copyright \(C) 2012 Jake Guffey. Free use of this software is |
||||
granted under the terms of the GNU General Public License version 3 (GPLv3). |
||||
Loading…
Reference in new issue