Projet

Général

Profil

Paste
Télécharger au format
Statistiques
| Branche: | Révision:

root / manifests / init.pp @ 8f4434ed

Historique | Voir | Annoter | Télécharger (9,14 ko)

1
# @summary Configure nftables
2
#
3
# @example allow dns out and do not allow ntp out
4
#   class{ 'nftables':
5
#     out_ntp => false,
6
#     out_dns => true,
7
#   }
8
#
9
# @example do not flush particular tables, fail2ban in this case
10
#   class{ 'nftables':
11
#     noflush_tables => ['inet-f2b-table'],
12
#   }
13
#
14
# @param out_all
15
#   Allow all outbound connections. If `true` then all other
16
#   out parameters `out_ntp`, `out_dns`, ... will be assuemed
17
#   false.
18
#
19
# @param out_ntp
20
#   Allow outbound to ntp servers.
21
#
22
# @param out_http
23
#   Allow outbound to http servers.
24
#
25
# @param out_dns
26
#   Allow outbound to dns servers.
27
#
28
# @param out_https
29
#   Allow outbound to https servers.
30
#
31
# @param out_icmp
32
#   Allow outbound ICMPv4/v6 traffic.
33
#
34
# @param in_ssh
35
#   Allow inbound to ssh servers.
36
#
37
# @param in_icmp
38
#   Allow inbound ICMPv4/v6 traffic.
39
#
40
# @param inet_filter
41
#   Add default tables, chains and rules to process traffic.
42
#
43
# @param nat
44
#   Add default tables and chains to process NAT traffic.
45
#
46
# @param nat_table_name
47
#   The name of the 'nat' table.
48
#
49
# @param purge_unmanaged_rules
50
#   Prohibits in-memory rules that are not declared in Puppet
51
#   code. Setting this to true activates a check that reloads nftables
52
#   if the rules in memory have been modified without Puppet.
53
#
54
# @param inmem_rules_hash_file
55
#   The name of the file where the hash of the in-memory rules
56
#   will be stored.
57
#
58
# @param sets
59
#   Allows sourcing set definitions directly from Hiera.
60
#
61
# @param log_prefix
62
#   String that will be used as prefix when logging packets. It can contain
63
#   two variables using standard sprintf() string-formatting:
64
#    * chain: Will be replaced by the name of the chain.
65
#    * comment: Allows chains to add extra comments.
66
#
67
# @param log_discarded
68
#   Allow to log discarded packets
69
#
70
# @param log_limit
71
#  String with the content of a limit statement to be applied
72
#  to the rules that log discarded traffic. Set to false to
73
#  disable rate limiting.
74
#
75
# @param reject_with
76
#   How to discard packets not matching any rule. If `false`, the
77
#   fate of the packet will be defined by the chain policy (normally
78
#   drop), otherwise the packet will be rejected with the REJECT_WITH
79
#   policy indicated by the value of this parameter.
80
#
81
# @param in_out_conntrack
82
#   Adds INPUT and OUTPUT rules to allow traffic that's part of an
83
#   established connection and also to drop invalid packets.
84
#
85
# @param in_out_drop_invalid
86
#   Drops invalid packets in INPUT and OUTPUT
87
#
88
# @param fwd_conntrack
89
#   Adds FORWARD rules to allow traffic that's part of an
90
#   established connection and also to drop invalid packets.
91
#
92
# @param fwd_drop_invalid
93
#   Drops invalid packets in FORWARD
94
#
95
# @param firewalld_enable
96
#   Configures how the firewalld systemd service unit is enabled. It might be
97
#   useful to set this to false if you're externaly removing firewalld from
98
#   the system completely.
99
#
100
# @param noflush_tables
101
#   If specified only other existings tables will be flushed.
102
#   If left unset all tables will be flushed via a `flush ruleset`
103
#
104
# @param rules
105
#   Specify hashes of `nftables::rule`s via hiera
106
#
107
# @param configuration_path
108
#   The absolute path to the principal nftables configuration file. The default
109
#   varies depending on the system, and is set in the module's data.
110
#
111
# @param nft_path
112
#   Path to the nft binary
113
#
114
# @param echo
115
#   Path to the echo binary
116
#
117
# @param default_config_mode
118
#   The default file & dir mode for configuration files and directories. The
119
#   default varies depending on the system, and is set in the module's data.
120
#
121
# @param clobber_default_config
122
#   Should the existing OS provided rules in the `configuration_path` be removed? If
123
#   they are not being removed this module will add all of its configuration to the end of
124
#   the existing rules.
125
#
126
class nftables (
127
  Stdlib::Unixpath $echo,
128
  Stdlib::Unixpath $configuration_path,
129
  Stdlib::Unixpath $nft_path,
130
  Stdlib::Filemode $default_config_mode,
131
  Boolean $clobber_default_config = false,
132
  Boolean $in_ssh = true,
133
  Boolean $in_icmp = true,
134
  Boolean $out_ntp = true,
135
  Boolean $out_dns = true,
136
  Boolean $out_http = true,
137
  Boolean $out_https = true,
138
  Boolean $out_icmp = true,
139
  Boolean $out_all = false,
140
  Boolean $in_out_conntrack = true,
141
  Boolean $in_out_drop_invalid = $in_out_conntrack,
142
  Boolean $fwd_conntrack = false,
143
  Boolean $fwd_drop_invalid = $fwd_conntrack,
144
  Boolean $inet_filter = true,
145
  Boolean $nat = true,
146
  Boolean $purge_unmanaged_rules = false,
147
  Hash $rules = {},
148
  Hash $sets = {},
149
  String $log_prefix = '[nftables] %<chain>s %<comment>s',
150
  String[1] $nat_table_name = 'nat',
151
  Stdlib::Unixpath $inmem_rules_hash_file = '/var/tmp/puppet-nft-memhash',
152
  Boolean $log_discarded = true,
153
  Variant[Boolean[false], String] $log_limit = '3/minute burst 5 packets',
154
  Variant[Boolean[false], Pattern[/icmp(v6|x)? type .+|tcp reset/]] $reject_with = 'icmpx type port-unreachable',
155
  Variant[Boolean[false], Enum['mask']] $firewalld_enable = 'mask',
156
  Optional[Array[Pattern[/^(ip|ip6|inet|arp|bridge|netdev)-[-a-zA-Z0-9_]+$/],1]] $noflush_tables = undef,
157
) {
158
  package { 'nftables':
159
    ensure => installed,
160
  }
161

    
162
  # /etc/services file is needed, on newer OSes this is a dependency on nftables
163
  if $facts['os']['name'] == 'Ubuntu' and $facts['os']['release']['major'] == '20.04' {
164
    package { 'netbase':
165
      ensure => present,
166
    }
167
  }
168

    
169
  if $clobber_default_config {
170
    file { $configuration_path:
171
      ensure  => file,
172
      owner   => 'root',
173
      group   => 'root',
174
      mode    => $default_config_mode,
175
      content => "#Puppet Managed\ninclude \"/etc/nftables/puppet.nft\"\n",
176
      require => Package['nftables'],
177
      before  => File['/etc/nftables'],
178
      notify  => Service['nftables'],
179
    }
180
  } else {
181
    file_line { 'enable_nftables':
182
      line    => 'include "/etc/nftables/puppet.nft"',
183
      path    => $configuration_path,
184
      require => Package['nftables'],
185
      before  => File['/etc/nftables'],
186
      notify  => Service['nftables'],
187
    }
188
  }
189

    
190
  file {
191
    default:
192
      owner => 'root',
193
      group => 'root',
194
      mode  => $default_config_mode;
195
    '/etc/nftables':
196
      ensure => directory,
197
      mode   => $default_config_mode;
198
    '/etc/nftables/puppet-preflight':
199
      ensure  => directory,
200
      mode    => $default_config_mode,
201
      purge   => true,
202
      force   => true,
203
      recurse => true;
204
    '/etc/nftables/puppet-preflight.nft':
205
      ensure  => file,
206
      content => epp('nftables/config/puppet.nft.epp', {
207
          'inet_filter' => $inet_filter,
208
          'nat'         => $nat,
209
          'noflush'     => $noflush_tables
210
        }
211
      );
212
  } ~> exec {
213
    'nft validate':
214
      refreshonly => true,
215
      command     => "${nft_path} -I /etc/nftables/puppet-preflight -c -f /etc/nftables/puppet-preflight.nft || ( ${echo} '#CONFIG BROKEN' >> /etc/nftables/puppet-preflight.nft && /bin/false)"; # lint:ignore:check_unsafe_interpolations
216
  } -> file {
217
    default:
218
      owner => 'root',
219
      group => 'root',
220
      mode  => $default_config_mode;
221
    '/etc/nftables/puppet.nft':
222
      ensure  => file,
223
      content => epp('nftables/config/puppet.nft.epp', {
224
          'inet_filter' => $inet_filter,
225
          'nat'         => $nat,
226
          'noflush'     => $noflush_tables
227
        }
228
      );
229
    '/etc/nftables/puppet':
230
      ensure  => directory,
231
      mode    => $default_config_mode,
232
      purge   => true,
233
      force   => true,
234
      recurse => true;
235
  } ~> service { 'nftables':
236
    ensure     => running,
237
    enable     => true,
238
    hasrestart => true,
239
    restart    => 'PATH=/usr/bin:/bin systemctl reload nftables',
240
  }
241

    
242
  if $purge_unmanaged_rules {
243
    # Reload nftables ruleset from disk if running state not match last service change hash, or is absent (-s required to ignore counters)
244
    exec { 'nftables_memory_state_check':
245
      command  => ['echo', 'reloading_nftables'],
246
      path     => $facts['path'],
247
      provider => shell,
248
      unless   => ["test -s ${inmem_rules_hash_file} -a \"$(nft -s list ruleset | sha1sum)\" = \"$(cat ${inmem_rules_hash_file})\""],
249
      notify   => Service['nftables'],
250
    }
251

    
252
    # Generate nftables hash upon changes to the nftables service
253
    exec { 'nftables_generate_hash':
254
      command     => ["nft -s list ruleset | sha1sum > ${inmem_rules_hash_file}"],
255
      path        => $facts['path'],
256
      provider    => shell,
257
      subscribe   => Service['nftables'],
258
      refreshonly => true,
259
    }
260
  }
261

    
262
  systemd::dropin_file { 'puppet_nft.conf':
263
    ensure  => present,
264
    unit    => 'nftables.service',
265
    content => epp('nftables/systemd/puppet_nft.conf.epp', {
266
        'configuration_path' => $configuration_path,
267
        'nft_path'           => $nft_path,
268
    }),
269
    notify  => Service['nftables'],
270
  }
271

    
272
  # firewalld.enable can be mask or false depending upon if firewalld is installed or not
273
  # https://tickets.puppetlabs.com/browse/PUP-10814
274
  service { 'firewalld':
275
    ensure => stopped,
276
    enable => $firewalld_enable,
277
  }
278

    
279
  if $inet_filter {
280
    include nftables::inet_filter
281
  }
282

    
283
  if $nat {
284
    include nftables::ip_nat
285
  }
286

    
287
  # inject custom rules e.g. from hiera
288
  $rules.each |$n,$v| {
289
    nftables::rule {
290
      $n:
291
        * => $v,
292
    }
293
  }
294

    
295
  # inject custom sets e.g. from hiera
296
  $sets.each |$n,$v| {
297
    nftables::set {
298
      $n:
299
        * => $v,
300
    }
301
  }
302
}