Skip to content

Commit d598280

Browse files
author
Morgan Haskel
committed
MODULES-1309 - Make package and service names configurable
This was motivated by a need to make this work on Debian Jessie.
1 parent b0daa9d commit d598280

10 files changed

+199
-48
lines changed

‎README.markdown

+8
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,14 @@ Parameter that controls the state of the `iptables` service on your system, allo
311311

312312
`ensure` can either be `running` or `stopped`. Default to `running`.
313313

314+
####`package`
315+
316+
Specify the platform-specific package(s) to install. Defaults defined in `firewall::params`.
317+
318+
####`service`
319+
320+
Specify the platform-specific service(s) to start or stop. Defaults defined in `firewall::params`.
321+
314322
###Type: firewall
315323

316324
This type enables you to manage firewall rules within Puppet.

‎manifests/init.pp

+7-3
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,10 @@
1212
# Default: running
1313
#
1414
class firewall (
15-
$ensure = running
16-
) {
15+
$ensure = running,
16+
$service = $::firewall::params::service,
17+
$package = $::firewall::params::package,
18+
) inherits ::firewall::params {
1719
case $ensure {
1820
/^(running|stopped)$/: {
1921
# Do nothing.
@@ -26,7 +28,9 @@
2628
case $::kernel {
2729
'Linux': {
2830
class { "${title}::linux":
29-
ensure => $ensure,
31+
ensure => $ensure,
32+
service => $service,
33+
package => $package,
3034
}
3135
}
3236
default: {

‎manifests/linux.pp

+10-2
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,10 @@
1212
# Default: running
1313
#
1414
class firewall::linux (
15-
$ensure = running
16-
) {
15+
$ensure = running,
16+
$service = $::firewall::params::service,
17+
$package = $::firewall::params::package,
18+
) inherits ::firewall::params {
1719
$enable = $ensure ? {
1820
running => true,
1921
stopped => false,
@@ -29,20 +31,26 @@
2931
class { "${title}::redhat":
3032
ensure => $ensure,
3133
enable => $enable,
34+
package => $package,
35+
service => $service,
3236
require => Package['iptables'],
3337
}
3438
}
3539
'Debian', 'Ubuntu': {
3640
class { "${title}::debian":
3741
ensure => $ensure,
3842
enable => $enable,
43+
package => $package,
44+
service => $service,
3945
require => Package['iptables'],
4046
}
4147
}
4248
'Archlinux': {
4349
class { "${title}::archlinux":
4450
ensure => $ensure,
4551
enable => $enable,
52+
package => $package,
53+
service => $service,
4654
require => Package['iptables'],
4755
}
4856
}

‎manifests/linux/archlinux.pp

+12-10
Original file line numberDiff line numberDiff line change
@@ -14,28 +14,30 @@
1414
# Default: true
1515
#
1616
class firewall::linux::archlinux (
17-
$ensure = 'running',
18-
$enable = true
19-
) {
20-
service { 'iptables':
21-
ensure => $ensure,
22-
enable => $enable,
23-
hasstatus => true,
17+
$ensure = 'running',
18+
$enable = true,
19+
$service = $::firewall::params::service,
20+
$package = $::firewall::params::package,
21+
) inherits ::firewall::params {
22+
if $package {
23+
package { $package:
24+
ensure => $ensure,
25+
}
2426
}
2527

26-
service { 'ip6tables':
28+
service { $service:
2729
ensure => $ensure,
2830
enable => $enable,
2931
hasstatus => true,
3032
}
3133

3234
file { '/etc/iptables/iptables.rules':
3335
ensure => present,
34-
before => Service['iptables'],
36+
before => Service[$service],
3537
}
3638

3739
file { '/etc/iptables/ip6tables.rules':
3840
ensure => present,
39-
before => Service['ip6tables'],
41+
before => Service[$service],
4042
}
4143
}

‎manifests/linux/debian.pp

+14-9
Original file line numberDiff line numberDiff line change
@@ -14,31 +14,36 @@
1414
# Default: true
1515
#
1616
class firewall::linux::debian (
17-
$ensure = running,
18-
$enable = true
19-
) {
20-
package { 'iptables-persistent':
21-
ensure => present,
17+
$ensure = running,
18+
$enable = true,
19+
$service = $::firewall::params::service,
20+
$package = $::firewall::params::package,
21+
) inherits ::firewall::params {
22+
23+
if $package {
24+
package { $package:
25+
ensure => present,
26+
}
2227
}
2328

2429
if($::operatingsystemrelease =~ /^6\./ and $enable == true
25-
and versioncmp($::iptables_persistent_version, '0.5.0') < 0 ) {
30+
and versioncmp($::iptables_persistent_version, '0.5.0') < 0 and ! $service) {
2631
# This fixes a bug in the iptables-persistent LSB headers in 6.x, without it
2732
# we lose idempotency
2833
exec { 'iptables-persistent-enable':
2934
logoutput => on_failure,
3035
command => '/usr/sbin/update-rc.d iptables-persistent enable',
3136
unless => '/usr/bin/test -f /etc/rcS.d/S*iptables-persistent',
32-
require => Package['iptables-persistent'],
37+
require => Package[$package],
3338
}
3439
} else {
3540
# This isn't a real service/daemon. The start action loads rules, so just
3641
# needs to be called on system boot.
37-
service { 'iptables-persistent':
42+
service { $service:
3843
ensure => undef,
3944
enable => $enable,
4045
hasstatus => true,
41-
require => Package['iptables-persistent'],
46+
require => Package[$package],
4247
}
4348
}
4449
}

‎manifests/linux/redhat.pp

+19-15
Original file line numberDiff line numberDiff line change
@@ -13,38 +13,42 @@
1313
# Default: true
1414
#
1515
class firewall::linux::redhat (
16-
$ensure = running,
17-
$enable = true
18-
) {
16+
$ensure = running,
17+
$enable = true,
18+
$service = $::firewall::params::service,
19+
$package = $::firewall::params::package,
20+
) inherits ::firewall::params {
1921

2022
# RHEL 7 and later and Fedora 15 and later require the iptables-services
2123
# package, which provides the /usr/libexec/iptables/iptables.init used by
2224
# lib/puppet/util/firewall.rb.
23-
if ($::operatingsystem != 'Fedora' and versioncmp($::operatingsystemrelease, '7.0') >= 0)
24-
or ($::operatingsystem == 'Fedora' and versioncmp($::operatingsystemrelease, '15') >= 0) {
25-
service { "firewalld":
25+
if ($::operatingsystem != 'Fedora' and versioncmp($::operatingsystemrelease, '7.0') >= 0)
26+
or ($::operatingsystem == 'Fedora' and versioncmp($::operatingsystemrelease, '15') >= 0) {
27+
service { 'firewalld':
2628
ensure => stopped,
2729
enable => false,
28-
before => Package['iptables-services']
30+
before => Package[$package],
2931
}
32+
}
3033

31-
package { 'iptables-services':
32-
ensure => present,
33-
before => Service['iptables'],
34+
if $package {
35+
package { $package:
36+
ensure => present,
37+
before => Service[$service],
3438
}
3539
}
3640

37-
service { 'iptables':
41+
service { $service:
3842
ensure => $ensure,
3943
enable => $enable,
4044
hasstatus => true,
4145
require => File['/etc/sysconfig/iptables'],
4246
}
4347

4448
file { '/etc/sysconfig/iptables':
45-
ensure => present,
46-
owner => 'root',
47-
group => 'root',
48-
mode => '0600',
49+
ensure => present,
50+
owner => 'root',
51+
group => 'root',
52+
mode => '0600',
4953
}
5054
}

‎manifests/params.pp

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
class firewall::params {
2+
case $::osfamily {
3+
'RedHat': {
4+
case $::operatingsystem {
5+
'Archlinux': {
6+
$service = ['iptables','ip6tables']
7+
$package = undef
8+
}
9+
'Fedora': {
10+
if versioncmp($::operatingsystemrelease, '15') >= 0 {
11+
$package = 'iptables-services'
12+
} else {
13+
$package = undef
14+
}
15+
$service = 'iptables'
16+
}
17+
default: {
18+
if versioncmp($::operatingsystemrelease, '7.0') >= 0 {
19+
$package = 'iptables-services'
20+
} else {
21+
$package = undef
22+
}
23+
$service = 'iptables'
24+
}
25+
}
26+
}
27+
'Debian': {
28+
if $::operatingsystemrelease =~ /^6\./ and versioncmp($::iptables_persistent_version, '0.5.0') < 0 {
29+
$service = undef
30+
$package = 'iptables-persistent'
31+
} elsif $::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '8.0') >= 0 {
32+
$service = 'netfilter-persistent'
33+
$package = 'netfilter-persistent'
34+
} else {
35+
$service = 'iptables-persistent'
36+
$package = 'iptables-persistent'
37+
}
38+
}
39+
default: {
40+
$package = undef
41+
$service = 'iptables'
42+
}
43+
}
44+
}

‎spec/unit/classes/firewall_linux_archlinux_spec.rb

+6
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
require 'spec_helper'
22

33
describe 'firewall::linux::archlinux', :type => :class do
4+
let(:facts) do
5+
{
6+
:osfamily => 'RedHat',
7+
:operatingsystem => 'Archlinux'
8+
}
9+
end
410
it { should contain_service('iptables').with(
511
:ensure => 'running',
612
:enable => 'true'

‎spec/unit/classes/firewall_linux_debian_spec.rb

+77-9
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,87 @@
11
require 'spec_helper'
22

33
describe 'firewall::linux::debian', :type => :class do
4-
it { should contain_package('iptables-persistent').with(
5-
:ensure => 'present'
6-
)}
7-
it { should contain_service('iptables-persistent').with(
8-
:ensure => nil,
9-
:enable => 'true',
10-
:require => 'Package[iptables-persistent]'
11-
)}
4+
context "Debian 7" do
5+
let(:facts) {{
6+
:osfamily => 'Debian',
7+
:operatingsystem => 'Debian',
8+
:operatingsystemrelease => '7.0'
9+
}}
10+
it { should contain_package('iptables-persistent').with(
11+
:ensure => 'present'
12+
)}
13+
it { should contain_service('iptables-persistent').with(
14+
:ensure => nil,
15+
:enable => 'true',
16+
:require => 'Package[iptables-persistent]'
17+
)}
18+
end
1219

13-
context 'enable => false' do
20+
context 'deb7 enable => false' do
21+
let(:facts) {{
22+
:osfamily => 'Debian',
23+
:operatingsystem => 'Debian',
24+
:operatingsystemrelease => '7.0'
25+
}}
1426
let(:params) {{ :enable => 'false' }}
1527
it { should contain_service('iptables-persistent').with(
1628
:enable => 'false'
1729
)}
1830
end
31+
32+
context "Debian 8" do
33+
let(:facts) {{
34+
:osfamily => 'Debian',
35+
:operatingsystem => 'Debian',
36+
:operatingsystemrelease => 'jessie/sid'
37+
}}
38+
it { should contain_package('netfilter-persistent').with(
39+
:ensure => 'present'
40+
)}
41+
it { should contain_service('netfilter-persistent').with(
42+
:ensure => nil,
43+
:enable => 'true',
44+
:require => 'Package[netfilter-persistent]'
45+
)}
46+
end
47+
48+
context 'deb8 enable => false' do
49+
let(:facts) {{
50+
:osfamily => 'Debian',
51+
:operatingsystem => 'Debian',
52+
:operatingsystemrelease => 'jessie/sid'
53+
}}
54+
let(:params) {{ :enable => 'false' }}
55+
it { should contain_service('netfilter-persistent').with(
56+
:enable => 'false'
57+
)}
58+
end
59+
60+
context "Debian 8, alt operatingsystem" do
61+
let(:facts) {{
62+
:osfamily => 'Debian',
63+
:operatingsystem => 'Debian',
64+
:operatingsystemrelease => '8.0'
65+
}}
66+
it { should contain_package('netfilter-persistent').with(
67+
:ensure => 'present'
68+
)}
69+
it { should contain_service('netfilter-persistent').with(
70+
:ensure => nil,
71+
:enable => 'true',
72+
:require => 'Package[netfilter-persistent]'
73+
)}
74+
end
75+
76+
context 'deb8, alt operatingsystem, enable => false' do
77+
let(:facts) {{
78+
:osfamily => 'Debian',
79+
:operatingsystem => 'Debian',
80+
:operatingsystemrelease => '8.0'
81+
}}
82+
let(:params) {{ :enable => 'false' }}
83+
it { should contain_service('netfilter-persistent').with(
84+
:enable => 'false'
85+
)}
86+
end
1987
end

‎spec/unit/classes/firewall_linux_redhat_spec.rb

+2
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
oldreleases.each do |osrel|
99
context "os #{os} and osrel #{osrel}" do
1010
let(:facts) {{
11+
:osfamily => 'RedHat',
1112
:operatingsystem => os,
1213
:operatingsystemrelease => osrel
1314
}}
@@ -20,6 +21,7 @@
2021
newreleases.each do |osrel|
2122
context "os #{os} and osrel #{osrel}" do
2223
let(:facts) {{
24+
:osfamily => 'RedHat',
2325
:operatingsystem => os,
2426
:operatingsystemrelease => osrel
2527
}}

0 commit comments

Comments
 (0)