From: Stephen Gran <steve@lobefin.net>
Date: Sun, 21 Feb 2010 16:48:28 +0000 (+0000)
Subject: Revert "will ferm do the right thing?"
X-Git-Url: https://git.donarmstrong.com/?a=commitdiff_plain;h=ab95643a2ad84e74ea08955ab3605d44263e1c2d;p=dsa-puppet.git

Revert "will ferm do the right thing?"

This reverts commit a47c22e58d6502bb314e9fca3814fae1cadc62e5.
---

diff --git a/modules/ferm/files/ferm.conf b/modules/ferm/files/ferm.conf
new file mode 100644
index 00000000..f761b01e
--- /dev/null
+++ b/modules/ferm/files/ferm.conf
@@ -0,0 +1,59 @@
+##
+## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
+## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
+##
+
+# -*- shell-script -*-
+
+@include 'conf.d/';
+
+domain ip {
+        table filter {
+              chain log_and_reject {
+                      ULOG ulog-prefix "REJECT: ";
+                      proto tcp REJECT reject-with tcp-reset;
+                      REJECT;
+              }
+
+              chain log_or_drop {
+                      mod hashlimit hashlimit-name ulogreject  hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second jump log_and_reject;
+                      mod hashlimit hashlimit-name uloglogdrop hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second ULOG ulog-prefix "DROP: ";
+                      DROP;
+              }
+
+        }
+}
+domain ip6 {
+        table filter {
+              chain log_and_reject {
+                      LOG log-prefix "REJECT: ";
+                      proto tcp REJECT reject-with tcp-reset;
+                      REJECT;
+              }
+
+              chain log_or_drop {
+                      mod hashlimit hashlimit-name logreject  hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second jump log_and_reject;
+                      mod hashlimit hashlimit-name loglogdrop hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second LOG log-prefix "DROP: ";
+                      DROP;
+              }
+        }
+}
+domain (ip ip6) {
+        table filter {
+              chain INPUT {
+                      policy DROP;
+                      mod state state (ESTABLISHED RELATED) ACCEPT;
+                      interface lo ACCEPT;
+                      proto icmp ACCEPT;
+                      mod state state (INVALID) DROP;
+              }
+        }
+}
+
+@include 'dsa.d/';
+
+domain (ip ip6) {
+        chain INPUT {
+                jump log_or_drop;
+        }
+}
diff --git a/modules/ferm/templates/ferm.conf.erb b/modules/ferm/templates/ferm.conf.erb
deleted file mode 100644
index f761b01e..00000000
--- a/modules/ferm/templates/ferm.conf.erb
+++ /dev/null
@@ -1,59 +0,0 @@
-##
-## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
-## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
-##
-
-# -*- shell-script -*-
-
-@include 'conf.d/';
-
-domain ip {
-        table filter {
-              chain log_and_reject {
-                      ULOG ulog-prefix "REJECT: ";
-                      proto tcp REJECT reject-with tcp-reset;
-                      REJECT;
-              }
-
-              chain log_or_drop {
-                      mod hashlimit hashlimit-name ulogreject  hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second jump log_and_reject;
-                      mod hashlimit hashlimit-name uloglogdrop hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second ULOG ulog-prefix "DROP: ";
-                      DROP;
-              }
-
-        }
-}
-domain ip6 {
-        table filter {
-              chain log_and_reject {
-                      LOG log-prefix "REJECT: ";
-                      proto tcp REJECT reject-with tcp-reset;
-                      REJECT;
-              }
-
-              chain log_or_drop {
-                      mod hashlimit hashlimit-name logreject  hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second jump log_and_reject;
-                      mod hashlimit hashlimit-name loglogdrop hashlimit-mode srcip hashlimit-burst 30 hashlimit 15/second LOG log-prefix "DROP: ";
-                      DROP;
-              }
-        }
-}
-domain (ip ip6) {
-        table filter {
-              chain INPUT {
-                      policy DROP;
-                      mod state state (ESTABLISHED RELATED) ACCEPT;
-                      interface lo ACCEPT;
-                      proto icmp ACCEPT;
-                      mod state state (INVALID) DROP;
-              }
-        }
-}
-
-@include 'dsa.d/';
-
-domain (ip ip6) {
-        chain INPUT {
-                jump log_or_drop;
-        }
-}
diff --git a/modules/munin-node/manifests/init.pp b/modules/munin-node/manifests/init.pp
index 06d47ced..ac999ef9 100644
--- a/modules/munin-node/manifests/init.pp
+++ b/modules/munin-node/manifests/init.pp
@@ -74,14 +74,9 @@ class munin-node {
         path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
         refreshonly => true,
     }
-    @ferm::rule { "dsa-munin-v4":
+    @ferm::rule { "dsa-munin":
             description     => "Allow munin from munin master",
-            rule            => "proto tcp mod state state (NEW) dport (munin) @subchain 'munin' { saddr (\$HOST_MUNIN_V4 \$HOST_NAGIOS_V4) ACCEPT; }"
-    }
-    @ferm::rule { "dsa-munin-v6":
-            description     => "Allow munin from munin master",
-            domain          => "ip6",
-            rule            => "proto tcp mod state state (NEW) dport (munin) @subchain 'munin' { saddr (\$HOST_MUNIN_V6 \$HOST_NAGIOS_V6) ACCEPT; }"
+            rule            => "proto tcp mod state state (NEW) dport (munin) @subchain 'munin' { saddr (\$HOST_MUNIN) ACCEPT; }"
     }
 }