ferm defs cleanup, and make sure static works even if we ssh restrict the participati...

diff --git a/modules/ferm/templates/defs.conf.erb b/modules/ferm/templates/defs.conf.erb
index ef88d6b1bcd1a547bda59f9d92db72a789cafc51..d94c62f5368e39a094e6f458faeb9fe2fccc896a 100644 (file)
--- a/modules/ferm/templates/defs.conf.erb
+++ b/modules/ferm/templates/defs.conf.erb
@@ -19,154 +19,55 @@
  proto (tcp udp) dport $port @subchain "$port" { saddr ($srange) ACCEPT; }"
 }
 
-@def $HOST_MAILRELAY_V4 = (<%=
-  mailrelay = []
-  scope.lookupvar('site::localinfo').keys.sort.each do |node|
-      if scope.lookupvar('site::localinfo')[node]['mailrelay']
-          scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip|
-             next if ip =~ /:/
-             mailrelay << ip
-          end
+<%
+  rolehost={}
+  localinfo = scope.lookupvar('site::localinfo')
+  allnodeinfo = scope.lookupvar('site::allnodeinfo')
+
+  %w{mailrelay nagiosmaster extranrpeclient muninmaster dbmaster static_mirror static_source static_master}.each do |role|
+    rolehost[role] = []
+    localinfo.keys.sort.each do |node|
+      if localinfo[node][role]
+        rolehost[role] << allnodeinfo[node]['ipHostNumber']
       end
+    end
+    rolehost[role].flatten!
   end
 
-  mailrelay.join(' ')
-%>);
-
-@def $HOST_MAILRELAY_V6 = (<%=
-  mailrelay = []
-  scope.lookupvar('site::localinfo').keys.sort.each do |node|
-      if scope.lookupvar('site::localinfo')[node]['mailrelay']
-          scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip|
-             next if ip =~ /\./
-             mailrelay << ip
-          end
-      end
+  dbs = []
+  allnodeinfo.keys.sort.each do |node|
+      next unless allnodeinfo[node].has_key?('ipHostNumber')
+      dbs << allnodeinfo[node]['ipHostNumber']
   end
+  dbs.flatten!
+%>
 
-  mailrelay.join(' ')
-%>);
-
+@def $HOST_MAILRELAY_V4 = (<%= scope.function_filter_ipv4([rolehost['mailrelay']]).uniq.join(' ') %>);
+@def $HOST_MAILRELAY_V6 = (<%= scope.function_filter_ipv6([rolehost['mailrelay']]).uniq.join(' ') %>);
 @def $HOST_MAILRELAY = ( $HOST_MAILRELAY_V4 $HOST_MAILRELAY_V6 );
 
-@def $HOST_NAGIOS_V4 = (<%=
-  nagii = []
-  scope.lookupvar('site::localinfo').keys.sort.each do |node|
-      if scope.lookupvar('site::localinfo')[node]['nagiosmaster'] or scope.lookupvar('site::localinfo')[node]['extranrpeclient']
-          scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip|
-             next if ip =~ /:/
-             nagii << ip
-          end
-      end
-  end
-
-  nagii.join(' ')
-%>);
-
-@def $HOST_NAGIOS_V6 = (<%=
-  nagii = []
-  scope.lookupvar('site::localinfo').keys.sort.each do |node|
-      if scope.lookupvar('site::localinfo')[node]['nagiosmaster'] or scope.lookupvar('site::localinfo')[node]['extranrpeclient']
-          scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip|
-             next if ip =~ /\./
-             nagii << ip
-          end
-      end
-  end
-
-  nagii.join(' ')
-%>);
-
+@def $HOST_NAGIOS_V4 = (<%= scope.function_filter_ipv4([rolehost['nagiosmaster'] + rolehost['extranrpeclient']]).uniq.join(' ') %>);
+@def $HOST_NAGIOS_V6 = (<%= scope.function_filter_ipv6([rolehost['nagiosmaster'] + rolehost['extranrpeclient']]).uniq.join(' ') %>);
 @def $HOST_NAGIOS = ( $HOST_NAGIOS_V4 $HOST_NAGIOS_V6 );
 
-@def $HOST_MUNIN_V4 = (<%=
-  munins = []
-  scope.lookupvar('site::localinfo').keys.sort.each do |node|
-      if scope.lookupvar('site::localinfo')[node]['muninmaster']
-          scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip|
-             next if ip =~ /:/
-             munins << ip
-          end
-      end
-  end
-
-  munins.join(' ')
-%>);
-
-@def $HOST_MUNIN_V6 = (<%=
-  munins = []
-  scope.lookupvar('site::localinfo').keys.sort.each do |node|
-      if scope.lookupvar('site::localinfo')[node]['muninmaster']
-          scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip|
-             next if ip =~ /\./
-             munins << ip
-          end
-      end
-  end
-
-  munins.join(' ')
-%>);
-
+@def $HOST_MUNIN_V4 = (<%= scope.function_filter_ipv4([rolehost['muninmaster']]).uniq.join(' ') %>);
+@def $HOST_MUNIN_V6 = (<%= scope.function_filter_ipv6([rolehost['muninmaster']]).uniq.join(' ') %>);
 @def $HOST_MUNIN = ( $HOST_MUNIN_V4 $HOST_MUNIN_V6 );
 
-@def $HOST_DB_V6  = (<%=
-  dbs = []
-  scope.lookupvar('site::localinfo').keys.sort.each do |node|
-      if scope.lookupvar('site::localinfo')[node]['dbmaster']
-          scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip|
-             next if ip =~ /\./
-             dbs << ip
-          end
-      end
-  end
-
-  dbs.join(' ')
-%>);
-
-@def $HOST_DB_V4 = (<%=
-  dbs = []
-  scope.lookupvar('site::localinfo').keys.sort.each do |node|
-      if scope.lookupvar('site::localinfo')[node]['dbmaster']
-          scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip|
-             next if ip =~ /:/
-             dbs << ip
-          end
-      end
-  end
-
-  dbs.join(' ')
-%>);
-
-@def $HOST_DB = ($HOST_DB_V4 $HOST_DB_V6);
-
-@def $HOST_DEBIAN_V4 = (<%=
-  dbs = []
-  scope.lookupvar('site::allnodeinfo').keys.sort.each do |node|
-      next unless scope.lookupvar('site::allnodeinfo')[node].has_key?('ipHostNumber')
-      scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip|
-         next if ip =~ /:/
-         dbs << ip
-      end
-  end
+@def $HOST_DB_V4 = (<%= scope.function_filter_ipv4([rolehost['dbmaster']]).uniq.join(' ') %>);
+@def $HOST_DB_V6 = (<%= scope.function_filter_ipv6([rolehost['dbmaster']]).uniq.join(' ') %>);
+@def $HOST_DB = ( $HOST_DB_V4 $HOST_DB_V6 );
 
-  dbs.join(' ')
-%>);
-
-@def $HOST_DEBIAN_V6  = (<%=
-  dbs = []
-  scope.lookupvar('site::allnodeinfo').keys.sort.each do |node|
-      next unless scope.lookupvar('site::allnodeinfo')[node].has_key?('ipHostNumber')
-      scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip|
-         next if ip =~ /\./
-         dbs << ip
-      end
-  end
-
-  dbs.join(' ')
-%>);
+@def $HOST_STATICMASTER_V4 = (<%= scope.function_filter_ipv4([rolehost['static_master']]).uniq.join(' ') %>);
+@def $HOST_STATICMASTER_V6 = (<%= scope.function_filter_ipv6([rolehost['static_master']]).uniq.join(' ') %>);
+@def $HOST_STATIC_V4 = (<%= scope.function_filter_ipv4([rolehost['static_mirror'] + rolehost['static_source'] + rolehost['static_master']]).uniq.join(' ') %>);
+@def $HOST_STATIC_V6 = (<%= scope.function_filter_ipv6([rolehost['static_mirror'] + rolehost['static_source'] + rolehost['static_master']]).uniq.join(' ') %>);
 
+@def $HOST_DEBIAN_V4 = (<%= scope.function_filter_ipv4([dbs]).uniq.join(' ') %>);
+@def $HOST_DEBIAN_V6 = (<%= scope.function_filter_ipv6([dbs]).uniq.join(' ') %>);
 @def $HOST_DEBIAN = ($HOST_DEBIAN_V4 $HOST_DEBIAN_V6);
 
+
 @def $sgran   = (91.103.132.24/29 85.158.45.51/32);
 @def $weasel  = ();
 @def $weasel  = ($weasel 86.59.118.144/28); # debian@sil

diff --git a/modules/ferm/templates/me.conf.erb b/modules/ferm/templates/me.conf.erb
index 7f2a75c932df2b2db1ed09cb65639ef72c830c32..94562a5a778a64d87c69aed671873f8ae579e6d1 100644 (file)
--- a/modules/ferm/templates/me.conf.erb
+++ b/modules/ferm/templates/me.conf.erb
@@ -4,13 +4,15 @@
 ##
 
 <%=
+nodeinfo = scope.lookupvar('site::nodeinfo')
+
 out = []
 
 restricted_purposes = ['kvm host', 'central syslog server', 'puppet master', 'jumphost']
 restrict_ssh = %w{lebrun geo1 geo2 geo3 beethoven tchaikovsky schroeder draghi}
 
-if (scope.lookupvar('site::nodeinfo')['ldap'].has_key?('purpose')) then
-       scope.lookupvar('site::nodeinfo')['ldap']['purpose'].each do |purp|
+if (nodeinfo['ldap'].has_key?('purpose')) then
+       nodeinfo['ldap']['purpose'].each do |purp|
                if restricted_purposes.include?(purp) then
                        restrict_ssh << hostname
                end
@@ -23,19 +25,28 @@ ssh6allowed = []
 if restrict_ssh.include?(hostname) then
        ssh4allowed  << %w{$DSA_IPS   $HOST_NAGIOS_V4 $HOST_MUNIN_V4 $HOST_DB_V4}
        ssh6allowed << %w{$DSA_V6_IPS $HOST_NAGIOS_V6 $HOST_MUNIN_V6 $HOST_DB_V6}
-end
-if %w{lebrun schroeder}.include?(hostname) then
-       out << '@def $CARNET = ( 193.198.184.8/29 161.53.160.133 161.53.160.90 161.53.11.222 161.53.12.134 161.53.12.142 161.53.12.143 );'
-       ssh4allowed << '$CARNET'
-       ssh4allowed << '$BUILDD_SSH_ACCESS'
-end
-if %w{beethoven draghi}.include?(hostname) then
-       ssh4allowed << '$HOST_DEBIAN_V4'
-       ssh6allowed << '$HOST_DEBIAN_V6'
-end
-if %w{unger}.include?(hostname) then
-       ssh4allowed << '$UNGER_SSH_ACCESS'  # Ganneff
-       ssh6allowed << '$UNGER_SSH6_ACCESS' # Ganneff, but more address space
+
+       if %w{lebrun schroeder}.include?(hostname) then
+               out << '@def $CARNET = ( 193.198.184.8/29 161.53.160.133 161.53.160.90 161.53.11.222 161.53.12.134 161.53.12.142 161.53.12.143 );'
+               ssh4allowed << '$CARNET'
+               ssh4allowed << '$BUILDD_SSH_ACCESS'
+       end
+       if %w{beethoven draghi}.include?(hostname) then
+               ssh4allowed << '$HOST_DEBIAN_V4'
+               ssh6allowed << '$HOST_DEBIAN_V6'
+       end
+       if %w{unger}.include?(hostname) then
+               ssh4allowed << '$UNGER_SSH_ACCESS'  # Ganneff
+               ssh6allowed << '$UNGER_SSH6_ACCESS' # Ganneff, but more address space
+       end
+
+       if nodeinfo['static_master'] then
+               ssh4allowed << '$HOST_STATIC_V4'
+               ssh6allowed << '$HOST_STATIC_V6'
+       elsif nodeinfo['static_source'] or nodeinfo['static_mirror'] then
+               ssh4allowed << '$HOST_STATICMASTER_V4'
+               ssh6allowed << '$HOST_STATICMASTER_V6'
+       end
 end
 ssh4allowed.length == 0 and ssh4allowed << '0.0.0.0/0'
 ssh6allowed.length == 0 and ssh6allowed << '::/0'
@@ -49,7 +60,7 @@ out << "@def $SSH_V6_SOURCES = (#{ssh6allowed.join(' ')});"
 smtp4allowed = []
 smtp6allowed = []
 
-if not scope.lookupvar('site::nodeinfo')['smarthost'].empty?
+if not nodeinfo['smarthost'].empty?
   smtp4allowed << %w{$HOST_MAILRELAY_V4 $HOST_NAGIOS_V4}
   smtp6allowed << %w{$HOST_MAILRELAY_V6 $HOST_NAGIOS_V6}
 end