GitHub puppet-ferm
Puppet module to manage the ferm firewall tooling

Repo Checks ( 15 of 24 successfull )
Metadata Valid
No translation
passed
Correct Puppet Version Range
Supported Puppet version range is %{PUPPET_SUPPORT_RANGE}
passed
With Puppet Version Range
Puppet version range is present in requirements in metadata.json
passed
With Operatingsystem Support
No translation
passed
Operatingsystems
No translation
passed
Supports Only Current Centos
No translation
passed
Supports Latest Centos
No translation
failed
Supports Only Current Redhat
No translation
passed
Supports Latest Redhat
No translation
failed
Supports Only Current Ubuntu
No translation
failed
Supports Latest Ubuntu
No translation
failed
Supports Only Current Debian
No translation
failed
Supports Latest Debian
No translation
failed
Supports Only Current Sles
No translation
passed
Supports Latest Sles
No translation
failed
Supports Only Current Virtuozzolinux
No translation
passed
Supports Latest Virtuozzolinux
No translation
failed
In Modulesync Repo
Is listed as a module managed using modulesync_config
passed
Synced
Has a .msync.yml file
passed
Latest Modulesync
Has been synchronized with the latest tagged version of modulesync_config
failed
Has Modulesync
Is present in voxpupuli/modulesync_config/managed_modules.yml
passed
Released
Is in modulesync_config and in forge releases.
passed
Valid Sync File
If a (optional) sync file is present, it must not contain a `.travis.yml` entry.
passed
Reference Dot Md
The repository has a REFERENCE.md. It needs to be generated / puppet-strings documentation is missing.
passed

Open Pull Requests

Add module counter to Vox Pupuli

<!--
Thank you for contributing to this project!

-->

Pull Request (PR) description

<!--
Replace this comment with a description of your pull request.
-->

This Pull Request (PR) fixes the following issues

<!--
Replace this comment with the list of issues or n/a.
Use format:
Fixes #123
Fixes #124
-->

Open PR in GitHub
add 'ipsets' hash to configure 'ferm::ipset' resource via Hiera
enhancement
needs-tests

Add ferm::ipsets parameter to enable configuration of ferm::ipset resources via Hiera.

It's basically the same as ferm::rules and ferm::chains.

Open PR in GitHub
Add Rocky and AlmaLinux 8 and 9 support
enhancement

includes: #174 #175 #176 #177 #178

Open PR in GitHub
Add EL 8 and 9 support
enhancement

includes: #174 #175 #176 #177

Open PR in GitHub
Enable negation of 'saddr', 'daddr', 'sport', and 'dport'

I successfully tested negation with 'saddr', 'daddr', 'sport', and 'dport' using ferm v2.6.

The new parameter negate takes String as well as Array.


'forward_accept_rfc1918':
chain: 'DOCKER-USER'
action: 'ACCEPT'
proto: 'tcp'
saddr:
- '10.0.0.0/8'
negate: 'saddr'


'forward_accept_rfc1918':
chain: 'DOCKER-USER'
action: 'ACCEPT'
proto: 'tcp'
saddr:
- '10.0.0.0/8'
negate:
- 'saddr'

Open PR in GitHub
Add Debian 11 support
enhancement

<!--
Thank you for contributing to this project!

-->

Pull Request (PR) description

<!--
Replace this comment with a description of your pull request.
-->

This Pull Request (PR) fixes the following issues

<!--
Replace this comment with the list of issues or n/a.
Use format:
Fixes #123
Fixes #124
-->

Open PR in GitHub
Add support for my use cases
  1. some "idempotent" (non user-visible) changes

    • make parameters and headers more readable
      • it's opinionated, but pretty much inline with what other modules do
    • refactor defined type rule moving boilerplate to new function
    • simplify rule with some new data types
  2. add support for my use cases

    • add parameters outerface, daddr_type, saddr_type, and ctstate

Of course, everything comes with tests and documentation. I didn't add tests for the function though, because I'd consider it tested indirectly as part of tests done on rule.

EDIT: Tests are failing due to outdated REFERENCE.md. Can't find redcarpet right now. Tried ...
```
$ bundle exec gem install redcarpet
Fetching redcarpet-3.6.0.gem
Building native extensions. This could take a while...
Successfully installed redcarpet-3.6.0
1 gem installed

$ gem install --user redcarpet
Building native extensions. This could take a while...
Successfully installed redcarpet-3.6.0
Parsing documentation for redcarpet-3.6.0
Done installing documentation for redcarpet after 0 seconds
1 gem installed

$ gem install redcarpet
Building native extensions. This could take a while...
Successfully installed redcarpet-3.6.0
Parsing documentation for redcarpet-3.6.0
Done installing documentation for redcarpet after 0 seconds
1 gem installed
```

... but still:

$ bundle exec rake strings:generate
[error]: Missing 'redcarpet' gem for Markdown formatting. Install it with `gem install redcarpet`

Will dig deeper tomorrow.

Open PR in GitHub
modulesync 5.3.0
modulesync

modulesync 5.3.0

Open PR in GitHub
Add `match` parameter to `ipset` resource to enable matching `dst` against ipsets
enhancement
needs-tests

This PR adds match parameter to ipset resource to enable matching dst against ipsets.

By default it's value is src thus making it (backwards) compatible with existing configurations

Open PR in GitHub
ensure correct ordering of concat::fragments

Fragments that share the same order number are ordered by name.

"${chain}-${interface}-aaa"
"${chain}-${interface}-${name}"
"${chain}-${interface}-zzz"

If name starts with upper case letter they're placed outside of interface eth0 {}:


mod comment comment 'AAA-minimal_example' proto all ACCEPT;
interface eth0 {
mod comment comment 'aaa-minimal_example:' proto all ACCEPT;
mod comment comment 'minimal_example' proto all ACCEPT;
}

I looked into testing for correct ordering, but didn't find a working solution.

There is (e.g.) .that_comes_before, but that's testing against before => ....

I also unsuccessfully tried testing against the content of File[/etc/ferm.d/chains/INPUT.conf] generated by concat_file.

Open PR in GitHub
add test for 'Ferm::Negation'

Add missing test for Ferm::Negation

Open PR in GitHub