fix kernel incompatibilities

Certain kernel modules and thus iptables functionality was introduced at
later releases, so we need to properly reflect that in our default chain
initialization procedure.

`INPUT` chain for `nat` table was introduced with 2.6.36

`ip6table_nat` kernel module for NAT functionality with IPv6 was
introduced with 3.17

This commit implements the required conditional constraints and includes
the rspec tests to validate it.

diff --git a/REFERENCE.md b/REFERENCE.md
index 32259696f20bf7911e5cf1e2eedf16845c3598f7..5ab5f0ba577acffe2db61d0784da47a3c1c35380 100644 (file)
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -263,6 +263,15 @@ Allowed values: (filter|raw|mangle|nat) (see Ferm::Tables type)
 
 Default value: 'filter'
 
+##### `ip_versions`
+
+Data type: `Array[Enum['ip','ip6']]`
+
+Set list of versions of ip we want ot use.
+Default value: $ferm::ip_versions
+
+Default value: $ferm::ip_versions
+
 ### ferm::rule
 
 This defined resource manages a single rule in a specific chain

diff --git a/manifests/chain.pp b/manifests/chain.pp
index a01b9b440b4eeed297869023ca682824cf14c2e3..10cc9c16d14faf7fdf8e4886327c517941758021 100644 (file)
--- a/manifests/chain.pp
+++ b/manifests/chain.pp
@@ -18,12 +18,15 @@
 # @param table Select the target table (filter/raw/mangle/nat)
 #   Default value: 'filter'
 #   Allowed values: (filter|raw|mangle|nat) (see Ferm::Tables type)
+# @param ip_versions Set list of versions of ip we want ot use.
+#   Default value: $ferm::ip_versions
 define ferm::chain (
   Boolean $disable_conntrack,
   Boolean $log_dropped_packets,
-  String[1] $chain                 = $name,
-  Optional[Ferm::Policies] $policy = undef,
-  Ferm::Tables $table              = 'filter',
+  String[1] $chain                     = $name,
+  Optional[Ferm::Policies] $policy     = undef,
+  Ferm::Tables $table                  = 'filter',
+  Array[Enum['ip','ip6']] $ip_versions = $ferm::ip_versions,
 ) {
   # prevent unmanaged files due to new naming schema
   # keep the default "filter" chains in the original location
@@ -74,7 +77,7 @@ define ferm::chain (
     target  => $ferm::configfile,
     content => epp(
       "${module_name}/ferm-table-chain-config-include.epp", {
-        'ip'       => join($ferm::ip_versions, ' '),
+        'ip'       => join($ip_versions, ' '),
         'table'    => $table,
         'chain'    => $chain,
         'filename' => $filename,

diff --git a/manifests/config.pp b/manifests/config.pp
index efabe2bb72920ea49789c183449ee87ba6fb88e9..7dae7a5a9d7de7960db3fe696a5130ebd3421e4e 100644 (file)
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -58,6 +58,9 @@ class ferm::config {
     log_dropped_packets => $ferm::output_log_dropped_packets,
   }
 
+  # some default chains and features depend on support from the kernel
+  $kver = $facts['kernelversion']
+
   # initialize default tables and chains
   ['PREROUTING', 'OUTPUT'].each |$raw_chain| {
     ferm::chain{"raw-${raw_chain}":
@@ -69,12 +72,28 @@ class ferm::config {
     }
   }
   ['PREROUTING', 'INPUT', 'OUTPUT', 'POSTROUTING'].each |$nat_chain| {
+    if versioncmp($kver, '3.17.0') >= 0 {
+      # supports both nat INPUT chain and ip6table_nat
+      $domains = $ferm::ip_versions
+    } elsif versioncmp($kver, '2.6.36') >= 0 {
+      # supports nat INPUT chain, but not ip6table_nat
+      if ('ip6' in $ferm::ip_versions and 'ip' in $ferm::ip_versions) {
+        $domains = ['ip']
+      }
+    } else {
+      # supports neither nat INPUT nor ip6table_nat
+      if $nat_chain == 'INPUT' { next() }
+      if ('ip6' in $ferm::ip_versions and 'ip' in $ferm::ip_versions) {
+        $domains = ['ip']
+      }
+    }
     ferm::chain{"nat-${nat_chain}":
       chain               => $nat_chain,
       policy              => 'ACCEPT',
       disable_conntrack   => true,
       log_dropped_packets => false,
       table               => 'nat',
+      ip_versions         => $domains,
     }
   }
   ['PREROUTING', 'INPUT', 'FORWARD', 'OUTPUT', 'POSTROUTING'].each |$mangle_chain| {

diff --git a/spec/classes/ferm_spec.rb b/spec/classes/ferm_spec.rb
index 3257fcad866b9580ffa5c1ccb54203127da82c86..d400a7b028d353019c0ec4f0c96b134fcce6bfd0 100644 (file)
--- a/spec/classes/ferm_spec.rb
+++ b/spec/classes/ferm_spec.rb
@@ -67,7 +67,11 @@ describe 'ferm' do
         it { is_expected.to contain_concat__fragment('raw-PREROUTING-config-include') }
         it { is_expected.to contain_concat__fragment('raw-OUTPUT-config-include') }
         it { is_expected.to contain_concat__fragment('nat-PREROUTING-config-include') }
-        it { is_expected.to contain_concat__fragment('nat-INPUT-config-include') }
+        if Gem::Version.new(facts[:kernelversion]) >= Gem::Version.new('2.6.36')
+          it { is_expected.to contain_concat__fragment('nat-INPUT-config-include') }
+        else
+          it { is_expected.not_to contain_concat__fragment('nat-INPUT-config-include') }
+        end
         it { is_expected.to contain_concat__fragment('nat-OUTPUT-config-include') }
         it { is_expected.to contain_concat__fragment('nat-POSTROUTING-config-include') }
         it { is_expected.to contain_concat__fragment('mangle-PREROUTING-config-include') }
@@ -91,7 +95,11 @@ describe 'ferm' do
         it { is_expected.to contain_concat__fragment('raw-PREROUTING-policy') }
         it { is_expected.to contain_concat__fragment('raw-OUTPUT-policy') }
         it { is_expected.to contain_concat__fragment('nat-PREROUTING-policy') }
-        it { is_expected.to contain_concat__fragment('nat-INPUT-policy') }
+        if Gem::Version.new(facts[:kernelversion]) >= Gem::Version.new('2.6.36')
+          it { is_expected.to contain_concat__fragment('nat-INPUT-policy') }
+        else
+          it { is_expected.not_to contain_concat__fragment('nat-INPUT-policy') }
+        end
         it { is_expected.to contain_concat__fragment('nat-OUTPUT-policy') }
         it { is_expected.to contain_concat__fragment('nat-POSTROUTING-policy') }
         it { is_expected.to contain_concat__fragment('mangle-PREROUTING-policy') }
@@ -106,7 +114,11 @@ describe 'ferm' do
           it { is_expected.to contain_concat('/etc/ferm/ferm.d/chains/raw-PREROUTING.conf') }
           it { is_expected.to contain_concat('/etc/ferm/ferm.d/chains/raw-OUTPUT.conf') }
           it { is_expected.to contain_concat('/etc/ferm/ferm.d/chains/nat-PREROUTING.conf') }
-          it { is_expected.to contain_concat('/etc/ferm/ferm.d/chains/nat-INPUT.conf') }
+          if Gem::Version.new(facts[:kernelversion]) >= Gem::Version.new('2.6.36')
+            it { is_expected.to contain_concat('/etc/ferm/ferm.d/chains/nat-INPUT.conf') }
+          else
+            it { is_expected.not_to contain_concat('/etc/ferm/ferm.d/chains/nat-INPUT.conf') }
+          end
           it { is_expected.to contain_concat('/etc/ferm/ferm.d/chains/nat-OUTPUT.conf') }
           it { is_expected.to contain_concat('/etc/ferm/ferm.d/chains/nat-POSTROUTING.conf') }
           it { is_expected.to contain_concat('/etc/ferm/ferm.d/chains/mangle-PREROUTING.conf') }
@@ -121,7 +133,11 @@ describe 'ferm' do
           it { is_expected.to contain_concat('/etc/ferm.d/chains/raw-PREROUTING.conf') }
           it { is_expected.to contain_concat('/etc/ferm.d/chains/raw-OUTPUT.conf') }
           it { is_expected.to contain_concat('/etc/ferm.d/chains/nat-PREROUTING.conf') }
-          it { is_expected.to contain_concat('/etc/ferm.d/chains/nat-INPUT.conf') }
+          if Gem::Version.new(facts[:kernelversion]) >= Gem::Version.new('2.6.36')
+            it { is_expected.to contain_concat('/etc/ferm.d/chains/nat-INPUT.conf') }
+          else
+            it { is_expected.not_to contain_concat('/etc/ferm.d/chains/nat-INPUT.conf') }
+          end
           it { is_expected.to contain_concat('/etc/ferm.d/chains/nat-OUTPUT.conf') }
           it { is_expected.to contain_concat('/etc/ferm.d/chains/nat-POSTROUTING.conf') }
           it { is_expected.to contain_concat('/etc/ferm.d/chains/mangle-PREROUTING.conf') }
@@ -136,7 +152,11 @@ describe 'ferm' do
         it { is_expected.to contain_ferm__chain('raw-PREROUTING') }
         it { is_expected.to contain_ferm__chain('raw-OUTPUT') }
         it { is_expected.to contain_ferm__chain('nat-PREROUTING') }
-        it { is_expected.to contain_ferm__chain('nat-INPUT') }
+        if Gem::Version.new(facts[:kernelversion]) >= Gem::Version.new('2.6.36')
+          it { is_expected.to contain_ferm__chain('nat-INPUT') }
+        else
+          it { is_expected.not_to contain_ferm__chain('nat-INPUT') }
+        end
         it { is_expected.to contain_ferm__chain('nat-OUTPUT') }
         it { is_expected.to contain_ferm__chain('nat-POSTROUTING') }
         it { is_expected.to contain_ferm__chain('mangle-PREROUTING') }