Add a define to add local filters
This commit is contained in:
Javier Bértoli
+36
-36
@@ -4,51 +4,51 @@
|
||||
# Documentation: Manpages & http://www.fail2ban.org/wiki/index.php/MANUAL_0_8
|
||||
#
|
||||
# Supported arguments:
|
||||
# $actionname - The name you want to give the action.
|
||||
# If not set, defaults to == default
|
||||
# action local file is named after this value, like
|
||||
# $name.local. The suffix "local" is automatically added.
|
||||
# $actionname - The name you want to give the action.
|
||||
# If not set, defaults to == $title
|
||||
# action local file is named after this value, like
|
||||
# $actionname.local. The suffix "local" is automatically added.
|
||||
#
|
||||
# $enable - true / false. If false, the rule _IS NOT ADDED_ to the
|
||||
# action.local file
|
||||
# Defaults to true
|
||||
# $actionenable - true / false. If false, the rule _IS NOT ADDED_ to the
|
||||
# action.local file
|
||||
# Defaults to true
|
||||
#
|
||||
# $source - Sets the content of source parameter for the new action
|
||||
# It's mutually exclusive with $template.
|
||||
# $actionsource - Sets the content of source parameter for the new action
|
||||
# It's mutually exclusive with $actiontemplate.
|
||||
#
|
||||
# $template - Template to use when defining a new action
|
||||
# It's mutually exclusive with $source.
|
||||
# $actiontemplate - Template to use when defining a new action
|
||||
# It's mutually exclusive with $actionsource.
|
||||
#
|
||||
# $start - command(s) executed when the jail starts.
|
||||
# Can be an array
|
||||
# Used only with $template
|
||||
# $actionstart - command(s) executed when the jail starts.
|
||||
# Can be an array
|
||||
# Used only with $actiontemplate
|
||||
#
|
||||
# $stop - command(s) executed when the jail stops.
|
||||
# Can be an array
|
||||
# Used only with $template
|
||||
# $actionstop - command(s) executed when the jail stops.
|
||||
# Can be an array
|
||||
# Used only with $actiontemplate
|
||||
#
|
||||
# $check - the command ran before any other action.
|
||||
# It aims to verify if the environment is still ok.
|
||||
# Used only with $template
|
||||
# $actioncheck - the command ran before any other action.
|
||||
# It aims to verify if the environment is still ok.
|
||||
# Used only with $actiontemplate
|
||||
#
|
||||
# $ban - command(s) that bans the IP address after maxretry
|
||||
# log lines matches within last findtime seconds.
|
||||
# Used only with $template
|
||||
# $actionban - command(s) that bans the IP address after maxretry
|
||||
# log lines matches within last findtime seconds.
|
||||
# Used only with $actiontemplate
|
||||
#
|
||||
# $unban - command(s) that unbans the IP address after bantime.
|
||||
# Used only with $template
|
||||
# $actionunban - command(s) that unbans the IP address after bantime.
|
||||
# Used only with $actiontemplate
|
||||
#
|
||||
# $actionbefore - indicates an action file that is read before the
|
||||
# [Definition] section.
|
||||
# $actionbefore - indicates an action file that is read before the
|
||||
# [Definition] section.
|
||||
#
|
||||
# $actionafter - indicates an action file is read after the
|
||||
# [Definition] section.
|
||||
# $actionafter - indicates an action file is read after the
|
||||
# [Definition] section.
|
||||
#
|
||||
# $initvars - Variables for the INIT stanza of the action file.
|
||||
# They are tuples in the format
|
||||
# "var = value"
|
||||
# Can be an array like
|
||||
# [ "var1 = value1", "var2 = value2",.., "varN = valueN" ]
|
||||
# $actioninitvars - Variables for the INIT stanza of the action file.
|
||||
# They are tuples in the format
|
||||
# "var = value"
|
||||
# Can be an array like
|
||||
# [ "var1 = value1", "var2 = value2",.., "varN = valueN" ]
|
||||
#
|
||||
define fail2ban::action (
|
||||
$actionname = '',
|
||||
@@ -62,7 +62,7 @@ define fail2ban::action (
|
||||
$actionbefore = '',
|
||||
$actionafter = '',
|
||||
$actioninitvars = '',
|
||||
$enable = true ) {
|
||||
$actionenable = true ) {
|
||||
|
||||
include fail2ban
|
||||
|
||||
@@ -121,7 +121,7 @@ define fail2ban::action (
|
||||
default => $actioninitvars,
|
||||
}
|
||||
|
||||
$ensure = bool2ensure($enable)
|
||||
$ensure = bool2ensure($actionenable)
|
||||
|
||||
$manage_file_source = $actionsource ? {
|
||||
'' => undef,
|
||||
|
||||
@@ -0,0 +1,113 @@
|
||||
# Define: fail2ban::filter
|
||||
#
|
||||
# Adds a custom fail2ban filter
|
||||
# Documentation: Manpages & http://www.fail2ban.org/wiki/index.php/MANUAL_0_8
|
||||
#
|
||||
# Supported arguments:
|
||||
# $filtername - The name you want to give the filter.
|
||||
# If not set, defaults to == $title
|
||||
# filter local file is named after this value, like
|
||||
# $name.local. The suffix "local" is automatically added.
|
||||
#
|
||||
# $filterenable - true / false. If false, the rule _IS NOT ADDED_ to the
|
||||
# filter.local file
|
||||
# Defaults to true
|
||||
#
|
||||
# $filtersource - Sets the content of source parameter for the new filter
|
||||
# It's mutually exclusive with $template.
|
||||
#
|
||||
# $filtertemplate - Template to use when defining a new filter
|
||||
# It's mutually exclusive with $source.
|
||||
#
|
||||
# $filterfailregex - command(s) executed when the jail failregexs.
|
||||
# Can be an array
|
||||
# Used only with $template
|
||||
#
|
||||
# $filterignoreregex - command(s) executed when the jail ignoreregexs.
|
||||
# Can be an array
|
||||
# Used only with $template
|
||||
#
|
||||
# $filterbefore - indicates an filter file that is read before the
|
||||
# [Definition] section.
|
||||
#
|
||||
# $filterafter - indicates an filter file is read after the
|
||||
# [Definition] section.
|
||||
#
|
||||
# $filterdefinitionvars - Variables for the INIT stanza of the filter file.
|
||||
# They are tuples in the format
|
||||
# "var = value"
|
||||
# Can be an array like
|
||||
# [ "var1 = value1", "var2 = value2",.., "varN = valueN" ]
|
||||
#
|
||||
define fail2ban::filter (
|
||||
$filtername = '',
|
||||
$filtersource = '',
|
||||
$filtertemplate = 'fail2ban/filter.local.erb',
|
||||
$filterfailregex = '',
|
||||
$filterignoreregex = '',
|
||||
$filterbefore = '',
|
||||
$filterafter = '',
|
||||
$filterdefinitionvars = '',
|
||||
$filterenable = true ) {
|
||||
|
||||
include fail2ban
|
||||
|
||||
$real_filtername = $filtername ? {
|
||||
'' => $title,
|
||||
default => $filtername,
|
||||
}
|
||||
|
||||
$filter_file = "${fail2ban::data_dir}/filter.d/${real_filtername}.local"
|
||||
|
||||
$array_failregex = is_array($filterfailregex) ? {
|
||||
false => $filterfailregex ? {
|
||||
'' => [],
|
||||
default => [$filterfailregex],
|
||||
},
|
||||
default => $filterfailregex,
|
||||
}
|
||||
|
||||
$array_ignoreregex = is_array($filterignoreregex) ? {
|
||||
false => $filterignoreregex? {
|
||||
'' => [],
|
||||
default => [$filterignoreregex],
|
||||
},
|
||||
default => $filterignoreregex,
|
||||
}
|
||||
|
||||
$array_definitionvars = is_array($filterdefinitionvars) ? {
|
||||
false => $filterdefinitionvars? {
|
||||
'' => [],
|
||||
default => [$filterdefinitionvars],
|
||||
},
|
||||
default => $filterdefinitionvars,
|
||||
}
|
||||
|
||||
$ensure = bool2ensure($filterenable)
|
||||
|
||||
$manage_file_source = $filtersource ? {
|
||||
'' => undef,
|
||||
default => $filtersource,
|
||||
}
|
||||
|
||||
$manage_file_content = $filtertemplate ? {
|
||||
'' => undef,
|
||||
default => template($filtertemplate),
|
||||
}
|
||||
|
||||
file { "${real_filtername}.local":
|
||||
ensure => $fail2ban::manage_file,
|
||||
path => $filter_file,
|
||||
mode => $fail2ban::config_file_mode,
|
||||
owner => $fail2ban::config_file_owner,
|
||||
group => $fail2ban::config_file_group,
|
||||
require => Package[$fail2ban::package],
|
||||
notify => $fail2ban::manage_service_autorestart,
|
||||
source => $manage_file_source,
|
||||
content => $manage_file_content,
|
||||
replace => $fail2ban::manage_file_replace,
|
||||
audit => $fail2ban::manage_audit,
|
||||
noop => $fail2ban::bool_noops,
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
require File.join(File.dirname(__FILE__), '..', 'spec_helper.rb')
|
||||
|
||||
describe 'fail2ban::filter' do
|
||||
|
||||
let(:title) { 'fail2ban::filter' }
|
||||
let(:node) { 'rspec.example42.com' }
|
||||
let(:facts) do
|
||||
{
|
||||
:ipaddress => '10.42.42.42',
|
||||
}
|
||||
end
|
||||
|
||||
describe 'Test filter define is called with no options' do
|
||||
let(:params) do
|
||||
{
|
||||
:filtername => 'sample1',
|
||||
}
|
||||
end
|
||||
let(:expected) do
|
||||
"# This file is managed by Puppet. DO NOT EDIT.
|
||||
#
|
||||
[INCLUDES]
|
||||
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex =
|
||||
ignoreregex =
|
||||
|
||||
"
|
||||
end
|
||||
|
||||
it { should contain_file('sample1.local').with_path('/etc/fail2ban/filter.d/sample1.local').with_content(expected) }
|
||||
end
|
||||
|
||||
describe 'Test filter.local is created with all options' do
|
||||
let(:params) do
|
||||
{
|
||||
:filtername => 'sample2',
|
||||
:filterfailregex => ['first_fail_regex','second_fail_regex','complex[filter]'],
|
||||
:filterignoreregex => 'now_ignore',
|
||||
:filterbefore => 'add_before',
|
||||
:filterdefinitionvars => ['a = 1','b = 2', 'not c'],
|
||||
}
|
||||
end
|
||||
let(:expected) do
|
||||
"# This file is managed by Puppet. DO NOT EDIT.
|
||||
#
|
||||
[INCLUDES]
|
||||
|
||||
before = add_before
|
||||
[Definition]
|
||||
|
||||
failregex = first_fail_regex
|
||||
\tsecond_fail_regex
|
||||
\tcomplex[filter]
|
||||
ignoreregex = now_ignore
|
||||
|
||||
a = 1
|
||||
b = 2
|
||||
not c
|
||||
"
|
||||
end
|
||||
|
||||
it { should contain_file('sample2.local').with_path('/etc/fail2ban/filter.d/sample2.local').with_content(expected) }
|
||||
it { should contain_file('sample2.local').without_source }
|
||||
end
|
||||
|
||||
describe 'Test filter define is called with a source file' do
|
||||
let(:params) do
|
||||
{
|
||||
:filtername => 'sample3',
|
||||
:filtersource => 'puppet:///some/path/to/source',
|
||||
}
|
||||
end
|
||||
|
||||
it { should contain_file('sample3.local').with_path('/etc/fail2ban/filter.d/sample3.local').with_source('puppet:///some/path/to/source') }
|
||||
it { should contain_file('sample3.local').without_template }
|
||||
end
|
||||
end
|
||||
@@ -0,0 +1,19 @@
|
||||
# This file is managed by Puppet. DO NOT EDIT.
|
||||
#
|
||||
[INCLUDES]
|
||||
|
||||
<% if @filterbefore != '' -%>
|
||||
before = <%= @filterbefore -%>
|
||||
<% end -%>
|
||||
<% if @filterafter != '' -%>
|
||||
after = <%= @filterafter -%>
|
||||
<% end -%>
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = <%= @array_failregex.join("\n\t") %>
|
||||
ignoreregex = <%= @array_ignoreregex.join("\n\t") %>
|
||||
|
||||
<% if @array_definitionvars != [] -%>
|
||||
<%= @array_definitionvars.join("\n") %>
|
||||
<% end -%>
|
||||
Reference in New Issue
Block a user