From 0b9de51a48620809d45c0206e28d2913a85eeab8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javier=20B=C3=A9rtoli?= Date: Fri, 9 Aug 2013 19:34:28 -0300 Subject: [PATCH] Add a define to add local filters --- manifests/action.pp | 72 ++++++++--------- manifests/filter.pp | 113 +++++++++++++++++++++++++++ spec/defines/fail2ban_filter_spec.rb | 80 +++++++++++++++++++ templates/filter.local.erb | 19 +++++ 4 files changed, 248 insertions(+), 36 deletions(-) create mode 100644 manifests/filter.pp create mode 100644 spec/defines/fail2ban_filter_spec.rb create mode 100644 templates/filter.local.erb diff --git a/manifests/action.pp b/manifests/action.pp index 2469f92..2117b69 100644 --- a/manifests/action.pp +++ b/manifests/action.pp @@ -4,51 +4,51 @@ # Documentation: Manpages & http://www.fail2ban.org/wiki/index.php/MANUAL_0_8 # # Supported arguments: -# $actionname - The name you want to give the action. -# If not set, defaults to == default -# action local file is named after this value, like -# $name.local. The suffix "local" is automatically added. +# $actionname - The name you want to give the action. +# If not set, defaults to == $title +# action local file is named after this value, like +# $actionname.local. The suffix "local" is automatically added. # -# $enable - true / false. If false, the rule _IS NOT ADDED_ to the -# action.local file -# Defaults to true +# $actionenable - true / false. If false, the rule _IS NOT ADDED_ to the +# action.local file +# Defaults to true # -# $source - Sets the content of source parameter for the new action -# It's mutually exclusive with $template. +# $actionsource - Sets the content of source parameter for the new action +# It's mutually exclusive with $actiontemplate. # -# $template - Template to use when defining a new action -# It's mutually exclusive with $source. +# $actiontemplate - Template to use when defining a new action +# It's mutually exclusive with $actionsource. # -# $start - command(s) executed when the jail starts. -# Can be an array -# Used only with $template +# $actionstart - command(s) executed when the jail starts. +# Can be an array +# Used only with $actiontemplate # -# $stop - command(s) executed when the jail stops. -# Can be an array -# Used only with $template +# $actionstop - command(s) executed when the jail stops. +# Can be an array +# Used only with $actiontemplate # -# $check - the command ran before any other action. -# It aims to verify if the environment is still ok. -# Used only with $template +# $actioncheck - the command ran before any other action. +# It aims to verify if the environment is still ok. +# Used only with $actiontemplate # -# $ban - command(s) that bans the IP address after maxretry -# log lines matches within last findtime seconds. -# Used only with $template +# $actionban - command(s) that bans the IP address after maxretry +# log lines matches within last findtime seconds. +# Used only with $actiontemplate # -# $unban - command(s) that unbans the IP address after bantime. -# Used only with $template +# $actionunban - command(s) that unbans the IP address after bantime. +# Used only with $actiontemplate # -# $actionbefore - indicates an action file that is read before the -# [Definition] section. +# $actionbefore - indicates an action file that is read before the +# [Definition] section. # -# $actionafter - indicates an action file is read after the -# [Definition] section. +# $actionafter - indicates an action file is read after the +# [Definition] section. # -# $initvars - Variables for the INIT stanza of the action file. -# They are tuples in the format -# "var = value" -# Can be an array like -# [ "var1 = value1", "var2 = value2",.., "varN = valueN" ] +# $actioninitvars - Variables for the INIT stanza of the action file. +# They are tuples in the format +# "var = value" +# Can be an array like +# [ "var1 = value1", "var2 = value2",.., "varN = valueN" ] # define fail2ban::action ( $actionname = '', @@ -62,7 +62,7 @@ define fail2ban::action ( $actionbefore = '', $actionafter = '', $actioninitvars = '', - $enable = true ) { + $actionenable = true ) { include fail2ban @@ -121,7 +121,7 @@ define fail2ban::action ( default => $actioninitvars, } - $ensure = bool2ensure($enable) + $ensure = bool2ensure($actionenable) $manage_file_source = $actionsource ? { '' => undef, diff --git a/manifests/filter.pp b/manifests/filter.pp new file mode 100644 index 0000000..15d3e20 --- /dev/null +++ b/manifests/filter.pp @@ -0,0 +1,113 @@ +# Define: fail2ban::filter +# +# Adds a custom fail2ban filter +# Documentation: Manpages & http://www.fail2ban.org/wiki/index.php/MANUAL_0_8 +# +# Supported arguments: +# $filtername - The name you want to give the filter. +# If not set, defaults to == $title +# filter local file is named after this value, like +# $name.local. The suffix "local" is automatically added. +# +# $filterenable - true / false. If false, the rule _IS NOT ADDED_ to the +# filter.local file +# Defaults to true +# +# $filtersource - Sets the content of source parameter for the new filter +# It's mutually exclusive with $template. +# +# $filtertemplate - Template to use when defining a new filter +# It's mutually exclusive with $source. +# +# $filterfailregex - command(s) executed when the jail failregexs. +# Can be an array +# Used only with $template +# +# $filterignoreregex - command(s) executed when the jail ignoreregexs. +# Can be an array +# Used only with $template +# +# $filterbefore - indicates an filter file that is read before the +# [Definition] section. +# +# $filterafter - indicates an filter file is read after the +# [Definition] section. +# +# $filterdefinitionvars - Variables for the INIT stanza of the filter file. +# They are tuples in the format +# "var = value" +# Can be an array like +# [ "var1 = value1", "var2 = value2",.., "varN = valueN" ] +# +define fail2ban::filter ( + $filtername = '', + $filtersource = '', + $filtertemplate = 'fail2ban/filter.local.erb', + $filterfailregex = '', + $filterignoreregex = '', + $filterbefore = '', + $filterafter = '', + $filterdefinitionvars = '', + $filterenable = true ) { + + include fail2ban + + $real_filtername = $filtername ? { + '' => $title, + default => $filtername, + } + + $filter_file = "${fail2ban::data_dir}/filter.d/${real_filtername}.local" + + $array_failregex = is_array($filterfailregex) ? { + false => $filterfailregex ? { + '' => [], + default => [$filterfailregex], + }, + default => $filterfailregex, + } + + $array_ignoreregex = is_array($filterignoreregex) ? { + false => $filterignoreregex? { + '' => [], + default => [$filterignoreregex], + }, + default => $filterignoreregex, + } + + $array_definitionvars = is_array($filterdefinitionvars) ? { + false => $filterdefinitionvars? { + '' => [], + default => [$filterdefinitionvars], + }, + default => $filterdefinitionvars, + } + + $ensure = bool2ensure($filterenable) + + $manage_file_source = $filtersource ? { + '' => undef, + default => $filtersource, + } + + $manage_file_content = $filtertemplate ? { + '' => undef, + default => template($filtertemplate), + } + + file { "${real_filtername}.local": + ensure => $fail2ban::manage_file, + path => $filter_file, + mode => $fail2ban::config_file_mode, + owner => $fail2ban::config_file_owner, + group => $fail2ban::config_file_group, + require => Package[$fail2ban::package], + notify => $fail2ban::manage_service_autorestart, + source => $manage_file_source, + content => $manage_file_content, + replace => $fail2ban::manage_file_replace, + audit => $fail2ban::manage_audit, + noop => $fail2ban::bool_noops, + } + +} diff --git a/spec/defines/fail2ban_filter_spec.rb b/spec/defines/fail2ban_filter_spec.rb new file mode 100644 index 0000000..6eac9af --- /dev/null +++ b/spec/defines/fail2ban_filter_spec.rb @@ -0,0 +1,80 @@ +require File.join(File.dirname(__FILE__), '..', 'spec_helper.rb') + +describe 'fail2ban::filter' do + + let(:title) { 'fail2ban::filter' } + let(:node) { 'rspec.example42.com' } + let(:facts) do + { + :ipaddress => '10.42.42.42', + } + end + + describe 'Test filter define is called with no options' do + let(:params) do + { + :filtername => 'sample1', + } + end + let(:expected) do +"# This file is managed by Puppet. DO NOT EDIT. +# +[INCLUDES] + + +[Definition] + +failregex = +ignoreregex = + +" + end + + it { should contain_file('sample1.local').with_path('/etc/fail2ban/filter.d/sample1.local').with_content(expected) } + end + + describe 'Test filter.local is created with all options' do + let(:params) do + { + :filtername => 'sample2', + :filterfailregex => ['first_fail_regex','second_fail_regex','complex[filter]'], + :filterignoreregex => 'now_ignore', + :filterbefore => 'add_before', + :filterdefinitionvars => ['a = 1','b = 2', 'not c'], + } + end + let(:expected) do +"# This file is managed by Puppet. DO NOT EDIT. +# +[INCLUDES] + +before = add_before +[Definition] + +failregex = first_fail_regex +\tsecond_fail_regex +\tcomplex[filter] +ignoreregex = now_ignore + +a = 1 +b = 2 +not c +" + end + + it { should contain_file('sample2.local').with_path('/etc/fail2ban/filter.d/sample2.local').with_content(expected) } + it { should contain_file('sample2.local').without_source } + end + + describe 'Test filter define is called with a source file' do + let(:params) do + { + :filtername => 'sample3', + :filtersource => 'puppet:///some/path/to/source', + } + end + + it { should contain_file('sample3.local').with_path('/etc/fail2ban/filter.d/sample3.local').with_source('puppet:///some/path/to/source') } + it { should contain_file('sample3.local').without_template } + end +end diff --git a/templates/filter.local.erb b/templates/filter.local.erb new file mode 100644 index 0000000..31b8637 --- /dev/null +++ b/templates/filter.local.erb @@ -0,0 +1,19 @@ +# This file is managed by Puppet. DO NOT EDIT. +# +[INCLUDES] + +<% if @filterbefore != '' -%> +before = <%= @filterbefore -%> +<% end -%> +<% if @filterafter != '' -%> +after = <%= @filterafter -%> +<% end -%> + +[Definition] + +failregex = <%= @array_failregex.join("\n\t") %> +ignoreregex = <%= @array_ignoreregex.join("\n\t") %> + +<% if @array_definitionvars != [] -%> +<%= @array_definitionvars.join("\n") %> +<% end -%>