openstack/puppet-tripleo
Code Issues Proposed changes

Ensure we get a clean firewall

Browse Source 
The iptables-services package pushes a bunch of default rules, activated as soon
as we start the "iptables" systemd unit.

This patch intends to remove those default rules, in order to ensure we get
only managed firewall rules (either by puppet, or by any openstack service like
neutron).

In order to prevent any issue, instead of erasing the file, we actually save the
current state prior the iptables-services installation and subsequent service startup.

The iptables-services installation and activation is done at the "include ::firewall"
step.
Prior that, iptables is empty, meaning if we save, and pre-create the
/etc/sysconfig/iptables and /etc/sysconfig/ip6tables files before we include the
"::firewall" class, we will get an empty, clean ruleset.

Please note, this won't correct already deployed infrastructure though - that will
probably requires an upgrade_tasks directly in tripleo-heat-templates.

SecurityImpact
Related: https://bugzilla.redhat.com/show_bug.cgi?id=1667887
Partial-Bug: #1812695
Change-Id: I74d15b8de216984ac42a0839430ae9afe2554d16
This commit is contained in:
Cédric Jeanneret 2019-01-21 15:05:47 +01:00
parent 7f4734d6a9
commit f25c27aa2c
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
manifests/firewall.pp
View File

@ -110,6 +110,26 @@ class tripleo::firewall(
'firewall_settings' => $firewall_post_extras,
})
# Ensure we don't get any unmanaged rules in the firewall.
#
# iptables-services package pushes some rules we don't want to see in the
# firewall, as they conflict with the ones we are actually managing:
# - opens ssh to the world (see https://review.openstack.org/632468)
# - reject connections (and this reject happens before the logging we push,
# preventing logging to happen)
# - some repetitions like RELATED,ESTABLISHED, and ICMP related rules
#
# See https://bugzilla.redhat.com/show_bug.cgi?id=1667887
# for more context and detail.
exec {'save ipv4 rules':
command => '/usr/sbin/iptables-save > /etc/sysconfig/iptables',
before => Service[$::firewall::params::service_name, $::firewall::params::service_name_v6],
}
exec {'save ipv6 rules':
command => '/usr/sbin/ip6tables-save > /etc/sysconfig/ip6tables',
before => Service[$::firewall::params::service_name, $::firewall::params::service_name_v6],
}
Class['tripleo::firewall::pre']
-> Firewall<|tag == 'tripleo-firewall-rule'|>
-> Class['tripleo::firewall::post']
@ -173,6 +193,8 @@ class tripleo::firewall(
]
}
Exec['save ipv4 rules'] -> Firewall<| |>
Exec['save ipv6 rules'] -> Firewall<| |>
Firewall<| |> -> Exec['nonpersistent_v4_rules_cleanup']
Firewall<| |> -> Exec['nonpersistent_v6_rules_cleanup']
Firewall<| |> -> Exec['nonpersistent_ironic_inspector_pxe_filter_v4_rules_cleanup']