dust-deploy 0.2.1 → 0.2.2

data/README.md

@@ -203,6 +203,7 @@ almost all functions understand the quiet=true and indend=integer arguments
 #### get_system_users quiet=false
 #### package_installed? packages, quiet=false, indent=1
 #### install_package package, quiet=false, indent=1, env=""
+#### remove_package package, quiet=false, indent=1
 #### update_repos quiet=false, indent=1
 #### system_update quiet=false, indent=1
 #### uses_apt? quiet=false, indent=1

data/bin/dust

@@ -10,7 +10,7 @@ require 'dust'
 module  Dust
   class Deploy < Thor::Runner
 
-    default_task :deploy
+    default_task :list
 
     desc 'deploy [server.yaml] [--filter key=value,value2] [--recipes recipe1 recipe2] [--proxy host:port]',
          'deploy all recipes to the node(s) specified in server.yaml or to all nodes defined in ./nodes/'

data/changelog.md

@@ -1,6 +1,23 @@
 Changelog
 =============
 
+0.2.2
+------------
+
+-  iptables will now sort rules before applying. thus enabling you to set the order of the rules.
+
+    recipes:
+      iptables:
+        forward:
+          1invalid: { match: state, state: INVALID, jump: DROP }
+          2valid: { jump: ACCEPT }
+
+-  removed all predefined iptables rules, you have (and can) do anything by yourself now
+-  small fixes and improvements for iptables recipes
+-  if you dont specify a chain, it will be set to ACCEPT per default
+-  dust list is now the default when launching dust without an argument
+
+
 0.2.1
 ------------
 
@@ -12,13 +29,17 @@ fixes small iptables issue when using --jump REDIRECT and --to-port
 
 heavily refactors iptables recipe. you HAVE to adapt your iptables settings. new usage:
 
-recipe:
-  iptables:
-    input:
-    - input:
-      ssh: { dport: 22, match: state, state: NEW }
-    - output:
-      drop: { jump: DROP }
+    recipe:
+      iptables:
+        input:
+          ssh: { dport: 22, match: state, state: NEW }
+          http: { dport: [ 80, 443 ], match: state, state: NEW }
+          spoof-protection: 
+            in-interface: eth0
+            source: [ 127.0.0.0/8, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12 ]
+            jump: DROP
+        output:
+          drop-everything: { jump: DROP }
 
 every iptables long option is allowed, it tries to automatically detect whether to use iptables, ip6tables or both.
 known issues: --to-destination is not checked for ipv4/ipv6, because it might include port numbers.
@@ -26,6 +47,12 @@ default jump target ist ACCEPT
 
 basic rules are added automatically, see iptables.rb for more information.
 
+**known issue:** the order of your rules is not enforced, due to hashes by definition not having an order, and using arrays would mess up inheritance. thus, be careful and doublecheck if rules are correctly interpreted when making statements that require a specific ordering of the rules, like the following:
+
+    forward:
+      invalid: { match: state, state: INVALID, jump: DROP }
+      valid: { jump: ACCEPT }
+
 
 0.1.8
 ------------
@@ -33,8 +60,8 @@ basic rules are added automatically, see iptables.rb for more information.
 adds recipe for making sure packages are _uninstalled_
 usage:
 
-recipes:
-  remove_packages: [ package1, package2, ... ]
+    recipes:
+      remove_packages: [ package1, package2, ... ]
 
 
 0.1.7

data/lib/dust/recipes/etc_hosts.rb

@@ -3,11 +3,13 @@ class EtcHosts < Thor
   def deploy node, daemon, options
     template_path = "./templates/#{ File.basename(__FILE__).chomp( File.extname(__FILE__) ) }"
 
-    return unless node.package_installed?('dnsmasq')
     node.scp("#{template_path}/hosts", '/etc/hosts')
 
     # restart dns service
-    node.restart_service daemon if options.restart?
+    if options.restart? and daemon.is_a? String
+      node.package_installed? daemon
+      node.restart_service daemon if options.restart?
+    end
   end
 end
 

data/lib/dust/recipes/iptables.rb

@@ -36,51 +36,26 @@ class Iptables < Thor
 
       # default policy for chains
       if node.uses_apt? true or node.uses_emerge? true
-        iptables_script += "-P INPUT DROP\n" +
-                     "-P OUTPUT DROP\n" +
-                     "-P FORWARD DROP\n" +
-                     "-F\n"
+        iptables_script += rules['input'] ? "-P INPUT DROP\n" : "-P INPUT ACCEPT\n"
+        iptables_script += rules['output'] ? "-P OUTPUT DROP\n" : "-P OUTPUT ACCEPT\n"
+        iptables_script += rules['forward'] ? "-P FORWARD DROP\n" : "-P FORWARD ACCEPT\n"
+
+        iptables_script += "-F\n"
         iptables_script += "-F -t nat\n" if ipv4
         iptables_script += "-X\n"
 
       elsif node.uses_rpm? true
-        iptables_script += "*filter\n" +
-                     ":INPUT DROP [0:0]\n" +
-                     ":FORWARD DROP [0:0]\n" +
-                     ":OUTPUT DROP [0:0]\n"
-      end
-
-      # allow localhost
-      iptables_script += "-A INPUT -i lo -j ACCEPT\n"
-
-      # drop invalid packets
-      iptables_script += "-A INPUT -m state --state INVALID -j DROP\n"
-
-      # allow related packets
-      iptables_script += "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n"
-
-      # drop tcp packets with the syn bit set if the tcp connection is already established
-      iptables_script += "-A INPUT -p tcp --tcp-flags SYN SYN -m state --state ESTABLISHED -j DROP\n" # if ipv4
-
-      # drop icmp timestamps
-      iptables_script += "-A INPUT -p icmp --icmp-type timestamp-request -j DROP\n" if ipv4
-      iptables_script += "-A INPUT -p icmp --icmp-type timestamp-reply -j DROP\n" if ipv4
-
-      # allow other icmp packets
-      iptables_script += "-A INPUT -p icmpv6 -j ACCEPT\n" if ipv6
-      iptables_script += "-A INPUT -p icmp -j ACCEPT\n"
+        iptables_script += "*filter\n"
 
-
-      # drop invalid outgoing packets
-      iptables_script += "-A OUTPUT -m state --state INVALID -j DROP\n"
-
-      # allow related outgoing packets
-      iptables_script += "-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n"
+        iptables_script += rules['input'] ? ":INPUT DROP [0:0]\n" : ":INPUT ACCEPT [0:0]\n"
+        iptables_script += rules['output'] ? ":OUTPUT DROP [0:0]\n" : ":OUTPUT ACCEPT [0:0]\n"
+        iptables_script += rules['forward'] ? ":FORWARD DROP [0:0]\n" : ":FORWARD ACCEPT [0:0]\n"
+      end
 
       # map rules to iptables strings
       rules.each do |chain, chain_rules|
         ::Dust.print_msg "#{::Dust.pink}#{chain.upcase}#{::Dust.none}\n", 2
-        chain_rules.each do |name, rule|
+        chain_rules.sort.each do |name, rule|
           # set default variables
           rule['jump'] ||= ['ACCEPT']
 
@@ -100,13 +75,6 @@ class Iptables < Thor
         end
       end
 
-      # deny the rest incoming
-      iptables_script += "-A INPUT -p tcp -j REJECT --reject-with tcp-reset\n"
-      iptables_script += "-A INPUT -j REJECT --reject-with icmp-port-unreachable\n" if ipv4
-
-      # allow everything out
-      iptables_script += "-A OUTPUT -j ACCEPT\n"
-
       # put commit statement for rpm machines
       iptables_script += "COMMIT\n" if node.uses_rpm? true
 
@@ -160,7 +128,7 @@ class Iptables < Thor
   # check if source and destination ip (if given)
   # are valid ips for this ip version
   def check_ipversion rule, ipv
-    ['source', 'destination', 'to-source'].each do |attr|
+    ['source', 'src', 'destination', 'dest', 'to-source'].each do |attr|
       if rule[attr]
         rule[attr].each do |addr|
           return false unless IPAddress(addr).send "ipv#{ipv}?"
@@ -178,8 +146,18 @@ class Iptables < Thor
     result = []
 
     r.each do |k, v|
-      # skip ip-version, since its not iptables option
-      with_dashes[k] = r[k].map { |value| "--#{k} #{value}" } unless k == 'ip-version'
+      next if k == 'ip-version' # skip ip-version, since its not iptables option
+      with_dashes[k] = r[k].map do |v|
+        value = v.to_s
+        if value.start_with? '!', '! '
+          # map '--key ! value' to '! --key value'
+          value.slice! '!' 
+          value.lstrip!
+          "! --#{k} #{value}"
+        else
+          "--#{k} #{value}"
+        end
+      end
     end
     with_dashes.values.each { |a| result = result.combine a }
 
@@ -192,6 +170,11 @@ class Iptables < Thor
       # shift to the end
       r = r.sort_by { |x| if x.include? '--jump' then 1 else -1 end }
       r = r.sort_by { |x| if x.include? '--to-port' then 1 else -1 end }
+      r = r.sort_by { |x| if x.include? '--to-destination' then 1 else -1 end }
+      r = r.sort_by { |x| if x.include? '--to-source' then 1 else -1 end }
+      r = r.sort_by { |x| if x.include? '--ttl-set' then 1 else -1 end }
+      r = r.sort_by { |x| if x.include? '--clamp-mss-to-pmtu' then 1 else -1 end }
+      r = r.sort_by { |x| if x.include? '--reject-with' then 1 else -1 end }
       sorted.push r
     end
 

data/lib/dust/recipes/ssh_authorized_keys.rb

@@ -15,6 +15,7 @@ class SshAuthorizedKeys < Thor
 
       # create the authorized_keys hash for this user
       ssh_users.each do |ssh_user|
+        users[ssh_user]['name'] ||= ssh_user
         ::Dust.print_msg "adding user #{users[ssh_user]['name']}", 2
         users[ssh_user]['keys'].each do |key|
           authorized_keys += "#{key}"

data/lib/dust/server.rb

@@ -199,14 +199,14 @@ module Dust
       end
     end
 
-    def remove_package package, quiet=false, indent=1, env=""
+    def remove_package package, quiet=false, indent=1
       return Dust.print_ok "package #{package} not installed", indent + 1 unless package_installed? package, true
 
       Dust.print_msg("removing #{package}", indent + 1) unless quiet
       if uses_apt? true
         Dust.print_result exec("DEBIAN_FRONTEND=noninteractive aptitude purge -y #{package}")[:exit_code], quiet
       elsif uses_emerge? true
-        Dust.print_result exec("#{env} emerge --unmerge #{package}")[:exit_code], quiet
+        Dust.print_result exec("emerge --unmerge #{package}")[:exit_code], quiet
       elsif uses_rpm? true
         Dust.print_result exec("yum erase -y #{package}")[:exit_code], quiet
       else

data/lib/dust/version.rb

@@ -1,3 +1,3 @@
 module Dust
-  VERSION = "0.2.1"
+  VERSION = "0.2.2"
 end

metadata

@@ -5,8 +5,8 @@ version: !ruby/object:Gem::Version
   segments: 
   - 0
   - 2
-  - 1
-  version: 0.2.1
+  - 2
+  version: 0.2.2
 platform: ruby
 authors: 
 - kris kechagia
@@ -14,7 +14,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-01-04 00:00:00 +01:00
+date: 2012-01-05 00:00:00 +01:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency