dust-deploy 0.3.0 → 0.3.1

data/changelog.md

@@ -1,6 +1,13 @@
 Changelog
 =============
 
+0.3.1
+------------
+
+-  hacked in nat table support for rpm-like systems, no support for other tables yet though (like mangle)
+-  small adjustment in repositories recipe
+
+
 0.3.0
 ------------
 

data/lib/dust/recipes/iptables.rb

@@ -32,24 +32,33 @@ class Iptables < Thor
       ::Dust.print_msg "configuring and deploying ipv4 rules\n" if ipv4
       ::Dust.print_msg "configuring and deploying ipv6 rules\n" if ipv6
 
-      iptables_script = '' 
+      iptables_filter = '' 
+      iptables_nat = '' if node.uses_rpm?
 
       # default policy for chains
       if node.uses_apt? or node.uses_emerge?
-        iptables_script += rules['input'] ? "-P INPUT DROP\n" : "-P INPUT ACCEPT\n"
-        iptables_script += rules['output'] ? "-P OUTPUT DROP\n" : "-P OUTPUT ACCEPT\n"
-        iptables_script += rules['forward'] ? "-P FORWARD DROP\n" : "-P FORWARD ACCEPT\n"
+        iptables_filter += rules['input'] ? "-P INPUT DROP\n" : "-P INPUT ACCEPT\n"
+        iptables_filter += rules['output'] ? "-P OUTPUT DROP\n" : "-P OUTPUT ACCEPT\n"
+        iptables_filter += rules['forward'] ? "-P FORWARD DROP\n" : "-P FORWARD ACCEPT\n"
 
-        iptables_script += "-F\n"
-        iptables_script += "-F -t nat\n" if ipv4
-        iptables_script += "-X\n"
+        iptables_filter += "-F\n"
+        iptables_filter += "-F -t nat\n" if ipv4
+        iptables_filter += "-X\n"
 
       elsif node.uses_rpm?
-        iptables_script += "*filter\n"
-
-        iptables_script += rules['input'] ? ":INPUT DROP [0:0]\n" : ":INPUT ACCEPT [0:0]\n"
-        iptables_script += rules['output'] ? ":OUTPUT DROP [0:0]\n" : ":OUTPUT ACCEPT [0:0]\n"
-        iptables_script += rules['forward'] ? ":FORWARD DROP [0:0]\n" : ":FORWARD ACCEPT [0:0]\n"
+        iptables_filter += "*filter\n"
+
+        iptables_filter += rules['input'] ? ":INPUT DROP [0:0]\n" : ":INPUT ACCEPT [0:0]\n"
+        iptables_filter += rules['output'] ? ":OUTPUT DROP [0:0]\n" : ":OUTPUT ACCEPT [0:0]\n"
+        iptables_filter += rules['forward'] ? ":FORWARD DROP [0:0]\n" : ":FORWARD ACCEPT [0:0]\n"
+
+        # also create a *nat element, centos-like systems need that.
+        if ipv4
+          iptables_nat  += "*nat\n"
+          iptables_nat  += ":PREROUTING ACCEPT [0:0]\n"
+          iptables_nat  += ":POSTROUTING ACCEPT [0:0]\n"
+          iptables_nat  += ":OUTPUT ACCEPT [0:0]\n"
+        end
       end
 
       # map rules to iptables strings
@@ -67,20 +76,37 @@ class Iptables < Thor
 
           next unless check_ipversion rule, ipv
 
+          # on centos-like machines, nat tables are handled differently
+          # remove --table argument and 
+          is_nat = false
+          if node.uses_rpm? and rule['table']
+            rule.delete 'table'
+            is_nat = true
+          end
+
           parse_rule(rule).each do |r|
             # TODO: parse nicer output
             ::Dust.print_msg "#{name}:#{::Dust.grey 0} '#{r.join ' ' }'#{::Dust.none}\n", :indent => 3
-            iptables_script += "-A #{chain.upcase} #{r.join ' '}\n"
+
+            if is_nat
+              # handle centos special case
+              iptables_nat += "-A #{chain.upcase} #{r.join ' '}\n" 
+            else
+              iptables_filter += "-A #{chain.upcase} #{r.join ' '}\n"
+            end
           end
         end
       end
 
       # put commit statement for rpm machines
-      iptables_script += "COMMIT\n" if node.uses_rpm?
+      if node.uses_rpm?
+        iptables_filter += "COMMIT\n"
+        iptables_nat += "COMMIT\n" if ipv4
+      end
 
       # prepend iptables command on non-centos-like machines
       if node.uses_apt? or node.uses_emerge?
-        iptables_script = iptables_script.map { |s| "#{iptables} #{s}" }.to_s
+        iptables_filter = iptables_filter.map { |s| "#{iptables} #{s}" }.to_s
       end
 
       # set header
@@ -89,14 +115,17 @@ class Iptables < Thor
         header  = "#!/bin/sh\n"
       end
       header += "# automatically generated by dust\n\n"
-      iptables_script = header + iptables_script
+      iptables_filter = header + iptables_filter
+
+      # append nat table to filter
+      iptables_filter = iptables_filter + iptables_nat if node.uses_rpm? and ipv4
 
       # set the target file depending on distribution
       target = "/etc/network/if-pre-up.d/#{iptables}" if node.uses_apt?
       target = "/etc/#{iptables}" if node.uses_emerge?
       target = "/etc/sysconfig/#{iptables}" if node.uses_rpm?
 
-      node.write target, iptables_script, :quiet => true
+      node.write target, iptables_filter, :quiet => true
 
       if node.uses_apt? or node.uses_emerge?
         node.chmod '700', target

data/lib/dust/recipes/repositories.rb

@@ -1,6 +1,7 @@
 class Repositories < Thor
   desc 'repositories:deploy', 'configures package management repositories (aptitude, yum)'
   def deploy node, repos, options
+    node.collect_facts
 
     if node.uses_apt? :quiet=>false
       :: Dust.print_msg 'deleting old repositories'

data/lib/dust/version.rb

@@ -1,3 +1,3 @@
 module Dust
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

metadata

@@ -5,8 +5,8 @@ version: !ruby/object:Gem::Version
   segments: 
   - 0
   - 3
-  - 0
-  version: 0.3.0
+  - 1
+  version: 0.3.1
 platform: ruby
 authors: 
 - kris kechagia
@@ -14,7 +14,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-01-10 00:00:00 +01:00
+date: 2012-01-12 00:00:00 +01:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency