2 # Cookbook Name:: networking
5 # Copyright 2010, OpenStreetMap Foundation.
6 # Copyright 2009, Opscode, Inc.
8 # Licensed under the Apache License, Version 2.0 (the "License");
9 # you may not use this file except in compliance with the License.
10 # You may obtain a copy of the License at
12 # https://www.apache.org/licenses/LICENSE-2.0
14 # Unless required by applicable law or agreed to in writing, software
15 # distributed under the License is distributed on an "AS IS" BASIS,
16 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 # See the License for the specific language governing permissions and
18 # limitations under the License.
21 # * node[:networking][:nameservers]
27 node[:networking][:interfaces].each do |name, interface|
28 if interface[:interface]
29 network_packages |= ["vlan"] if interface[:interface] =~ /\.\d+$/
30 network_packages |= ["ifenslave"] if interface[:bond]
32 if interface[:role] && (role = node[:networking][:roles][interface[:role]])
33 if role[interface[:family]]
34 node.normal[:networking][:interfaces][name][:prefix] = role[interface[:family]][:prefix]
35 node.normal[:networking][:interfaces][name][:gateway] = role[interface[:family]][:gateway]
38 node.normal[:networking][:interfaces][name][:metric] = role[:metric]
39 node.normal[:networking][:interfaces][name][:zone] = role[:zone]
42 prefix = node[:networking][:interfaces][name][:prefix]
44 node.normal[:networking][:interfaces][name][:netmask] = (~IPAddr.new(interface[:address]).mask(0)).mask(prefix)
45 node.normal[:networking][:interfaces][name][:network] = IPAddr.new(interface[:address]).mask(prefix)
47 node.rm(:networking, :interfaces, name)
51 package network_packages
53 template "/etc/network/interfaces" do
54 source "interfaces.erb"
62 command "/bin/hostname -F /etc/hostname"
65 template "/etc/hostname" do
70 notifies :run, "execute[hostname]"
73 template "/etc/hosts" do
80 unless node[:networking][:nameservers].empty?
81 link "/etc/resolv.conf" do
84 to "/run/resolvconf/resolv.conf"
85 only_if { File.symlink?("/etc/resolv.conf") }
88 template "/etc/resolv.conf" do
89 source "resolv.conf.erb"
96 node.interfaces(:role => :internal) do |interface|
97 if interface[:gateway] && interface[:gateway] != interface[:address]
98 search(:node, "networking_interfaces*address:#{interface[:gateway]}") do |gateway|
99 next unless gateway[:openvpn]
101 gateway[:openvpn][:tunnels].each_value do |tunnel|
102 if tunnel[:peer][:address] # ~FC023
103 route tunnel[:peer][:address] do
104 netmask "255.255.255.255"
105 gateway interface[:gateway]
106 device interface[:interface]
110 next unless tunnel[:peer][:networks]
112 tunnel[:peer][:networks].each do |network|
113 route network[:address] do
114 netmask network[:netmask]
115 gateway interface[:gateway]
116 device interface[:interface]
126 search(:node, "networking:interfaces").collect do |n|
127 next if n[:fqdn] == node[:fqdn]
129 n.interfaces.each do |interface|
130 next unless interface[:role] == "external" && interface[:zone]
132 zones[interface[:zone]] ||= {}
133 zones[interface[:zone]][interface[:family]] ||= []
134 zones[interface[:zone]][interface[:family]] << interface[:address]
140 template "/etc/default/shorewall" do
141 source "shorewall-default.erb"
145 notifies :restart, "service[shorewall]"
148 template "/etc/shorewall/shorewall.conf" do
149 source "shorewall.conf.erb"
153 notifies :restart, "service[shorewall]"
156 template "/etc/shorewall/zones" do
157 source "shorewall-zones.erb"
161 variables :type => "ipv4"
162 notifies :restart, "service[shorewall]"
165 template "/etc/shorewall/interfaces" do
166 source "shorewall-interfaces.erb"
170 notifies :restart, "service[shorewall]"
173 template "/etc/shorewall/hosts" do
174 source "shorewall-hosts.erb"
178 variables :zones => zones
179 notifies :restart, "service[shorewall]"
182 template "/etc/shorewall/policy" do
183 source "shorewall-policy.erb"
187 notifies :restart, "service[shorewall]"
190 template "/etc/shorewall/rules" do
191 source "shorewall-rules.erb"
195 variables :family => "inet"
196 notifies :restart, "service[shorewall]"
199 service "shorewall" do
200 action [:enable, :start]
201 supports :restart => true
202 status_command "shorewall status"
205 template "/etc/logrotate.d/shorewall" do
206 source "logrotate.shorewall.erb"
210 variables :name => "shorewall"
213 firewall_rule "limit-icmp-echo" do
219 dest_ports "echo-request"
220 rate_limit "s:1/sec:5"
223 %w[ucl ic bm aws].each do |zone|
224 firewall_rule "accept-openvpn-#{zone}" do
230 dest_ports "1194:1197"
231 source_ports "1194:1197"
235 if node[:roles].include?("gateway")
236 template "/etc/shorewall/masq" do
237 source "shorewall-masq.erb"
241 notifies :restart, "service[shorewall]"
244 file "/etc/shorewall/masq" do
246 notifies :restart, "service[shorewall]"
250 unless node.interfaces(:family => :inet6).empty?
253 template "/etc/default/shorewall6" do
254 source "shorewall-default.erb"
258 notifies :restart, "service[shorewall6]"
261 template "/etc/shorewall6/shorewall6.conf" do
262 source "shorewall6.conf.erb"
266 notifies :restart, "service[shorewall6]"
269 template "/etc/shorewall6/zones" do
270 source "shorewall-zones.erb"
274 variables :type => "ipv6"
275 notifies :restart, "service[shorewall6]"
278 template "/etc/shorewall6/interfaces" do
279 source "shorewall6-interfaces.erb"
283 notifies :restart, "service[shorewall6]"
286 template "/etc/shorewall6/hosts" do
287 source "shorewall6-hosts.erb"
291 variables :zones => zones
292 notifies :restart, "service[shorewall6]"
295 template "/etc/shorewall6/policy" do
296 source "shorewall-policy.erb"
300 notifies :restart, "service[shorewall6]"
303 template "/etc/shorewall6/rules" do
304 source "shorewall-rules.erb"
308 variables :family => "inet6"
309 notifies :restart, "service[shorewall6]"
312 service "shorewall6" do
313 action [:enable, :start]
314 supports :restart => true
315 status_command "shorewall6 status"
318 template "/etc/logrotate.d/shorewall6" do
319 source "logrotate.shorewall.erb"
323 variables :name => "shorewall6"
326 firewall_rule "limit-icmp6-echo" do
332 dest_ports "echo-request"
333 rate_limit "s:1/sec:5"
337 firewall_rule "accept-http" do
343 rate_limit node[:networking][:firewall][:http_rate_limit]
344 connection_limit node[:networking][:firewall][:http_connection_limit]
347 firewall_rule "accept-https" do
353 rate_limit node[:networking][:firewall][:http_rate_limit]
354 connection_limit node[:networking][:firewall][:http_connection_limit]