Add docker support to shorewall

[chef.git] / cookbooks / networking / templates / default / shorewall.conf.erb

diff --git a/cookbooks/networking/templates/default/shorewall.conf.erb b/cookbooks/networking/templates/default/shorewall.conf.erb
index 03c7c6fffeec63367d8decf9da77a5367d222bcc..1ec804b047d565a96582ad4a136f6158d7985964 100644 (file)
--- a/cookbooks/networking/templates/default/shorewall.conf.erb
+++ b/cookbooks/networking/templates/default/shorewall.conf.erb
@@ -28,7 +28,11 @@ FIREWALL=
 #                             L O G G I N G
 ###############################################################################
 
+<% if node[:networking][:firewall][:log] -%>
 LOG_LEVEL="info"
+<% else -%>
+LOG_LEVEL="none"
+<% end -%>
 
 BLACKLIST_LOG_LEVEL=
 
@@ -104,20 +108,12 @@ TC=
 #              D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-<%- if node[:lsb][:release].to_f <= 16.04 %>
-ACCEPT_DEFAULT="none"
-DROP_DEFAULT="Drop"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
-REJECT_DEFAULT="Reject"
-<%- else %>
 ACCEPT_DEFAULT="none"
 BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
 NFQUEUE_DEFAULT="none"
 QUEUE_DEFAULT="none"
 REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
-<%- end %>
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
@@ -144,17 +140,17 @@ AUTOCOMMENT=Yes
 
 AUTOHELPERS=Yes
 
-<%- if node[:lsb][:release].to_f <= 16.04 %>
-AUTOMAKE=No
-<%- else %>
 AUTOMAKE=Yes
-<%- end %>
 
 BALANCE_PROVIDERS=No
 
 BASIC_FILTERS=No
 
+<% if node[:networking][:firewall][:raw] -%>
 BLACKLIST="NEW,INVALID,UNTRACKED"
+<% else -%>
+BLACKLIST="NEW,INVALID"
+<% end -%>
 
 CLAMPMSS=No
 
@@ -170,7 +166,7 @@ DETECT_DNAT_IPADDRS=No
 
 DISABLE_IPV6=No
 
-DOCKER=No
+DOCKER=Yes
 
 DONT_LOAD=
 
@@ -211,10 +207,6 @@ MAPOLDACTIONS=No
 MARK_IN_FORWARD_CHAIN=No
 
 MINIUPNPD=No
-<%- if node[:lsb][:release].to_f <= 16.04 %>
-
-MODULE_SUFFIX=ko
-<%- end %>
 
 MULTICAST=No
 
@@ -222,11 +214,7 @@ MUTEX_TIMEOUT=60
 
 NULL_ROUTE_RFC1918=No
 
-<%- if node[:lsb][:release].to_f <= 14.04 %>
-OPTIMIZE=1
-<%- else %>
 OPTIMIZE=All
-<%- end %>
 
 OPTIMIZE_ACCOUNTING=No
 
@@ -250,7 +238,11 @@ SAVE_ARPTABLES=No
 
 SAVE_IPSETS=No
 
+<% if node[:networking][:firewall][:mangle] -%>
 TC_ENABLED=Internal
+<% else -%>
+TC_ENABLED=No
+<% end -%>
 
 TC_EXPERT=No
 
@@ -261,10 +253,8 @@ TRACK_PROVIDERS=Yes
 TRACK_RULES=No
 
 USE_DEFAULT_RT=No
-<%- if node[:lsb][:release].to_f >= 18.04 %>
 
 USE_NFLOG_SIZE=No
-<%- end %>
 
 USE_PHYSICAL_NAMES=No