1369566 - OSX firewall puppet support

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: Puppet, task)

Description

[Jake Watkins [:dividehex]]

This really deserves a bug of its own.  OSX has a couple firewall layers,  the one we will be focusing on is the pf (packet firewall).

Comment 1

[Jake Watkins [:dividehex]]

I'll be using t-yosemite-r7-393.test.releng.mdc1.mozilla.com for testing.

Comment 2

[Jake Watkins [:dividehex]]

Attachment: Intergrate packet filtering support into the fw wrapper module

This is my first attempt at setting up a module for osx pf management.  It also setups up a roles and profile framework for build modular firewall rule definitions independent of which posix OS we are trying to manage.

The rules and network definitions are in no way meant to be exhaustive.  I've only setup a few roles/profiles to get the ball rolling for when we come together and start filling in the blanks.

Comment 3

[Jake Watkins [:dividehex]]

Attachment: 10.7 pf module support

This adds support for OSX 10.7 to the pf module.  For the most part, there is not a big difference.

* pf.conf per osx major version
* Do not pass tcpdump sdterr to syslog since it is verbose on startup

Comment 4

[Jake Watkins [:dividehex]]

Attachment: Fix pflog plist and add service resource

This ensure the pflog daemon actually runs via puppet and not just on boot.  Also, moved service to a proper name format.

Comment 5

[Jake Watkins [:dividehex]]

Comment on attachment 8893000 [details] [diff] [review]
10.7 pf module support

https://hg.mozilla.org/build/puppet/rev/88a5dea2a59d4e01d7f4b73b4070fda1b0b28c36
https://hg.mozilla.org/build/puppet/rev/ba6f6f842411d192ed35f3bda68708607b5f274d

Comment 6

[Jake Watkins [:dividehex]]

Comment on attachment 8893499 [details] [diff] [review]
Fix pflog plist and add service resource

https://hg.mozilla.org/build/puppet/rev/6432dc7e24232833b490db4692109c117b801b78
https://hg.mozilla.org/build/puppet/rev/7cfbef8a71a4643d62cbb6df551d7a06e40db15c