Only switch FTP conntrack to explicit CT target for stretch hosts

While it also works for jessie works, it requires a reboot as module
loading is disabled.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

diff --git a/modules/ferm/manifests/ftp_conntrack.pp b/modules/ferm/manifests/ftp_conntrack.pp
index 868110b..45e060b 100644 (file)
--- a/modules/ferm/manifests/ftp_conntrack.pp
+++ b/modules/ferm/manifests/ftp_conntrack.pp
@@ -1,20 +1,24 @@
 class ferm::ftp_conntrack {
+       # This also works for jessie hosts, but requires a reboot
+       if (versioncmp($::lsbmajdistrelease, '9') >= 0) {
+               # Allow non-passive connections to an FTP server
+               @ferm::rule { 'dsa-ftp-conntrack-client':
+                       domain      => '(ip ip6)',
+                       description => 'ftp client connection tracking',
+                       table       => 'raw',
+                       chain       => 'OUTPUT',
+                       rule        => 'proto tcp dport 21 CT helper ftp'
+               }
 
-       # Allow non-passive connections to an FTP server
-       @ferm::rule { 'dsa-ftp-conntrack-client':
-               domain      => '(ip ip6)',
-               description => 'ftp client connection tracking',
-               table       => 'raw',
-               chain       => 'OUTPUT',
-               rule        => 'proto tcp dport 21 CT helper ftp'
-       }
-
-       # Allow passive connections from an FTP client
-       @ferm::rule { 'dsa-ftp-conntrack-server':
-               domain      => '(ip ip6)',
-               description => 'ftp server connection tracking',
-               table       => 'raw',
-               chain       => 'PREROUTING',
-               rule        => 'proto tcp dport 21 CT helper ftp'
+               # Allow passive connections from an FTP client
+               @ferm::rule { 'dsa-ftp-conntrack-server':
+                       domain      => '(ip ip6)',
+                       description => 'ftp server connection tracking',
+                       table       => 'raw',
+                       chain       => 'PREROUTING',
+                       rule        => 'proto tcp dport 21 CT helper ftp'
+               }
+       } else {
+               ferm::module { 'nf_conntrack_ftp': }
        }
 }