From: Aurelien Jarno <aurelien@aurel32.net>
Date: Thu, 20 Apr 2017 15:59:53 +0000 (+0200)
Subject: Drop outgoing IPv4 multicast traffic at AQL
X-Git-Url: https://git.adam-barratt.org.uk/?a=commitdiff_plain;h=12332fbd95be46e7d6ca5dc584ea8be270a01324;p=mirror%2Fdsa-puppet.git

Drop outgoing IPv4 multicast traffic at AQL

Some packages like gst-rtsp-server1.0 generate multicast traffic in
their testsuite. This triggers protections at AQL. Avoid this by
dropping all the outgoing IPv4 multicast traffic.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
---

diff --git a/modules/ferm/manifests/aql.pp b/modules/ferm/manifests/aql.pp
new file mode 100644
index 000000000..b5578e2de
--- /dev/null
+++ b/modules/ferm/manifests/aql.pp
@@ -0,0 +1,10 @@
+class ferm::aql {
+	@ferm::rule { 'dsa-drop-multicast':
+		domain      => 'ip',
+		description => 'drop multicast traffic to avoid triggering protection',
+		table       => 'filter',
+		chain       => 'OUTPUT',
+		rule        => 'destination 224.0.0.0/24 jump log_or_drop'
+	}
+}
+
diff --git a/modules/ferm/manifests/per_host.pp b/modules/ferm/manifests/per_host.pp
index f7362135a..d6c4343f6 100644
--- a/modules/ferm/manifests/per_host.pp
+++ b/modules/ferm/manifests/per_host.pp
@@ -3,6 +3,10 @@ class ferm::per_host {
 		include ferm::zivit
 	}
 
+	if (scope.lookupvar('site::nodeinfo')['hoster']['name'] == "aql") {
+		include ferm::aq
+	}
+
 	case $::hostname {
 		czerny,clementi: {
 			@ferm::rule { 'dsa-upsmon':