From: Matt Domsch mdomsch@puppet1.fedora.phx.redhat.com

--- configs/system/ip6tables-template.conf.erb | 40 ++++++++++++++++++++++++++++ 1 files changed, 40 insertions(+), 0 deletions(-) create mode 100644 configs/system/ip6tables-template.conf.erb

diff --git a/configs/system/ip6tables-template.conf.erb b/configs/system/ip6tables-template.conf.erb new file mode 100644 index 0000000..e0a0efc --- /dev/null +++ b/configs/system/ip6tables-template.conf.erb @@ -0,0 +1,40 @@ +# Firewall configuration written by system-config-securitylevel +# Manual customization of this file is not recommended. +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:RH-Firewall-1-INPUT - [0:0] +-A INPUT -j RH-Firewall-1-INPUT +-A FORWARD -j RH-Firewall-1-INPUT + +# loopback allowed +-A RH-Firewall-1-INPUT -i lo -j ACCEPT + +# Accept ping and traceroute (needs icmp) +-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT + +# Accept IPv6 packets at all +-A RH-Firewall-1-INPUT -p 50 -j ACCEPT +-A RH-Firewall-1-INPUT -p 51 -j ACCEPT + +# Accept SSH +-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT + +# Custom Services +<% custom.each do |cust| -%> +<%= cust %> +<% end -%> + +# Services TCP +<% tcpPorts.each do |port| -%> +-A RH-Firewall-1-INPUT -p tcp -m tcp --dport <%= port %> -j ACCEPT +<% end -%> + +# Services UDP +<% udpPorts.each do |port| -%> +-A RH-Firewall-1-INPUT -p udp -m udp --dport <%= port %> -j ACCEPT +<% end -%> + +-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited +COMMIT

From: Matt Domsch mdomsch@puppet1.fedora.phx.redhat.com

--- modules/bind/files/named.conf | 12 +++++++++--- 1 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/modules/bind/files/named.conf b/modules/bind/files/named.conf index 6063696..29f0d63 100644 --- a/modules/bind/files/named.conf +++ b/modules/bind/files/named.conf @@ -13,9 +13,11 @@ key "rndckey" { // dns1.j2solutions.net - run by Jesse Keating jkeating@redhat.com acl "slaves" { 209.124.61.35; 209.124.61.34; 209.124.62.154; }; // -acl "me" { 127.0.0.1; }; +acl "me" { 127.0.0.1; ::1; }; // -acl "everyone" { 0.0.0.0/0; }; +acl "everyone-v4" { 0.0.0.0/0; }; +acl "everyone-v6" { ::0/0; }; +acl "everyone" { 0.0.0.0/0; ::0/0; }; // acl "ns_redhat" { 66.187.233.210; 209.132.183.2; 66.187.229.10; }; // @@ -27,6 +29,7 @@ options { allow-query { everyone; }; allow-recursion { me; cloud; }; query-source address * port *; + query-source-v6 address * port *; allow-transfer { me; slaves; }; transfer-source * port 53; pid-file "var/run/named/named.pid"; @@ -34,7 +37,10 @@ options { // forwarders { 209.132.178.0/23; }; version "cowbell++"; listen-on port 53 { - everyone; + everyone-v4; + }; + listen-on-v6 port 53 { + everyone-v6; }; notify yes; };

From: Matt Domsch mdomsch@puppet1.fedora.phx.redhat.com

--- configs/system/generic-network.conf.erb | 4 ++++ manifests/filetypes/interfaces.pp | 2 +- 2 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/configs/system/generic-network.conf.erb b/configs/system/generic-network.conf.erb index 07ece31..f4366dd 100644 --- a/configs/system/generic-network.conf.erb +++ b/configs/system/generic-network.conf.erb @@ -19,3 +19,7 @@ BRIDGE=<%= brname %> <% else -%> TYPE=Ethernet <% end -%> + +<% if ipv6addrs.length then -%> +IPV6ADDR_SECONDARIES="<%= ipv6addrs.map{|ip| ip }.join(" ") %>" +<% end -%> diff --git a/manifests/filetypes/interfaces.pp b/manifests/filetypes/interfaces.pp index 1a7f30e..29722f6 100644 --- a/manifests/filetypes/interfaces.pp +++ b/manifests/filetypes/interfaces.pp @@ -1,6 +1,6 @@ # Define ethernet devices (usually aliased)

-define eth($ipaddr, $netmask) { +define eth($ipaddr, $netmask, $ipv6addrs=[]) { $bootproto='static' $device = $name $ethtype = "standard"

From: Matt Domsch mdomsch@puppet1.fedora.phx.redhat.com

--- manifests/servergroups/proxy.pp | 23 +++++++++++++++++++++++ 1 files changed, 23 insertions(+), 0 deletions(-)

diff --git a/manifests/servergroups/proxy.pp b/manifests/servergroups/proxy.pp index bfa0481..eeb9e19 100644 --- a/manifests/servergroups/proxy.pp +++ b/manifests/servergroups/proxy.pp @@ -22,6 +22,7 @@ class proxy { "66.35.62.162", "80.239.156.214", "152.46.7.221", + "[2610:28:200:1::fed0:1]", ], server_aliases => [ "stg.fedoraproject.org" ], ssl => true, @@ -39,6 +40,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "admin.stg.fedoraproject.org" ], ssl => true, @@ -57,6 +59,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "mirrors.stg.fedoraproject.org" ], ssl => true, @@ -74,6 +77,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "download01.fedoraproject.org", @@ -103,6 +107,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "translate.stg.fedoraproject.org" ], ssl => true, @@ -121,6 +126,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "smolt.fedoraproject.org", "stg.smolts.org", 'www.smolts.org'], ssl => false, @@ -137,6 +143,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "doc.fedoraproject.org", "docs.stg.fedoraproject.org" ], ssl => true, @@ -154,6 +161,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "bodhi.stg.fedoraproject.org" ], ssl => true, @@ -171,6 +179,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "bugz.stg.fedoraproject.org" ], ssl => true, @@ -188,6 +197,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "fas.stg.fedoraproject.org", "accounts.fedoraproject.org" ], ssl => true, @@ -207,6 +217,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "fedoralinux.com", @@ -252,6 +263,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "get.stg.fedoraproject.org" ], ssl => true, @@ -269,6 +281,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "help.stg.fedoraproject.org" ], ssl => true, @@ -286,6 +299,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "join.stg.fedoraproject.org" ], ssl => true, @@ -303,6 +317,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "l10n.stg.fedoraproject.org" ], ssl => true, @@ -320,6 +335,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "start.stg.fedoraproject.org" ], ssl => true, @@ -337,6 +353,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "download.fedora.redhat.com", @@ -357,6 +374,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "*.id.fedoraproject.org", @@ -378,6 +396,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "www.port389.org", @@ -398,6 +417,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "www.k12linux.org" ], ssl => false, @@ -413,6 +433,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "fonts.stg.fedoraproject.org" ], ssl => true, @@ -430,6 +451,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "meetbot.stg.fedoraproject.org" ], ssl => true, @@ -447,6 +469,7 @@ class proxy { "66.35.62.166", "80.239.156.215", "152.46.7.222", + "[2610:28:200:1::fed0:2]", ], server_aliases => [ "blogs.stg.fedoraproject.org" ], ssl => true,

From: Matt Domsch mdomsch@puppet1.fedora.phx.redhat.com

--- manifests/nodes/proxy4.fedoraproject.org.pp | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/manifests/nodes/proxy4.fedoraproject.org.pp b/manifests/nodes/proxy4.fedoraproject.org.pp index 8926d94..fb31481 100644 --- a/manifests/nodes/proxy4.fedoraproject.org.pp +++ b/manifests/nodes/proxy4.fedoraproject.org.pp @@ -61,8 +61,15 @@ node "proxy4.fedoraproject.org" { alias => ["value2", "value2.fedoraproject.org"], }

+ eth { "eth0": + ipaddr => "152.46.7.221", + netmask => "255.255.255.0", + ipv6addrs => ["2610:28:200:1::fed0:1/64"], + } + eth { "eth0:0": ipaddr => "152.46.7.222", netmask => "255.255.255.0", + ipv6addrs => ["2610:28:200:1::fed0:2/64"], } }

From: Matt Domsch mdomsch@puppet1.fedora.phx.redhat.com

--- manifests/servergroups/proxy.pp | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/manifests/servergroups/proxy.pp b/manifests/servergroups/proxy.pp index eeb9e19..745909e 100644 --- a/manifests/servergroups/proxy.pp +++ b/manifests/servergroups/proxy.pp @@ -772,11 +772,20 @@ class proxy { content => template("system/iptables-template.conf.erb"), }

+ ip6tables { "/etc/sysconfig/ip6tables": + content => template("system/ip6tables-template.conf.erb"), + } + service { "iptables": ensure => running, hasstatus => true, }

+ service { "ip6tables": + ensure => running, + hasstatus => true, + } + selboolean { [ "httpd_can_network_connect_db", "httpd_can_network_relay",

From: Matt Domsch mdomsch@puppet1.fedora.phx.redhat.com

--- modules/bind/files/master/fedoraproject.org | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/modules/bind/files/master/fedoraproject.org b/modules/bind/files/master/fedoraproject.org index 14eb8c3..6f9286d 100644 --- a/modules/bind/files/master/fedoraproject.org +++ b/modules/bind/files/master/fedoraproject.org @@ -17,12 +17,14 @@ $TTL 3600 @ 60 IN A 66.35.62.162 @ 60 IN A 152.46.7.221 ;@ 60 IN A 80.239.156.214 +@ 60 IN AAAA 2610:28:200:1::fed0:1

; Our non fp.o load balanced setup wildcard 60 IN A 209.132.176.120 wildcard 60 IN A 66.35.62.166 wildcard 60 IN A 152.46.7.222 ;wildcard 60 IN A 80.239.156.215 +wildcard 60 IN AAAA 2610:28:200:1::fed0:2

; koji koji IN A 209.132.176.65

On Fri, 28 Aug 2009, Jeff Garzik wrote:

On 08/28/2009 05:11 PM, Matt Domsch wrote:

...

From: Matt Domschmdomsch@puppet1.fedora.phx.redhat.com

---

modules/httpd/files/00-namevirtualhost.conf | 4 ++++ modules/httpd/files/httpd.conf-rhel5p | 1 + 2 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/modules/httpd/files/00-namevirtualhost.conf b/modules/httpd/files/00-namevirtualhost.conf index 3c87355..a3c8b39 100644 --- a/modules/httpd/files/00-namevirtualhost.conf +++ b/modules/httpd/files/00-namevirtualhost.conf @@ -25,6 +25,10 @@ NameVirtualHost 152.46.7.221:80 NameVirtualHost 152.46.7.221:443 NameVirtualHost 152.46.7.222:80 NameVirtualhost 152.46.7.222:443 +NameVirtualHost [2610:28:200:1::fed0:1]:80 +NameVirtualHost [2610:28:200:1::fed0:1]:443 +NameVirtualHost [2610:28:200:1::fed0:2]:80 +NameVirtualHost [2610:28:200:1::fed0:2]:443

Do SSL certificates need to be aware of this new IPv6 web address?

AFAIK, no. ssl certs are completely unaware of IP addresses.

-Mike

On 08/28/2009 05:11 PM, Matt Domsch wrote:

index 5c40c80..bd4480f 100644 --- a/modules/httpd/files/httpd.conf-rhel5p +++ b/modules/httpd/files/httpd.conf-rhel5p @@ -148,6 +148,7 @@ MaxRequestsPerChild 10000 # Listen 0.0.0.0:80 Listen 0.0.0.0:443 +Listen [::]:80

Two comments:

- wouldn't "*:80" accomplish the same thing as two listen directives? Perhaps "*:80" means that Apache binds, on Linux, to the slightly-more-efficient ipv6 socket, where ipv4 connections are ipv6-mapped (:ffff:10.20.30.40)?

- do you need a listen "[::]:443" also?

On Fri, 28 Aug 2009, Jerald Darow wrote:

Matt why are you spamming the list

He's trying to make sure these changes (there's a lot of them) don't break the world. And since we can't really test these in staging he's getting as many eyes on it as he can.

-Mike

----- Original Message ----- From: "Matt Domsch" Matt_Domsch@dell.com To: fedora-infrastructure-list@redhat.com Sent: Friday, August 28, 2009 5:11 PM Subject: [PATCH] add ip6tables on DNS servers

...

From: Matt Domsch mdomsch@puppet1.fedora.phx.redhat.com

---

manifests/servergroups/dns.pp | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/manifests/servergroups/dns.pp b/manifests/servergroups/dns.pp index 0b543b2..01b5a60 100644 --- a/manifests/servergroups/dns.pp +++ b/manifests/servergroups/dns.pp @@ -12,11 +12,20 @@ class dns { content => template('system/iptables-template.conf.erb'), }

• ip6tables { '/etc/sysconfig/ip6tables':

•        content => template('system/ip6tables-template.conf.erb'),
  

• }

• service { iptables: ensure => running, hasstatus => true, }

• service { ip6tables:

•    ensure => running,
  

•    hasstatus => true,
  

• }

• semanage_fcontext { '/var/named/chroot/log(/.*)?': type => 'named_log_t' }

-- 1.5.5.6

---

Fedora-infrastructure-list mailing list Fedora-infrastructure-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list

---

Fedora-infrastructure-list mailing list Fedora-infrastructure-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list

On 08/28/2009 05:11 PM, Matt Domsch wrote:

From: Matt Domschmdomsch@puppet1.fedora.phx.redhat.com

---

manifests/servergroups/proxy.pp | 23 +++++++++++++++++++++++ 1 files changed, 23 insertions(+), 0 deletions(-)

diff --git a/manifests/servergroups/proxy.pp b/manifests/servergroups/proxy.pp index bfa0481..eeb9e19 100644 --- a/manifests/servergroups/proxy.pp +++ b/manifests/servergroups/proxy.pp @@ -22,6 +22,7 @@ class proxy { "66.35.62.162", "80.239.156.214", "152.46.7.221",

•        "[2610:28:200:1::fed0:1]",
      ],
      server_aliases =>  [ "stg.fedoraproject.org" ],
      ssl            =>  true,
  

No objection/comment on the IPv6 portion of this patch.

I'm surprised these highly repetitive address lists are not auto-generated from a flat file (or other database), though.

Jeff

On 08/28/2009 07:36 PM, Mike McGrath wrote:

On Fri, 28 Aug 2009, Jeff Garzik wrote:

...

On 08/28/2009 05:11 PM, Matt Domsch wrote:

...

From: Matt Domschmdomsch@puppet1.fedora.phx.redhat.com

---

manifests/servergroups/proxy.pp | 23 +++++++++++++++++++++++ 1 files changed, 23 insertions(+), 0 deletions(-)

diff --git a/manifests/servergroups/proxy.pp b/manifests/servergroups/proxy.pp index bfa0481..eeb9e19 100644 --- a/manifests/servergroups/proxy.pp +++ b/manifests/servergroups/proxy.pp @@ -22,6 +22,7 @@ class proxy { "66.35.62.162", "80.239.156.214", "152.46.7.221",

•        "[2610:28:200:1::fed0:1]",
       ],
       server_aliases =>   [ "stg.fedoraproject.org" ],
       ssl            =>   true,
  

No objection/comment on the IPv6 portion of this patch.

I'm surprised these highly repetitive address lists are not auto-generated from a flat file (or other database), though.

I'm not quite sure what you mean but I am interested in a better way to do this. basically we've got 4 sites + staging. As such, fedoraproject.org could listen on 5 different addresses. We have to enter them somewhere, any ideas?

I was thinking in the m4-macro sense; looking at Matt's patch, it appears that a large number of virtual hosts have the same address list. If so, it seems like some sort of macro substitution could be employed to match a list of virtual hosts with a set of addresses.

Not a big deal... just noting an above-average amount of copy/paste.

Jeff