From 65041ed9d8618cf3762d6d1a811e98fe69cb1ce9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Jeanneret?= <cjeanner@redhat.com>
Date: Fri, 1 Feb 2019 10:02:20 +0100
Subject: [PATCH] Clean unmanaged rules pushed by iptables-services package

As iptables-services injects default rules, we must ensure,
upon upgrade, that none of those unmanaged rules are present
in the firewall, nor in the iptables saved state.

We cannot remove them with puppet nor ansible due to the following
reasons:

- puppetlabs-firewall, the puppet module used in TripleO, manages
  the firewall resources with comments - the comment value is the
  name of the puppet resource. As the default rules have no comment,
  puppet doesn't "see" them as managed resources, and can't affect
  them.

- we can't simply "flush" all the rules and reapply them, because
  puppet does not manage all the rules - some are managed by neutron,
  for example.

- ansible "iptables" module doesn't make a full match of the chain,
  and might drop the unwanted ones, keeping the unmanaged in place.
  Also, it doesn't take care of the saved state.

SecurityImpact
Related: https://bugzilla.redhat.com/show_bug.cgi?id=1667887
Closes-Bug: #1812695
Change-Id: I59733cb9a0323bbce4e20838a78103a70ec0d426
---
 .../tripleo-firewall-baremetal-puppet.yaml    | 55 +++++++++++++++++--
 1 file changed, 50 insertions(+), 5 deletions(-)

diff --git a/deployment/tripleo-firewall/tripleo-firewall-baremetal-puppet.yaml b/deployment/tripleo-firewall/tripleo-firewall-baremetal-puppet.yaml
index a989e04269..63bb1852dc 100644
--- a/deployment/tripleo-firewall/tripleo-firewall-baremetal-puppet.yaml
+++ b/deployment/tripleo-firewall/tripleo-firewall-baremetal-puppet.yaml
@@ -56,8 +56,53 @@ outputs:
       step_config: |
         include ::tripleo::firewall
       upgrade_tasks:
-        - name: blank ipv6 rule before activating ipv6 firewall.
-          when: step|int == 3
-          shell: cat /etc/sysconfig/ip6tables > /etc/sysconfig/ip6tables.n-o-upgrade; cat</dev/null>/etc/sysconfig/ip6tables
-          args:
-            creates: /etc/sysconfig/ip6tables.n-o-upgrade
+        - when: step|int == 3
+          block:
+            - name: blank ipv6 rule before activating ipv6 firewall.
+              shell: cat /etc/sysconfig/ip6tables > /etc/sysconfig/ip6tables.n-o-upgrade; cat</dev/null>/etc/sysconfig/ip6tables
+              args:
+                creates: /etc/sysconfig/ip6tables.n-o-upgrade
+            - name: cleanup unmanaged rules pushed by iptables-services
+              shell: |
+                iptables -C INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT &>/dev/null && \
+                  iptables -D INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+                iptables -C INPUT -p icmp -j ACCEPT &>/dev/null && \
+                  iptables -D INPUT -p icmp -j ACCEPT
+                iptables -C INPUT -i lo -j ACCEPT &>/dev/null && \
+                  iptables -D INPUT -i lo -j ACCEPT
+                iptables -C INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT &>/dev/null && \
+                  iptables -D INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
+                iptables -C INPUT -j REJECT --reject-with icmp-host-prohibited &>/dev/null && \
+                  iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited
+                iptables -C FORWARD -j REJECT --reject-with icmp-host-prohibited &>/dev/null && \
+                  iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited
+
+                sed -i '/^-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT$/d' /etc/sysconfig/iptables
+                sed -i '/^-A INPUT -p icmp -j ACCEPT$/d' /etc/sysconfig/iptables
+                sed -i '/^-A INPUT -i lo -j ACCEPT$/d' /etc/sysconfig/iptables
+                sed -i '/^-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT$/d' /etc/sysconfig/iptables
+                sed -i '/^-A INPUT -j REJECT --reject-with icmp-host-prohibited$/d' /etc/sysconfig/iptables
+                sed -i '/^-A FORWARD -j REJECT --reject-with icmp-host-prohibited$/d' /etc/sysconfig/iptables
+
+                ip6tables -C INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT &>/dev/null && \
+                  ip6tables -D INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+                ip6tables -C INPUT -p ipv6-icmp -j ACCEPT &>/dev/null && \
+                  ip6tables -D INPUT -p ipv6-icmp -j ACCEPT
+                ip6tables -C INPUT -i lo -j ACCEPT &>/dev/null && \
+                  ip6tables -D INPUT -i lo -j ACCEPT
+                ip6tables -C INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT &>/dev/null && \
+                  ip6tables -D INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
+                ip6tables -C INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT &>/dev/null && \
+                  ip6tables -D INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT
+                ip6tables -C INPUT -j REJECT --reject-with icmp6-adm-prohibited &>/dev/null && \
+                  ip6tables -D INPUT -j REJECT --reject-with icmp6-adm-prohibited
+                ip6tables -C FORWARD -j REJECT --reject-with icmp6-adm-prohibited &>/dev/null && \
+                  ip6tables -D FORWARD -j REJECT --reject-with icmp6-adm-prohibited
+
+                sed -i '/^-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT$/d' /etc/sysconfig/ip6tables
+                sed -i '/^-A INPUT -p ipv6-icmp -j ACCEPT$/d' /etc/sysconfig/ip6tables
+                sed -i '/^-A INPUT -i lo -j ACCEPT$/d' /etc/sysconfig/ip6tables
+                sed -i '/^-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT$/d' /etc/sysconfig/ip6tables
+                sed -i '/^-A INPUT -d fe80::\/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT$/d' /etc/sysconfig/ip6tables
+                sed -i '/^-A INPUT -j REJECT --reject-with icmp6-adm-prohibited$/d' /etc/sysconfig/ip6tables
+                sed -i '/^-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited$/d' /etc/sysconfig/ip6tables