propellor/src/Propellor/Property/Firewall.hs, branch master

fix broken SemigroupMonoid transition <>

2018-04-30T13:03:46Z

Turns out that with ghc 8.2.2, the instructions given on the page don't work. And the cppless variant that I had compiles, but into effectively mappend = mappend so it loops. The only way I can see to make it work without cpp is to use mappend = (Sem.<>) which is ugly and a land mine waiting to explode if someone changes it to a nicer mappend = (<>) with a newer version of ghc which will compile it and work ok, while breaking it with 8.2.2. Sigh. I posted to haskell-cafe about this.

semigroup monoid change fallout; drop ghc 7 support

2018-04-23T17:20:13Z

Fix build with ghc 8.4, which broke due to the Semigroup Monoid change. See https://prime.haskell.org/wiki/Libraries/Proposals/SemigroupMonoid Dropped support for building propellor with ghc 7 (as in debian oldstable), to avoid needing to depend on the semigroups transitional package, but also because it's just too old to be worth supporting. If we indeed drop ghc 7 support entirely, some code to support "jessie" can be removed; concurrent-output can be de-embedded, and the Singletons code can be simplified. This commit was sponsored by Jack Hill on Patreon.

Move table and target to before the other rule arguments

2018-03-20T21:08:17Z

Some commands in IPTables are order dependent. In particular, I have seen this with the --to-dest and the --to-source arguments for DNAT and SNAT respectively. Below is an example rule which demonstrates the issue. $ iptables -A PREROUTING -p tcp -i eth0 --dport 4000 \ --to-dest 10.3.0.6:4000 -t nat -j DNAT iptables v1.6.0: unknown option "--to-dest" $ iptables -A PREROUTING -p tcp -i eth0 --dport 4000 \ -j DNAT --to-dest 10.3.0.6:4000 -t nat Signed-off-by: Russell Sim

convert fromIPAddr to val

2017-02-26T20:48:26Z

convert from* in Firewall to val

2017-02-26T20:45:33Z

use ConfigurableValue where applicable

2017-02-26T20:17:19Z

* Removed fromPort (use val instead). (API change) * Removed several Show instances that were only used for generating configuration, replacing with ConfigurableValue instances. (API change) It's somewhat annoying that IsInfo requires a Show instance. That's needed to be able to display Info in ghci, but some non-derived Show instances had to be kept to support that.

add GroupOwner and NotDestination iptables Rules

2016-05-19T05:25:09Z

more porting

2016-03-26T18:28:38Z

Firewall: add NatDestination to Rules

2016-03-07T20:32:03Z

(cherry picked from commit df40046fd65bc07eced41adb73c7e227d2b54cd1)

add fromPort function

2016-03-07T20:31:52Z

(cherry picked from commit c3a23f89092d1ef8367c37ab8993ea7031124f4b)