[CVE-2016-9599] Enforce Firewall TCP / UDP rules management

This closes CVE-2016-9599.

1) Sanitize dynamic HAproxy endpoints firewall rules

Build the hash of firewall rules only when a port is specified. The
HAproxy endpoints are using TCP protocol, which means we have to specify
a port to the IPtables rules.
Some services don't have public network exposure (e.g. Glance Registry),
which means they don't need haproxy_ssl rule.
The code prepare the hash depending on the service_port and
public_ssl_port parameters and create the actual firewall rules only if
one of those or both parameters are specified.
It will prevent new services without public exposure to open all traffic
because no port is specified.

2) Secure Firewall rules creations

The code won't allow to create TCP / UDP IPtables rules in INPUT
or OUTPUT chains without port or sport or dport, because doing it would
allow an IPtables rule opening all traffic for TCP or UDP.
If we try to do that, Puppet catalog will fail with an error explaining
why.
Example of use-cases:
- creating VRRP rules wouldn't require port parameters.
- creating TCP or UDP rules would require port parameters.

3) Allow to open all traffic for TCO / UDP (when desired)

Some use-cases require to open all traffic for all ports on TCP / UDP.
It will be possible if the user gives port = 'all' when creating the
firewall rule.

Backward compatibility:
- if our users created custom TCP / UDP firewall rules without port
  parameters, it won't work anymore, for security purpose.
- if you users want to open TCP / UDP for all ports, they need to pass
  port = 'all' and the rule will be created, though a warning will be
  displayed because this is insecure.
- if our users created custom VRRP rules without port parameters, it
  will still work correctly and rules will be created.
- TCP / UDP rules in FORWARD chain without port are still accepted.

Change-Id: I19396c8ab06b91fee3253cdfcb834482f4040a59
Closes-Bug: #1651831

1 files changed, 21 insertions, 8 deletions

diff --git a/manifests/haproxy/endpoint.pp b/manifests/haproxy/endpoint.pp
index 4311049..0bba245 100644
--- a/manifests/haproxy/endpoint.pp
+++ b/manifests/haproxy/endpoint.pp
@@ -149,14 +149,27 @@ define tripleo::haproxy::endpoint (
   }
   if hiera('manage_firewall', true) {
     include ::tripleo::firewall
-    $firewall_rules = {
-      "100 ${name}_haproxy"     => {
-        'dport' => $service_port,
-      },
-      "100 ${name}_haproxy_ssl" => {
-        'dport' => $public_ssl_port,
-      },
+    # This block will construct firewall rules only when we specify
+    # a port for the regular service and also the ssl port for the service.
+    # It makes sure we're not trying to create TCP iptables rules where no port
+    # is specified.
+    if $service_port {
+      $haproxy_firewall_rules = {
+        "100 ${name}_haproxy"     => {
+          'dport' => $service_port,
+        },
+      }
+    }
+    if $public_ssl_port {
+      $haproxy_ssl_firewall_rules = {
+        "100 ${name}_haproxy_ssl" => {
+          'dport' => $public_ssl_port,
+        },
+      }
+    }
+    $firewall_rules = merge($haproxy_firewall_rules, $haproxy_ssl_firewall_rules)
+    if $service_port or $public_ssl_port {
+      create_resources('tripleo::firewall::rule', $firewall_rules)
     }
-    create_resources('tripleo::firewall::rule', $firewall_rules)
   }
 }