<commit_before>####
## Unified iptables configuration - Chef edition
####

# This file was generated by Chef for <%= node['fqdn'] =%>

####
## Things to remember
####
##
## 1) iptables rules are evaluated in order.  Place high-traffic (eg 80 ACCEPT) at the
##    top for performance reasons.
## 2) We try to remove ip_conntrack from the picture as much as possible.  Please try to
##    not enable NAT anywhere.  Also don't use -m if you don't need it, this can enable
##    ip_conntrack.
##
####

###
## Disable IP connection tracking
###
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
<% if node['loom_firewall']['notrack_ports'] %>
# NOTRACK ports
<% node['loom_firewall']['notrack_ports'].each do |p| %>
-A PREROUTING -p tcp --dport <%= p =%> -j NOTRACK
-A OUTPUT -p tcp --sport <%= p =%> -j NOTRACK
-A OUTPUT -p tcp --dport <%= p =%> -j NOTRACK
-A PREROUTING -p udp --dport <%= p =%> -j NOTRACK
-A OUTPUT -p udp --sport <%= p =%> -j NOTRACK
-A OUTPUT -p udp --dport <%= p =%> -j NOTRACK
<% end %>
<% end %>
COMMIT

###
## Set defaults
###
*filter
# node['loom_firewall']['INPUT_policy']
<% if node['loom_firewall']['INPUT_policy'] %>
:INPUT <%= node['loom_firewall']['INPUT_policy'] =%> [0:0]
<% end %>
<% if node['loom_firewall']['FORWARD_policy'] %>
:FORWARD <%= node['loom_firewall']['FORWARD_policy'] =%> [0:0]
<% end %>
<% if node['loom_firewall']['OUTPUT_policy'] %>
:OUTPUT <%= node['loom_firewall']['OUTPUT_policy'] =%> [0:0]
<% end %>

## Allow traffic that is a part of an ongoing connection
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

###
## Services open to the outside world
###

## Allow certain flavours of ICMP (11 for traceroute, 0 & 8 for ping)
-A INPUT -p icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp --icmp-type 8  -j ACCEPT
-A INPUT -p icmp --icmp-type 0  -j ACCEPT

<% if node['loom_firewall']['open_tcp_ports'] %>
# Open TCP ports
<% node['loom_firewall']['open_tcp_ports'].each do |p| %>
-A INPUT -p tcp --dport <%= p =%> -j ACCEPT
<% end %>
<% end %>

<% if node['loom_firewall']['open_udp_ports'] %>
# Open UDP ports
<% node['loom_firewall']['open_udp_ports'].each do |p| %>
-A INPUT -p udp --dport <%= p =%> -j ACCEPT
-A INPUT -p udp --sport <%= p =%> -j ACCEPT
<% end %>
<% end %>

###
## Interfaces
###

## Allow all traffic from loopback
-A INPUT -i lo -j ACCEPT 

###
## Nodes
###

<% (node['loom']['cluster']['nodes'].sort_by {|n, v| v}).each do |n, v| %>
-A INPUT -s <%= v.ipaddress =%> -j ACCEPT
<% end %>

<% if node['loom_firewall']['whitelist_nodes'] %>
# Whitelisted nodes
<% node['loom_firewall']['whitelist_nodes'].each do |n| %>
-A INPUT -s <%= n =%> -j ACCEPT
<% end %>
<% end %>

<% if node['loom_firewall']['blacklist_nodes'] %><commit_msg>There's no reason to sort, and it caused a recipe compile error<commit_after>####
## Unified iptables configuration - Chef edition
####

# This file was generated by Chef for <%= node['fqdn'] =%>

####
## Things to remember
####
##
## 1) iptables rules are evaluated in order.  Place high-traffic (eg 80 ACCEPT) at the
##    top for performance reasons.
## 2) We try to remove ip_conntrack from the picture as much as possible.  Please try to
##    not enable NAT anywhere.  Also don't use -m if you don't need it, this can enable
##    ip_conntrack.
##
####

###
## Disable IP connection tracking
###
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
<% if node['loom_firewall']['notrack_ports'] %>
# NOTRACK ports
<% node['loom_firewall']['notrack_ports'].each do |p| %>
-A PREROUTING -p tcp --dport <%= p =%> -j NOTRACK
-A OUTPUT -p tcp --sport <%= p =%> -j NOTRACK
-A OUTPUT -p tcp --dport <%= p =%> -j NOTRACK
-A PREROUTING -p udp --dport <%= p =%> -j NOTRACK
-A OUTPUT -p udp --sport <%= p =%> -j NOTRACK
-A OUTPUT -p udp --dport <%= p =%> -j NOTRACK
<% end %>
<% end %>
COMMIT

###
## Set defaults
###
*filter
# node['loom_firewall']['INPUT_policy']
<% if node['loom_firewall']['INPUT_policy'] %>
:INPUT <%= node['loom_firewall']['INPUT_policy'] =%> [0:0]
<% end %>
<% if node['loom_firewall']['FORWARD_policy'] %>
:FORWARD <%= node['loom_firewall']['FORWARD_policy'] =%> [0:0]
<% end %>
<% if node['loom_firewall']['OUTPUT_policy'] %>
:OUTPUT <%= node['loom_firewall']['OUTPUT_policy'] =%> [0:0]
<% end %>

## Allow traffic that is a part of an ongoing connection
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

###
## Services open to the outside world
###

## Allow certain flavours of ICMP (11 for traceroute, 0 & 8 for ping)
-A INPUT -p icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp --icmp-type 8  -j ACCEPT
-A INPUT -p icmp --icmp-type 0  -j ACCEPT

<% if node['loom_firewall']['open_tcp_ports'] %>
# Open TCP ports
<% node['loom_firewall']['open_tcp_ports'].each do |p| %>
-A INPUT -p tcp --dport <%= p =%> -j ACCEPT
<% end %>
<% end %>

<% if node['loom_firewall']['open_udp_ports'] %>
# Open UDP ports
<% node['loom_firewall']['open_udp_ports'].each do |p| %>
-A INPUT -p udp --dport <%= p =%> -j ACCEPT
-A INPUT -p udp --sport <%= p =%> -j ACCEPT
<% end %>
<% end %>

###
## Interfaces
###

## Allow all traffic from loopback
-A INPUT -i lo -j ACCEPT 

###
## Nodes
###

<% node['loom']['cluster']['nodes'].each do |n, v| %>
-A INPUT -s <%= v.ipaddress =%> -j ACCEPT
<% end %>

<% if node['loom_firewall']['whitelist_nodes'] %>
# Whitelisted nodes
<% node['loom_firewall']['whitelist_nodes'].each do |n| %>
-A INPUT -s <%= n =%> -j ACCEPT
<% end %>
<% end %>

<% if node['loom_firewall']['blacklist_nodes'] %>
{'fraction_non_alphanumeric': 0.2086317722681359, 'fraction_numerical': 0.00808080808080808, 'mean_word_length': 3.941923774954628, 'pattern_counts': {'":': 0, '<': 83, '<?xml version=': 0, '>': 83, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2411507', 'n_tokens_mistral': 2254, 'n_tokens_neox': 2067, 'n_words': 622}