Issue 2487 - Introduce fail2ban module

modules/fail2ban/manifests/filter.pp

 # == Type: fail2ban::filter
 #
 # Manage filter information and files for any custom filter.
 #
 # == Parameters:
 #
-# [*failregex*]

[mathias, 2016/11/29 13:21:24]

Either we allow for passing a single string as well (the most common use-case
probably, and easy to wrap into an array later, but a little more excessive
documentation required) or we should re-name the parameter to reflect the list
character (plural).

[f.lopez, 2016/12/01 09:13:48]

Acknowledged.

+# [*regexes*]
 #   Array of strings containing the regular expressions applied to
 #   the filter.
 #
 # [*ensure*]
 #   Translates directly into the state of the file resource.
 #
 # === Examples:
 #
-#   fail2ban::filter => {'CVE-2013-0235':

[mathias, 2016/11/29 13:21:24]

The "=>" here is invalid syntax, and the sub-levels below should be indented by
2wo spaces only.

[f.lopez, 2016/12/01 09:13:48]

Acknowledged.

-#       failregex => [
-#         '^<HOST>.*\"WordPress\/.*',
-#         '^.*\"WordPress\/.*<HOST>.*'

[mathias, 2016/11/29 13:21:24]

Missing a comma here, after the string item.

[f.lopez, 2016/12/01 09:13:48]

Acknowledged.

-#       ],
-#       'ensure' => 'present',
+#   fail2ban::filter {'CVE-2013-0235':
+#     regexes => [
+#       '^<HOST>.*\"WordPress\/.*',
+#       '^.*\"WordPress\/.*<HOST>.*',
+#     ],
+#     'ensure' => 'present',
 #   }

[mathias, 2016/11/29 13:21:24]

Another comment-line (hash-tag in the beginning, otherwise empty) should follow
here.

[f.lopez, 2016/12/01 09:13:48]

Acknowledged.

+#
 define fail2ban::filter (
-  $failregex = [],
+  $regexes = [],
   $ensure = 'present',
 ) {
 
   include fail2ban
   include stdlib
 
-  if (size($failregex) == 0) and ($ensure == 'present') {
-    fail('Require an array of string[s] with the regex patterns to apply.')

[mathias, 2016/11/29 13:21:24]

Those square brackets are not necessary. And the error message does not indicate
the actual issue, namely that an empty array has been encountered ("array of
strings" vs "array of one or more regular expressions", for example).

[f.lopez, 2016/12/01 09:13:48]

Acknowledged.

+  if (size($regexes) == 0) and ($ensure == 'present') {
+    fail("An array of one or more regular expressions is needed.")
   }
 
-  file {"/etc/fail2ban/filter.d/$title.conf":
+  # The $name parameter is used to compose the file name.
+  file {"/etc/fail2ban/filter.d/$name.conf":
     ensure => $ensure,
     content => template("fail2ban/filter.erb"),
     group => 'root',
     mode => '0644',
     owner => 'root',
     require => Package['fail2ban'],
     notify => Service['fail2ban'],
   }
 }