Improve firewalld support #303
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Suites now correctly test against all compatible platforms for each firewall solution. Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
The resource was specifying --zone when creating --direct rules, which is not allowed for direct rules in firewalld. Fixes sous-chefs#298 Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Due to firewalld/firewalld#1438 Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
The firewalld_zone resource has been updated to support priority, ingress_priority, and egress_priority zone options introduced in firewalld 2.0.0. As a result, this update extends support to RHEL 10, its derivatives, and Ubuntu 24.04, all of which utilize firewalld 2.0.0 or later. Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
decoyjoe
force-pushed
the
fix-firewalld-support
branch
3 times, most recently
from
db2054d to
886fdbe
Compare
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Refactors firewalld support to use rich rules instead of the "--direct" interface, which was deprecated with the firewalld 1.0.0 release [1]. Adds IPv6 support for firewalld platforms (fixes sous-chefs#86). [1] https://firewalld.org/2021/06/the-upcoming-1-0-0 Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Until chef/chef#14760 is fixed. Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
decoyjoe
force-pushed
the
fix-firewalld-support
branch
2 times, most recently
from
0b87ceb to
e6d8da4
Compare
Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
decoyjoe
force-pushed
the
fix-firewalld-support
branch
from
e6d8da4 to
6f34a40
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
I started out meaning to just fix a couple of bugs with the firewalld provider. I ended up needing to refactor and modernize the firewalld implementation in order to get it into a supportable state. Many bugs were fixed along the way.
Key changes in this release:
firewall_ruleresource now creates rich rules on firewalld platforms instead of using the deprecated--directinterface.default['firewall']['solution']attribute to determine the firewall solution to use instead of a hardcoded assignment for each platform. It defaults to the platform's native firewall (same as previous hardcoded values).Added
priority,ingress_priority,egress_priorityproperties added tofirewalld_zone.firewalld_rich_ruleresource for adding/removing rich rules to/from firewalld zones.Changed
firewalldservice remains enabled and started when installed.firewall_ruleresource now creates rich rules on firewalld platforms, instead of the using the deprecated--directfirewalld interface.Fixed
firewall_ruleresource fails with a--zone is an invalid option with --directerror on firewalld.firewalld_zoneunexpectedly have forwarding enabled by default.firewalld_*resources ignore properties whose value isfalse.firewalld_*resources were not idempotent when usingports,source_ports, andrich_rulesproperties.ufwprovider doesn't ensureufwservice is enabled.Removed
disabledproperty fromfirewallresource.default['firewall']['firewalld']attributes. Use thefirewalld_zoneresource to manage firewalld zone configuration.:savefromfirewallresource. Firewalld rules are now always added permanently.permanentfromfirewall_ruleresource. Firewalld rules are now always added permanently.disabled_zoneandenabled_zonefromfirewallresource. Use thefirewalld_zoneresource to manage firewalld zone configuration.firewall::firewalld. Its functionality has been merged into thefirewall::defaultrecipe.default['firewall']['ubuntu_iptables']anddefault['firewall']['redhat7_iptables']. Use the newdefault['firewall']['solution']attribute to set the desired firewall solution to use.Issues Resolved
Check List
## Unreleased