Improve firewalld support #304
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Joseph Larionov <[email protected]>
Suites now correctly test against all compatible platforms for each firewall solution. Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
The resource was specifying --zone when creating --direct rules, which is not allowed for direct rules in firewalld. Fixes sous-chefs#298 Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Due to firewalld/firewalld#1438 Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
The firewalld_zone resource has been updated to support priority, ingress_priority, and egress_priority zone options introduced in firewalld 2.0.0. As a result, this update extends support to RHEL 10, its derivatives, and Ubuntu 24.04, all of which utilize firewalld 2.0.0 or later. Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Refactors firewalld support to use rich rules instead of the "--direct" interface, which was deprecated with the firewalld 1.0.0 release [1]. Adds IPv6 support for firewalld platforms (fixes sous-chefs#86). [1] https://firewalld.org/2021/06/the-upcoming-1-0-0 Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Until chef/chef#14760 is fixed. Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
Signed-off-by: Joseph Larionov <[email protected]>
|
Bonus fix: All kitchen tests now run successfully in GitHub Actions CI. |
bmhughes
added
Release: Major
bmhughes
approved these changes
Jan 3, 2025
|
Wow @decoyjoe! Thanks for this, really great job. I'll get this released now. |
|
Released as: 7.0.0 |
|
Thanks! I'll keep an eye on the repo's issues in-case a new bug crops up due to this refactor. |
This was referenced Jan 3, 2025
|
I should have surveyed the open issues a bit better before creating the PR. I found these open issues that are all fixed by this PR:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
I started out meaning to just fix a couple of bugs with the firewalld provider. I ended up needing to refactor and modernize the firewalld implementation in order to get it into a supportable state. Many bugs were fixed along the way.
Key changes in this release:
firewall_ruleresource now creates rich rules on firewalld platforms instead of using the deprecated--directinterface.default['firewall']['solution']attribute to determine the firewall solution to use instead of a hardcoded assignment for each platform. It defaults to the platform's native firewall (same as previous hardcoded values).Added
priority,ingress_priority,egress_priorityproperties added tofirewalld_zone.firewalld_rich_ruleresource for adding/removing rich rules to/from firewalld zones.Changed
firewalldservice remains enabled and started when installed.firewall_ruleresource now creates rich rules on firewalld platforms, instead of the using the deprecated--directfirewalld interface.Fixed
firewall_ruleresource fails with a--zone is an invalid option with --directerror on firewalld.firewalld_zoneunexpectedly have forwarding enabled by default.firewalld_*resources ignore properties whose value isfalse.firewalld_*resources were not idempotent when usingports,source_ports, andrich_rulesproperties.ufwprovider doesn't ensureufwservice is enabled.Removed
disabledproperty fromfirewallresource.default['firewall']['firewalld']attributes. Use thefirewalld_zoneresource to manage firewalld zone configuration.:savefromfirewallresource. Firewalld rules are now always added permanently.permanentfromfirewall_ruleresource. Firewalld rules are now always added permanently.disabled_zoneandenabled_zonefromfirewallresource. Use thefirewalld_zoneresource to manage firewalld zone configuration.firewall::firewalld. Its functionality has been merged into thefirewall::defaultrecipe.default['firewall']['ubuntu_iptables']anddefault['firewall']['redhat7_iptables']. Use the newdefault['firewall']['solution']attribute to set the desired firewall solution to use.Issues Resolved
Check List
## Unreleased