|
36 | 36 | # Before executing the simple_iptables_* resources, reset the |
37 | 37 | # node attributes to their defaults. This gives "action :delete" |
38 | 38 | # semantics for free by removing a resource from a recipe. |
39 | | - node.set["simple_iptables"]["chains"] = {"filter" => [], "nat" => [], "mangle" => [], "raw" => []} |
40 | | - node.set["simple_iptables"]["rules"] = {"filter" => [], "nat" => [], "mangle" => [], "raw" => []} |
41 | | - node.set["simple_iptables"]["policy"] = {"filter" => {}, "nat" => {}, "mangle" => {}, "raw" => {}} |
| 39 | + node.set["simple_iptables"]["ipv4"]["chains"] = {"filter" => [], "nat" => [], "mangle" => [], "raw" => []} |
| 40 | + node.set["simple_iptables"]["ipv4"]["rules"] = {"filter" => [], "nat" => [], "mangle" => [], "raw" => []} |
| 41 | + node.set["simple_iptables"]["ipv4"]["policy"] = {"filter" => {}, "nat" => {}, "mangle" => {}, "raw" => {}} |
42 | 42 |
|
| 43 | + node.set["simple_iptables"]["ipv6"]["chains"] = {"filter" => [], "mangle" => [], "raw" => []} |
| 44 | + node.set["simple_iptables"]["ipv6"]["rules"] = {"filter" => [], "mangle" => [], "raw" => []} |
| 45 | + node.set["simple_iptables"]["ipv6"]["policy"] = {"filter" => {}, "mangle" => {}, "raw" => {}} |
43 | 46 | # Then run all the simple_iptables_* resources |
44 | 47 | run_context.resource_collection.each do |resource| |
45 | 48 | if resource.kind_of?(Chef::Resource::SimpleIptablesRule) |
|
58 | 61 | case node['platform_family'] |
59 | 62 | when 'debian' |
60 | 63 | iptable_rules = '/etc/iptables-rules' |
| 64 | + ip6table_rules = '/etc/ip6tables-rules' |
61 | 65 | when 'rhel', 'fedora' |
62 | 66 | iptable_rules = '/etc/sysconfig/iptables' |
| 67 | + ip6table_rules = '/etc/sysconfig/ip6tables' |
63 | 68 | end |
64 | 69 |
|
65 | | -ruby_block "test-iptables" do |
66 | | - block do |
67 | | - cmd = Mixlib::ShellOut.new("iptables-restore --test < #{iptable_rules}", |
68 | | - :user => "root") |
69 | | - cmd.run_command |
70 | | - if !Array(cmd.valid_exit_codes).include?(cmd.exitstatus) |
71 | | - msg = <<-eos |
72 | | -iptables-restore exited with code #{cmd.exitstatus} while testing new rules |
73 | | -STDOUT: |
74 | | -#{cmd.stdout} |
75 | | -STDERR: |
76 | | -#{cmd.stderr} |
77 | | -eos |
78 | | - match = cmd.stderr.match /line:?\s*(\d+)/ |
79 | | - if match |
80 | | - line_no = match[1].to_i |
81 | | - msg << "Line #{line_no}: #{IO.readlines(iptable_rules)[line_no-1]}" |
| 70 | +if node["simple_iptables"]["ip_versions"].include?("ipv4") |
| 71 | + ruby_block "test-iptables" do |
| 72 | + block do |
| 73 | + cmd = Mixlib::ShellOut.new("iptables-restore --test < #{iptable_rules}", |
| 74 | + :user => "root") |
| 75 | + cmd.run_command |
| 76 | + if !Array(cmd.valid_exit_codes).include?(cmd.exitstatus) |
| 77 | + msg = <<-eos |
| 78 | + iptables-restore exited with code #{cmd.exitstatus} while testing new rules |
| 79 | + STDOUT: |
| 80 | + #{cmd.stdout} |
| 81 | + STDERR: |
| 82 | + #{cmd.stderr} |
| 83 | + eos |
| 84 | + match = cmd.stderr.match /line:?\s*(\d+)/ |
| 85 | + if match |
| 86 | + line_no = match[1].to_i |
| 87 | + msg << "Line #{line_no}: #{IO.readlines(iptable_rules)[line_no-1]}" |
| 88 | + end |
| 89 | + # Delete the file so that the next Chef run is forced to recreate it |
| 90 | + # and retest it. Otherwise, if the rules remain unchanged, the template |
| 91 | + # resource won't recreate the file, won't notify the test resource, |
| 92 | + # and the Chef run will be allowed to complete successfully despite |
| 93 | + # and invalid rule being present. |
| 94 | + File.delete(iptable_rules) |
| 95 | + raise msg |
82 | 96 | end |
83 | | - # Delete the file so that the next Chef run is forced to recreate it |
84 | | - # and retest it. Otherwise, if the rules remain unchanged, the template |
85 | | - # resource won't recreate the file, won't notify the test resource, |
86 | | - # and the Chef run will be allowed to complete successfully despite |
87 | | - # and invalid rule being present. |
88 | | - File.delete(iptable_rules) |
89 | | - raise msg |
90 | 97 | end |
| 98 | + notifies :run, "execute[reload-iptables]" |
| 99 | + action :nothing |
91 | 100 | end |
92 | | - notifies :run, "execute[reload-iptables]" |
93 | | - action :nothing |
94 | | -end |
95 | 101 |
|
96 | | -execute "reload-iptables" do |
97 | | - command "iptables-restore < #{iptable_rules}" |
98 | | - user "root" |
99 | | - action :nothing |
| 102 | + execute "reload-iptables" do |
| 103 | + command "iptables-restore < #{iptable_rules}" |
| 104 | + user "root" |
| 105 | + action :nothing |
| 106 | + end |
| 107 | + |
| 108 | + template iptable_rules do |
| 109 | + source "iptables-rules.erb" |
| 110 | + cookbook "simple_iptables" |
| 111 | + notifies :create, "ruby_block[test-iptables]" |
| 112 | + action :create |
| 113 | + end |
100 | 114 | end |
101 | 115 |
|
102 | | -template iptable_rules do |
103 | | - source "iptables-rules.erb" |
104 | | - cookbook "simple_iptables" |
105 | | - notifies :create, "ruby_block[test-iptables]" |
106 | | - action :create |
| 116 | +if node["simple_iptables"]["ip_versions"].include?("ipv6") |
| 117 | + ruby_block "test-ip6tables" do |
| 118 | + block do |
| 119 | + cmd = Mixlib::ShellOut.new("ip6tables-restore --test < #{ip6table_rules}", |
| 120 | + :user => "root") |
| 121 | + cmd.run_command |
| 122 | + if !Array(cmd.valid_exit_codes).include?(cmd.exitstatus) |
| 123 | + msg = <<-eos |
| 124 | + ip6tables-restore exited with code #{cmd.exitstatus} while testing new rules |
| 125 | + STDOUT: |
| 126 | + #{cmd.stdout} |
| 127 | + STDERR: |
| 128 | + #{cmd.stderr} |
| 129 | + eos |
| 130 | + match = cmd.stderr.match /line:?\s*(\d+)/ |
| 131 | + if match |
| 132 | + line_no = match[1].to_i |
| 133 | + msg << "Line #{line_no}: #{IO.readlines(ip6table_rules)[line_no-1]}" |
| 134 | + end |
| 135 | + # Delete the file so that the next Chef run is forced to recreate it |
| 136 | + # and retest it. Otherwise, if the rules remain unchanged, the template |
| 137 | + # resource won't recreate the file, won't notify the test resource, |
| 138 | + # and the Chef run will be allowed to complete successfully despite |
| 139 | + # and invalid rule being present. |
| 140 | + File.delete(ip6table_rules) |
| 141 | + raise msg |
| 142 | + end |
| 143 | + end |
| 144 | + notifies :run, "execute[reload-ip6tables]" |
| 145 | + action :nothing |
| 146 | + end |
| 147 | + |
| 148 | + execute "reload-ip6tables" do |
| 149 | + command "ip6tables-restore < #{ip6table_rules}" |
| 150 | + user "root" |
| 151 | + action :nothing |
| 152 | + end |
| 153 | + |
| 154 | + template ip6table_rules do |
| 155 | + source "ip6tables-rules.erb" |
| 156 | + cookbook "simple_iptables" |
| 157 | + notifies :create, "ruby_block[test-ip6tables]" |
| 158 | + action :create |
| 159 | + end |
107 | 160 | end |
108 | 161 |
|
109 | 162 | case node['platform_family'] |
110 | 163 | when 'debian' |
111 | 164 |
|
112 | | - # TODO: Generalize this for other platforms somehow |
113 | | - file "/etc/network/if-up.d/iptables-rules" do |
114 | | - owner "root" |
115 | | - group "root" |
116 | | - mode "0755" |
117 | | - content "#!/bin/bash\niptables-restore < #{iptable_rules}\n" |
118 | | - action :create |
| 165 | + if node["simple_iptables"]["ip_versions"].include?("ipv4") |
| 166 | + # TODO: Generalize this for other platforms somehow |
| 167 | + file "/etc/network/if-up.d/iptables-rules" do |
| 168 | + owner "root" |
| 169 | + group "root" |
| 170 | + mode "0755" |
| 171 | + content "#!/bin/bash\niptables-restore < #{iptable_rules}\n" |
| 172 | + action :create |
| 173 | + end |
119 | 174 | end |
| 175 | + |
| 176 | + if node["simple_iptables"]["ip_versions"].include?("ipv6") |
| 177 | + file "/etc/network/if-up.d/ip6tables-rules" do |
| 178 | + owner "root" |
| 179 | + group "root" |
| 180 | + mode "0755" |
| 181 | + content "#!/bin/bash\nip6tables-restore < #{ip6table_rules}\n" |
| 182 | + action :create |
| 183 | + end |
| 184 | + end |
| 185 | + |
120 | 186 | end |
0 commit comments