property :source, :kind_of => String, :required => true
property :dest, :kind_of => String, :required => true
property :proto, :kind_of => String, :required => true
-property :dest_ports, :kind_of => [String, Integer], :default => "-"
-property :source_ports, :kind_of => [String, Integer], :default => "-"
+property :dest_ports, :kind_of => [String, Integer, Array]
+property :source_ports, :kind_of => [String, Integer, Array]
property :rate_limit, :kind_of => String, :default => "-"
property :connection_limit, :kind_of => [String, Integer], :default => "-"
property :helper, :kind_of => String, :default => "-"
action_class do
def add_rule(action)
- if node[:networking][:firewall][:engine] == "shorewall"
- add_shorewall_rule(action)
- elsif node[:networking][:firewall][:engine] == "nftables"
- if new_resource.family.nil?
- add_nftables_rule(action, "inet")
- add_nftables_rule(action, "inet6")
- elsif new_resource.family.to_s == "inet"
- add_nftables_rule(action, "inet")
- elsif new_resource.family.to_s == "inet6"
- add_nftables_rule(action, "inet6")
- end
- end
- end
-
- def add_shorewall_rule(action)
- rule = {
- :action => action.to_s.upcase,
- :source => new_resource.source,
- :dest => new_resource.dest,
- :proto => new_resource.proto,
- :dest_ports => new_resource.dest_ports.to_s,
- :source_ports => new_resource.source_ports.to_s,
- :rate_limit => new_resource.rate_limit,
- :connection_limit => new_resource.connection_limit.to_s,
- :helper => new_resource.helper
- }
-
if new_resource.family.nil?
- node.default[:networking][:firewall][:inet] << rule
- node.default[:networking][:firewall][:inet6] << rule
+ add_nftables_rule(action, "inet")
+ add_nftables_rule(action, "inet6")
elsif new_resource.family.to_s == "inet"
- node.default[:networking][:firewall][:inet] << rule
+ add_nftables_rule(action, "inet")
elsif new_resource.family.to_s == "inet6"
- node.default[:networking][:firewall][:inet6] << rule
- else
- log "Unsupported network family" do
- level :error
- end
+ add_nftables_rule(action, "inet6")
end
end
when "tcp", "tcp:syn" then "tcp"
end
- if new_resource.source_ports != "-"
+ if new_resource.source_ports
rule << "#{proto} sport { #{nftables_source_ports} }"
end
- if new_resource.dest_ports != "-"
+ if new_resource.dest_ports
rule << "#{proto} dport { #{nftables_dest_ports} }"
end
rule << "add @#{set} { #{ip} saddr ct count #{new_resource.connection_limit} }"
end
- # if new_resource.rate_limit =~ %r{^s:(\d+)/sec:(\d+)$}
- # set = "#{new_resource.rule}-#{ip}"
- # rate = Regexp.last_match(1)
- # burst = Regexp.last_match(2)
- #
- # node.default[:networking][:firewall][:sets] << set
- #
- # rule << "add @#{set} { #{ip} saddr limit rate #{rate}/second burst #{burst} packets }"
- # end
+ if new_resource.rate_limit =~ %r{^s:(\d+)/sec:(\d+)$}
+ set = "ratelimit-#{new_resource.rule}-#{ip}"
+ rate = Regexp.last_match(1)
+ burst = Regexp.last_match(2)
+
+ node.default[:networking][:firewall][:sets] << set
+
+ rule << "update @#{set} { #{ip} saddr limit rate #{rate}/second burst #{burst} packets }"
+ end
rule << case action
when :accept then "accept"
end
def nftables_source_ports
- new_resource.source_ports.to_s.sub(/:$/, "-65535").gsub(":", "-")
+ Array(new_resource.source_ports).map(&:to_s).join(",")
end
def nftables_dest_ports
- new_resource.dest_ports.to_s.sub(/:$/, "-65535").gsub(":", "-")
+ Array(new_resource.dest_ports).map(&:to_s).join(",")
end
end