Simpligy configuration of port numbers in firewall rules

diff --git a/cookbooks/bind/recipes/default.rb b/cookbooks/bind/recipes/default.rb
index 78db7466f5a3e8e5c3794060cc66228138c41f02..8c7ee11e790c92863a49939bab4738be4a763cc0 100644 (file)
--- a/cookbooks/bind/recipes/default.rb
+++ b/cookbooks/bind/recipes/default.rb
@@ -66,7 +66,6 @@ firewall_rule "accept-dns-udp" do
   dest "fw"
   proto "udp"
   dest_ports "domain"
-  source_ports "-"
 end
 
 firewall_rule "accept-dns-tcp" do
@@ -75,5 +74,4 @@ firewall_rule "accept-dns-tcp" do
   dest "fw"
   proto "tcp:syn"
   dest_ports "domain"
-  source_ports "-"
 end

diff --git a/cookbooks/exim/recipes/default.rb b/cookbooks/exim/recipes/default.rb
index 789c4e253a1802b82d68e5e504480a914472b91b..219baa36d45c7d7d61b98a7b5672c982720ab4f9 100644 (file)
--- a/cookbooks/exim/recipes/default.rb
+++ b/cookbooks/exim/recipes/default.rb
@@ -236,7 +236,7 @@ if node[:exim][:smarthost_name]
       dest "fw"
       proto "tcp:syn"
       dest_ports port
-      source_ports "1024:"
+      source_ports "1024-65535"
     end
   end
 else
@@ -256,7 +256,7 @@ else
       dest "fw"
       proto "tcp:syn"
       dest_ports port
-      source_ports "1024:"
+      source_ports "1024-65535"
     end
 
     firewall_rule "accept-inbound-smtp-#{port}" do
@@ -266,7 +266,7 @@ else
       dest "fw"
       proto "tcp:syn"
       dest_ports port
-      source_ports "1024:"
+      source_ports "1024-65535"
     end
   end
 end

diff --git a/cookbooks/ftp/recipes/default.rb b/cookbooks/ftp/recipes/default.rb
index 28d69a7514bd1d7479942cda001d917678d5ca7c..14ab725a0e402495163c2c9bee4c0792fa78b00a 100644 (file)
--- a/cookbooks/ftp/recipes/default.rb
+++ b/cookbooks/ftp/recipes/default.rb
@@ -49,6 +49,5 @@ firewall_rule "accept-ftp-tcp" do
   dest "fw"
   proto "tcp"
   dest_ports "ftp"
-  source_ports "-"
   helper "ftp"
 end

diff --git a/cookbooks/logstash/recipes/default.rb b/cookbooks/logstash/recipes/default.rb
index df4da98f1861fd99383b97d6d6c50322d262b37b..81a0b79f8c1a2695017ea90c93f0a2c33c5528b4 100644 (file)
--- a/cookbooks/logstash/recipes/default.rb
+++ b/cookbooks/logstash/recipes/default.rb
@@ -85,7 +85,7 @@ forwarders.sort_by { |n| n[:fqdn] }.each do |forwarder|
       dest "fw"
       proto "tcp:syn"
       dest_ports "5043"
-      source_ports "1024:"
+      source_ports "1024-65535"
     end
 
     firewall_rule "accept-beats-#{forwarder}" do
@@ -95,7 +95,7 @@ forwarders.sort_by { |n| n[:fqdn] }.each do |forwarder|
       dest "fw"
       proto "tcp:syn"
       dest_ports "5044"
-      source_ports "1024:"
+      source_ports "1024-65535"
     end
   end
 end
@@ -111,7 +111,7 @@ gateways.sort_by { |n| n[:fqdn] }.each do |gateway|
       dest "fw"
       proto "tcp:syn"
       dest_ports "5043"
-      source_ports "1024:"
+      source_ports "1024-65535"
     end
 
     firewall_rule "accept-beats-#{gateway}" do
@@ -121,7 +121,7 @@ gateways.sort_by { |n| n[:fqdn] }.each do |gateway|
       dest "fw"
       proto "tcp:syn"
       dest_ports "5044"
-      source_ports "1024:"
+      source_ports "1024-65535"
     end
   end
 end

diff --git a/cookbooks/munin/recipes/default.rb b/cookbooks/munin/recipes/default.rb
index 6c4bc6e765369b46d5fff36a57387049ead1317e..25b81a477dc670411ef263c0ce210bd3ac274005 100644 (file)
--- a/cookbooks/munin/recipes/default.rb
+++ b/cookbooks/munin/recipes/default.rb
@@ -35,7 +35,7 @@ servers.each do |server|
       dest "fw"
       proto "tcp:syn"
       dest_ports "munin"
-      source_ports "1024:"
+      source_ports "1024-65535"
     end
   end
 end

diff --git a/cookbooks/networking/resources/firewall_rule.rb b/cookbooks/networking/resources/firewall_rule.rb
index 92256936a5328b54b5d0abf15a1b27ee34542f74..63970e661cbc32fddb8ea337557d4e1b920c0f90 100644 (file)
--- a/cookbooks/networking/resources/firewall_rule.rb
+++ b/cookbooks/networking/resources/firewall_rule.rb
@@ -29,8 +29,8 @@ property :family, :kind_of => [String, Symbol]
 property :source, :kind_of => String, :required => true
 property :dest, :kind_of => String, :required => true
 property :proto, :kind_of => String, :required => true
-property :dest_ports, :kind_of => [String, Integer], :default => "-"
-property :source_ports, :kind_of => [String, Integer], :default => "-"
+property :dest_ports, :kind_of => [String, Integer, Array]
+property :source_ports, :kind_of => [String, Integer, Array]
 property :rate_limit, :kind_of => String, :default => "-"
 property :connection_limit, :kind_of => [String, Integer], :default => "-"
 property :helper, :kind_of => String, :default => "-"
@@ -74,11 +74,11 @@ action_class do
             when "tcp", "tcp:syn" then "tcp"
             end
 
-    if new_resource.source_ports != "-"
+    if new_resource.source_ports
       rule << "#{proto} sport { #{nftables_source_ports} }"
     end
 
-    if new_resource.dest_ports != "-"
+    if new_resource.dest_ports
       rule << "#{proto} dport { #{nftables_dest_ports} }"
     end
 
@@ -134,10 +134,10 @@ action_class do
   end
 
   def nftables_source_ports
-    new_resource.source_ports.to_s.sub(/:$/, "-65535").gsub(":", "-")
+    Array(new_resource.source_ports).map(&:to_s).join(",")
   end
 
   def nftables_dest_ports
-    new_resource.dest_ports.to_s.sub(/:$/, "-65535").gsub(":", "-")
+    Array(new_resource.dest_ports).map(&:to_s).join(",")
   end
 end

diff --git a/cookbooks/rsyncd/recipes/default.rb b/cookbooks/rsyncd/recipes/default.rb
index b13568acabeb52d2e7fae07d9c5efd647bb42f62..12131fc8313450bf8e0af1b29dd592dbfbfba429 100644 (file)
--- a/cookbooks/rsyncd/recipes/default.rb
+++ b/cookbooks/rsyncd/recipes/default.rb
@@ -81,5 +81,5 @@ firewall_rule "accept-rsync" do
   dest "fw"
   proto "tcp:syn"
   dest_ports "rsync"
-  source_ports "1024:"
+  source_ports "1024-65535"
 end

diff --git a/cookbooks/snmpd/recipes/default.rb b/cookbooks/snmpd/recipes/default.rb
index 26ae86b784ef4f9f6a1bd7f9ee4dc129603c7bc0..6fc4a36aac8e7e401022c7c2b5a544c919afaa2c 100644 (file)
--- a/cookbooks/snmpd/recipes/default.rb
+++ b/cookbooks/snmpd/recipes/default.rb
@@ -46,7 +46,7 @@ if node[:snmpd][:clients]
       dest "fw"
       proto "udp"
       dest_ports "snmp"
-      source_ports "1024:"
+      source_ports "1024-65535"
     end
   end
 else
@@ -57,7 +57,7 @@ else
     dest "fw"
     proto "udp"
     dest_ports "snmp"
-    source_ports "1024:"
+    source_ports "1024-65535"
   end
 end
 
@@ -70,7 +70,7 @@ if node[:snmpd][:clients6]
       dest "fw"
       proto "udp"
       dest_ports "snmp"
-      source_ports "1024:"
+      source_ports "1024-65535"
     end
   end
 else
@@ -81,6 +81,6 @@ else
     dest "fw"
     proto "udp"
     dest_ports "snmp"
-    source_ports "1024:"
+    source_ports "1024-65535"
   end
 end