From 969e1e6d277ef40a24d2cdc33f31f1eaa48752f5 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Tue, 7 Mar 2023 19:13:38 +0000 Subject: [PATCH] Drop tcp vs tcp:syn distinction --- cookbooks/bind/recipes/default.rb | 2 +- cookbooks/exim/recipes/default.rb | 8 ++++---- cookbooks/geodns/recipes/default.rb | 2 +- cookbooks/logstash/recipes/default.rb | 8 ++++---- cookbooks/munin/recipes/default.rb | 2 +- cookbooks/networking/recipes/default.rb | 2 +- cookbooks/networking/resources/firewall_rule.rb | 9 ++------- cookbooks/openssh/recipes/default.rb | 2 +- cookbooks/prometheus/resources/exporter.rb | 2 +- cookbooks/rsyncd/recipes/default.rb | 2 +- 10 files changed, 17 insertions(+), 22 deletions(-) diff --git a/cookbooks/bind/recipes/default.rb b/cookbooks/bind/recipes/default.rb index 8c7ee11e7..6c596420d 100644 --- a/cookbooks/bind/recipes/default.rb +++ b/cookbooks/bind/recipes/default.rb @@ -72,6 +72,6 @@ firewall_rule "accept-dns-tcp" do action :accept source "net" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports "domain" end diff --git a/cookbooks/exim/recipes/default.rb b/cookbooks/exim/recipes/default.rb index 219baa36d..1a82a2273 100644 --- a/cookbooks/exim/recipes/default.rb +++ b/cookbooks/exim/recipes/default.rb @@ -234,7 +234,7 @@ if node[:exim][:smarthost_name] action :accept source "net" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports port source_ports "1024-65535" end @@ -254,7 +254,7 @@ else family :inet source "net:#{smarthosts_inet.sort.join(',')}" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports port source_ports "1024-65535" end @@ -264,7 +264,7 @@ else family :inet6 source "net:#{smarthosts_inet6.sort.join(',')}" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports port source_ports "1024-65535" end @@ -276,7 +276,7 @@ if node[:exim][:smarthost_via] action :reject source "fw" dest "net" - proto "tcp:syn" + proto "tcp" dest_ports "smtp" end end diff --git a/cookbooks/geodns/recipes/default.rb b/cookbooks/geodns/recipes/default.rb index 8afa85cc5..b40a7643f 100644 --- a/cookbooks/geodns/recipes/default.rb +++ b/cookbooks/geodns/recipes/default.rb @@ -100,6 +100,6 @@ firewall_rule "accept-dns-tcp" do action :accept source "net" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports "domain" end diff --git a/cookbooks/logstash/recipes/default.rb b/cookbooks/logstash/recipes/default.rb index 81a0b79f8..56caa7312 100644 --- a/cookbooks/logstash/recipes/default.rb +++ b/cookbooks/logstash/recipes/default.rb @@ -83,7 +83,7 @@ forwarders.sort_by { |n| n[:fqdn] }.each do |forwarder| family interface[:family] source "net:#{interface[:address]}" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports "5043" source_ports "1024-65535" end @@ -93,7 +93,7 @@ forwarders.sort_by { |n| n[:fqdn] }.each do |forwarder| family interface[:family] source "net:#{interface[:address]}" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports "5044" source_ports "1024-65535" end @@ -109,7 +109,7 @@ gateways.sort_by { |n| n[:fqdn] }.each do |gateway| family interface[:family] source "net:#{interface[:address]}" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports "5043" source_ports "1024-65535" end @@ -119,7 +119,7 @@ gateways.sort_by { |n| n[:fqdn] }.each do |gateway| family interface[:family] source "net:#{interface[:address]}" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports "5044" source_ports "1024-65535" end diff --git a/cookbooks/munin/recipes/default.rb b/cookbooks/munin/recipes/default.rb index 25b81a477..c1233f9b9 100644 --- a/cookbooks/munin/recipes/default.rb +++ b/cookbooks/munin/recipes/default.rb @@ -33,7 +33,7 @@ servers.each do |server| family interface[:family] source "net:#{interface[:address]}" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports "munin" source_ports "1024-65535" end diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb index 831d7ce84..799871963 100644 --- a/cookbooks/networking/recipes/default.rb +++ b/cookbooks/networking/recipes/default.rb @@ -458,7 +458,7 @@ firewall_rule "accept-http" do action :accept source "net" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports %w[http https] rate_limit node[:networking][:firewall][:http_rate_limit] connection_limit node[:networking][:firewall][:http_connection_limit] diff --git a/cookbooks/networking/resources/firewall_rule.rb b/cookbooks/networking/resources/firewall_rule.rb index 63970e661..6e6c72585 100644 --- a/cookbooks/networking/resources/firewall_rule.rb +++ b/cookbooks/networking/resources/firewall_rule.rb @@ -69,10 +69,7 @@ action_class do when "inet6" then "ip6" end - proto = case new_resource.proto - when "udp" then "udp" - when "tcp", "tcp:syn" then "tcp" - end + proto = new_resource.proto if new_resource.source_ports rule << "#{proto} sport { #{nftables_source_ports} }" @@ -98,9 +95,7 @@ action_class do rule << "#{ip} daddr { #{addresses} }" end - if new_resource.proto == "tcp:syn" - rule << "ct state new" - end + rule << "ct state new" if new_resource.proto == "tcp" if new_resource.connection_limit != "-" set = "connlimit-#{new_resource.rule}-#{ip}" diff --git a/cookbooks/openssh/recipes/default.rb b/cookbooks/openssh/recipes/default.rb index 06a88e8b5..6a299d226 100644 --- a/cookbooks/openssh/recipes/default.rb +++ b/cookbooks/openssh/recipes/default.rb @@ -86,6 +86,6 @@ firewall_rule "accept-ssh" do action :accept source "net" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports node[:openssh][:port] end diff --git a/cookbooks/prometheus/resources/exporter.rb b/cookbooks/prometheus/resources/exporter.rb index 581c961dd..782f84aa3 100644 --- a/cookbooks/prometheus/resources/exporter.rb +++ b/cookbooks/prometheus/resources/exporter.rb @@ -74,7 +74,7 @@ action :create do action :accept source "osm" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports new_resource.port only_if { node[:prometheus][:mode] == "external" } end diff --git a/cookbooks/rsyncd/recipes/default.rb b/cookbooks/rsyncd/recipes/default.rb index 12131fc83..bcc0046e4 100644 --- a/cookbooks/rsyncd/recipes/default.rb +++ b/cookbooks/rsyncd/recipes/default.rb @@ -79,7 +79,7 @@ firewall_rule "accept-rsync" do action :accept source "net" dest "fw" - proto "tcp:syn" + proto "tcp" dest_ports "rsync" source_ports "1024-65535" end -- 2.43.2