From 02d9b5f7f647b7e97c7077cdab750c3465f2390c Mon Sep 17 00:00:00 2001 From: nilsver Date: Tue, 19 Nov 2024 14:12:09 +0000 Subject: [PATCH] another refactor --- resources/attributes/default.rb | 8 +-- resources/libraries/helper.rb | 106 ++++++++------------------------ resources/providers/config.rb | 97 +++++++++++++++++------------ 3 files changed, 86 insertions(+), 125 deletions(-) diff --git a/resources/attributes/default.rb b/resources/attributes/default.rb index c01d498..fb2cd25 100644 --- a/resources/attributes/default.rb +++ b/resources/attributes/default.rb @@ -2,7 +2,7 @@ default['firewall']['roles'] = { 'manager' => { - 'home_zone' => { + 'home' => { 'tcp_ports' => [ 53, 443, 2056, 2057, 2058, 2181, 2888, 3888, 4443, 5432, 7946, 7980, 8080, 8081, 8083, 8084, 8300, 8301, @@ -10,7 +10,7 @@ 'udp_ports' => [123, 161, 162, 1812, 1813, 2055, 5353, 6343], 'protocols' => ['igmp'], }, - 'public_zone' => { + 'public' => { 'tcp_ports' => [53, 443, 2056, 2057, 2058, 8080, 8081, 8083, 8084, 9000, 9001], 'udp_ports' => [53, 161, 162, 123, 2055, 6343, 5353], 'protocols' => ['112'], @@ -18,13 +18,13 @@ }, }, 'proxy' => { - 'public_zone' => { + 'public' => { 'tcp_ports' => [514, 2056, 2057, 2058, 7779], 'udp_ports' => [161, 162, 1812, 1813, 2055, 6343], }, }, 'ips' => { - 'public_zone' => { + 'public' => { 'udp_ports' => [161, 162], }, }, diff --git a/resources/libraries/helper.rb b/resources/libraries/helper.rb index 6859f7d..3e6d581 100644 --- a/resources/libraries/helper.rb +++ b/resources/libraries/helper.rb @@ -4,96 +4,38 @@ module Helpers require 'socket' include ::Chef::Mixin::ShellOut - def fetch_existing_rules(zone) - ports = shell_out!("firewall-cmd --zone=#{zone} --list-ports").stdout.strip.split(/\s+/) - protos = shell_out!("firewall-cmd --zone=#{zone} --list-protocols").stdout.strip.split(/\s+/) - rich_rules = shell_out!("firewall-cmd --zone=#{zone} --list-rich-rules").stdout.strip.split(/\n/) - return ports, protos, rich_rules - end - - def configure_firewalld_rules - if is_manager? - ports_home, protos_home, rich_rules_home = fetch_existing_rules('home') - apply_zone_rules(node['firewall']['roles']['manager']['home_zone'], 'home', ports_home, protos_home, rich_rules_home) - - ports_pub, protos_pub, rich_rules_pub = fetch_existing_rules('public') - apply_zone_rules(node['firewall']['roles']['manager']['public_zone'], 'public', ports_pub, protos_pub, rich_rules_pub) - end - if is_proxy? - ports_pub, protos_pub, rich_rules_pub = fetch_existing_rules('public') - apply_zone_rules(node['firewall']['roles']['proxy']['public_zone'], 'public', ports_pub, protos_pub, rich_rules_pub) - end - if is_ips? - ports_pub, protos_pub, rich_rules_pub = fetch_existing_rules('public') - apply_zone_rules(node['firewall']['roles']['ips']['public_zone'], 'public', ports_pub, protos_pub, rich_rules_pub) - end - end - - def apply_zone_rules(zone_rules, zone, existing_ports, existing_protocols, existing_rich_rules) - return if zone_rules.nil? - zone_rules['tcp_ports']&.each { |port| apply_rule(:port, port, zone, existing_ports, 'tcp') } - zone_rules['udp_ports']&.each { |port| apply_rule(:port, port, zone, existing_ports, 'udp') } - zone_rules['protocols']&.each { |protocol| apply_rule(:protocol, protocol, zone, existing_protocols) } - zone_rules['rich_rules']&.each { |rule| apply_rule(:rich_rule, rule, zone, existing_rich_rules) } - end - - def apply_rule(type, value, zone, existing_items, protocol = nil) - value = "#{value}/#{protocol || 'tcp'}" if type == :port - unless existing_items.include?(value) - case type - when :port - firewall_rule "Allow port #{value} in #{zone} zone" do - port value - protocol protocol - zone zone - action :create - permanent true - end - when :protocol - firewall_rule "Allow protocol #{value} in #{zone} zone" do - protocols value - zone zone - action :create - permanent true - end - when :rich_rule - firewall_rule "Adding rich rule #{value} in #{zone} zone" do - rules value - zone zone - action :create - permanent true - end + def apply_rule(type, value, zone, protocol = nil) + case type + when :port + firewall_rule "Allow port #{value}/#{protocol} in #{zone} zone" do + port value + protocol protocol + zone zone + action :create + permanent true + not_if "firewall-cmd --permanent --zone=#{zone} --query-port=#{value}/#{protocol}" end - end - end - - def manage_kafka_rule_for_ips(ip, rich_rules) - unless rich_rules.include?(ip) - firewall_rule "Open Kafka port 9092 for manager ips" do - rules "rule family='ipv4' source address=#{ip} port port=9092 protocol=tcp accept" - zone 'public' + when :protocol + firewall_rule "Allow protocol #{value} in #{zone} zone" do + protocols value + zone zone action :create permanent true + not_if "firewall-cmd --permanent --zone=#{zone} --query-protocol=#{value}" end - end - end - - def remove_kafka_rule_for_ips(ip, rich_rules) - if rich_rules.include?(ip) - firewall_rule "Remove Kafka port 9092 for manager IPs" do - rules "rule family='ipv4' source address=#{ip} port port=9092 protocol=tcp accept" - zone 'public' - action :delete + when :rich_rule + firewall_rule "Adding rich rule #{value} in #{zone} zone" do + rules value + zone zone + action :create permanent true + not_if "firewall-cmd --permanent --zone=#{zone} --query-rich-rule='#{value}'" end end end - def reload! - shell_out!('firewall-cmd --reload') - end - - def get_existing_ips_for_port(rich_rules) + def get_existing_ip_addresses_in_rules + rich_rules = shell_out!('firewall-cmd --zone=public --list-rich-rules').stdout existing_ips = [] rich_rules.split("\n").each do |rule| if rule.include?('port="9092"') @@ -131,7 +73,7 @@ def is_ips? node.role?('ips-sensor') || node.role?('ipscp-sensor') end - def get_ip_of_manager_ips + def get_ip_of_manager_ips_nodes sensors = search(:node, 'role:ips-sensor').sort sensors.map { |s| { ipaddress: s['ipaddress'] } } end diff --git a/resources/providers/config.rb b/resources/providers/config.rb index df6e182..8344817 100644 --- a/resources/providers/config.rb +++ b/resources/providers/config.rb @@ -6,11 +6,7 @@ action :add do sync_ip = new_resource.sync_ip ip_addr = new_resource.ip_addr - ip_address_ips = get_ip_of_manager_ips - - service 'firewalld' do - action [:enable, :start] - end + ip_address_ips_nodes = get_ip_of_manager_ips_nodes dnf_package 'firewalld' do action :upgrade @@ -23,57 +19,80 @@ notifies :restart, 'service[firewalld]', :delayed end + # Add sync interface and subnet to home zone if is_manager? sync_interface = interface_for_ip(sync_ip) sync_subnet = ip_to_subnet(sync_ip) - interfaces = shell_out!('firewall-cmd --zone=home --list-interfaces').stdout.strip.split - sources = shell_out!('firewall-cmd --zone=home --list-sources').stdout.strip.split - unless interfaces.include?(interface_for_ip(sync_ip)) - firewall_rule 'Add sync interface to home' do - interface sync_interface - zone 'home' - action :create - permanent true - end + firewall_rule 'Add sync interface to home' do + interface sync_interface + zone 'home' + action :create + permanent true + not_if "firewall-cmd --zone=home --query-interface=#{sync_interface}" end - unless sources.include?(ip_to_subnet(sync_ip)) - firewall_rule 'Add sync subnet to home' do - sources sync_subnet - zone 'home' - action :create - permanent true - end + firewall_rule 'Add sync subnet to home' do + sources sync_subnet + zone 'home' + action :create + permanent true + not_if "firewall-cmd --zone=home --query-source=#{sync_subnet}" end end - configure_firewalld_rules + # Applying firewall ports, protocols, and rich rules based on zones + roles = { + 'manager' => ['home', 'public'], + 'proxy' => ['public'], + 'ips' => ['public'] + } + roles.each do |role, zones| + next unless send("is_#{role}?") + zones.each do |zone| + zone_rules = node['firewall']['roles'][role][zone] + next if zone_rules.nil? + zone_rules['tcp_ports']&.each { |port| apply_rule(:port, port, zone, 'tcp') } + zone_rules['udp_ports']&.each { |port| apply_rule(:port, port, zone, 'udp') } + zone_rules['protocols']&.each { |protocol| apply_rule(:protocol, protocol, zone) } + zone_rules['rich_rules']&.each { |rule| apply_rule(:rich_rule, rule, zone) } + end + end + # Managing port 9092 on the manager only for that specific IPS if is_manager? && sync_ip != ip_addr - rich_rules = shell_out!('firewall-cmd --zone=public --list-rich-rules').stdout - existing_ips = get_existing_ips_for_port(rich_rules) - if ip_address_ips.empty? - existing_ips.each do |ip| - if rich_rules.match(/source address=\"#{ip}\".*port port=\"9092\".*protocol=\"tcp\"/) - manage_kafka_rule_for_ips(ip, rich_rules) - end - end - else - ips_to_remove = existing_ips - ip_address_ips.map { |ips| ips[:ipaddress] } + existing_addresses = get_existing_ip_addresses_in_rules + aux = ip_address_ips_nodes.empty? ? existing_addresses : ip_address_ips_nodes.map { |ips| ips[:ipaddress] } + + unless ip_address_ips_nodes.empty? + ips_to_remove = existing_addresses - aux ips_to_remove.each do |ip| - if rich_rules.match(/source address=\"#{ip}\".*port port=\"9092\".*protocol=\"tcp\"/) - remove_kafka_rule_for_ips(ip, rich_rules) + firewall_rule "Remove Kafka port 9092 for IP: #{ip}" do + rules "rule family='ipv4' source address=#{ip} port port=9092 protocol=tcp accept" + zone 'public' + action :delete + permanent true + only_if "firewall-cmd --permanent --zone=public --query-rich-rule='rule family=\"ipv4\" source address=\"#{ip}\" port port=\"9092\" protocol=\"tcp\" accept'" end end - ip_address_ips.each do |ip| - unless rich_rules.match(/source address=\"#{ip[:ipaddress]}\".*port port=\"9092\".*protocol=\"tcp\"/) - manage_kafka_rule_for_ips(ip[:ipaddress], rich_rules) - end + end + + aux.each do |ip| + firewall_rule "Open Kafka port 9092 for IP: #{ip}" do + rules "rule family='ipv4' source address=#{ip} port port=9092 protocol=tcp accept" + zone 'public' + action :create + permanent true + not_if "firewall-cmd --permanent --zone=public --query-rich-rule='rule family=\"ipv4\" source address=\"#{ip}\" port port=\"9092\" protocol=\"tcp\" accept'" end end end - reload! + + service 'firewalld' do + service_name 'firewalld' + supports status: true, reload: true, restart: true, start: true, enable: true + action [:enable, :start, :reload] + end Chef::Log.info('Firewall configuration has been applied.') end