(CAT-376) Rework firewall module to use the resource_api #1145
Conversation
david22swan
changed the title
david22swan
changed the title
There was a problem hiding this comment.
After the struggle I went through to get #1126 and #1127 in working order, there are large parts of this file that read like a bandaid being torn off. It might not be fun to re-work my PR to fit this framework, but I'm betting it'll be so much easier than writing the original draft was. Reading through this version is so much more satisfying!
One question, though - if the output of ip[6]tables-save is just the arguments one should append to iptables -t <blah> to regenerate the same rule again, would it have been simpler to use optparse to recover the sense from the rules' arguments?
There was a problem hiding this comment.
Thanks for the positive response :)
In regards to the use of optparse, I had not encountered it before and so didn't consider it as an option.
It may be a little late for me to be rewriting the code, I am scheduled to move onto other work, however I will make sure to ticket it up as an improvement so if I do not get time to implement it myself, it will exist as a goal for the future.
david22swan
changed the title
|
LGTM, can we get review from more experts? |
|
@bastelfreak Could you take a look at this? |
|
CentOS 8 failures have appeared on nightly, |
Remove all old code from the module
- support for IPv4 (CAT-683) - support for IPv6 (CAT-961)
- support for IPv4 (CAT-684) - support for IPv6 (CAT-961) - support for all attributes (CAT-960)
Update acceptance testing to account for changes. Includes: - standard_usage_spec.rb - rules_spec.rb - resource_cmd_spec.rb - firewallchain_spec.rb - firewall_duplicate_comment_spec.rb
Update acceptance testing to account for changes. Includes: - class_spec.rb - firewall_attributes_exceptions_spec.rb - firewall_attributes_happy_path_spec.rb - firewall_attributes_ipv6_exceptions_spec.rb - firewall_attributes_ipv6_happy_path_spec.rb
Unit test coverage for utility functions found within the puppet_x namespace
Test coverage for the firewall and firewallchain Types
Test separated out into three files due to the size and complexity of the provider.
Actionable errors left in file will be handled by a follow-up PR
david22swan
changed the title
|
The action parameter going ? Is that necessary ? If it could live till EOL for EL7? |
|
@traylenator The functionality behind the attribute is still there, it just means renaming the attribute your setting to jump instead. As a side, any reason for E7 in particular? |
Thanks for the reply - will live with the status quo till we launch EL7 into oblivion (and drop this module). |
Add Requires on puppet-resource_api It's needed since the merge of [1] [1] puppetlabs/puppetlabs-firewall#1145 (cherry picked from commit 0b245d6) Change-Id: Id033e1418a4696726382b4ceeb684ae0afa3d253
It's needed since the merge of [1] [1] puppetlabs/puppetlabs-firewall#1145 Change-Id: If156134ecf968b98578a57dbe14030a1a8c93174
7 participants
Summary
This PR has been created to update the Firewall module to utilize the resource_api, with the intention being to increase the ease with which the module can be updated and managed in the future.
As part of this several backwards incompatible changes where made, including:
providerattribute with the Firewall type has been renamedprotocol, due to both the resource_api forbidding the use of this as an attribute name and to bring it in line with the Firewallchain. Though it continues to accept bothiptablesandip6tablesalongsideIPv4andIPv6, this may change in the future.actionattribute has been removed as it managed the same function as thejumpattribute, only on a more limited scale. Though this was given a reason, to enforce the use of generic parameters, I found this to be a needlessly complex addition to the code.portattribute has been removed as it was deprecated several years ago.dport/sportranges should be passed with:as a separator as this is the valid form of input for the flag. Code has been updated to allow the original separator-, though it is not preferred.sport/dport, that require negation to be universal among all passed values have been updated so that rather than negating each and every value passed you now simply negate the first value in the array in order to negate them all, although the original form of negating each and every value is still allowed. Certain array values such assrc_type/dst_typediffer however and necessitate that each value be negated, or not negated as it were, separately.**NOTES:
puppet-resource_apifunctionality to be merged and released: (CAT-761) Add custom_generate as a feature puppet-resource_api#316 -->puppet-resource_apichange has been merged and released (v1.9.0), waiting on update topuppet-agentto include this new version so that I can turn on the automated tests (CAT-761) Update puppet-resource_api version puppet-agent#2383 --> PR has been merged and will be included in7.26.0and8.2.0--> tests enabledChecklist
puppet apply)