(CAT-376) Rework firewall module to use the resource_api #1145

david22swan · 2023-07-18T15:52:32Z

Summary

This PR has been created to update the Firewall module to utilize the resource_api, with the intention being to increase the ease with which the module can be updated and managed in the future.
As part of this several backwards incompatible changes where made, including:

The provider attribute with the Firewall type has been renamed protocol, due to both the resource_api forbidding the use of this as an attribute name and to bring it in line with the Firewallchain. Though it continues to accept both iptables and ip6tables alongside IPv4 and IPv6, this may change in the future.
The action attribute has been removed as it managed the same function as the jump attribute, only on a more limited scale. Though this was given a reason, to enforce the use of generic parameters, I found this to be a needlessly complex addition to the code.
Strict types have been declared for all attributes.
The port attribute has been removed as it was deprecated several years ago.
dport/sport ranges should be passed with : as a separator as this is the valid form of input for the flag. Code has been updated to allow the original separator -, though it is not preferred.
Array attributes, such as sport/dport, that require negation to be universal among all passed values have been updated so that rather than negating each and every value passed you now simply negate the first value in the array in order to negate them all, although the original form of negating each and every value is still allowed. Certain array values such as src_type/dst_type differ however and necessitate that each value be negated, or not negated as it were, separately.

**NOTES:

firewallchain purge tests disabled, waiting on puppet-resource_api functionality to be merged and released: (CAT-761) Add custom_generate as a feature puppet-resource_api#316 --> puppet-resource_api change has been merged and released (v1.9.0), waiting on update to puppet-agent to include this new version so that I can turn on the automated tests (CAT-761) Update puppet-resource_api version puppet-agent#2383 --> PR has been merged and will be included in 7.26.0 and 8.2.0 --> tests enabled
Unable to use the Stdlib IP types for most address style input as they include extra features such as ranges and negation.

Checklist

🟢 Spec tests.
🟢 Acceptance tests.
Manually verified. (For example puppet apply)

david22swan · 2023-08-29T12:58:38Z

CentOS 8 failures have appeared on nightly,
cause found and accounted for

Remove all old code from the module

- support for IPv4 (CAT-683) - support for IPv6 (CAT-961)

- support for IPv4 (CAT-684) - support for IPv6 (CAT-961) - support for all attributes (CAT-960)

Update acceptance testing to account for changes. Includes: - standard_usage_spec.rb - rules_spec.rb - resource_cmd_spec.rb - firewallchain_spec.rb - firewall_duplicate_comment_spec.rb

Update acceptance testing to account for changes. Includes: - class_spec.rb - firewall_attributes_exceptions_spec.rb - firewall_attributes_happy_path_spec.rb - firewall_attributes_ipv6_exceptions_spec.rb - firewall_attributes_ipv6_happy_path_spec.rb

Unit test coverage for utility functions found within the puppet_x namespace

Test coverage for the firewall and firewallchain Types

Test separated out into three files due to the size and complexity of the provider.

Actionable errors left in file will be handled by a follow-up PR

README.md

bastelfreak

I'm not a resource_api expert, but the changes look good to me.

LukasAud

LGTM 👍

Dont forget to remove the Do Not Merge

traylenator · 2023-08-30T14:47:30Z

The action parameter going ? Is that necessary ?

If it could live till EOL for EL7?

david22swan · 2023-08-30T14:53:03Z

@traylenator The functionality behind the attribute is still there, it just means renaming the attribute your setting to jump instead.
I felt it was wasteful to have two attributes for the same iptables value.
It may be inconvenient in the short term but in the long term it helps to simplify the code.

As a side, any reason for E7 in particular?

traylenator · 2023-08-30T14:55:56Z

@traylenator The functionality behind the attribute is still there, it just means renaming the attribute your setting to jump instead. I felt it was wasteful to have two attributes for the same iptables value. It may be inconvenient in the short term but in the long term it helps to simplify the code.

Thanks for the reply - will live with the status quo till we launch EL7 into oblivion (and drop this module).

Add Requires on puppet-resource_api It's needed since the merge of [1] [1] puppetlabs/puppetlabs-firewall#1145 (cherry picked from commit 0b245d6) Change-Id: Id033e1418a4696726382b4ceeb684ae0afa3d253

It's needed since the merge of [1] [1] puppetlabs/puppetlabs-firewall#1145 Change-Id: If156134ecf968b98578a57dbe14030a1a8c93174

david22swan added the backwards-incompatible label Jul 18, 2023

david22swan requested a review from a team as a code owner July 18, 2023 15:52

david22swan force-pushed the CONT-376/Firewall_rework branch 2 times, most recently from e7731c0 to e067e01 Compare July 18, 2023 16:07

david22swan changed the title ~~(CONT-376) Rework firewall module to use the resource_api~~ (WIP)(CONT-376) Rework firewall module to use the resource_api Jul 18, 2023

david22swan mentioned this pull request Jul 18, 2023

Re-Architect Firewall #1100

Closed

david22swan force-pushed the CONT-376/Firewall_rework branch 13 times, most recently from 4143d8d to ccd6486 Compare July 25, 2023 15:52

david22swan force-pushed the CONT-376/Firewall_rework branch from ccd6486 to cff3a04 Compare July 26, 2023 13:31

david22swan changed the title ~~(WIP)(CONT-376) Rework firewall module to use the resource_api~~ (WIP)(CAT-376) Rework firewall module to use the resource_api Jul 26, 2023

david22swan force-pushed the CONT-376/Firewall_rework branch 9 times, most recently from a8affb5 to 91b2ee4 Compare August 1, 2023 08:42

david22swan added 14 commits August 29, 2023 15:57

(CAT-376) Fully Remove Old Code

e863171

Remove all old code from the module

(CAT-376) Move utility files into puppet_x

4a8d21d

(CAT-683) firewallchain type and provider

269a91b

- support for IPv4 (CAT-683) - support for IPv6 (CAT-961)

(CAT-684) firewall type and provider

4cf9ca9

- support for IPv4 (CAT-684) - support for IPv6 (CAT-961) - support for all attributes (CAT-960)

(CAT-685) firewallchain purge functionality

bb59d6e

(CAT-378) README.md and REFERENCE.md updates

8ea5f45

(BUGFIX) Fix for RedHat

1091d34

(CAT-962) Reinitialize and update acceptance tests - P1

72c4ada

Update acceptance testing to account for changes. Includes: - standard_usage_spec.rb - rules_spec.rb - resource_cmd_spec.rb - firewallchain_spec.rb - firewall_duplicate_comment_spec.rb

(CAT-1258) puppet_x unit tests

ca232bf

Unit test coverage for utility functions found within the puppet_x namespace

(CAT1259) firewall/firewallchain Type unit tests

3f70d07

Test coverage for the firewall and firewallchain Types

(CAT-1260) firewallchain Provider unit tests

4df8f9b

(CAT1318) firewall Provider unit tests

3cefaa4

Test separated out into three files due to the size and complexity of the provider.

(RUBOCOP) Update rubocop_todo

4a72aab

Actionable errors left in file will be handled by a follow-up PR

david22swan force-pushed the CONT-376/Firewall_rework branch from 77b5dd6 to 4a72aab Compare August 29, 2023 15:26

bastelfreak reviewed Aug 30, 2023

View reviewed changes

README.md Outdated Show resolved Hide resolved

bastelfreak reviewed Aug 30, 2023

View reviewed changes

README.md Outdated Show resolved Hide resolved

(CAT-378) README.md / REFERENCE.md fixes

47564d3

bastelfreak approved these changes Aug 30, 2023

View reviewed changes

LukasAud approved these changes Aug 30, 2023

View reviewed changes

LukasAud merged commit cc46895 into puppetlabs:main Aug 30, 2023

david22swan changed the title ~~(DO NOT MERGE)(CAT-376) Rework firewall module to use the resource_api~~ (CAT-376) Rework firewall module to use the resource_api Aug 30, 2023

david22swan deleted the CONT-376/Firewall_rework branch September 13, 2023 15:23

rdoproject pushed a commit to rdo-packages/puppet-firewall-distgit that referenced this pull request Oct 18, 2023

Add Requires on puppet-resource_api

0b245d6

It's needed since the merge of [1] [1] puppetlabs/puppetlabs-firewall#1145 Change-Id: If156134ecf968b98578a57dbe14030a1a8c93174

robertc99 mentioned this pull request Nov 9, 2023

Firewall 7.0.3: parameter issue alex-harvey-z3q/puppet-firewall_multi#44

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

(CAT-376) Rework firewall module to use the resource_api #1145

(CAT-376) Rework firewall module to use the resource_api #1145

david22swan commented Jul 18, 2023 •

edited

Loading

david22swan commented Aug 29, 2023 •

edited

Loading

bastelfreak left a comment

LukasAud left a comment

traylenator commented Aug 30, 2023

david22swan commented Aug 30, 2023 •

edited

Loading

traylenator commented Aug 30, 2023 •

edited

Loading

(CAT-376) Rework firewall module to use the resource_api #1145

(CAT-376) Rework firewall module to use the resource_api #1145

Conversation

david22swan commented Jul 18, 2023 • edited Loading

Summary

Checklist

david22swan commented Aug 29, 2023 • edited Loading

bastelfreak left a comment

Choose a reason for hiding this comment

LukasAud left a comment

Choose a reason for hiding this comment

traylenator commented Aug 30, 2023

david22swan commented Aug 30, 2023 • edited Loading

traylenator commented Aug 30, 2023 • edited Loading

david22swan commented Jul 18, 2023 •

edited

Loading

david22swan commented Aug 29, 2023 •

edited

Loading

david22swan commented Aug 30, 2023 •

edited

Loading

traylenator commented Aug 30, 2023 •

edited

Loading