2 # Cookbook:: networking
3 # Resource:: firewall_rule
5 # Copyright:: 2020, OpenStreetMap Foundation
7 # Licensed under the Apache License, Version 2.0 (the "License");
8 # you may not use this file except in compliance with the License.
9 # You may obtain a copy of the License at
11 # https://www.apache.org/licenses/LICENSE-2.0
13 # Unless required by applicable law or agreed to in writing, software
14 # distributed under the License is distributed on an "AS IS" BASIS,
15 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 # See the License for the specific language governing permissions and
17 # limitations under the License.
20 resource_name :firewall_rule
21 provides :firewall_rule
23 default_action :nothing
25 property :rule, :kind_of => String, :name_property => true
26 property :family, :kind_of => [String, Symbol]
27 property :source, :kind_of => String, :required => true
28 property :dest, :kind_of => String, :required => true
29 property :proto, :kind_of => String, :required => true
30 property :dest_ports, :kind_of => [String, Integer], :default => "-"
31 property :source_ports, :kind_of => [String, Integer], :default => "-"
32 property :rate_limit, :kind_of => String, :default => "-"
33 property :connection_limit, :kind_of => [String, Integer], :default => "-"
34 property :helper, :kind_of => String, :default => "-"
36 property :compile_time, TrueClass, :default => true
53 :action => action.to_s.upcase,
54 :source => new_resource.source,
55 :dest => new_resource.dest,
56 :proto => new_resource.proto,
57 :dest_ports => new_resource.dest_ports.to_s,
58 :source_ports => new_resource.source_ports.to_s,
59 :rate_limit => new_resource.rate_limit,
60 :connection_limit => new_resource.connection_limit.to_s,
61 :helper => new_resource.helper
64 if new_resource.family.nil?
65 node.default[:networking][:firewall][:inet] << rule
66 node.default[:networking][:firewall][:inet6] << rule
67 elsif new_resource.family.to_s == "inet"
68 node.default[:networking][:firewall][:inet] << rule
69 elsif new_resource.family.to_s == "inet6"
70 node.default[:networking][:firewall][:inet6] << rule
72 log "Unsupported network family" do