From: Tom Hughes <tom@compton.nu>
Date: Sat, 4 Mar 2023 12:03:53 +0000 (+0000)
Subject: Fix port range syntax for nftables
X-Git-Url: https://git.openstreetmap.org./chef.git/commitdiff_plain/9bb700cfe792fea35319206696cf4764a19c8f5a

Fix port range syntax for nftables
---

diff --git a/cookbooks/networking/resources/firewall_rule.rb b/cookbooks/networking/resources/firewall_rule.rb
index e72a3df78..0eca03176 100644
--- a/cookbooks/networking/resources/firewall_rule.rb
+++ b/cookbooks/networking/resources/firewall_rule.rb
@@ -106,11 +106,11 @@ action_class do
             end
 
     if new_resource.source_ports != "-"
-      rule << "#{proto} sport { #{new_resource.source_ports} }"
+      rule << "#{proto} sport { #{nftables_source_ports} }"
     end
 
     if new_resource.dest_ports != "-"
-      rule << "#{proto} dport { #{new_resource.dest_ports} }"
+      rule << "#{proto} dport { #{nftables_dest_ports} }"
     end
 
     if new_resource.source == "osm"
@@ -159,4 +159,12 @@ action_class do
       node.default[:networking][:firewall][:incoming] << rule.join(" ")
     end
   end
+
+  def nftables_source_ports
+    new_resource.source_ports.to_s.sub(/:$/, "-65535").gsub(":", "-")
+  end
+
+  def nftables_dest_ports
+    new_resource.dest_ports.to_s.sub(/:$/, "-65535").gsub(":", "-")
+  end
 end