From 61ea9e7318289547ddcd09503ef9fc11aca8546e Mon Sep 17 00:00:00 2001 From: Lukas Audzevicius Date: Thu, 3 Nov 2022 12:14:51 +0000 Subject: [PATCH] (CONT-256) Removing outdated code Prior to this commit, the firewall modules had multiple instances of outdated code. This commit aims to clean-up some of that code to keep the module clean and readable. --- lib/facter/iptables_persistent_version.rb | 10 +----- lib/puppet/type/firewall.rb | 9 ++--- manifests/linux/debian.pp | 43 ++++++----------------- manifests/linux/redhat.pp | 20 ++--------- manifests/params.pp | 3 -- 5 files changed, 16 insertions(+), 69 deletions(-) diff --git a/lib/facter/iptables_persistent_version.rb b/lib/facter/iptables_persistent_version.rb index fc0d420..5f3598c 100644 --- a/lib/facter/iptables_persistent_version.rb +++ b/lib/facter/iptables_persistent_version.rb @@ -5,15 +5,7 @@ Facter.add(:iptables_persistent_version) do setcode do # Throw away STDERR because dpkg >= 1.16.7 will make some noise if the # package isn't currently installed. - os = Facter.value(:operatingsystem) - os_release = Facter.value(:operatingsystemrelease) - cmd = if (os == 'Debian' && (Puppet::Util::Package.versioncmp(os_release, '8.0') >= 0)) || - (os == 'Ubuntu' && (Puppet::Util::Package.versioncmp(os_release, '14.10') >= 0)) || - (os == 'Debian' && (Puppet::Util::Package.versioncmp(os_release, 'unstable') >= 0)) - "dpkg-query -Wf '${Version}' netfilter-persistent 2>/dev/null" - else - "dpkg-query -Wf '${Version}' iptables-persistent 2>/dev/null" - end + cmd = "dpkg-query -Wf '${Version}' netfilter-persistent 2>/dev/null" version = Facter::Core::Execution.execute(cmd) if version.nil? || !version.match(%r{\d+\.\d+}) diff --git a/lib/puppet/type/firewall.rb b/lib/puppet/type/firewall.rb index d19c3d4..d79066d 100644 --- a/lib/puppet/type/firewall.rb +++ b/lib/puppet/type/firewall.rb @@ -2342,12 +2342,9 @@ Puppet::Type.newtype(:firewall) do end end - # autobefore is only provided since puppet 4.0 - if Puppet::Util::Package.versioncmp(Puppet.version, '4.0') >= 0 - # On RHEL 7 this needs to be threaded correctly to manage SE Linux permissions after persisting the rules - autobefore(:file) do - ['/etc/sysconfig/iptables', '/etc/sysconfig/ip6tables'] - end + # On RHEL 7 this needs to be threaded correctly to manage SE Linux permissions after persisting the rules + autobefore(:file) do + ['/etc/sysconfig/iptables', '/etc/sysconfig/ip6tables'] end validate do diff --git a/manifests/linux/debian.pp b/manifests/linux/debian.pp index f6bf76d..07f1c43 100644 --- a/manifests/linux/debian.pp +++ b/manifests/linux/debian.pp @@ -25,39 +25,16 @@ class firewall::linux::debian ( $package_name = $firewall::params::package_name, $package_ensure = $firewall::params::package_ensure, ) inherits ::firewall::params { - if $package_name { - #Fixes hang while installing iptables-persistent on debian 8 - exec { 'iptables-persistent-debconf': - command => "/bin/echo \"${package_name} ${package_name}/autosave_v4 boolean false\" | - /usr/bin/debconf-set-selections && /bin/echo \"${package_name} ${package_name}/autosave_v6 boolean false\" | - /usr/bin/debconf-set-selections", + ensure_packages([$package_name], { + ensure => $package_ensure + }) - refreshonly => true, - } - ensure_packages([$package_name], { - ensure => $package_ensure, - require => Exec['iptables-persistent-debconf'] - }) - } - - if($::operatingsystemrelease =~ /^6\./ and $enable == true and $::iptables_persistent_version - and versioncmp($::iptables_persistent_version, '0.5.0') < 0) { - # This fixes a bug in the iptables-persistent LSB headers in 6.x, without it - # we lose idempotency - exec { 'iptables-persistent-enable': - logoutput => on_failure, - command => '/usr/sbin/update-rc.d iptables-persistent enable', - unless => '/usr/bin/test -f /etc/rcS.d/S*iptables-persistent', - require => Package[$package_name], - } - } else { - # This isn't a real service/daemon. The start action loads rules, so just - # needs to be called on system boot. - service { $service_name: - ensure => undef, - enable => $enable, - hasstatus => true, - require => Package[$package_name], - } + # This isn't a real service/daemon. The start action loads rules, so just + # needs to be called on system boot. + service { $service_name: + ensure => undef, + enable => $enable, + hasstatus => true, + require => Package[$package_name], } } diff --git a/manifests/linux/redhat.pp b/manifests/linux/redhat.pp index 36c455e..902dd99 100644 --- a/manifests/linux/redhat.pp +++ b/manifests/linux/redhat.pp @@ -49,9 +49,7 @@ class firewall::linux::redhat ( # RHEL 7 / CentOS 7 and later and Fedora 15 and later require the iptables-services # package, which provides the /usr/libexec/iptables/iptables.init used by # lib/puppet/util/firewall.rb. - if ($::operatingsystem != 'Amazon') - and (($::operatingsystem != 'Fedora' and versioncmp($::operatingsystemrelease, '7.0') >= 0) - or ($::operatingsystem == 'Fedora' and versioncmp($::operatingsystemrelease, '15') >= 0)) { + if ($::operatingsystem != 'Amazon') { if $firewalld_manage { service { 'firewalld': ensure => stopped, @@ -74,9 +72,7 @@ class firewall::linux::redhat ( ) } - if ($::operatingsystem != 'Amazon') - and (($::operatingsystem != 'Fedora' and versioncmp($::operatingsystemrelease, '7.0') >= 0) - or ($::operatingsystem == 'Fedora' and versioncmp($::operatingsystemrelease, '15') >= 0)) { + if ($::operatingsystem != 'Amazon') { if $ensure == 'running' { exec { '/usr/bin/systemctl daemon-reload': require => Package[$package_name], @@ -134,13 +130,6 @@ class firewall::linux::redhat ( } } - # Before puppet 4, the autobefore on the firewall type does not work - therefore - # we need to keep this workaround here - if versioncmp($::puppetversion, '4.0') <= 0 { - File<| title == "/etc/sysconfig/${service_name}" |> -> Service<| title == $service_name |> - File<| title == "/etc/sysconfig/${service_name_v6}" |> -> Service<| title == $service_name_v6 |> - } - # Redhat 7 selinux user context for /etc/sysconfig/iptables is set to system_u # Redhat 7 selinux type context for /etc/sysconfig/iptables is set to system_conf_t case $::selinux { @@ -149,11 +138,6 @@ class firewall::linux::redhat ( case $::operatingsystem { 'CentOS': { case $::operatingsystemrelease { - /^5\..*/: { - $seluser = 'system_u' - $seltype = 'etc_t' - } - /^6\..*/: { $seluser = 'unconfined_u' $seltype = 'system_conf_t' diff --git a/manifests/params.pp b/manifests/params.pp index a0cb426..bbd0a56 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -21,9 +21,6 @@ class firewall::params { if versioncmp($::operatingsystemrelease, '34') >= 0 { $package_name = 'iptables-services' $iptables_name = 'iptables-compat' - } elsif versioncmp($::operatingsystemrelease, '15') >= 0 { - $package_name = 'iptables-services' - $iptables_name = 'iptables' } else { $iptables_name = 'iptables' $package_name = undef -- 2.45.2