sjsadowski / firewalld-cookbook Goto Github PK

firewalld_rich_rule 'ssh' do
  zone 'public'
  family 'ipv4'
  source_address '10.0.0.0/16'
  service_name 'ssh'
  firewall_action "accept"
  action :add
end

STDERR: Error: INVALID_RULE: more than one element. There cannot be both 'protocol' and 'service name="ssh"' in one rule.
Error: INVALID_RULE: more than one element. There cannot be both 'protocol' and 'service name="ssh"' in one rule.
---- End output of     firewall-cmd --zone=public --add-rich-rule="rule family='ipv4' source address='10.0.0.0/16' service name='ssh' protocol value='tcp' accept"
    firewall-cmd --permanent --zone=public --add-rich-rule="rule family='ipv4' source address='10.0.0.0/16' service name='ssh' protocol value='tcp' accept"

[root@ip-10-42-110-240 centos]# firewall-cmd --permanent  --query-service=http
no
[root@ip-10-42-110-240 centos]# firewall-cmd --permanent  --add-service=http
success
[root@ip-10-42-110-240 centos]# firewall-cmd --permanent  --query-service=http
yes

[2015-04-03T17:36:58+00:00] INFO: Processing package[firewalld] action install (firewalld::default line 7)
[2015-04-03T17:36:59+00:00] INFO: package[firewalld] installing firewalld-0.3.9-11.el7 from base repository
[2015-04-03T17:37:16+00:00] INFO: Processing service[firewalld] action enable (firewalld::default line 9)
[2015-04-03T17:37:16+00:00] INFO: Processing service[firewalld] action start (firewalld::default line 9)
[2015-04-03T17:37:16+00:00] INFO: service[firewalld] started
[2015-04-03T17:37:16+00:00] INFO: Processing firewalld_port[8000/tcp] action add (app-ca-ppp::app line 12)
**[2015-04-03T17:37:16+00:00] INFO: Processing execute[add port 8000/tcp to zone] action run (/var/chef/cache/cookbooks/firewalld/providers/port.rb line 8)**
�[0m
================================================================================�[0m
�[31mError executing action `run` on resource 'execute[add port 8000/tcp to zone]'�[0m
================================================================================�[0m

�[0mMixlib::ShellOut::CommandTimeout�[0m
--------------------------------�[0m
Command timed out after 600s:
�[0mCommand exceeded allowed execution time, process terminated
�[0m---- Begin output of firewall-cmd --permanent  --query-port=8000/tcp ----
�[0mSTDOUT: 
�[0mSTDERR: ERROR:dbus.proxies:Introspect error on :1.7:/org/fedoraproject/FirewallD1: dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
�[0m---- End output of firewall-cmd --permanent  --query-port=8000/tcp ----
�[0mRan firewall-cmd --permanent  --query-port=8000/tcp returned �[0m

�[0mResource Declaration:�[0m
---------------------�[0m
# In /var/chef/cache/cookbooks/firewalld/providers/port.rb
�[0m
�[0m  8:   e = execute "add port #{new_resource.port} to zone" do
�[0m  9:     not_if "firewall-cmd --permanent #{zone} --query-port=#{new_resource.port}"
�[0m 10:     command(<<-EOC)
�[0m 11:       firewall-cmd #{zone} --add-port=#{new_resource.port}
�[0m 12:       firewall-cmd --permanent #{zone} --add-port=#{new_resource.port}
�[0m 13:     EOC
�[0m 14:   end
�[0m 15:   new_resource.updated_by_last_action(e.updated_by_last_action?)
�[0m
�[0mCompiled Resource:�[0m
------------------�[0m
# Declared in /var/chef/cache/cookbooks/firewalld/providers/port.rb:8:in `block in class_from_file'
�[0m
�[0mexecute("add port 8000/tcp to zone") do
�[0m  action "run"
�[0m  retries 0
�[0m  retry_delay 2
�[0m  guard_interpreter :default
�[0m  command "      firewall-cmd  --add-port=8000/tcp\n      firewall-cmd --permanent  --add-port=8000/tcp\n"
�[0m  backup 5
�[0m  returns 0
�[0m  cookbook_name "app-ca-ppp"
�[0m  not_if "firewall-cmd --permanent  --query-port=8000/tcp"
�[0mend
�[0m
�[0m[2015-04-03T17:47:27+00:00] INFO: Running queued delayed notifications before re-raising exception

%w(all_established all_icmp prefix postfix).each do |rule|
    iptables_rule "#{rule}" do
        action :enable
    end
end

type=USER_AVC msg=audit(1439827431.885:704): pid=563 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.14 spid=553 tpid=3047 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:system_r:cloud_init_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'

module firewalld-dbus 1.0;

require {
  type firewalld_var_run_t;
  type cloud_init_t;
  type firewalld_t;
  type root_t;
  class dbus send_msg;
}

allow firewalld_t cloud_init_t:dbus send_msg;

           ================================================================================
           Error executing action `add` on resource 'firewalld_forward[514_to_5514]'
           ================================================================================

           Mixlib::ShellOut::ShellCommandFailed
           ------------------------------------
           execute[add forward port 514:udp => 5514 ] (/tmp/kitchen/cache/cookbooks/firewalld/providers/forward.rb line 10) had an error: Mixlib::ShellOut::ShellCommandFailed: Expected process to exit with [0], but received '106'
           ---- Begin output of         firewall-cmd --zone=public --add-forward-port=port=514:proto=udp:toport=5514"
            firewall-cmd --permanent --zone=public --add-forward-port=port=514:proto=udp:toport=5514"
            ----
           STDOUT:
           STDERR: Error: INVALID_FORWARD: invalid forward port arg 'toport=5514
            firewall-cmd --permanent --zone=public --add-forward-port=port=514'
           ---- End output of         firewall-cmd --zone=public --add-forward-port=port=514:proto=udp:toport=5514"
            firewall-cmd --permanent --zone=public --add-forward-port=port=514:proto=udp:toport=5514"
            ----
           Ran         firewall-cmd --zone=public --add-forward-port=port=514:proto=udp:toport=5514"
            firewall-cmd --permanent --zone=public --add-forward-port=port=514:proto=udp:toport=5514"
            returned 106

           Resource Declaration:
           ---------------------
           # In /tmp/kitchen/cache/cookbooks/logstash/recipes/default.rb

            20: firewalld_forward '514_to_5514' do
            21:   port 514
            22:   to_port 5514
            23:   protocol :udp
            24:   zone 'public'
            25: end

           Compiled Resource:
           ------------------
           # Declared in /tmp/kitchen/cache/cookbooks/logstash/recipes/default.rb:20:in `from_file'

           firewalld_forward("514_to_5514") do
             action [:add]
             retries 0
             retry_delay 2
             default_guard_interpreter :default
             declared_type :firewalld_forward
             cookbook_name "logstash"
             recipe_name "default"
             port 514
             to_port 5514
             protocol :udp
             zone "public"
           end

================================================================================
Recipe Compile Error in /var/chef/cache/cookbooks/firewalld/providers/rich_rule.rb
================================================================================

SyntaxError
-----------
/var/chef/cache/cookbooks/firewalld/providers/rich_rule.rb:42: syntax error, unexpected tIDENTIFIER, expecting '('
...rt_protocol && not new_resource.port_number
...                               ^

System Info:
------------
chef_version=12.22.5
platform=oracle
platform_version=7.7
ruby=ruby 2.3.6p384 (2017-12-14 revision 61254) [x86_64-linux]
program_name=chef-client worker: ppid=24379;start=17:26:04;
executable=/opt/chef/bin/chef-client