chef-boneyard / windows_firewall

Chef cookbook to configure Windows Firewall
Apache License 2.0
6 stars 9 forks source link

netsh advfirewall errors when you use the :deny firewall_action #16

Closed tpetchel closed 9 years ago

tpetchel commented 9 years ago

I submitted #15 because I noticed that the README appeared incorrect - firewall_action must now be :allow or :deny.

But when I use :deny, I get an error that I didn't specify allow|block|bypass as the action.

================================================================================
           Error executing action `run` on resource 'batch[netsh advfirewall firewall add rule name="Disable WinRM over HTTP" description="Firewall rule" localport=5985 dir=in protocol=tcp action=deny profile=any interfacetype=any ]'
           ================================================================================

           Mixlib::ShellOut::ShellCommandFailed
           ------------------------------------
           Expected process to exit with [0], but received '1'
           ---- Begin output of "cmd.exe" /c "C:/Users/vagrant/AppData/Local/Temp/chef-script20150730-92-msald.bat" ----
           STDOUT: C:\>netsh advfirewall firewall add rule name="Disable WinRM over HTTP" description="Firewall rule" localport=5985 dir=in protocol=tcp action=deny profile=any interfacetype=any

           A specified value is not valid.

           Usage: add rule name=<string>
          dir=in|out
          action=allow|block|bypass

Which makes sense because firewall_action gets passed through directly as the action parameter to the underlying netsh advfirewall command:

https://github.com/lynx44/windows_firewall/blob/master/providers/rule.rb#L19

Is there a bug in this cookbook, or am I doing something wrong? My resource looks like this:

windows_firewall_rule 'Disable WinRM over HTTP' do
  localport '5985'
  protocol 'tcp'
  firewall_action :deny
end
mattstratton commented 9 years ago

Looks like a bug in the cookbook. The action on the rule shouldn't be "deny", it should be "block". Should be an easy fix and I'll try to get it in shortly.