search

chr4-cookbooks / iptables-ng

Cookbook to maintain iptables rules and policies on different platforms, respecting the way the os handles these settings.
GNU General Public License v3.0
38 stars 33 forks source link

Does not remove old rules #10

Closed phessler closed 10 years ago

phessler commented 10 years ago

Version 2.0.0, downloaded from the Chef Cookbook site.

I made a change to a rule name, and the previous rule still existed.

From:

iptables_ng_rule 'http' do
  rule '--protocol tcp --dport 80 --match state --state NEW --jump ACCEPT'
end

To:

iptables_ng_rule '90-http' do
  rule '--protocol tcp --dport 80 --match state --state NEW --jump ACCEPT'
end

I now have two copies of allowing port 80.

Additionally, when I remove a rule, it is not deleted from the ruleset.

phessler commented 10 years ago

Needless to say, this is a rather critical bug for us.

chr4 commented 10 years ago

Hi,

this is not a bug. The typical behaviour of chef resources is that they are not deleted when the code is removed. The proper way to deal with your problem is to add the following to your recipe (the same as with other resources, like file, template, user etc):

iptables_ng_rule 'http' do
  action :delete
end

Let me know if this works for you.

chr4 commented 10 years ago

Additionally, when I remove a rule, it is not deleted from the ruleset.

I'm sorry, I dont' quite understand what you mean with this. Can you explain this in some more detail?

phessler commented 10 years ago

Huh. That is a surprising behaviour of Chef for me. Ok, thanks.

phessler commented 10 years ago

I removed the LWRP entry from my rule, and it stayed on the test system.

That makes sense now.

phessler commented 10 years ago

Ok, please close this with NOTABUG, and SUBMITTERISADUMBASS ;).

chr4 commented 10 years ago

No worries :) Thanks for using my cookbook!