sous-chefs / firewall

Development repository for the firewall cookbook
https://supermarket.chef.io/cookbooks/firewall
Apache License 2.0
99 stars 150 forks source link

Incorrect file checking #170

Closed tyuio9 closed 7 years ago

tyuio9 commented 7 years ago

Description

On the Ubuntu when ubuntu_iptables is being enabled, firewall rules get created twice. First, it creates a file with default rules, it restarts the firewall and then it creates a file with rules defined with firewall_rule resource. This actually, causes a security bug, I guess. The firewall gets opened for the short amount of time (this time varies on the chef run) but when allow_established (the default is true) is being employed it makes a possibility to create a connection behind the firewall and this connection won't be killed when proper rules are in place.

Check List

martinb3 commented 7 years ago

I've adjusted this slightly in 42b6b415c3fb78b7737ad9746fe56acd7be5a724 to remove the version bump, and created #173.