saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Normalize new rich rules before comparing to old

Browse source 
Firewallcmd rich rule output quotes each
assigned part of the rich rule, for example:
rule family="ipv4" source port port="161" ...
The firewalld module must first normalize
the user defined rich rules to match the
firewallcmd output before comparison to
ensure idempotency.
This commit is contained in:
Marek Czernek 2024-05-13 11:29:48 +02:00 • committed by Daniel Wozniak
parent 2aa213123b
commit f96ecd141c
1 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
salt/states/firewalld.py
View file

@ -376,6 +376,27 @@ def service(name, ports=None, protocols=None):
return ret
def _normalize_rich_rules(rich_rules):
normalized_rules = []
for rich_rule in rich_rules:
normalized_rule = ""
for cmd in rich_rule.split(" "):
cmd_components = cmd.split("=", 1)
if len(cmd_components) == 2:
assigned_component = cmd_components[1]
if not assigned_component.startswith(
'"'
) and not assigned_component.endswith('"'):
if assigned_component.startswith(
"'"
) and assigned_component.endswith("'"):
assigned_component = assigned_component[1:-1]
cmd_components[1] = f'"{assigned_component}"'
normalized_rule = f"{normalized_rule} {'='.join(cmd_components)}"
normalized_rules.append(normalized_rule.lstrip())
return normalized_rules
def _present(
name,
block_icmp=None,
@ -767,6 +788,7 @@ def _present(
if rich_rules or prune_rich_rules:
rich_rules = rich_rules or []
rich_rules = _normalize_rich_rules(rich_rules)
try:
_current_rich_rules = __salt__["firewalld.get_rich_rules"](
name, permanent=True