kosmos/chef
kosmos/chef
8
3
Fork 0
Code Issues 30 Pull Requests 3 Projects 2 Activity

Update the firewall cookbook to the latest version

Browse Source 
This gives us comments from the named resources
This commit is contained in:
Greg Karékinian 2023-06-29 15:08:44 +02:00
parent 916ae8094c
commit 68ce3c4834
72 changed files with 4774 additions and 448 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Berksfile
View File

@ -11,7 +11,7 @@ cookbook 'php', '~> 8.0.0'
cookbook 'composer', '~> 2.7.0'
cookbook 'users', '~> 5.3.1'
cookbook 'hostname', '= 0.4.2'
cookbook 'firewall', '~> 2.6.3'
cookbook 'firewall', '~> 6.2.16'
cookbook 'nginx', '= 9.0.0'
cookbook 'fail2ban', '~> 7.0.4'
cookbook 'mysql', '~> 8.7.3'

10
Berksfile.lock
View File

@ -7,7 +7,7 @@ DEPENDENCIES
composer (~> 2.7.0)
elasticsearch (= 4.3.0)
fail2ban (~> 7.0.4)
firewall (~> 2.6.3)
firewall (~> 6.2.16)
git (~> 10.0.0)
golang (~> 5.3.1)
homebrew (= 3.0.0)
@ -44,6 +44,9 @@ GRAPH
apt (7.3.0)
ark (6.0.3)
seven_zip (>= 3.1)
build-essential (8.2.1)
mingw (>= 1.1)
seven_zip (>= 0.0.0)
chef-sugar (5.1.12)
chocolatey (3.0.0)
compat_resource (12.19.0)
@ -58,8 +61,7 @@ GRAPH
yum (>= 0.0.0)
fail2ban (7.0.4)
yum-epel (>= 0.0.0)
firewall (2.6.5)
chef-sugar (>= 0.0.0)
firewall (6.2.16)
git (10.0.0)
golang (5.3.1)
ark (>= 6.0)
@ -81,6 +83,8 @@ GRAPH
apache2 (>= 0.0.0)
nginx (>= 0.0.0)
php (>= 0.0.0)
mingw (2.1.7)
seven_zip (>= 0.0.0)
mysql (8.7.4)
nginx (9.0.0)
build-essential (>= 5.0)

285
cookbooks/build-essential/CHANGELOG.md Normal file
View File

@ -0,0 +1,285 @@
# build-essential Cookbook CHANGELOG
This file is used to list changes made in each version of the build-essential cookbook.
## 8.2.1 (2018-09-04)
- Add a note that this cookbook is no longer maintained as the build_essential resource was moved directly into the chef-client making this cookbook no longer necessary.
## 8.2.0 (2018-08-28)
- Simplify the if installed logic for macos
- Remove support for FreeBSD < 10 which is VERY much EOL
- Avoid ChefSpec deprecation warnings
- Avoid deprecation warnings in Chef 14.3+ by not loading resources already in Chef
## 8.1.1 (2018-03-17)
- Make sure we install the last available xcode command line tool package so we get the latest version
## 8.1.0 (2018-03-17)
- Support Amazon Linux 2.0
- Remove the ChefSpec matchers which are autogenerated now in recent ChefDK releaeses. If your specs fail because of this you need to update to a more recent ChefDK release.
- Swap Debian 7 testing for Amazon 2 & Ubuntu 18.04 testing since Debian 7 is EOL in May
## 8.0.4 (2017-11-29)
- Install gcc-c and gcc-c++ for solaris 11
- Fix dokken's amazonlinux configuration
- Update chef dependency in metadata.rb to Chef 12.7
- Clean up testing
## 8.0.3 (2017-05-30)
- Fix solaris metadata in metadata.rb
- Remove mac_os_x_server from metata as it's not a platform
## 8.0.2 (2017-05-06)
- Remove buggy action_class.class_eval usage
## 8.0.1 (2017-04-14)
- Test with local delivery and not Rake
- Ensure compatibility with Chef 12.5
- Update apache2 license string
- Ensure compatibility with Amazon Linux on Chef 13
## 8.0.0 (2017-02-14)
- Require 12.5 or later and remove compat_resource cookbook dependency
## 7.0.3 (2016-12-22)
- Require the latest compat_resource
- Cookstyle fixes
## 7.0.2 (2016-11-07)
- Fix softwareupdate issue from -v to --verbose
## 7.0.1 (2016-10-06)
- Install gcc 4.8 on SUSE < 12
## 7.0.0 (2016-09-30)
- Remove support for OS X < 10.9 and add support for OS X 10.12
- Refactor the xcode installer resource as a custom resource that does not require updates for each new OS X update
- Use a test recipe with apt_update to avoid needing apt
## 6.0.6 (2016-09-19)
- Remove chef 11 compatibility in the metadata
- Solaris 11 needs both make and gnu make
## 6.0.5 (2016-09-07)
- Testing updates
- Require the latest compat_resource
## 6.0.4 (2016-08-19)
- Install CLTools from dmg with -allowUntrusted on old OSX
- Switch to cookstyle for ruby linting
- Add OS X hosts to the kitchen config
- Remove chefdk included gems from the Gemfile
- Better handle kitchen failures in the Rakefile
- Perform all unit/linting in a single travis job
## v6.0.3 (2016-07-26)
- Fix how gcc version specified for Solaris 11
## v6.0.2 (2016-07-22)
- Properly warn on Solaris 10
- Specify the verson of gcc to install on Solaris 11
## v6.0.1 (2016-07-19)
- Clarify that this cookbook actually required Chef 12.1 or later not 12.0 or later
- Add chef_version metadata
## v6.0.0 (2016-06-03)
This cookbook now uses the new msys2 based compiler toolchain on windows. Both 32-bit DW2 and 64-bit SEH based toolchains are available based on the gcc 5.3x series compiler. By default these are located in C:\msys2\mingw32 and C:\msys2\mingw64
## v5.0.0 (2016-06-03)
The cookbook now ships with a 12.5+ style custom resource 'build_essential' which performs the same work that the existing default.rb recipe. The default.rb recipe has been converted to consume that resource to provide backwards compatibility for users that use build-essential::default in their run lists or cookbooks. In converting to this custom resource support for EOL omnios has been removed and warning messages for Solaris 10 users have been removed. See the readme for usage information on the new resource.
## v4.0.0 (2016-05-12)
### Breaking change
This cookbook now requires Chef 12 or later as it includes the new mingw cookbook for installing Windows compilers. Mingw includes 12.5 style custom resources, which will fail to compile on Chef 11\. If you are not running Chef 12 you'll need to pin to 3.x in your environment.
## v3.2.0 (2016-03-25)
This version backs out a change in the 3.0 release which attempted to install the version of kernel-devel for the current running kernel on RHEL systems. This change had several unintended consequences and we believe the best solution is to back to change out until a better solution for the original problem is developed. Several of the issues could be resolved by code updates to build-essential, but not all, which complicates rolling forward vs. a roll back. The change caused issues which Chefspec runs on cookbooks where build-essential is a dependency as Fauxhai, used by Chefspec, does not mock out node['virtualization']. Fauxhai is being updated to mock out node['virtualization'], but we'd like to make sure a ChefDK release ships with this new Fauxhai before depending on that change.
## v3.1.0 (2016-03-23)
- Install GCC 4.8 if running on OmniOS >= 151008
## v3.0.0 (2016-03-23)
- Install GCC 4.9 on FreeBSD < 10
- Install the version of kernel-devel that matches the running Kernel on RHEL
- Remove suggests 'pkgutil' from the metadata as suggests does nothing
- Properly warn the user that build-essential does not support Solaris 10 instead of just silently continuing on
- Updated specs to run against more recent OS releases
- Removed the warning for OmniOS users from the Readme as the upstream issue has been resolved
- Switch from 7-zip to seven_zip cookbook as 7-zip has been deprecated
- Add 7-zip to the system path on Windows hosts so the recipe will work out of the box
- Switch from the deprecated 7-zip cookbook to seven_zip
## v2.4.0 (2016-03-21)
- Add gettext package to RHEL / FreeBSD to match other platforms
- Fix OS X version detection logic to properly detect OS X 10.10 and 10.11
## v2.3.1 (2016-02-18)
- Restore Chef 11 compatibility and add Travis / Test Kitchen testing for Chef 11
## v2.3.0 (2016-02-17)
- Add mingw/msys based build tools for Windows
## v2.2.4 (2015-10-06)
- Add patch package on Fedora systems
- Add additional platforms to Kitchen CI
- Use Chef standard Rubocop file and resolve several issues
- Update contributing and testing docs
- Update Gemfile with the latest testing and development deps
- Add maintainers.md and maintainers.toml files
- Add chefignore file to limit the files uploaded to the Chef server
- Add source_url and issues_url metadata for Supermarket
## v2.2.3 (2015-04-15)
- Don't install omnibus-build-essential on Solaris 10 - We decided it's easier to use the old GCC that ships with Solaris 10.
- Use ChefDK for all Travis testing.
## v2.2.2 (2015-03-27)
- Update Solar 10's omnibus-build-essential to 0.0.5
## v2.2.1 (2015-03-23)
- Install GNU Patch on Solaris 11
## v2.2.0 (2015-03-18)
- [solaris] Differentiate between Solaris 10 and 11
- [solaris] Add ucb compat package
- [solaris] Solaris 10 build essential setup
- Fix metadata to use a string instead of a bool (see #56, #57)
## v2.1.3 (2014-11-18)
- Update metadata for supported versions of OS X (10.7+) as noted from
- v2.0.0 previously (#38)
- Clarify requirement to have apt package cache updated in README. (#41)
- Fix Xcode CLI installation on OS X (#50)
## v2.1.2 (2014-10-14)
- Mac OS X 10.10 Yosemite support
## v2.1.0 (2014-10-14)
- Use fully-qualified names when installing FreeBSD package
## v2.0.6 (2014-08-11)
- Use the resource form of `remote_file` to prevent context issues
## v2.0.4 (2014-06-06)
- [COOK-4661] added patch package to _rhel recipe
## v2.0.2 (2014-05-02)
- Updated documentation about older Chef versions
- Added new SVG badges to the README
- Fix a bug where `potentially_at_compile_time` fails on non-resources
## v2.0.0 (2014-03-13)
- Updated tested harnesses to use latest ecosystem tools
- Added support for FreeBSD
- Added support for installing XCode Command Line Tools on OSX (10.7, 10.8, 10.9)
- Created a DSL method for wrapping compile_time vs runtime execution
- Install additional developement tools on some platforms
- Add nicer log and warning messages with helpful information
**Potentially Breaking Changes**
- Dropped support for OSX 10.6
- OSX no longer downloads OSX GCC and uses XCode CLI tools instead
- `build_essential` -> `build-essential` in node attributes
- `compiletime` -> `compile_time` in node attributes
- Cookbook version 2.x no longer supports Chef 10.x
## v1.4.4 (2014-02-27)
- [COOK-4245] Wrong package name used for developer tools on OS X 10.9
## v1.4.2
### Bug
- **[COOK-3318](https://tickets.chef.io/browse/COOK-3318)** - Use Mixlib::ShellOut instead of Chef::ShellOut
### New Feature
- **[COOK-3093](https://tickets.chef.io/browse/COOK-3093)** - Add OmniOS support
### Improvement
- **[COOK-3024](https://tickets.chef.io/browse/COOK-3024)** - Use newer package on SmartOS
## v1.4.0
This version splits up the default recipe into recipes included based on the node's platform_family.
- [COOK-2505] - backport omnibus builder improvements
## v1.3.4
- [COOK-2272] - Complete `platform_family` conversion in build-essential
## v1.3.2
- [COOK-2069] - build-essential will install osx-gcc-installer when XCode is present
## v1.3.0
- [COOK-1895] - support smartos
## v1.2.0
- Add test-kitchen support (source repo only)
- [COOK-1677] - build-essential cookbook support for OpenSuse and SLES
- [COOK-1718] - build-essential cookbook metadata should include scientific
- [COOK-1768] - The apt-get update in build-essentials needs to be renamed
## v1.1.2
- [COOK-1620] - support OS X 10.8
## v1.1.0
- [COOK-1098] - support amazon linux
- [COOK-1149] - support Mac OS X
- [COOK-1296] - allow for compile-time installation of packages through an attribute (see README)
## v1.0.2
- [COOK-1098] - Add Amazon Linux platform support
- [COOK-1149] - Add OS X platform support

0
cookbooks/firewall/CONTRIBUTING.md → cookbooks/build-essential/CONTRIBUTING.md
View File

138
cookbooks/build-essential/README.md Normal file
View File

@ -0,0 +1,138 @@
# build-essential Cookbook
[![Cookbook Version](http://img.shields.io/cookbook/v/build-essential.svg)][cookbook] [![Build Status](https://travis-ci.org/chef-cookbooks/build-essential.svg?branch=master)](https://travis-ci.org/chef-cookbooks/build-essential)
Installs packages required for compiling C software from source. Use this cookbook if you wish to compile C programs, or install RubyGems with native extensions. Contains a resource, 'build_essential', as as well as a default recipe that simply calls that same resource.
Note: The functionality of this cookbook is now built into Chef 14+ in the [build_essential resource](https://docs.chef.io/resource_build_essential.html). This cookbook is no longer being maintained and all future changes will be done directly in the chef-client. We highly recommend you update your chef-client to the latest release and if possible migrate to using the build_essential resources instead of the recipe in this cookbook.
## Requirements
### Platforms
- Debian/Ubuntu
- RHEL/CentOS/Scientific/Amazon/Oracle
- openSUSE / SUSE Enterprise Linux
- SmartOS
- Fedora
- Mac OS X 10.9+
- FreeBSD
### Chef
- Chef 12.7+
### Cookbooks
- seven_zip
- mingw
**Note for Debian platform family:** On Debian platform-family systems, it is recommended that `apt-get update` be run, to ensure that the package cache is updated. It's not in the scope of this cookbook to do that, as it can [create a duplicate resource](https://tickets.chef.io/browse/CHEF-3694). We recommend using the [apt](https://supermarket.chef.io/cookbooks/apt) cookbook to do this.
## Attributes
Attribute | Default | Description
------------------------------------------ | :---------------------------: | -----------------------------------------------------
`node['build-essential']['compile_time']` | `false` | Execute resources at compile time
`node['build-essential']['msys2']['path']` | `#{ENV['SYSTEMDRIVE']\\msys2` | Destination for msys2 build tool chain (Windows only)
## Usage
### Recipe Usage
The recipe simply calls the build_essential resource, but it ideal for adding to roles or node run lists.
Include the build-essential recipe in your run list:
```sh
knife node run_list add NODE "recipe[build-essential::default]"
```
or add the build-essential recipe as a dependency and include it from inside another cookbook:
```ruby
include_recipe 'build-essential::default'
```
### Gems with C extensions
For RubyGems that include native C extensions you wish to use with Chef, you should do the following.
- Set the `compile_time` attribute to true in your wrapper cookbook or role:
```ruby
# Wrapper attribute
default['build-essential']['compile_time'] = true
```
```ruby
# Role
default_attributes(
'build-essential' => {
'compile_time' => true
}
)
```
- Ensure that the C libraries, which include files and other assorted "dev"
type packages, are installed in the compile phase after the build-essential
recipe is executed. For example:
```ruby
include_recipe 'build-essential::default'
package('mypackage-devel') { action :nothing }.run_action(:install)
```
- Use the `chef_gem` resource in your recipe to install the gem with the native
extension:
```ruby
chef_gem 'gem-with-native-extension'
```
### Resource Usage
The cookbook includes a resource 'build_essential' that can be included in your cookbook to install the necessary build-essential packages
Simple package installation during the client run:
```ruby
build_essential 'some name you choose'
```
Package installation during the compile phase:
```ruby
build_essential 'some name you choose' do
compile_time false
end
```
## Maintainers
This cookbook is maintained by Chef's Community Cookbook Engineering team. Our goal is to improve cookbook quality and to aid the community in contributing to cookbooks. To learn more about our team, process, and design goals see our [team documentation](https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/COOKBOOK_TEAM.MD). To learn more about contributing to cookbooks like this see our [contributing documentation](https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/CONTRIBUTING.MD), or if you have general questions about this cookbook come chat with us in #cookbok-engineering on the [Chef Community Slack](http://community-slack.chef.io/)
## License
**Copyright:** 2009-2016, Chef Software, Inc.
```
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
```
[cookbook]: https://supermarket.chef.io/cookbooks/build-essential
[travis]: http://travis-ci.org/chef-cookbooks/build-essential

21
cookbooks/build-essential/attributes/default.rb Normal file
View File

@ -0,0 +1,21 @@
#
# Cookbook:: build-essential
# Attributes:: default
#
# Copyright:: 2008-2017, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
default['build-essential']['compile_time'] = false
default['build-essential']['msys2']['path'] = "#{ENV['SYSTEMDRIVE']}\\msys2"

1
cookbooks/build-essential/metadata.json Normal file
View File

File diff suppressed because one or more lines are too long

53
cookbooks/build-essential/recipes/_windows.rb Normal file
View File

@ -0,0 +1,53 @@
#
# Cookbook:: build-essential
# Recipe:: _windows
#
# Copyright:: 2016-2017, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
node.default['seven_zip']['syspath'] = true
include_recipe 'seven_zip::default'
tool_path = node['build-essential']['msys2']['path']
directory tool_path do
action :create
recursive true
end
[
'base-devel', # Brings down msys based bash/make/awk/patch/stuff..
'mingw-w64-x86_64-toolchain', # Puts 64-bit SEH mingw toolchain in msys2\mingw64
'mingw-w64-i686-toolchain' # Puts 32-bit DW2 mingw toolchain in msys2\ming32
].each do |package|
msys2_package package do
root tool_path
end
end
# Certain build steps assume that a tar command is available on the
# system path. The default tar present in msys2\usr\bin is an msys GNU tar
# that expects forward slashes and consider ':' to be a remote tape separator
# or something weird like that. We therefore drop bat file in msys2\bin that
# redirect to the underlying executables without mucking around with
# msys2's /usr/bin itself.
{
'bsdtar.exe' => 'tar.bat',
'patch.exe' => 'patch.bat',
}.each do |reference, link|
file "#{tool_path}\\bin\\#{link}" do
content "@%~dp0..\\usr\\bin\\#{reference} %*"
end
end

24
cookbooks/build-essential/recipes/default.rb Normal file
View File

@ -0,0 +1,24 @@
#
# Cookbook:: build-essential
# Recipe:: default
#
# Copyright:: 2008-2018, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# Call the build-essential custom resource
# This can also be called directly in your cookbooks anywhere you want
build_essential 'install_packages' do
compile_time node['build-essential']['compile_time']
end

107
cookbooks/build-essential/resources/build_essential.rb Normal file
View File

@ -0,0 +1,107 @@
#
# Cookbook:: build-essential
# resource:: build_essential
#
# Copyright:: 2008-2018, Chef Software Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
chef_version_for_provides '< 14.0' if respond_to?(:chef_version_for_provides)
provides :build_essential
resource_name :build_essential
property :compile_time, [true, false], default: false
action :install do
case node['platform_family']
when 'debian'
package %w( autoconf binutils-doc bison build-essential flex gettext ncurses-dev )
when 'amazon', 'fedora', 'rhel'
package %w( autoconf bison flex gcc gcc-c++ gettext kernel-devel make m4 ncurses-devel patch )
# Ensure GCC 4 is available on older pre-6 EL
package %w( gcc44 gcc44-c++ ) if !platform?('amazon') && node['platform_version'].to_i < 6
when 'freebsd'
package 'devel/gmake'
package 'devel/autoconf'
package 'devel/m4'
package 'devel/gettext'
when 'mac_os_x'
xcode_command_line_tools 'install'
when 'omnios'
package 'developer/gcc48'
package 'developer/object-file'
package 'developer/linker'
package 'developer/library/lint'
package 'developer/build/gnu-make'
package 'system/header'
package 'system/library/math/header-math'
# Per OmniOS documentation, the gcc bin dir isn't in the default
# $PATH, so add it to the running process environment
# http://omnios.omniti.com/wiki.php/DevEnv
ENV['PATH'] = "#{ENV['PATH']}:/opt/gcc-4.7.2/bin"
when 'solaris2'
if node['platform_version'].to_f == 5.10
Chef::Log.warn('build-essential does not support Solaris 10. You will need to install SUNWbison, SUNWgcc, SUNWggrp, SUNWgmake, and SUNWgtar from the Solaris DVD')
elsif node['platform_version'].to_f == 5.11
package 'autoconf'
package 'automake'
package 'bison'
package 'gnu-coreutils'
package 'flex'
# lock gcc versions because we don't use 5 yet
%w(gcc gcc-c gcc-c++).each do |pkg|
package pkg do # ~FC009
accept_license true
version '4.8.2'
end
end
package 'gnu-grep'
package 'gnu-make'
package 'gnu-patch'
package 'gnu-tar'
package 'make'
package 'pkg-config'
package 'ucb'
end
when 'smartos'
package 'autoconf'
package 'binutils'
package 'build-essential'
package 'gcc47'
package 'gmake'
package 'pkg-config'
when 'suse'
package %w( autoconf bison flex gcc gcc-c++ kernel-default-devel make m4 )
package %w( gcc48 gcc48-c++ ) if node['platform_version'].to_i < 12
when 'windows'
include_recipe 'build-essential::_windows'
else
Chef::Log.warn <<-EOH
A build-essential recipe does not exist for '#{node['platform_family']}'. This
means the build-essential cookbook does not have support for the
#{node['platform_family']} family. If you are not compiling gems with native
extensions or building packages from source, this will likely not affect you.
EOH
end
end
# this resource forces itself to run at compile_time
def after_created
return unless compile_time
Array(action).each do |action|
run_action(action)
end
end

57
cookbooks/build-essential/resources/xcode_command_line_tools.rb Normal file
View File

@ -0,0 +1,57 @@
#
# Cookbook:: build-essential
# Resource:: xcode_command_line_tools
#
# Copyright:: 2014-2018, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
resource_name :xcode_command_line_tools
action :install do
if installed?
Chef::Log.debug("#{new_resource} already installed - skipping")
else
converge_by("Install #{new_resource}") do
# This script was graciously borrowed and modified from Tim Sutton's
# osx-vm-templates at https://github.com/timsutton/osx-vm-templates/blob/b001475df54a9808d3d56d06e71b8fa3001fff42/scripts/xcode-cli-tools.sh
execute 'install XCode Command Line tools' do
command <<-EOH.gsub(/^ {14}/, '')
# create the placeholder file that's checked by CLI updates' .dist code
# in Apple's SUS catalog
touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
# find the CLI Tools update
PROD=$(softwareupdate -l | grep "\*.*Command Line" | tail -n 1 | awk -F"*" '{print $2}' | sed -e 's/^ *//' | tr -d '\n')
# install it
softwareupdate -i "$PROD" --verbose
# Remove the placeholder to prevent perpetual appearance in the update utility
rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
EOH
end
end
end
end
action_class do
#
# Determine if the XCode Command Line Tools are installed
#
# @return [true, false]
#
def installed?
cmd = Mixlib::ShellOut.new('pkgutil --pkgs=com.apple.pkg.CLTools_Executables')
cmd.run_command
cmd.error? ? false : true
end
end

3
cookbooks/firewall/.foodcritic
View File

@ -1,3 +0,0 @@
~FC001
~FC057
~FC019

5
cookbooks/firewall/.markdownlint-cli2.yaml Normal file
View File

@ -0,0 +1,5 @@
config:
ul-indent: false # MD007
line-length: false # MD013
no-duplicate-heading: false # MD024
reference-links-images: false # MD052

551
cookbooks/firewall/CHANGELOG.md
View File

@ -1,291 +1,458 @@
firewall Cookbook CHANGELOG
=======================
# firewall Cookbook CHANGELOG
This file is used to list changes made in each version of the firewall cookbook.
## 6.2.16 - *2023-05-17*
## 6.2.15 - *2023-04-26*
Update CI runner to MacOS 12
## 6.2.14 - *2023-04-17*
## 6.2.13 - *2023-04-11*
Fix documentation to pass markdown lint
## 6.2.12 - *2023-04-07*
Standardise files with files in sous-chefs/repo-management
## 6.2.11 - *2023-04-04*
Fixed a typo in the readme
## 6.2.10 - *2023-04-01*
## 6.2.9 - *2023-04-01*
## 6.2.8 - *2023-04-01*
Standardise files with files in sous-chefs/repo-management
Standardise files with files in sous-chefs/repo-management
## 6.2.7 - *2023-03-02*
## 6.2.6 - *2023-02-23*
Standardise files with files in sous-chefs/repo-management
## 6.2.5 - *2023-02-16*
Standardise files with files in sous-chefs/repo-management
## 6.2.4 - *2023-02-15*
Standardise files with files in sous-chefs/repo-management
## 6.2.3 - *2022-12-08*
Standardise files with files in sous-chefs/repo-management
## 6.2.2 - *2022-12-08*
Standardise files with files in sous-chefs/repo-management
## 6.2.1 - *2022-12-02*
## 6.2.0 - *2022-12-02*
- Add support for for the description attribute when using UFW
## 6.1.0 - *2022-09-15*
- Add filepath selection based on OS for nftables.conf
## 6.0.2 - *2022-05-15*
Standardise files with files in sous-chefs/repo-management
## 6.0.1 - *2022-05-13*
- Standardise files with files in sous-chefs/repo-management
## 6.0.0 - *2022-05-09*
- Values for firewalld resources must be specified as one would
specify them to `firewall-cmd`.
- Do not use begin/rescue blocks when adding firewalld-objects, as
that resulted in errors being logged by firewalld.
- Various bug fixes that were found along the way.
## 5.1.0 - *2022-05-07*
- Add new providers for firewalld using the dbus-interface of firewalld.
## 5.0.0 - *2022-04-20*
- Add support for nftables
## 4.0.3 - *2022-04-11*
- Use resuable workflows instead of Chef Delivery
## 4.0.2 - *2022-02-17*
- Standardise files with files in sous-chefs/repo-management
- Remove delivery folder
## 4.0.1 - *2022-01-07*
- Remove extraneous task file that's no longer needed
## 4.0.0 - *2021-09-09*
- Remove dependency on chef-sugar cookbook
- Bump to require Chef Infra Client >= 15.5 for chef-utils
- Update metadata and README to Sous Chefs
## 3.0.2 - *2021-08-30*
- Standardise files with files in sous-chefs/repo-management
## 3.0.1 - *2021-07-08*
- Restart netfilter service in iptables mode after updating firewall rules
## 3.0.0 - *2021-06-14*
- Add Amazon Linux support
- Fix firewall resource actions list
- First attempt to modernize testing
- Various Cookstyle fixes
## 2.7.1 - *2021-06-01*
- resolved cookstyle error: libraries/helpers_windows.rb:47:9 convention: `Style/RedundantAssignment`
- resolved cookstyle error: libraries/helpers_windows.rb:48:9 convention: `Layout/IndentationWidth`
- resolved cookstyle error: libraries/helpers_windows.rb:49:16 convention: `Layout/ElseAlignment`
- resolved cookstyle error: libraries/helpers_windows.rb:50:9 convention: `Layout/IndentationWidth`
- resolved cookstyle error: libraries/helpers_windows.rb:51:16 warning: `Layout/EndAlignment`
- resolved cookstyle error: libraries/helpers_windows.rb:52:1 convention: `Layout/EmptyLinesAroundMethodBody`
- resolved cookstyle error: libraries/helpers_windows.rb:52:1 convention: `Layout/TrailingWhitespace`
- resolved cookstyle error: libraries/provider_firewall_firewalld.rb:30:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_firewalld.rb:54:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_firewalld.rb:114:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_firewalld.rb:136:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_firewalld.rb:149:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables.rb:33:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables.rb:63:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables.rb:112:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables.rb:134:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu.rb:34:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu.rb:67:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu.rb:133:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu.rb:156:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu1404.rb:34:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu1404.rb:67:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu1404.rb:133:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu1404.rb:156:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_rule.rb:24:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_ufw.rb:32:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_ufw.rb:61:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_ufw.rb:102:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_ufw.rb:115:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_windows.rb:29:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_windows.rb:42:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_windows.rb:97:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: libraries/provider_firewall_windows.rb:118:5 refactor: `ChefModernize/ActionMethodInResource`
- resolved cookstyle error: attributes/iptables.rb:8:54 refactor: `ChefStyle/AttributeKeys`
- resolved cookstyle error: attributes/iptables.rb:8:54 convention: `Style/StringLiteralsInInterpolation`
- resolved cookstyle error: attributes/iptables.rb:8:63 refactor: `ChefStyle/AttributeKeys`
- resolved cookstyle error: attributes/iptables.rb:8:64 convention: `Style/StringLiteralsInInterpolation`
- resolved cookstyle error: attributes/iptables.rb:9:56 refactor: `ChefStyle/AttributeKeys`
- resolved cookstyle error: attributes/iptables.rb:9:56 convention: `Style/StringLiteralsInInterpolation`
- resolved cookstyle error: attributes/iptables.rb:9:65 refactor: `ChefStyle/AttributeKeys`
- resolved cookstyle error: attributes/iptables.rb:9:66 convention: `Style/StringLiteralsInInterpolation`
- resolved cookstyle error: attributes/iptables.rb:10:55 refactor: `ChefStyle/AttributeKeys`
- resolved cookstyle error: attributes/iptables.rb:10:55 convention: `Style/StringLiteralsInInterpolation`
- resolved cookstyle error: attributes/iptables.rb:10:64 refactor: `ChefStyle/AttributeKeys`
- resolved cookstyle error: attributes/iptables.rb:10:65 convention: `Style/StringLiteralsInInterpolation`
## 2.7.0 (2018-12-19)
- Nominal support for Debian 9 (#202)
## 2.6.5 (2018-07-24)
- use platform_family instead of platform to include all rhels
v2.6.4 (2018-07-01)
-------------------
* Stop including chef-sugar when it's >= 4.0.0 (#197)
## v2.6.4 (2018-07-01)
v2.6.3 (2018-02-01)
-------------------
* Fix issue with deep merging of hashes and arrays in recent chef release (#185)
- Stop including chef-sugar when it's >= 4.0.0 (#197)
v2.6.2 (2017-06-01)
-------------------
* Incorrect file checking on Ubuntu, double file write (#173)
* Added testing on CentOS 6.9
* Clarify metadata that we're not working on Amazon Linux (#172)
## v2.6.3 (2018-02-01)
v2.6.1 (2017-04-21)
-------------------
* Add recipe to disable firewall (#164)
- Fix issue with deep merging of hashes and arrays in recent chef release (#185)
v2.6.0 (2017-04-17)
-------------------
* Initial Chef 13.x support (#160, #159)
* Allow loopback and icmp, when enabled (#161)
* Address various newer rubocop and foodcritic complaints
* Convert rule provider away from DSL (#159)
## v2.6.2 (2017-06-01)
v2.5.4 (2017-02-13)
-------------------
* Update Test Kitchen platforms to the latest
* Update copyright headers
* Allow package options to be passed through to the package install for firewall
* Define policy for Windows Firewall and use the attributes to set desired policy
- Incorrect file checking on Ubuntu, double file write (#173)
- Added testing on CentOS 6.9
- Clarify metadata that we're not working on Amazon Linux (#172)
v2.5.3 (2016-10-26)
-------------------
* Don't show firewall resource as updated (#133)
* Add :off as a valid logging level (#129)
* Add support for Ubuntu 16.04 (#149)
## v2.6.1 (2017-04-21)
v2.5.2 (2016-06-02)
-------------------
* Don't issue commands when firewalld isn't active (#140)
* Install iptables-services on CentOS >= 7 (#131)
* Update Ruby version on Travis for listen gem
- Add recipe to disable firewall (#164)
v2.5.1 (2016-05-31)
-------------------
* Protocol guard incorrectly prevents "none" protocol type on UFW helper (#128)
* Fix wrongly ordered conditional for converting ports to strings using port_to_s
* Fix notify_firewall attribute crashing firewall_rule provider (#130)
* Add warning if firewall rule opens all traffic (#132)
* Add ipv6 attribute respect to Ubuntu iptables (#138)
## v2.6.0 (2017-04-17)
v2.5.0 (2016-03-08)
-------------------
* Don't modify parameter for port (#120)
* Remove a reference to the wrong variable name under windows (#123)
* Add support for mobile shell default firewall rule (#121)
* New rubocop rules and style fixes
* Correct a README.md example for `action :allow`
- Initial Chef 13.x support (#160, #159)
- Allow loopback and icmp, when enabled (#161)
- Address various newer rubocop and foodcritic complaints
- Convert rule provider away from DSL (#159)
v2.4.0 (2016-01-28)
-------------------
* Expose default iptables ruleset so that raw rules can be used in conjunction
with rulesets for other tables (#101).
## v2.5.4 (2017-02-13)
v2.3.1 (2016-01-08)
-------------------
* Add raw rule support to the ufw firewall provider (#113).
- Update Test Kitchen platforms to the latest
- Update copyright headers
- Allow package options to be passed through to the package install for firewall
- Define policy for Windows Firewall and use the attributes to set desired policy
v2.3.0 (2015-12-23)
-------------------
* Refactor logic so that firewall rules don't add a string rule to the firewall
when their actions run. Just run the action once on the firewall itself. This is
designed to prevent partial application of rules (#106)
## v2.5.3 (2016-10-26)
* Switch to "enabled" (positive logic) instead of "disabled" (negative logic) on
the firewall resource. It was difficult to reason with "disabled false" for some
complicated recipes using firewall downstream. `disabled` is now deprecated.
- Don't show firewall resource as updated (#133)
- Add :off as a valid logging level (#129)
- Add support for Ubuntu 16.04 (#149)
* Add proper Windows testing and serverspec tests back into this cookbook.
## v2.5.2 (2016-06-02)
* Fix the `port_to_s` function so it also works for Windows (#111)
- Don't issue commands when firewalld isn't active (#140)
- Install iptables-services on CentOS >= 7 (#131)
- Update Ruby version on Travis for listen gem
* Fix typo checking action instead of command in iptables helper (#112)
## v2.5.1 (2016-05-31)
* Remove testing ranges of ports on CentOS 5.x, as it's broken there.
- Protocol guard incorrectly prevents "none" protocol type on UFW helper (#128)
- Fix wrongly ordered conditional for converting ports to strings using port_to_s
- Fix notify_firewall attribute crashing firewall_rule provider (#130)
- Add warning if firewall rule opens all traffic (#132)
- Add ipv6 attribute respect to Ubuntu iptables (#138)
## v2.5.0 (2016-03-08)
- Don't modify parameter for port (#120)
- Remove a reference to the wrong variable name under windows (#123)
- Add support for mobile shell default firewall rule (#121)
- New rubocop rules and style fixes
- Correct a README.md example for `action :allow`
## v2.4.0 (2016-01-28)
- Expose default iptables ruleset so that raw rules can be used in conjunction with rulesets for other tables (#101).
## v2.3.1 (2016-01-08)
- Add raw rule support to the ufw firewall provider (#113).
## v2.3.0 (2015-12-23)
- Refactor logic so that firewall rules don't add a string rule to the firewall when their actions run. Just run the action once on the firewall itself. This is designed to prevent partial application of rules (#106)
- Switch to "enabled" (positive logic) instead of "disabled" (negative logic) on the firewall resource. It was difficult to reason with "disabled false" for some complicated recipes using firewall downstream. `disabled` is now deprecated.
- Add proper Windows testing and serverspec tests back into this cookbook.
- Fix the `port_to_s` function so it also works for Windows (#111)
- Fix typo checking action instead of command in iptables helper (#112)
- Remove testing ranges of ports on CentOS 5.x, as it's broken there.
## v2.2.0 (2015-11-02)
v2.2.0 (2015-11-02)
-------------------
Added permanent as default option for RHEL 7 based systems using firewall-cmd.
This defaults to turned off, but it will be enabled by default on the next major version bump.
v2.1.0 (2015-10-15)
-------------------
## v2.1.0 (2015-10-15)
Minor feature release.
* Ensure ICMPv6 is open when `['firewall']['allow_established']` is set to true (the default). ICMPv6 is critical for most IPv6 operations.
v2.0.5 (2015-10-05)
-------------------
- Ensure ICMPv6 is open when `['firewall']['allow_established']` is set to true (the default). ICMPv6 is critical for most IPv6 operations.
## v2.0.5 (2015-10-05)
Minor bugfix release.
* Ensure provider filtering always yields 1 and only 1 provider, #97 & #98
* Documentation update #96
v2.0.4 (2015-09-23)
-------------------
- Ensure provider filtering always yields 1 and only 1 provider, #97 & #98
- Documentation update #96
## v2.0.4 (2015-09-23)
Minor bugfix release.
* Allow override of filter chain policies, #94
* Fix foodcrtitic and chefspec errors
v2.0.3 (2015-09-14)
-------------------
- Allow override of filter chain policies, #94
- Fix foodcrtitic and chefspec errors
## v2.0.3 (2015-09-14)
Minor bugfix release.
* Fix wrong conditional for firewalld ports, #93
* Fix ipv6 command logic under iptables, #91
v2.0.2 (2015-09-08)
-------------------
* Release with working CI, Chefspec matchers.
- Fix wrong conditional for firewalld ports, #93
- Fix ipv6 command logic under iptables, #91
v2.0.1 (2015-09-01)
-------------------
* Add default related/established rule for iptables
## v2.0.2 (2015-09-08)
v2.0.0 (2015-08-31)
-------------------
* #84, major rewrite:
- Allow relative positioning of rules
- Use delayed notifications to create one firewall ruleset instead of incremental changes
- Remove poise dependency
* #82 - Introduce Windows firewall support and test-kitchen platform.
* #73 - Add the option to disable ipv6 commands on iptables
* #78 - Use Chef-12 style `provides` to address provider mapping issues
* Rubocop and foodcritic cleanup
- Release with working CI, Chefspec matchers.
v1.6.1 (2015-07-24)
-------------------
* #80 - Remove an extra space in port range
## v2.0.1 (2015-09-01)
v1.6.0 (2015-07-15)
-------------------
* #68 - Install firewalld when it does not exist
* #72 - Fix symbol that was a string, breaking comparisons
- Add default related/established rule for iptables
v1.5.2 (2015-07-15)
-------------------
* #75 - Use correct service in iptables save action, Add serverspec tests for iptables suite
## v2.0.0 (2015-08-31)
v1.5.1 (2015-07-13)
-------------------
* #74 - add :save matcher for Chefspec
- 84, major rewrite
- Allow relative positioning of rules
- Use delayed notifications to create one firewall ruleset instead of incremental changes
- Remove poise dependency
- #82 - Introduce Windows firewall support and test-kitchen platform
- #73 - Add the option to disable ipv6 commands on iptables
- #78 - Use Chef-12 style `provides` to address provider mapping issues
- Rubocop and foodcritic cleanup
v1.5.0 (2015-07-06)
-------------------
## v1.6.1 (2015-07-24)
* #70 - Add chef service resource to ensure firewall-related services are enabled/disabled
* - Add testing and support for iptables on ubuntu in iptables provider
- 80 - Remove an extra space in port range
v1.4.0 (2015-06-30)
-------------------
## v1.6.0 (2015-07-15)
* #69 - Support for CentOS/RHEL 5.x
- 68 - Install firewalld when it does not exist
- 72 - Fix symbol that was a string, breaking comparisons
v1.3.0 (2015-06-09)
-------------------
* #63 - Add support for protocol numbers
## v1.5.2 (2015-07-15)
v1.2.0 (2015-05-28)
-------------------
* #64 - Support the newer version of poise
- 75 - Use correct service in iptables save action, Add serverspec tests for iptables suite
v1.1.2 (2015-05-19)
-------------------
* #60 - Always add /32 or /128 to ipv4 or ipv6 addresses, respectively.
## v1.5.1 (2015-07-13)
- 74 - add :save matcher for Chefspec
## v1.5.0 (2015-07-06)
- 70 - Add chef service resource to ensure firewall-related services are enabled/disabled
- Add testing and support for iptables on ubuntu in iptables provider
## v1.4.0 (2015-06-30)
- 69 - Support for CentOS/RHEL 5.x
## v1.3.0 (2015-06-09)
- 63 - Add support for protocol numbers
## v1.2.0 (2015-05-28)
- 64 - Support the newer version of poise
## v1.1.2 (2015-05-19)
- 60 - Always add /32 or /128 to ipv4 or ipv6 addresses, respectively
- Make comment quoting optional; iptables on Ubuntu strips quotes on strings without any spaces
v1.1.1 (2015-05-11)
-------------------
* #57 - Suppress warning: already initialized constant XXX while Chefspec
## v1.1.1 (2015-05-11)
v1.1.0 (2015-04-27)
-------------------
* #56 - Better ipv6 support for firewalld and iptables
* #54 - Document raw parameter
- 57 - Suppress warning: already initialized constant XXX while Chefspec
v1.0.2 (2015-04-03)
-------------------
* #52 - Typo in :masquerade action name
## v1.1.0 (2015-04-27)
v1.0.1 (2015-03-28)
-------------------
* #49 - Fix position attribute of firewall_rule providers to be correctly used as a string in commands
- 56 - Better ipv6 support for firewalld and iptables
- 54 - Document raw parameter
v1.0.0 (2015-03-25)
-------------------
* Major upgrade and rewrite as HWRP using poise
* Adds support for iptables and firewalld
* Modernize tests and other files
* Fix many bugs from ufw defaults to multiport suppot
## v1.0.2 (2015-04-03)
v0.11.8 (2014-05-20)
--------------------
* Corrects issue where on a secondary converge would not distinguish between inbound and outbound rules
- 52 - Typo in :masquerade action name
## v1.0.1 (2015-03-28)
- 49 - Fix position attribute of firewall_rule providers to be correctly used as a string in commands
## v1.0.0 (2015-03-25)
- Major upgrade and rewrite as HWRP using poise
- Adds support for iptables and firewalld
- Modernize tests and other files
- Fix many bugs from ufw defaults to multiport suppot
## v0.11.8 (2014-05-20)
- Corrects issue where on a secondary converge would not distinguish between inbound and outbound rules
## v0.11.6 (2014-02-28)
v0.11.6 (2014-02-28)
--------------------
[COOK-4385] - UFW provider is broken
## v0.11.4 (2014-02-25)
v0.11.4 (2014-02-25)
--------------------
[COOK-4140] Only notify when a rule is actually added
## v0.11.2
v0.11.2
-------
### Bug
- **[COOK-3615](https://tickets.opscode.com/browse/COOK-3615)** - Install required UFW package on Debian
v0.11.0
-------
- [COOK-3615]: Install required UFW package on Debian
## v0.11.0
### Improvement
- [COOK-2932]: ufw providers work on debian but cannot be used
v0.10.2
-------
## v0.10.2
- [COOK-2250] - improve readme
v0.10.0
------
## v0.10.0
- [COOK-1234] - allow multiple ports per rule
v0.9.2
------
## v0.9.2
- [COOK-1615] - Firewall example docs have incorrect direction syntax
v0.9.0
------
## v0.9.0
The default action for firewall LWRP is now :enable, the default action for firewall_rule LWRP is now :reject. This is in line with a "default deny" policy.
- [COOK-1429] - resolve foodcritic warnings
v0.8.0
------
## v0.8.0
- refactor all resources and providers into LWRPs
- removed :reset action from firewall resource (couldn't find a good way to make it idempotent)
- removed :logging action from firewall resource...just set desired level via the log_level attribute
v0.6.0
------
## v0.6.0
- [COOK-725] Firewall cookbook firewall_rule LWRP needs to support logging attribute.
- Firewall cookbook firewall LWRP needs to support :logging
v0.5.7
------
## v0.5.7
- [COOK-696] Firewall cookbook firewall_rule LWRP needs to support interface
- [COOK-697] Firewall cookbook firewall_rule LWRP needs to support the direction for the rules
v0.5.6
------
## v0.5.6
- [COOK-695] Firewall cookbook firewall_rule LWRP needs to support destination port
v0.5.5
------
## v0.5.5
- [COOK-709] fixed :nothing action for the 'firewall_rule' resource.
v0.5.4
------
## v0.5.4
- [COOK-694] added :reject action to the 'firewall_rule' resource.
v0.5.3
------
## v0.5.3
- [COOK-698] added :reset action to the 'firewall' resource.
v0.5.2
------
- Add missing 'requires' statements. fixes 'NameError: uninitialized constant' error.
thanks to Ernad Husremović for the fix.
## v0.5.2
- Add missing 'requires' statements. fixes 'NameError: uninitialized constant' error. Thanks to Ernad Husremović for the fix.
## v0.5.0
v0.5.0
------
- [COOK-686] create firewall and firewall_rule resources
- [COOK-687] create UFW providers for all resources

202
cookbooks/firewall/LICENSE Normal file
View File

@ -0,0 +1,202 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "{}"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright {yyyy} {name of copyright owner}
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

19
cookbooks/firewall/MAINTAINERS.md
View File

@ -1,19 +0,0 @@
<!-- This is a generated file. Please do not edit directly -->
# Maintainers
This file lists how this cookbook project is maintained. When making changes to the system, this
file tells you who needs to review your patch - you need a simple majority of maintainers
for the relevant subsystems to provide a :+1: on your pull request. Additionally, you need
to not receive a veto from a Lieutenant or the Project Lead.
Check out [How Cookbooks are Maintained](https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/CONTRIBUTING.MD)
for details on the process and how to become a maintainer or the project lead.
# Project Maintainer
* [Martin Smith](https://github.com/martinb3)
# Maintainers
* [Jennifer Davis](https://github.com/sigje)
* [Tim Smith](https://github.com/tas50)
* [Thom May](https://github.com/thommay)
* [Martin Smith](https://github.com/martinb3)

255
cookbooks/firewall/README.md
View File

@ -1,59 +1,79 @@
firewall Cookbook
=================
# firewall Cookbook
[![Build Status](https://travis-ci.org/chef-cookbooks/firewall.svg?branch=master)](http://travis-ci.org/chef-cookbooks/firewall)
[![Cookbook Version](https://img.shields.io/cookbook/v/firewall.svg)](https://supermarket.chef.io/cookbooks/firewall)
[![CI State](https://github.com/sous-chefs/firewall/workflows/ci/badge.svg)](https://github.com/sous-chefs/firewall/actions?query=workflow%3Aci)
[![OpenCollective](https://opencollective.com/sous-chefs/backers/badge.svg)](#backers)
[![OpenCollective](https://opencollective.com/sous-chefs/sponsors/badge.svg)](#sponsors)
[![License](https://img.shields.io/badge/License-Apache%202.0-green.svg)](https://opensource.org/licenses/Apache-2.0)
Provides a set of primitives for managing firewalls and associated rules.
PLEASE NOTE - The resource/providers in this cookbook are under heavy development. An attempt is being made to keep the resource simple/stupid by starting with less sophisticated firewall implementations first and refactor/vet the resource definition with each successive provider.
Requirements
------------
**Chef 12.5.x+** is required. We are currently testing against Chef 13. If you need Chef 11 support, please try pinning back to a version less than 2.0, e.g.:
```
depends 'firewall', '< 2.0'
## Maintainers
This cookbook is maintained by the Sous Chefs. The Sous Chefs are a community of Chef cookbook maintainers working together to maintain important cookbooks. If you’d like to know more please visit [sous-chefs.org](https://sous-chefs.org/) or come chat with us on the Chef Community Slack in [#sous-chefs](https://chefcommunity.slack.com/messages/C2V7B88SF).
## Requirements
- Chef Infra Client 15.5+
```ruby
depends 'firewall'
```
### Supported firewalls and platforms
* UFW - Ubuntu, Debian
* IPTables - Red Hat & CentOS, Ubuntu
* FirewallD - Red Hat & CentOS >= 7.0 (IPv4 only support, [needs contributions/testing](https://github.com/chef-cookbooks/firewall/issues/86))
* Windows Advanced Firewall - 2012 R2
- UFW - Ubuntu, Debian (except 9)
- IPTables - Red Hat & CentOS, Ubuntu
- FirewallD - Red Hat & CentOS >= 7.0 (IPv4 only support, [needs contributions/testing](https://github.com/chef-cookbooks/firewall/issues/86))
- Windows Advanced Firewall - 2012 R2
- nftables
Tested on:
* Ubuntu 14.04, 16.04 with iptables, ufw
* Debian 7, 8 with ufw
* CentOS 6 with iptables
* CentOS 7.1 with firewalld
* Windows Server 2012r2 with Windows Advanced Firewall
- Ubuntu 16.04 with iptables, ufw
- Debian 9 with iptables
- Debian 11 with nftables
- Debian 11 with new resources for firewalld
- CentOS 6 with iptables
- CentOS 7.1 with firewalld
- Oracle 8 with nftables
- Windows Server 2012r2 with Windows Advanced Firewall
By default, Ubuntu chooses ufw. To switch to iptables, set this in an attribute file:
```
```ruby
default['firewall']['ubuntu_iptables'] = true
```
By default, Red Hat & CentOS >= 7.0 chooses firewalld. To switch to iptables, set this in an attribute file:
```
```ruby
default['firewall']['redhat7_iptables'] = true
```
# Considerations that apply to all firewall providers and resources
In order to use nftables, just use the resource `nftables` and
`nftables_rule`. These resources are written in more modern design
styles and are not configurable by node attributes.
## Considerations that apply to all firewall providers and resources
This cookbook comes with two resources, firewall and firewall rule. The typical usage scenario is as follows:
- run the `:install` action on the `firewall` resource named 'default', which installs appropriate packages and configures services to start on boot and starts them
- run the `:create` action on every `firewall_rule` resource, which adds to the list of rules that should be configured on the firewall. `firewall_rule` then automatically sends a delayed notification to the `firewall['default']` resource to run the `:restart` action.
- run the delayed notification with action `:restart` on the `firewall` resource. if any rules are different than the last run, the provider will update the current state of the firewall rules to match the expected rules.
There is a fundamental mismatch between the idea of a chef action and the action that should be taken on a firewall rule. For this reason, the chef action for a firewall_rule may be `:nothing` (the rule should not be present in the firewall) or `:create` (the rule should be present in the firewall), but the action taken on a packet in a firewall (`DROP`, `ACCEPT`, etc) is denoted as a `command` parameter on the `firewall_rule` resource.
# iptables considerations
The same points hold for the `nftables`- and `nftables_rule`-resources.
## iptables considerations
If you need to use a table other than `*filter`, the best way to do so is like so:
```
```ruby
node.default['firewall']['iptables']['defaults'][:ruleset] = {
'*filter' => 1,
':INPUT DROP' => 2,
@ -71,7 +91,8 @@ node.default['firewall']['iptables']['defaults'][:ruleset] = {
Note -- in order to support multiple hash keys containing the same rule, anything found after the underscore will be stripped for: `:OUTPUT :INPUT :POSTROUTING :PREROUTING COMMIT`. This allows an example like the above to be reduced to just repeated lines of `COMMIT` and `:OUTPUT ACCEPT` while still avoiding duplication of other things.
Then it's trivial to add additional rules to the `*nat` table using the raw parameter:
```
```ruby
firewall_rule "postroute" do
raw "-A POSTROUTING -o eth1 -p tcp -d 172.28.128.21 -j SNAT --to-source 172.28.128.6"
position 150
@ -81,42 +102,48 @@ end
Note that any line starting with `COMMIT` will become just `COMMIT`, as hash
keys must be unique but we need multiple commit lines.
# Recipes
## nftables
Please read the documentation for the
[`nftables` resource](documentation/resource_nftables.md) and the
[`nftables_rule` resource](documentation/resource_nftables_rule.md)
## Recipes
### default
The default recipe creates a firewall resource with action install.
### disable_firewall
Used to disable platform specific firewall. Many clouds have their own firewall configured outside of the OS instance such as AWS Security Groups.
# Attributes
## Attributes
* `default['firewall']['allow_ssh'] = false`, set true to open port 22 for SSH when the default recipe runs
* `default['firewall']['allow_mosh'] = false`, set to true to open UDP ports 60000 - 61000 for [Mosh][0] when the default recipe runs
* `default['firewall']['allow_winrm'] = false`, set true to open port 5989 for WinRM when the default recipe runs
* `default['firewall']['allow_loopback'] = false`, set to true to allow all traffic on the loopback interface
* `default['firewall']['allow_icmp'] = false`, set true to allow icmp protocol on supported OSes (note: ufw and windows implementations don't support this)
- `default['firewall']['allow_ssh'] = false`, set true to open port 22 for SSH when the default recipe runs
- `default['firewall']['allow_mosh'] = false`, set to true to open UDP ports 60000 - 61000 for [Mosh][0] when the default recipe runs
- `default['firewall']['allow_winrm'] = false`, set true to open port 5989 for WinRM when the default recipe runs
- `default['firewall']['allow_loopback'] = false`, set to true to allow all traffic on the loopback interface
- `default['firewall']['allow_icmp'] = false`, set true to allow icmp protocol on supported OSes (note: ufw and windows implementations don't support this)
- `default['firewall']['ubuntu_iptables'] = false`, set to true to use iptables on Ubuntu / Debian when using the default recipe
- `default['firewall']['redhat7_iptables'] = false`, set to true to use iptables on Red Hat / CentOS 7 when using the default recipe
- `default['firewall']['ufw']['defaults']` hash for template `/etc/default/ufw`
- `default['firewall']['iptables']['defaults']` hash for default policies for 'filter' table's chains`
- `default['firewall']['windows']['defaults']` hash to define inbound / outbound firewall policy on Windows platform
- `default['firewall']['allow_established'] = true`, set to false if you don't want a related/established default rule on iptables
- `default['firewall']['ipv6_enabled'] = true`, set to false if you don't want IPv6 related/established default rule on iptables (this enables ICMPv6, which is required for much of IPv6 communication)
- `default['firewall']['firewalld']['permanent'] = false`, set to true if you want firewalld rules to be added with `--permanent` so they survive a reboot. This will be changed to `true` by default in a future major version release.
* `default['firewall']['ubuntu_iptables'] = false`, set to true to use iptables on Ubuntu / Debian when using the default recipe
* `default['firewall']['redhat7_iptables'] = false`, set to true to use iptables on Red Hat / CentOS 7 when using the default recipe
## Resources
* `default['firewall']['ufw']['defaults']` hash for template `/etc/default/ufw`
* `default['firewall']['iptables']['defaults']` hash for default policies for 'filter' table's chains`
* `default['firewall']['windows']['defaults']` hash to define inbound / outbound firewall policy on Windows platform
* `default['firewall']['allow_established'] = true`, set to false if you don't want a related/established default rule on iptables
* `default['firewall']['ipv6_enabled'] = true`, set to false if you don't want IPv6 related/established default rule on iptables (this enables ICMPv6, which is required for much of IPv6 communication)
* `default['firewall']['firewalld']['permanent'] = false`, set to true if you want firewalld rules to be added with `--permanent` so they survive a reboot. This will be changed to `true` by default in a future major version release.
# Resources
There is a separate folder for [`firewalld` resources](documentation/README.md).
### firewall
***NB***: The name 'default' of this resource is important as it is used for firewall_rule providers to locate the firewall resource. If you change it, you must also supply the same value to any firewall_rule resources using the `firewall_name` parameter.
#### Actions
- `:install` (*default action*): Install and Enable the firewall. This will ensure the appropriate packages are installed and that any services have been started.
- `:disable`: Disable the firewall. Drop any rules and put the node in an unprotected state. Flush all current rules. Also erase any internal state used to detect when rules should be applied.
- `:flush`: Flush all current rules. Also erase any internal state used to detect when rules should be applied.
@ -132,8 +159,6 @@ Used to disable platform specific firewall. Many clouds have their own firewall
- `enabled_zone` (firewalld only): The zone to set on firewalld when the firewall should be enabled. Can be any string in symbol form, e.g. :public, :drop, etc. Defaults to `:drop.`
- `package_options`: Used to pass options to the package install of firewall
#### Examples
```ruby
# all defaults
firewall 'default'
@ -153,55 +178,36 @@ end
### firewall_rule
#### Actions
- `:create` (_default action_): If a firewall_rule runs this action, the rule will be recorded in a chef resource's internal state, and applied when providers automatically notify the firewall resource with action `:reload`. The notification happens automatically.
- `:create` (*default action*): If a firewall_rule runs this action, the rule will be recorded in a chef resource's internal state, and applied when providers automatically notify the firewall resource with action `:reload`. The notification happens automatically.
#### Parameters
- `firewall_name`: the matching firewall resource that this rule applies to. Default value: `default`
- `raw`: Used to pass an entire rule as a string, omitting all other parameters. This line will be directly loaded by `iptables-restore`, fed directly into `ufw` on the command line, or run using `firewall-cmd`.
- `description` (_default: same as rule name_): Used to provide a comment that will be included when adding the firewall rule.
- `include_comment` (_default: true_): Used to optionally exclude the comment in the rule.
- `position` (_default: 50_): **relative** position to insert rule at. Position may be any integer between 0 < n < 100 (exclusive), and more than one rule may specify the same position.
- `description` (*default: same as rule name*): Used to provide a comment that will be included when adding the firewall rule.
- `include_comment` (*default: true*): Used to optionally exclude the comment in the rule.
- `position` (*default: 50*): **relative** position to insert rule at. Position may be any integer between 0 < n < 100 (exclusive), and more than one rule may specify the same position.
- `command`: What action to take on a particular packet
- `:allow` (_default action_): the rule should allow matching packets
- `:deny`: the rule should deny matching packets
- `:reject`: the rule should reject matching packets
- `:masqerade`: Masquerade the matching packets
- `:redirect`: Redirect the matching packets
- `:log`: Configure logging
- `:allow` (*default action*): the rule should allow matching packets
- `:deny`: the rule should deny matching packets
- `:reject`: the rule should reject matching packets
- `:masquerade`: Masquerade the matching packets
- `:redirect`: Redirect the matching packets
- `:log`: Configure logging
- `stateful`: a symbol or array of symbols, such as ``[:related, :established]` that will be passed to the state module in iptables or firewalld.
- `protocol`: `:tcp` (_default_), `:udp`, `:icmp`, `:none` or protocol number. Using protocol numbers is not supported using the ufw provider (default for debian/ubuntu systems).
- `direction`: For ufw, direction of the rule. valid values are: `:in` (_default_), `:out`, `:pre`, `:post`.
- `source` (_Default is `0.0.0.0/0` or `Anywhere`_): source ip address or subnet to filter.
- `source_port` (_Default is nil_): source port for filtering packets.
- `protocol`: `:tcp` (*default*), `:udp`, `:icmp`, `:none` or protocol number. Using protocol numbers is not supported using the ufw provider (default for debian/ubuntu systems).
- `direction`: For ufw, direction of the rule. valid values are: `:in` (*default*), `:out`, `:pre`, `:post`.
- `source` (*Default is `0.0.0.0/0` or `Anywhere`*): source ip address or subnet to filter.
- `source_port` (*Default is nil*): source port for filtering packets.
- `destination`: ip address or subnet to filter on packet destination, must be a valid IP
- `port` or `dest_port`: target port number (ie. 22 to allow inbound SSH), or an array of incoming port numbers (ie. [80,443] to allow inbound HTTP & HTTPS).
NOTE: `protocol` attribute is required with multiple ports, or a range of incoming port numbers (ie. 60000..61000 to allow inbound mobile-shell. NOTE: `protocol`, or an attribute is required with a range of ports.
NOTE: `protocol` attribute is required with multiple ports, or a range of incoming port numbers (ie. 60000..61000 to allow inbound mobile-shell. NOTE: `protocol`, or an attribute is required with a range of ports.
- `interface`: (source) interface to apply rule (ie. `eth0`).
- `dest_interface`: interface where packets may be destined to go
- `redirect_port`: redirected port for rules with command `:redirect`
- `logging`: may be added to enable logging for a particular rule. valid values are: `:connections`, `:packets`. In the ufw provider, `:connections` logs new connections while `:packets` logs all packets.
#### Examples
```ruby
# open standard ssh port
firewall_rule 'ssh' do
@ -245,7 +251,7 @@ firewall_rule "VRRP" do
raw "allow to 224.0.0.18"
end
# open UDP ports 60000..61000 for mobile shell (mosh.mit.edu), note
# open UDP ports 60000..61000 for mobile shell (mosh.org), note
# that the protocol attribute is required when using port_range
firewall_rule 'mosh' do
protocol :udp
@ -273,66 +279,71 @@ end
Different providers will determine the current state of the rules differently -- parsing the output of a command, maintaining the state in a file, or some other way. If the firewall is adjusted from outside of chef (non-idempotent), it's possible that chef may be caught unaware of the current state of the firewall. The best workaround is to add a `:flush` action to the firewall resource as early as possible in the chef run, if you plan to modify the firewall state outside of chef.
# Troubleshooting
## Troubleshooting
To figure out what the position values are for current rules, print the hash that contains the weights:
```
```ruby
require pp
default_firewall = resources(:firewall, 'default')
pp default_firewall.rules
```
# Development
## Development
This section details "quick development" steps. For a detailed explanation, see [[Contributing.md]].
1. Clone this repository from GitHub:
$ git clone git@github.com:chef-cookbooks/firewall.git
`$ git clone git@github.com:chef-cookbooks/firewall.git`
2. Create a git branch
1. Create a git branch
$ git checkout -b my_bug_fix
`$ git checkout -b my_bug_fix`
3. Install dependencies:
1. Install dependencies:
$ bundle install
`$ bundle install`
4. Make your changes/patches/fixes, committing appropiately
5. **Write tests**
6. Run the tests:
- `bundle exec foodcritic -f any .`
- `bundle exec rspec`
- `bundle exec rubocop`
- `bundle exec kitchen test`
1. Make your changes/patches/fixes, committing appropiately
1. **Write tests**
1. Run the tests:
In detail:
- Foodcritic will catch any Chef-specific style errors
- RSpec will run the unit tests
- Rubocop will check for Ruby-specific style errors
- Test Kitchen will run and converge the recipes
- `bundle exec foodcritic -f any .`
- `bundle exec rspec`
- `bundle exec rubocop`
- `bundle exec kitchen test`
In detail:
# License & Authors
<!-- $ find -type f -iname "*.rb" -exec grep -i author '{}' \; | sort -k4 | uniq | sed 's/#/-/g' -->
- Author:: Seth Chisamore (<schisamo@opscode.com>)
- Author:: Ronald Doorn (<rdoorn@schubergphilis.com>)
- Author:: Martin Smith (<martin@mbs3.org>)
- Author:: Sander van Harmelen (<svanharmelen@schubergphilis.com>)
- Foodcritic will catch any Chef-specific style errors
- RSpec will run the unit tests
- Rubocop will check for Ruby-specific style errors
- Test Kitchen will run and converge the recipes
```text
Copyright:: 2011-2015, Chef Software, Inc
## Contributors
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
This project exists thanks to all the people who [contribute.](https://opencollective.com/sous-chefs/contributors.svg?width=890&button=false)
http://www.apache.org/licenses/LICENSE-2.0
### Backers
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
```
Thank you to all our backers!
[0]: https://mosh.mit.edu/
![https://opencollective.com/sous-chefs#backers](https://opencollective.com/sous-chefs/backers.svg?width=600&avatarHeight=40)
### Sponsors
Support this project by becoming a sponsor. Your logo will show up here with a link to your website.
![https://opencollective.com/sous-chefs/sponsor/0/website](https://opencollective.com/sous-chefs/sponsor/0/avatar.svg?avatarHeight=100)
![https://opencollective.com/sous-chefs/sponsor/1/website](https://opencollective.com/sous-chefs/sponsor/1/avatar.svg?avatarHeight=100)
![https://opencollective.com/sous-chefs/sponsor/2/website](https://opencollective.com/sous-chefs/sponsor/2/avatar.svg?avatarHeight=100)
![https://opencollective.com/sous-chefs/sponsor/3/website](https://opencollective.com/sous-chefs/sponsor/3/avatar.svg?avatarHeight=100)
![https://opencollective.com/sous-chefs/sponsor/4/website](https://opencollective.com/sous-chefs/sponsor/4/avatar.svg?avatarHeight=100)
![https://opencollective.com/sous-chefs/sponsor/5/website](https://opencollective.com/sous-chefs/sponsor/5/avatar.svg?avatarHeight=100)
![https://opencollective.com/sous-chefs/sponsor/6/website](https://opencollective.com/sous-chefs/sponsor/6/avatar.svg?avatarHeight=100)
![https://opencollective.com/sous-chefs/sponsor/7/website](https://opencollective.com/sous-chefs/sponsor/7/avatar.svg?avatarHeight=100)
![https://opencollective.com/sous-chefs/sponsor/8/website](https://opencollective.com/sous-chefs/sponsor/8/avatar.svg?avatarHeight=100)
![https://opencollective.com/sous-chefs/sponsor/9/website](https://opencollective.com/sous-chefs/sponsor/9/avatar.svg?avatarHeight=100)
[0]: https://mosh.org

6
cookbooks/firewall/TODO.md Normal file
View File

@ -0,0 +1,6 @@
# TODO
- update for rhel-8+ nftables, RHEL docs recommend nftables for new firewalls <https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking>
- fix windows tests
- iptables' `-S` not supported in libraries/provider_firewall_iptables.rb
- save action might not make sense for firewalls

6
cookbooks/firewall/attributes/iptables.rb
View File

@ -5,9 +5,9 @@ default['firewall']['iptables']['defaults'][:policy] = {
}
default['firewall']['iptables']['defaults'][:ruleset] = {
'*filter' => 1,
":INPUT #{node['firewall']['iptables']['defaults'][:policy][:input]}" => 2,
":FORWARD #{node['firewall']['iptables']['defaults'][:policy][:forward]}" => 3,
":OUTPUT #{node['firewall']['iptables']['defaults'][:policy][:output]}" => 4,
":INPUT #{node['firewall']['iptables']['defaults']['policy']['input']}" => 2,
":FORWARD #{node['firewall']['iptables']['defaults']['policy']['forward']}" => 3,
":OUTPUT #{node['firewall']['iptables']['defaults']['policy']['output']}" => 4,
'COMMIT_FILTER' => 100,
}

115
cookbooks/firewall/chefignore Normal file
View File

@ -0,0 +1,115 @@
# Put files/directories that should be ignored in this file when uploading
# to a Chef Infra Server or Supermarket.
# Lines that start with '# ' are comments.
# OS generated files #
######################
.DS_Store
ehthumbs.db
Icon?
nohup.out
Thumbs.db
.envrc
# EDITORS #
###########
.#*
.project
.settings
*_flymake
*_flymake.*
*.bak
*.sw[a-z]
*.tmproj
*~
\#*
REVISION
TAGS*
tmtags
.vscode
.editorconfig
## COMPILED ##
##############
*.class
*.com
*.dll
*.exe
*.o
*.pyc
*.so
*/rdoc/
a.out
mkmf.log
# Testing #
###########
.circleci/*
.codeclimate.yml
.delivery/*
.foodcritic
.kitchen*
.mdlrc
.overcommit.yml
.rspec
.rubocop.yml
.travis.yml
.watchr
.yamllint
azure-pipelines.yml
Dangerfile
examples/*
features/*
Guardfile
kitchen*.yml
mlc_config.json
Procfile
Rakefile
spec/*
test/*
# SCM #
#######
.git
.gitattributes
.gitconfig
.github/*
.gitignore
.gitkeep
.gitmodules
.svn
*/.bzr/*
*/.git
*/.hg/*
*/.svn/*
# Berkshelf #
#############
Berksfile
Berksfile.lock
cookbooks/*
tmp
# Bundler #
###########
vendor/*
Gemfile
Gemfile.lock
# Policyfile #
##############
Policyfile.rb
Policyfile.lock.json
# Documentation #
#############
CODE_OF_CONDUCT*
CONTRIBUTING*
documentation/*
TESTING*
UPGRADING*
# Vagrant #
###########
.vagrant
Vagrantfile

9
cookbooks/firewall/libraries/helpers.rb
View File

@ -67,8 +67,8 @@ module FirewallCookbook
end
end
def ubuntu?(current_node)
current_node['platform'] == 'ubuntu'
def debian?(current_node)
current_node['platform_family'] == 'debian'
end
def build_rule_file(rules)
@ -96,5 +96,10 @@ module FirewallCookbook
false
end
def default_description(new_resource)
new_resource.description ||
"Generated by chef from #{cookbook_name}[#{recipe_name}] by #{new_resource}"
end
end
end

2
cookbooks/firewall/libraries/helpers_firewalld.rb
View File

@ -21,7 +21,7 @@ module FirewallCookbook
return false unless firewalld_active?
cmd = shell_out('firewall-cmd', '--get-default-zone')
cmd.stdout =~ /^#{z.to_s}$/
cmd.stdout =~ /^#{z}$/
end
def firewalld_default_zone!(z)

72
cookbooks/firewall/libraries/helpers_firewalld_dbus.rb Normal file
View File

@ -0,0 +1,72 @@
module FirewallCookbook
module Helpers
module FirewalldDBus
def firewalld(system_bus)
system_bus['org.fedoraproject.FirewallD1']
end
def firewalld_object(system_bus)
firewalld(system_bus)['/org/fedoraproject/FirewallD1']
end
def firewalld_interface(system_bus)
firewalld_object(system_bus)['org.fedoraproject.FirewallD1']
end
def config_object(system_bus)
firewalld(system_bus)['/org/fedoraproject/FirewallD1/config']
end
def config_interface(system_bus)
config_object(system_bus)['org.fedoraproject.FirewallD1.config']
end
def icmptype_interface(dbus, icmptype_path)
icmptype_object = firewalld(dbus)[icmptype_path]
icmptype_object['org.fedoraproject.FirewallD1.config.icmptype']
end
def ipset_interface(dbus, ipset_path)
ipset_object = firewalld(dbus)[ipset_path]
ipset_object['org.fedoraproject.FirewallD1.config.ipset']
end
def helper_interface(dbus, helper_path)
helper_object = firewalld(dbus)[helper_path]
helper_object['org.fedoraproject.FirewallD1.config.helper']
end
def service_interface(dbus, service_path)
service_object = firewalld(dbus)[service_path]
service_object['org.fedoraproject.FirewallD1.config.service']
end
def policy_interface(dbus, policy_path)
policy_object = firewalld(dbus)[policy_path]
policy_object['org.fedoraproject.FirewallD1.config.policy']
end
def zone_interface(dbus, zone_path)
zone_object = firewalld(dbus)[zone_path]
zone_object['org.fedoraproject.FirewallD1.config.zone']
end
# port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]
def parse_forward_ports(forward_ports)
port_regex = %r{port=([\w-]+):proto=([\w]+)(:toport=([\w-]+)|)(:toaddr=([\d\./]+)|)}
captures = forward_ports.match(port_regex).captures
captures.delete_at(4)
captures.delete_at(2)
captures.map { |e| e || '' }
end
def forward_ports_to_dbus(new_resource)
fwp = new_resource.forward_ports.map do |e|
parse_forward_ports(e)
end
new_resource.forward_ports = fwp
DBus.variant('a(ssss)', new_resource.forward_ports)
end
end
end
end

4
cookbooks/firewall/libraries/helpers_iptables.rb
View File

@ -49,14 +49,14 @@ module FirewallCookbook
end
def iptables_packages(new_resource)
packages = if ipv6_enabled?(new_resource)
packages = if ipv6_enabled?(new_resource) && !amazon_linux? && node['platform_version'].to_i < 8
%w(iptables iptables-ipv6)
else
%w(iptables)
end
# centos 7 requires extra service
if !ubuntu?(node) && node['platform_version'].to_i >= 7
if (!debian?(node) && node['platform_version'].to_i >= 7) || amazon_linux?
packages << %w(iptables-services)
end

170
cookbooks/firewall/libraries/helpers_nftables.rb Normal file
View File

@ -0,0 +1,170 @@
module FirewallCookbook
module Helpers
module Nftables
include FirewallCookbook::Helpers
CHAIN ||= {
in: 'INPUT',
out: 'OUTPUT',
pre: 'PREROUTING',
post: 'POSTROUTING',
forward: 'FORWARD',
}.freeze
TARGET ||= {
accept: 'accept',
allow: 'accept',
counter: 'counter',
deny: 'drop',
drop: 'drop',
log: 'log',
masquerade: 'masquerade',
redirect: 'redirect',
reject: 'reject',
}.freeze
def port_to_s(ports)
case ports
when String
ports
when Integer
ports.to_s
when Array
p_strings = ports.map { |o| port_to_s(o) }
"{#{p_strings.sort.join(',')}}"
when Range
"#{ports.first}-#{ports.last}"
else
raise "unknown class of port definition: #{ports.class}"
end
end
def nftables_command_log(rule_resource)
log_prefix = 'prefix '
log_prefix << if rule_resource.log_prefix.nil?
"\"#{CHAIN[rule_resource.direction]}:\""
else
"\"#{rule_resource.log_prefix}\""
end
log_group = if rule_resource.log_group.nil?
nil
else
"group #{rule_resource.log_group} "
end
"log #{log_prefix} #{log_group}"
end
def nftables_command_redirect(rule_resource)
if rule_resource.redirect_port.nil?
raise 'Specify redirect_port when using :redirect as commmand'
end
"redirect to #{rule_resource.redirect_port} "
end
def nftables_commands(rule_resource)
firewall_rule = ''
Array(rule_resource.command).each do |command|
begin
target = TARGET.fetch(command)
rescue KeyError
raise "Invalid command: #{command.inspect}. Use one of #{TARGET.keys}"
end
firewall_rule << case target
when 'log'
nftables_command_log(rule_resource)
when 'redirect'
nftables_command_redirect(rule_resource)
else
"#{TARGET[command.to_sym]} "
end
end
firewall_rule
end
def build_firewall_rule(rule_resource)
return rule_resource.raw.strip if rule_resource.raw
ip = ipv6_rule?(rule_resource) ? 'ip6' : 'ip'
table = if [:pre, :post].include?(rule_resource.direction)
'nat'
else
'filter'
end
firewall_rule = if table == 'nat'
"add rule #{ip} #{table} "
else
"add rule inet #{table} "
end
firewall_rule << "#{CHAIN.fetch(rule_resource.direction.to_sym, 'FORWARD')} "
firewall_rule << "iif #{rule_resource.interface} " if rule_resource.interface
firewall_rule << "oif #{rule_resource.outerface} " if rule_resource.outerface
if rule_resource.source
source_with_mask = ip_with_mask(rule_resource, rule_resource.source)
if source_with_mask != '0.0.0.0/0' && source_with_mask != '::/128'
firewall_rule << "#{ip} saddr #{source_with_mask} "
end
end
firewall_rule << "#{ip} daddr #{rule_resource.destination} " if rule_resource.destination
case rule_resource.protocol
when :icmp
firewall_rule << 'icmp type echo-request '
when :'ipv6-icmp', :icmpv6
firewall_rule << 'icmpv6 type { echo-request, nd-router-solicit, nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } '
when :tcp, :udp
firewall_rule << "#{rule_resource.protocol} sport #{port_to_s(rule_resource.sport)} " if rule_resource.sport
firewall_rule << "#{rule_resource.protocol} dport #{port_to_s(rule_resource.dport)} " if rule_resource.dport
when :esp, :ah
firewall_rule << "#{ip} #{ip == 'ip6' ? 'nexthdr' : 'protocol'} #{rule_resource.protocol} "
when :ipv6, :none
# nothing to do
end
firewall_rule << "ct state #{Array(rule_resource.stateful).join(',').downcase} " if rule_resource.stateful
firewall_rule << nftables_commands(rule_resource)
firewall_rule << "comment \"#{rule_resource.description}\" " if rule_resource.include_comment
firewall_rule.strip!
firewall_rule
end
def default_ruleset(new_resource)
rules = {
'add table inet filter' => 1,
"add chain inet filter INPUT { type filter hook input priority 0 ; policy #{new_resource.input_policy}; }" => 2,
"add chain inet filter OUTPUT { type filter hook output priority 0 ; policy #{new_resource.output_policy}; }" => 2,
"add chain inet filter FOWARD { type filter hook forward priority 0 ; policy #{new_resource.forward_policy}; }" => 2,
}
if new_resource.table_ip_nat
rules['add table ip nat'] = 1
rules['add chain ip nat POSTROUTING { type nat hook postrouting priority 100 ;}'] = 2
rules['add chain ip nat PREROUTING { type nat hook prerouting priority -100 ;}'] = 2
end
if new_resource.table_ip6_nat
rules['add table ip6 nat'] = 1
rules['add chain ip6 nat POSTROUTING { type nat hook postrouting priority 100 ;}'] = 2
rules['add chain ip6 nat PREROUTING { type nat hook prerouting priority -100 ;}'] = 2
end
rules
end
def ensure_default_rules_exist(new_resource)
input = new_resource.rules || {}
input.merge!(default_ruleset(new_resource))
end
def default_nftables_conf_path
case node['platform_family']
when 'rhel'
'/etc/sysconfig/nftables.conf'
when 'debian'
'/etc/nftables.conf'
else
raise "default_nftables_conf_path: Unsupported platform_family #{node['platform_family']}."
end
end
end
end
end

7
cookbooks/firewall/libraries/helpers_ufw.rb
View File

@ -74,6 +74,7 @@ module FirewallCookbook
rule << rule_proto(new_resource)
rule << rule_dest_port(new_resource)
rule << rule_source_port(new_resource)
rule << rule_description(new_resource)
rule = rule.strip
if rule == 'ufw allow in proto tcp to any from any'
@ -97,6 +98,12 @@ module FirewallCookbook
rule
end
def rule_description(new_resource)
rule = ''
rule << "comment \"#{new_resource.description}\" " if new_resource.description && new_resource.include_comment
rule
end
def rule_dest_port(new_resource)
rule = if new_resource.destination
"to #{new_resource.destination} "

17
cookbooks/firewall/libraries/helpers_windows.rb
View File

@ -44,12 +44,11 @@ module FirewallCookbook
def to_type(new_resource)
cmd = new_resource.command
type = if cmd == :reject || cmd == :deny
:block
else
:allow
end
type
if cmd == :reject || cmd == :deny
:block
else
:allow
end
end
def build_rule(new_resource)
@ -66,13 +65,13 @@ module FirewallCookbook
if new_resource.direction.to_sym == :out
parameters['localip'] = new_resource.source ? fixup_cidr(new_resource.source) : 'any'
parameters['localport'] = new_resource.source_port ? port_to_s(new_resource.source_port) : 'any'
parameters['interfacetype'] = new_resource.interface ? new_resource.interface : 'any'
parameters['interfacetype'] = new_resource.interface || 'any'
parameters['remoteip'] = new_resource.destination ? fixup_cidr(new_resource.destination) : 'any'
parameters['remoteport'] = new_resource.dest_port ? port_to_s(new_resource.dest_port) : 'any'
else
parameters['localip'] = new_resource.destination ? new_resource.destination : 'any'
parameters['localip'] = new_resource.destination || 'any'
parameters['localport'] = dport_calc(new_resource) ? port_to_s(dport_calc(new_resource)) : 'any'
parameters['interfacetype'] = new_resource.dest_interface ? new_resource.dest_interface : 'any'
parameters['interfacetype'] = new_resource.dest_interface || 'any'
parameters['remoteip'] = new_resource.source ? fixup_cidr(new_resource.source) : 'any'
parameters['remoteport'] = new_resource.source_port ? port_to_s(new_resource.source_port) : 'any'
end

30
cookbooks/firewall/libraries/matchers.rb
View File

@ -1,30 +0,0 @@
if defined?(ChefSpec)
ChefSpec.define_matcher(:firewall)
ChefSpec.define_matcher(:firewall_rule)
# actions(:install, :restart, :disable, :flush, :save)
def install_firewall(resource)
ChefSpec::Matchers::ResourceMatcher.new(:firewall, :install, resource)
end
def restart_firewall(resource)
ChefSpec::Matchers::ResourceMatcher.new(:firewall, :restart, resource)
end
def disable_firewall(resource)
ChefSpec::Matchers::ResourceMatcher.new(:firewall, :disable, resource)
end
def flush_firewall(resource)
ChefSpec::Matchers::ResourceMatcher.new(:firewall, :flush, resource)
end
def save_firewall(resource)
ChefSpec::Matchers::ResourceMatcher.new(:firewall, :save, resource)
end
def create_firewall_rule(resource)
ChefSpec::Matchers::ResourceMatcher.new(:firewall_rule, :create, resource)
end
end

14
cookbooks/firewall/libraries/provider_firewall_firewalld.rb
View File

@ -19,15 +19,15 @@ class Chef
class Provider::FirewallFirewalld < Chef::Provider::LWRPBase
include FirewallCookbook::Helpers::Firewalld
provides :firewall, os: 'linux', platform_family: %w(rhel fedora) do |node|
node['platform_version'].to_f >= 7.0 && !node['firewall']['redhat7_iptables']
provides :firewall, os: 'linux', platform_family: %w(rhel fedora amazon) do |node|
(node['platform_version'].to_i == 7 && !node['firewall']['redhat7_iptables']) || (amazon_linux? && !node['firewall']['redhat7_iptables'])
end
def whyrun_supported?
false
end
def action_install
action :install do
return if disabled?(new_resource)
firewalld_package = package 'firewalld' do
@ -51,7 +51,7 @@ class Chef
end
end
def action_restart
action :restart do
return if disabled?(new_resource)
# ensure it's initialized
@ -111,7 +111,7 @@ class Chef
new_resource.updated_by_last_action(true)
end
def action_disable
action :disable do
return if disabled?(new_resource)
if firewalld_active?
@ -133,7 +133,7 @@ class Chef
new_resource.updated_by_last_action(rules_file.updated_by_last_action?)
end
def action_flush
action :flush do
return if disabled?(new_resource)
return unless firewalld_active?
@ -146,7 +146,7 @@ class Chef
new_resource.updated_by_last_action(rules_file.updated_by_last_action?)
end
def action_save
action :save do
return if disabled?(new_resource)
return if firewalld_all_rules_permanent!

16
cookbooks/firewall/libraries/provider_firewall_iptables.rb
View File

@ -3,7 +3,7 @@
# Cookbook:: firewall
# Resource:: default
#
# Copyright:: 2011-2016, Chef Software, Inc.
# Copyright:: 2011-2019, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -22,15 +22,15 @@ class Chef
include FirewallCookbook::Helpers
include FirewallCookbook::Helpers::Iptables
provides :firewall, os: 'linux', platform_family: %w(rhel fedora) do |node|
node['platform_version'].to_f < 7.0 || node['firewall']['redhat7_iptables']
provides :firewall, os: 'linux', platform_family: %w(rhel fedora amazon) do |node|
(node['platform_version'].to_i < 7 && !amazon_linux?) || node['platform_version'].to_i >= 8 || node['firewall']['redhat7_iptables']
end
def whyrun_supported?
false
end
def action_install
action :install do
return if disabled?(new_resource)
# Ensure the package is installed
@ -60,7 +60,7 @@ class Chef
end
end
def action_restart
action :restart do
return if disabled?(new_resource)
# prints all the firewall rules
@ -104,12 +104,12 @@ class Chef
next unless iptables_file.updated_by_last_action?
iptables_service = lookup_or_create_service(iptables_type)
new_resource.notifies(:restart, iptables_service, :delayed)
iptables_service.run_action(:restart)
new_resource.updated_by_last_action(true)
end
end
def action_disable
action :disable do
return if disabled?(new_resource)
iptables_flush!(new_resource)
@ -131,7 +131,7 @@ class Chef
end
end
def action_flush
action :flush do
return if disabled?(new_resource)
iptables_flush!(new_resource)

23
cookbooks/firewall/libraries/provider_firewall_iptables_ubuntu.rb
View File

@ -3,7 +3,7 @@
# Cookbook:: firewall
# Resource:: default
#
# Copyright:: 2011-2016, Chef Software, Inc.
# Copyright:: 2011-2019, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -23,14 +23,15 @@ class Chef
include FirewallCookbook::Helpers::Iptables
provides :firewall, os: 'linux', platform_family: %w(debian) do |node|
node['platform_version'].to_f > 14.04 && node['firewall'] && node['firewall']['ubuntu_iptables']
node['firewall'] && node['firewall']['ubuntu_iptables'] &&
node['platform_version'].to_f > (node['platform'] == 'ubuntu' ? 14.04 : 7)
end
def whyrun_supported?
false
end
def action_install
action :install do
return if disabled?(new_resource)
# Ensure the package is installed
@ -63,7 +64,7 @@ class Chef
end
end
def action_restart
action :restart do
return if disabled?(new_resource)
# prints all the firewall rules
@ -97,6 +98,8 @@ class Chef
end
end
restart_service = false
rule_files = %w(iptables)
rule_files << 'ip6tables' if ipv6_enabled?(new_resource)
@ -119,17 +122,19 @@ class Chef
iptables_file.run_action(:create)
# if the file was changed, restart iptables
next unless iptables_file.updated_by_last_action?
restart_service = true if iptables_file.updated_by_last_action?
end
if restart_service
service_affected = service 'netfilter-persistent' do
action :nothing
end
new_resource.notifies(:restart, service_affected, :delayed)
service_affected.run_action(:restart)
new_resource.updated_by_last_action(true)
end
end
def action_disable
action :disable do
return if disabled?(new_resource)
iptables_flush!(new_resource)
@ -152,7 +157,7 @@ class Chef
end
end
def action_flush
action :flush do
return if disabled?(new_resource)
iptables_flush!(new_resource)

25
cookbooks/firewall/libraries/provider_firewall_iptables_ubuntu1404.rb
View File

@ -1,9 +1,9 @@
#
# Author:: Seth Chisamore (<schisamo@opscode.com>)
# Cookbook Name:: firewall
# Cookbook:: firewall
# Resource:: default
#
# Copyright:: 2011, Opscode, Inc.
# Copyright:: 2011-2019, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -23,14 +23,15 @@ class Chef
include FirewallCookbook::Helpers::Iptables
provides :firewall, os: 'linux', platform_family: %w(debian) do |node|
node['platform_version'].to_f <= 14.04 && node['firewall'] && node['firewall']['ubuntu_iptables']
node['firewall'] && node['firewall']['ubuntu_iptables'] &&
node['platform_version'].to_f <= (node['platform'] == 'ubuntu' ? 14.04 : 7)
end
def whyrun_supported?
false
end
def action_install
action :install do
return if disabled?(new_resource)
# Ensure the package is installed
@ -63,7 +64,7 @@ class Chef
end
end
def action_restart
action :restart do
return if disabled?(new_resource)
# prints all the firewall rules
@ -97,6 +98,8 @@ class Chef
end
end
restart_service = false
rule_files = %w(iptables)
rule_files << 'ip6tables' if ipv6_enabled?(new_resource)
@ -119,17 +122,19 @@ class Chef
iptables_file.run_action(:create)
# if the file was changed, restart iptables
next unless iptables_file.updated_by_last_action?
restart_service = true if iptables_file.updated_by_last_action?
end
if restart_service
service_affected = service 'iptables-persistent' do
action :nothing
end
new_resource.notifies(:restart, service_affected, :delayed)
service_affected.run_action(:restart)
new_resource.updated_by_last_action(true)
end
end
def action_disable
action :disable do
return if disabled?(new_resource)
iptables_flush!(new_resource)
@ -152,7 +157,7 @@ class Chef
end
end
def action_flush
action :flush do
return if disabled?(new_resource)
iptables_flush!(new_resource)

2
cookbooks/firewall/libraries/provider_firewall_rule.rb
View File

@ -21,7 +21,7 @@ class Chef
class Provider::FirewallRuleGeneric < Chef::Provider::LWRPBase
provides :firewall_rule
def action_create
action :create do
return unless new_resource.notify_firewall
firewall_resource = Chef.run_context.resource_collection.find(firewall: new_resource.firewall_name)

10
cookbooks/firewall/libraries/provider_firewall_ufw.rb
View File

@ -3,7 +3,7 @@
# Cookbook:: firewall
# Resource:: default
#
# Copyright:: 2011-2016, Chef Software, Inc.
# Copyright:: 2011-2019, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -29,7 +29,7 @@ class Chef
false
end
def action_install
action :install do
return if disabled?(new_resource)
pkg_ufw = package 'ufw' do
@ -58,7 +58,7 @@ class Chef
new_resource.updated_by_last_action(true) if ufw_file.updated_by_last_action?
end
def action_restart
action :restart do
return if disabled?(new_resource)
# ensure it's initialized
@ -99,7 +99,7 @@ class Chef
new_resource.updated_by_last_action(true)
end
def action_disable
action :disable do
return if disabled?(new_resource)
ufw_file = lookup_or_create_rulesfile
@ -112,7 +112,7 @@ class Chef
new_resource.updated_by_last_action(true)
end
def action_flush
action :flush do
return if disabled?(new_resource)
ufw_reset!

8
cookbooks/firewall/libraries/provider_firewall_windows.rb
View File

@ -26,7 +26,7 @@ class Chef
false
end
def action_install
action :install do
return if disabled?(new_resource)
svc = service 'MpsSvc' do
@ -39,7 +39,7 @@ class Chef
end
end
def action_restart
action :restart do
return if disabled?(new_resource)
# ensure it's initialized
@ -94,7 +94,7 @@ class Chef
new_resource.updated_by_last_action(true)
end
def action_disable
action :disable do
return if disabled?(new_resource)
if active?
@ -115,7 +115,7 @@ class Chef
end
end
def action_flush
action :flush do
return if disabled?(new_resource)
reset!

5
cookbooks/firewall/libraries/resource_firewall_rule.rb
View File

@ -6,7 +6,6 @@ class Chef
resource_name(:firewall_rule)
provides(:firewall_rule)
actions(:create)
default_action(:create)
attribute(:firewall_name, kind_of: String, default: 'default')
@ -20,12 +19,12 @@ class Chef
attribute(:direction, kind_of: Symbol, equal_to: [:in, :out, :pre, :post], default: :in)
attribute(:logging, kind_of: Symbol, equal_to: [:connections, :packets])
attribute(:source, callbacks: { 'must be a valid ip address' => ->(ip) { !!IPAddr.new(ip) } })
attribute(:source, kind_of: String, callbacks: { 'must be a valid ip address' => ->(ip) { !!IPAddr.new(ip) } })
attribute(:source_port, kind_of: [Integer, Array, Range]) # source port
attribute(:interface, kind_of: String)
attribute(:port, kind_of: [Integer, Array, Range]) # shorthand for dest_port
attribute(:destination, callbacks: { 'must be a valid ip address' => ->(ip) { !!IPAddr.new(ip) } })
attribute(:destination, kind_of: String, callbacks: { 'must be a valid ip address' => ->(ip) { !!IPAddr.new(ip) } })
attribute(:dest_port, kind_of: [Integer, Array, Range])
attribute(:dest_interface, kind_of: String)

41
cookbooks/firewall/metadata.json
View File

File diff suppressed because one or more lines are too long

15
cookbooks/firewall/metadata.rb Normal file
View File

@ -0,0 +1,15 @@
name 'firewall'
maintainer 'Sous Chefs'
maintainer_email 'help@sous-chefs.org'
license 'Apache-2.0'
description 'Provides a set of primitives for managing firewalls and associated rules.'
version '6.2.16'
source_url 'https://github.com/sous-chefs/firewall'
issues_url 'https://github.com/sous-chefs/firewall/issues'
chef_version '>= 15.5'
supports 'amazon'
supports 'centos'
supports 'debian'
supports 'ubuntu'
supports 'windows'

10
cookbooks/firewall/recipes/default.rb
View File

@ -2,7 +2,7 @@
# Cookbook:: firewall
# Recipe:: default
#
# Copyright:: 2011-2016, Chef Software, Inc.
# Copyright:: 2011-2019, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -17,17 +17,13 @@
# limitations under the License.
#
chef_sugar_cookbook_version = Gem::Version.new(run_context.cookbook_collection['chef-sugar'].metadata.version)
include_recipe 'chef-sugar' if chef_sugar_cookbook_version < Gem::Version.new('4.0.0')
firewall 'default' do
ipv6_enabled node['firewall']['ipv6_enabled']
action :install
end
# create a variable to use as a condition on some rules that follow
iptables_firewall = rhel? || node['firewall']['ubuntu_iptables']
iptables_firewall = rhel? || amazon_linux? || node['firewall']['ubuntu_iptables']
firewall_rule 'allow loopback' do
interface 'lo'
@ -41,7 +37,7 @@ firewall_rule 'allow icmp' do
command :allow
# debian ufw doesn't allow 'icmp' protocol, but does open
# icmp by default, so we skip it in default recipe
only_if { (!debian? || iptables_firewall) && node['firewall']['allow_icmp'] }
only_if { iptables_firewall && node['firewall']['allow_icmp'] }
end
firewall_rule 'allow world to ssh' do

2
cookbooks/firewall/recipes/disable_firewall.rb
View File

@ -2,7 +2,7 @@
# Cookbook:: firewall
# Recipe:: disable_firewall
#
# Copyright:: 2011-2016, Chef Software, Inc.
# Copyright:: 2011-2019, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.

17
cookbooks/firewall/renovate.json Normal file
View File

@ -0,0 +1,17 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:base"],
"packageRules": [{
"groupName": "Actions",
"matchUpdateTypes": ["patch", "pin", "digest"],
"automerge": true,
"addLabels": ["Release: Patch", "Skip: Announcements"]
},
{
"groupName": "Actions",
"matchUpdateTypes": ["major"],
"automerge": false,
"addLabels": ["Release: Patch", "Skip: Announcements"]
}
]
}

28
cookbooks/firewall/resources/firewalld.rb Normal file
View File

@ -0,0 +1,28 @@
unified_mode true
provides :firewalld,
os: 'linux'
action :install do
chef_gem 'ruby-dbus'
require 'dbus'
package 'firewalld'
end
action :reload do
service 'firewalld' do
action :reload
end
end
action :restart do
service 'firewalld' do
action :restart
end
end
action :disable do
service 'firewalld' do
action [:disable, :stop]
end
end

39
cookbooks/firewall/resources/firewalld_config.rb Normal file
View File

@ -0,0 +1,39 @@
unified_mode true
provides :firewalld_config,
os: 'linux'
property :default_zone,
String,
description: 'Set default zone for connections and interfaces where no zone has been selected to zone. Setting the default zone changes the zone for the connections or interfaces, that are using the default zone.'
property :log_denied,
String,
equal_to: %w(all unicast broadcast multicast off),
description: 'Set LogDenied value to value. If LogDenied is enabled, then logging rules are added right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones.'
load_current_value do |_new_resource|
sysbus = DBus.system_bus
firewalld_service = sysbus['org.fedoraproject.FirewallD1']
firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1']
interface = firewalld_object['org.fedoraproject.FirewallD1']
default_zone interface.getDefaultZone
log_denied interface.getLogDenied
end
action :update do
dbus = DBus.system_bus
fw = firewalld_interface(dbus)
converge_if_changed :default_zone do
fw.setDefaultZone new_resource.default_zone
end
converge_if_changed :log_denied do
fw.setLogDenied new_resource.log_denied
end
end
action_class do
include FirewallCookbook::Helpers::FirewalldDBus
end

106
cookbooks/firewall/resources/firewalld_helpers.rb Normal file
View File

@ -0,0 +1,106 @@
unified_mode true
provides :firewalld_helper,
os: 'linux'
property :version,
String,
default: '',
description: 'see version attribute of helper tag in firewalld.helper(5).'
property :short,
String,
name_property: true,
description: 'see short tag in firewalld.helper(5).'
property :description,
String,
description: 'see description tag in firewalld.helper(5).'
property :family,
String,
equal_to: %w(ipv4 ipv6),
default: 'ipv4',
description: 'see family tag in firewalld.helper(5).'
property :nf_module,
String,
description: 'see module tag in firewalld.helper(5).'
property :ports,
[Array, String],
default: [],
description: 'array of port and protocol pairs. See port tag in firewalld.helper(5).',
coerce: proc { |o| Array(o) }
load_current_value do |new_resource|
dbus = DBus.system_bus
firewalld_service = dbus['org.fedoraproject.FirewallD1']
firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config']
fw_config = firewalld_object['org.fedoraproject.FirewallD1.config']
if fw_config.getHelperNames.include?(new_resource.short)
helper_path = fw_config.getHelperByName(new_resource.short)
object = firewalld_service[helper_path]
config_helper = object['org.fedoraproject.FirewallD1.config.helper']
settings = config_helper.getSettings
version settings[0]
# short settings[1]
description settings[2]
family settings[3]
nf_module settings[4]
ports settings[5]
else
Chef::Log.info "Helper #{new_resource.short} does not exist. Will be created."
end
end
action :update do
dbus = DBus.system_bus
fw = firewalld_interface(dbus)
fw_config = config_interface(dbus)
helper_names = fw_config.getHelperNames
reload = false
if !helper_names.include?(new_resource.short)
values = [
new_resource.version,
new_resource.short,
default_description(new_resource),
new_resource.family,
new_resource.nf_module,
new_resource.ports.map { |e| e.split('/') },
]
converge_by "Add Helper #{new_resource.short}" do
fw_config.addHelper(new_resource.short, values)
end
reload = true
else
helper_path = fw_config.getHelperByName(new_resource.short)
helper = helper_interface(dbus, helper_path)
converge_if_changed :version do
helper.setVersion new_resource.version
reload = true
end
converge_if_changed :description do
helper.setDescription default_description(new_resource)
reload = true
end
converge_if_changed :family do
helper.setFamily new_resource.family
reload = true
end
converge_if_changed :nf_module do
helper.setModule new_resource.nf_module
reload = true
end
converge_if_changed :ports do
helper.setPorts new_resource.ports.map { |e| e.split('/') }
reload = true
end
end
if reload
converge_by ['reload permanent configuration of firewalld'] do
fw.reload
end
end
end
action_class do
include FirewallCookbook::Helpers
include FirewallCookbook::Helpers::FirewalldDBus
end

88
cookbooks/firewall/resources/firewalld_icmptype.rb Normal file
View File

@ -0,0 +1,88 @@
unified_mode true
provides :firewalld_icmptype,
os: 'linux'
property :version,
String,
default: '',
description: 'see version attribute of icmptype tag in firewalld.icmptype(5).'
property :short,
String,
name_property: true,
description: 'see short tag in firewalld.icmptype(5).'
property :description,
String,
description: 'see description tag in firewalld.icmptype(5).'
property :destinations,
Array,
equal_to: [['ipv4'], ['ipv6'], %w(ipv4 ipv6)],
default: 'ipv4',
description: 'array, either empty or containing strings \'ipv4\' and/or \'ipv6\', see destination tag in firewalld.icmptype(5).',
coerce: proc { |o| Array(o) }
load_current_value do |new_resource|
sysbus = DBus.system_bus
firewalld_service = sysbus['org.fedoraproject.FirewallD1']
firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config']
fw_config = firewalld_object['org.fedoraproject.FirewallD1.config']
if fw_config.getIcmpTypeNames.include?(new_resource.short)
icmptype_path = fw_config.getIcmpTypeByName(new_resource.short)
object = firewalld_service[icmptype_path]
config_icmptype = object['org.fedoraproject.FirewallD1.config.icmptype']
settings = config_icmptype.getSettings
version settings[0]
# short settings[1]
description settings[2]
destinations settings[3]
else
Chef::Log.info "IcmpType #{new_resource.short} does not exist. Will be created."
end
end
action :update do
dbus = DBus.system_bus
fw_config = config_interface(dbus)
fw = firewalld_interface(dbus)
reload = false
icmptype_names = fw_config.getIcmpTypeNames
if !icmptype_names.include?(new_resource.short)
values = [
new_resource.version,
new_resource.short,
default_description(new_resource),
new_resource.destinations,
]
converge_by "Add IcmpType #{new_resource.short}" do
fw_config.addIcmpType(new_resource.short, values)
end
reload = true
else
icmptype_path = fw_config.getIcmpTypeByName(new_resource.short)
icmptype = icmptype_interface(dbus, icmptype_path)
converge_if_changed :version do
icmptype.setVersion new_resource.version
reload = true
end
converge_if_changed :description do
icmptype.setDescription default_description(new_resource)
reload = true
end
converge_if_changed :destinations do
icmptype.setDestinations new_resource.destinations
reload = true
end
end
if reload
converge_by ['reload permanent configuration of firewalld'] do
fw.reload
end
end
end
action_class do
include FirewallCookbook::Helpers
include FirewallCookbook::Helpers::FirewalldDBus
end

104
cookbooks/firewall/resources/firewalld_ipset.rb Normal file
View File

@ -0,0 +1,104 @@
unified_mode true
provides :firewalld_ipset,
os: 'linux'
property :version,
String,
description: 'see version attribute of ipset tag in firewalld.ipset(5).'
property :short,
String,
name_property: true,
description: 'see short tag in firewalld.ipset(5).'
property :description,
String,
description: 'see description tag in firewalld.ipset(5).'
property :type,
String,
default: 'hash:ip',
description: 'see type attribute of ipset tag in firewalld.ipset(5).',
equal_to:
%w(hash:ip hash:ip,mark hash:ip,port hash:ip,port,ip hash:ip,port,net hash:mac hash:net hash:net,iface hash:net,net hash:net,port hash:net,port,net)
property :options,
Hash,
description: 'hash of {option : value} . See options tag in firewalld.ipset(5).'
property :entries,
[Array, String],
description: 'array of entries, see entry tag in firewalld.ipset(5).',
coerce: proc { |o| Array(o) }
load_current_value do |new_resource|
sysbus = DBus.system_bus
firewalld_service = sysbus['org.fedoraproject.FirewallD1']
firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config']
fw_config = firewalld_object['org.fedoraproject.FirewallD1.config']
if fw_config.getIPSetNames.include?(new_resource.short)
ipset_path = fw_config.getIPSetByName(new_resource.short)
object = firewalld_service[ipset_path]
config_ipset = object['org.fedoraproject.FirewallD1.config.ipset']
settings = config_ipset.getSettings
version settings[0]
# short settings[1]
description settings[2]
type settings[3]
options settings[4]
entries settings[5]
else
Chef::Log.info "Ipset #{new_resource.short} does not exist. Will be created."
end
end
action :update do
dbus = DBus.system_bus
fw = firewalld_interface(dbus)
fw_config = config_interface(dbus)
reload = false
if !fw_config.getIPSetNames.include?(new_resource.short)
values = [
new_resource.version || '',
new_resource.short,
default_description(new_resource),
new_resource.type,
new_resource.options || {},
new_resource.entries,
]
converge_by "Add ipset #{new_resource.short}" do
fw_config.addIPSet(new_resource.short, values)
end
reload = true
else
ipset_path = fw_config.getIPSetByName(new_resource.short)
ipset = ipset_interface(dbus, ipset_path)
converge_if_changed :version do
ipset.setVersion new_resource.version
reload = true
end
converge_if_changed :description do
ipset.setDescriptions default_description(new_resource)
reload = true
end
converge_if_changed :type do
ipset.setType new_resource.type
reload = true
end
converge_if_changed :options do
ipset.setOptions(new_resource.options || {})
reload = true
end
converge_if_changed :entries do
ipset.setEntries new_resource.entries
reload = true
end
end
if reload
converge_by ['reload permanent configuration of firewalld'] do
fw.reload
end
end
end
action_class do
include FirewallCookbook::Helpers
include FirewallCookbook::Helpers::FirewalldDBus
end

115
cookbooks/firewall/resources/firewalld_policy.rb Normal file
View File

@ -0,0 +1,115 @@
unified_mode true
provides :firewalld_policy,
os: 'linux'
property :description,
String,
description: 'see description tag in firewalld.policy(5).'
property :egress_zones,
[Array, String],
description: 'array of zone names. See egress-zone tag in firewalld.policy(5).',
coerce: proc { |o| Array(o) }
property :forward_ports,
[Array, String],
description: 'array of `portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]`. See forward-port tag in firewalld.policy(5).',
coerce: proc { |o| Array(o) }
property :icmp_blocks,
[Array, String],
description: 'array of icmp-blocks. See icmp-block tag in firewalld.policy(5).'
property :ingress_zones,
[Array, String],
description: 'array of zone names. See ingress-zone tag in firewalld.policy(5).',
coerce: proc { |o| Array(o) }
property :masquerade,
[true, false],
description: 'see masquerade tag in firewalld.policy(5).'
property :ports,
[Array, String],
description: 'array of port and protocol pairs. See port tag in firewalld.policy(5).',
coerce: proc { |o| Array(o) }
property :priority,
Integer,
description: 'see priority tag in firewalld.policy(5).'
property :protocols,
[Array, String],
description: 'array of protocols, see protocol tag in firewalld.policy(5).',
coerce: proc { |o| Array(o) }
property :rich_rules,
[Array, String],
description: 'array of rich-language rules. See rule tag in firewalld.policy(5).',
coerce: proc { |o| Array(o) }
property :services,
[Array, String],
description: 'array of service names, see service tag in firewalld.policy(5).',
coerce: proc { |o| Array(o) }
property :short,
String,
description: 'see short tag in firewalld.policy(5).',
name_property: true
property :source_ports,
[Array, String],
description: 'array of port and protocol pairs. See source-port tag in firewalld.policy(5).',
coerce: proc { |o| Array(o) }
property :target,
String,
description: 'see target attribute of policy tag in firewalld.policy(5).'
property :version,
String,
description: 'see version attribute of policy tag in firewalld.policy(5).'
load_current_value do |new_resource|
sysbus = DBus.system_bus
firewalld_service = sysbus['org.fedoraproject.FirewallD1']
firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config']
fw_config = firewalld_object['org.fedoraproject.FirewallD1.config']
if fw_config.getPolicyNames.include?(new_resource.short)
policy_path = fw_config.getPolicyByName(new_resource.short)
object = firewalld_service[policy_path]
config_policy = object['org.fedoraproject.FirewallD1.config.policy']
config_policy.getSettings.each do |k, v|
send(k, v)
end
else
Chef::Log.info "Zone #{new_resource.short} does not exist. Will be created."
end
end
action :update do
dbus = DBus.system_bus
fw = firewalld_interface(dbus)
fw_config = config_interface(dbus)
reload = false
unless fw_config.getPolicyNames.include?(new_resource.short)
fw_config.addPolicy(new_resource.short, {})
end
policy_path = fw_config.getPolicyByName(new_resource.short)
policy = policy_interface(dbus, policy_path)
properties = new_resource.class.state_properties.map(&:name)
properties.each do |property|
new_value = new_resource.send(property)
next if new_value.nil?
if [:ports, :source_ports].include?(property)
new_value = DBus.variant('a(ss)', new_value.map { |e| e.split('/') })
elsif [:forward_ports].include?(property)
new_value = forward_ports_to_dbus(new_resource)
elsif [:priority].include?(property)
new_value = DBus.variant('i', new_value)
end
converge_if_changed property do
policy.update({ property.to_s => new_value })
reload = true
end
end
if reload
converge_by ['reload permanent configuration of firewalld'] do
fw.reload
end
end
end
action_class do
include FirewallCookbook::Helpers::FirewalldDBus
end

98
cookbooks/firewall/resources/firewalld_service.rb Normal file
View File

@ -0,0 +1,98 @@
unified_mode true
provides :firewalld_service,
os: 'linux'
property :version,
String,
description: 'see version attribute of service tag in firewalld.service(5).'
property :short,
String,
name_property: true,
description: 'see short tag in firewalld.service(5).'
property :description,
String,
description: 'see description tag in firewalld.service(5).'
property :ports,
[Array, String],
description: 'array of port and protocol pairs. See port tag in firewalld.service(5).',
coerce: proc { |o| Array(o) }
property :module_names,
[Array, String],
description: 'array of kernel netfilter helpers, see module tag in firewalld.service(5).',
coerce: proc { |o| Array(o) }
property :destination,
Hash,
description: 'hash of {IP family : IP address} where \'IP family\' key can be either \'ipv4\' or \'ipv6\'. See destination tag in firewalld.service(5).'
property :protocols,
[Array, String],
description: 'array of protocols, see protocol tag in firewalld.service(5).',
coerce: proc { |o| Array(o) }
property :source_ports,
[Array, String],
description: 'array of port and protocol pairs. See source-port tag in firewalld.service(5).',
coerce: proc { |o| Array(o) }
property :includes,
[Array, String],
description: 'array of service includes, see include tag in firewalld.service(5).',
coerce: proc { |o| Array(o) }
property :helpers,
[Array, String],
description: 'array of service helpers, see helper tag in firewalld.service(5).',
coerce: proc { |o| Array(o) }
load_current_value do |new_resource|
sysbus = DBus.system_bus
firewalld_service = sysbus['org.fedoraproject.FirewallD1']
firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config']
fw_config = firewalld_object['org.fedoraproject.FirewallD1.config']
if fw_config.getServiceNames.include?(new_resource.short)
service_path = fw_config.getServiceByName(new_resource.short)
object = firewalld_service[service_path]
config_service = object['org.fedoraproject.FirewallD1.config.service']
config_service.getSettings2.each do |k, v|
send(k, v)
end
else
Chef::Log.info "Service #{new_resource.short} does not exist. Will be created."
end
end
action :update do
dbus = DBus.system_bus
fw = firewalld_interface(dbus)
fw_config = config_interface(dbus)
reload = false
unless fw_config.getServiceNames.include?(new_resource.short)
fw_config.addService2(new_resource.short, {})
end
service_path = fw_config.getServiceByName(new_resource.short)
service = service_interface(dbus, service_path)
properties = new_resource.class.state_properties.map(&:name)
properties.each do |property|
new_value = new_resource.send(property)
next unless new_value
if [:ports, :source_ports].include?(property)
new_value = DBus.variant('a(ss)', new_value.map { |e| e.split('/') })
elsif property == :description
new_value = default_description(new_resource)
end
converge_if_changed property do
key = property == :short ? 'name' : property.to_s
service.update2({ key => new_value })
reload = true
end
end
if reload
converge_by ['reload permanent configuration of firewalld'] do
fw.reload
end
end
end
action_class do
include FirewallCookbook::Helpers
include FirewallCookbook::Helpers::FirewalldDBus
end

118
cookbooks/firewall/resources/firewalld_zone.rb Normal file
View File

@ -0,0 +1,118 @@
unified_mode true
provides :firewalld_zone,
os: 'linux'
property :description,
String,
description: 'see description tag in firewalld.zone(5).'
property :forward,
[true, false],
description: 'see forward tag in firewalld.zone(5).'
property :forward_ports,
[Array, String],
description: 'array of (port, protocol, to-port, to-addr). See forward-port tag in firewalld.zone(5).',
coerce: proc { |o| Array(o) }
property :icmp_block_inversion,
[true, false],
description: 'see icmp-block-inversion tag in firewalld.zone(5).'
property :icmp_blocks,
[Array, String],
description: 'array of icmp-blocks. See icmp-block tag in firewalld.zone(5).',
coerce: proc { |o| Array(o) }
property :interfaces,
[Array, String],
description: 'array of interfaces. See interface tag in firewalld.zone(5).',
coerce: proc { |o| Array(o) }
property :masquerade,
[true, false],
description: 'see masquerade tag in firewalld.zone(5).'
property :ports,
[Array, String],
description: 'array of port and protocol pairs. See port tag in firewalld.zone(5).',
coerce: proc { |o| Array(o) }
property :protocols,
[Array, String],
description: 'array of protocols, see protocol tag in firewalld.zone(5).',
coerce: proc { |o| Array(o) }
property :rules_str,
[Array, String],
description: 'array of rich-language rules. See rule tag in firewalld.zone(5).',
coerce: proc { |o| Array(o) }
property :services,
[Array, String],
description: 'array of service names, see service tag in firewalld.zone(5).',
coerce: proc { |o| Array(o) }
property :short,
String,
name_property: true,
description: 'see short tag in firewalld.zone(5).'
property :source_ports,
[Array, String],
description: 'array of port and protocol pairs. See source-port tag in firewalld.zone(5).',
coerce: proc { |o| Array(o) }
property :sources,
[Array, String],
description: 'array of source addresses. See source tag in firewalld.zone(5).',
coerce: proc { |o| Array(o) }
property :target,
String,
description: 'see target attribute of zone tag in firewalld.zone(5).'
property :version,
String,
description: 'see version attribute of zone tag in firewalld.zone(5).'
load_current_value do |new_resource|
sysbus = DBus.system_bus
firewalld_service = sysbus['org.fedoraproject.FirewallD1']
firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config']
fw_config = firewalld_object['org.fedoraproject.FirewallD1.config']
if fw_config.getZoneNames.include?(new_resource.short)
zone_path = fw_config.getZoneByName(new_resource.short)
object = firewalld_service[zone_path]
config_zone = object['org.fedoraproject.FirewallD1.config.zone']
config_zone.getSettings2.each do |k, v|
send(k, v)
end
else
Chef::Log.info "Zone #{new_resource.short} does not exist. Will be created."
end
end
action :update do
dbus = DBus.system_bus
fw = firewalld_interface(dbus)
fw_config = config_interface(dbus)
unless fw_config.getZoneNames.include?(new_resource.short)
fw_config.addZone2(new_resource.short, {})
end
zone_path = fw_config.getZoneByName(new_resource.short)
zone = zone_interface(dbus, zone_path)
reload = false
properties = new_resource.class.state_properties.map(&:name)
properties.each do |property|
new_value = new_resource.send(property)
next unless new_value
if [:ports, :source_ports].include?(property)
new_value = DBus.variant('a(ss)', new_value.map { |e| e.split('/') })
elsif [:forward_ports].include?(property)
new_value = forward_ports_to_dbus(new_resource)
end
converge_if_changed property do
zone.update2({ property.to_s => new_value })
reload = true
end
end
if reload
converge_by ['reload permanent configuration of firewalld'] do
fw.reload
end
end
end
action_class do
include FirewallCookbook::Helpers::FirewalldDBus
end

71
cookbooks/firewall/resources/nftables.rb Normal file
View File

@ -0,0 +1,71 @@
unified_mode true
include FirewallCookbook::Helpers
include FirewallCookbook::Helpers::Nftables
provides :nftables,
os: 'linux'
property :rules,
Hash,
default: {}
property :input_policy,
String,
equal_to: %w(drop accept),
default: 'accept'
property :output_policy,
String,
equal_to: %w(drop accept),
default: 'accept'
property :forward_policy,
String,
equal_to: %w(drop accept),
default: 'accept'
property :table_ip_nat,
[true, false],
default: false
property :table_ip6_nat,
[true, false],
default: false
property :nftables_conf_path, String,
description: 'nftables.conf filepath',
default: lazy { default_nftables_conf_path }
action :install do
package 'nftables' do
action :install
notifies :rebuild, "nftables[#{new_resource.name}]"
end
end
action :rebuild do
ensure_default_rules_exist(new_resource)
file new_resource.nftables_conf_path do
content <<~NFT
#!/usr/sbin/nft -f
flush ruleset
#{build_rule_file(new_resource.rules)}
NFT
mode '0750'
owner 'root'
group 'root'
notifies :restart, 'service[nftables]'
end
service 'nftables' do
action [:enable, :start]
end
end
action :restart do
service 'nftables' do
action :restart
end
end
action :disable do
service 'nftables' do
action [:disable, :stop]
end
end

113
cookbooks/firewall/resources/nftables_rule.rb Normal file
View File

@ -0,0 +1,113 @@
unified_mode true
require 'ipaddr'
action_class do
include FirewallCookbook::Helpers
include FirewallCookbook::Helpers::Nftables
def return_early?(new_resource)
!new_resource.notify_firewall ||
!(new_resource.action.include?(:create) &&
!new_resource.should_skip?(:create))
end
end
provides :nftables_rule
default_action :create
property :firewall_name,
String,
default: 'default'
property :command,
[Array, Symbol],
default: :accept
property :protocol,
[Integer, Symbol],
default: :tcp,
callbacks: {
'must be either :tcp, :udp, :icmp, :\'ipv6-icmp\', :icmpv6, :none, or a valid IP protocol number' => lambda do |p|
%i(udp tcp icmp icmpv6 ipv6-icmp esp ah ipv6 none).include?(p) || (0..142).include?(p)
end,
}
property :direction,
Symbol,
equal_to: [:in, :out, :pre, :post, :forward],
default: :in
# nftables handles ip6 and ip simultaneously. Except for directions
# :pre and :post, where where either :ip6 or :ip must be specified.
# callback should prevent from mixing that up.
property :family,
Symbol,
equal_to: [:ip6, :ip],
default: :ip
property :source,
[String, Array],
callbacks: {
'must be a valid ip address' => lambda do |ips|
Array(ips).inject(false) do |a, ip|
a || !!IPAddr.new(ip)
end
end,
}
property :sport,
[Integer, String, Array, Range]
property :interface,
String
property :dport,
[Integer, String, Array, Range]
property :destination,
[String, Array],
callbacks: {
'must be a valid ip address' => lambda do |ips|
Array(ips).inject(false) do |a, ip|
a || !!IPAddr.new(ip)
end
end,
}
property :outerface,
String
property :position,
Integer,
default: 50
property :stateful,
[Symbol, Array]
property :redirect_port,
Integer
property :description,
String,
name_property: true
property :include_comment,
[true, false],
default: true
property :log_prefix,
String
property :log_group,
Integer
# for when you just want to pass a raw rule
property :raw,
String
# do you want this rule to notify the firewall to recalculate
# (and potentially reapply) the firewall_rule(s) it finds?
property :notify_firewall,
[true, false],
default: true
action :create do
return if return_early?(new_resource)
fwr = build_firewall_rule(new_resource)
with_run_context :root do
edit_resource!('nftables', new_resource.firewall_name) do |fw_rule|
r = rules.dup || {}
r.merge!({
fwr => fw_rule.position,
})
rules(r)
delayed_action :rebuild
end
end
end

4
cookbooks/mingw/.markdownlint-cli2.yaml Normal file
View File

@ -0,0 +1,4 @@
config:
ul-indent: false # MD007
line-length: false # MD013
no-duplicate-heading/no-duplicate-header: false # MD024

83
cookbooks/mingw/CHANGELOG.md Normal file
View File

@ -0,0 +1,83 @@
# mingw Cookbook CHANGELOG
This file is used to list changes made in each version of the mingw cookbook.
## 2.1.7 - *2023-06-01*
## 2.1.6 - *2023-04-01*
## 2.1.5 - *2023-03-03*
## 2.1.4 - *2022-02-08*
- Remove delivery folder
## 2.1.3 - *2021-08-31*
- Standardise files with files in sous-chefs/repo-management
## 2.1.1 (2020-06-02)
- Resolve cookstyle 5.8 warnings - [@tas50](https://github.com/tas50)
- Require Chef 12.15+ - [@tas50](https://github.com/tas50)
- Fix compatibility with Chef Infra Client 16 - [@xorimabot](https://github.com/xorimabot)
- resolved cookstyle error: resources/get.rb:26:1 warning: `ChefDeprecations/ResourceUsesOnlyResourceName`
- resolved cookstyle error: resources/msys2_package.rb:31:1 warning: `ChefDeprecations/ResourceUsesOnlyResourceName`
- resolved cookstyle error: resources/tdm_gcc.rb:26:1 warning: `ChefDeprecations/ResourceUsesOnlyResourceName`
## 2.1.0 (2018-07-24)
- refactor msys2 package source and checksum to attributes
## 2.0.2 (2018-02-15)
- Remove kind_of usage in the custom resources (FC117)
## 2.0.1 (2017-04-26)
- Test with Local Delivery instead of Rake
- Add chef_version to the metadata
- Use standardize Apache 2 license string
## 2.0.0 (2017-02-27)
- Require Chef 12.5 and remove compat_resource dependency
## 1.2.5 (2017-01-18)
- Require a working compat_resource
## v1.2.4 (2016-07-26)
- New msys2 shells do not inherit PATH from windows. Provide a way for
clients to do this.
## v1.2.3 (2016-07-25)
- If PKG_CONFIG_PATH is already defined, honor it in the msys2 shell.
## v1.2.2 (2016-06-24)
- Download msys2 from the primary download url (instead of a specific mirror).
## v1.2.1 (2016-06-23)
- Fix msys2 initial install/upgrade steps that dependended on file modification time.
- Make msys2_package :install idempotent - it should not reinstall packages.
- Do not allow bash.exe to be called if MSYSTEM is undefined.
## v1.2.0 (2016-06-03)
- Updating to fix the issue where msys2 bash does not inherit the cwd correctly
## v1.1.0 (2016-06-03)
- Add msys2 based compiler support using the new msys2_package resource
## v1.0.0 (2016-05-11)
- Remove unnecessary default_action from the resources
- Depend on compat_resource cookbook to add Chef 12.1 - 12.4 compatbility
- Add this changelog file
- Fix license metadata in metadata.rb
- Disable FC016 check

202
cookbooks/mingw/LICENSE Normal file
View File

@ -0,0 +1,202 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "{}"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright {yyyy} {name of copyright owner}
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

68
cookbooks/mingw/README.md Normal file
View File

@ -0,0 +1,68 @@
# mingw Cookbook
[![Cookbook Version](http://img.shields.io/cookbook/v/mingw.svg)][cookbook] [![Build Status](http://img.shields.io/travis/chef-cookbooks/mingw.svg?branch=master)][travis]
Installs a mingw/msys based compiler tools chain on windows. This is required for compiling C software from source.
## Requirements
### Platforms
- Windows
### Chef
- Chef 12.15+
### Cookbooks
- seven_zip
## Usage
Add this cookbook as a dependency to your cookbook in its `metadata.rb` and include the default recipe in one of your recipes.
```ruby
# metadata.rb
depends 'mingw'
```
```ruby
# your recipe.rb
include_recipe 'mingw::default'
```
Use the `msys2_package` resource in any recipe to fetch msys2 based packages. Use the `mingw_get` resource in any recipe to fetch mingw packages. Use the `mingw_tdm_gcc` resource to fetch a version of the TDM GCC compiler.
By default, you should prefer the msys2 packages as they are newer and better supported. C/C++ compilers on windows use various different exception formats and you need to pick the right one for your task. In the 32-bit world, you have SJLJ (set-jump/long-jump) based exception handling and DWARF-2 (shortened to DW2) based exception handling. SJLJ produces code that can happily throw exceptions across stack frames of code compiled by MSVC. DW2 involves more extensive metadata but produces code that cannot unwind MSVC generated stack-frames - hence you need to ensure that you don't have any code that throws across a "system call". Certain languages and runtimes have specific requirements as to the exception format supported. As an example, if you are building code for Rust, you will probably need a modern gcc from msys2 with DW2 support as that's what the panic/exception formatter in Rust depends on. In a 64-bit world, you may still use SJLJ but compilers all commonly support SEH (structured exception handling).
Of course, to further complicate matters, different versions of different compilers support different exception handling. The default compilers that come with mingw_get are 32-bit only compilers and support DW2\. The TDM compilers come in 3 flavors: a 32-bit only version with SJLJ support, a 32-bit only version with DW2 support and a "multilib" compiler which supports only SJLJ in 32-bit mode but can produce 64-bit SEH code. The standard library support varies drastically between these various compiler flavors (even within the same version). In msys2, you can install a mingw-w64 based compilers for either 32-bit DW2 support or 64-bit SEH support. If all this hurts your brain, I can only apologize.
## Resources
- [minw_get](./documentation/mingw_get.md)
- [mingw_tdm_gcc](./documentation/mingw_tdm_gcc.md)
- [msys2_package](./documentation/msys2_package.md)
## License & Authors
**Author:** Cookbook Engineering Team ([cookbooks@chef.io](mailto:cookbooks@chef.io))
**Copyright:** 2009-2016, Chef Software, Inc.
```text
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
```
[cookbook]: https://supermarket.chef.io/cookbooks/mingw
[travis]: http://travis-ci.org/chef-cookbooks/mingw

3
cookbooks/mingw/attributes/default.rb Normal file
View File

@ -0,0 +1,3 @@
# override these attributes to pull the msys2 package from a custom url
default['msys2']['url'] = 'http://downloads.sourceforge.net/project/msys2/Base/x86_64/msys2-base-x86_64-20160205.tar.xz'
default['msys2']['checksum'] = '7e97e2af042e1b6f62cf0298fe84839014ef3d4a3e7825cffc6931c66cc0fc20'

115
cookbooks/mingw/chefignore Normal file
View File

@ -0,0 +1,115 @@
# Put files/directories that should be ignored in this file when uploading
# to a Chef Infra Server or Supermarket.
# Lines that start with '# ' are comments.
# OS generated files #
######################
.DS_Store
ehthumbs.db
Icon?
nohup.out
Thumbs.db
.envrc
# EDITORS #
###########
.#*
.project
.settings
*_flymake
*_flymake.*
*.bak
*.sw[a-z]
*.tmproj
*~
\#*
REVISION
TAGS*
tmtags
.vscode
.editorconfig
## COMPILED ##
##############
*.class
*.com
*.dll
*.exe
*.o
*.pyc
*.so
*/rdoc/
a.out
mkmf.log
# Testing #
###########
.circleci/*
.codeclimate.yml
.delivery/*
.foodcritic
.kitchen*
.mdlrc
.overcommit.yml
.rspec
.rubocop.yml
.travis.yml
.watchr
.yamllint
azure-pipelines.yml
Dangerfile
examples/*
features/*
Guardfile
kitchen.yml*
mlc_config.json
Procfile
Rakefile
spec/*
test/*
# SCM #
#######
.git
.gitattributes
.gitconfig
.github/*
.gitignore
.gitkeep
.gitmodules
.svn
*/.bzr/*
*/.git
*/.hg/*
*/.svn/*
# Berkshelf #
#############
Berksfile
Berksfile.lock
cookbooks/*
tmp
# Bundler #
###########
vendor/*
Gemfile
Gemfile.lock
# Policyfile #
##############
Policyfile.rb
Policyfile.lock.json
# Documentation #
#############
CODE_OF_CONDUCT*
CONTRIBUTING*
documentation/*
TESTING*
UPGRADING*
# Vagrant #
###########
.vagrant
Vagrantfile

17
cookbooks/mingw/files/default/bash.bat Normal file
View File

@ -0,0 +1,17 @@
@echo off
set HOME=/home/%USERNAME%
IF "%MSYSTEM%"=="" (
echo MSYSTEM is NOT defined
exit
)
rem Ask MSYS to initialize with a minimal path by default.
rem This will put only the windows system paths into the msys path.
set MSYS2_PATH_TYPE=minimal
rem See /etc/profile - it should invoke post-install step 05-home-dir.post
rem which uses this environment variable to change directories.
set CHERE_INVOKING=1
%~dp0..\usr\bin\bash.exe -l %*

23
cookbooks/mingw/files/default/custom-upgrade.sh Normal file
View File

@ -0,0 +1,23 @@
declare -r CRITICAL_PACKAGES="bash pacman msys2-runtime"
declare -r OPTIONAL_PACKAGES="msys2-runtime-devel"
# set pacman command if not already defined
PACMAN=${PACMAN:-pacman}
# save full path to command as PATH may change when sourcing /etc/profile
PACMAN_PATH=$(type -P $PACMAN)
run_pacman() {
local cmd
cmd=("$PACMAN_PATH" "$@")
"${cmd[@]}"
}
if ! run_pacman -Sy; then
exit 1
fi
run_pacman -Qu ${CRITICAL_PACKAGES}
if ! run_pacman -S --noconfirm --needed ${CRITICAL_PACKAGES} ${OPTIONAL_PACKAGES}; then
exit 1
fi

13
cookbooks/mingw/files/default/custom_prefix.sh Normal file
View File

@ -0,0 +1,13 @@
# Prepend values from the parent environment to msys2 environment variables.
export PKG_CONFIG_PATH="${PREMSYS2_PKG_CONFIG_PATH:+${PREMSYS2_PKG_CONFIG_PATH}:}${PKG_CONFIG_PATH}"
# Instead of placing our entire windows path into msys2, we can selectively
# prepend just the important parts that we need. This also ensures that
# we don't accidentally add other unnecessary chef or git msys2 library
# files in the path.
export PATH="${PREMSYS2_PATH:+${PREMSYS2_PATH}:}${PATH}"
# TODO: If there are other variabled we want to control like MANPATH or ACLOCALPATH,
# add those here.

719
cookbooks/mingw/files/default/pthread.h Normal file
View File

@ -0,0 +1,719 @@
/*
Copyright (c) 2011-2013 mingw-w64 project
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
*/
/*
* Parts of this library are derived by:
*
* Posix Threads library for Microsoft Windows
*
* Use at own risk, there is no implied warranty to this code.
* It uses undocumented features of Microsoft Windows that can change
* at any time in the future.
*
* (C) 2010 Lockless Inc.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without modification,
* are permitted provided that the following conditions are met:
*
*
* * Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* * Neither the name of Lockless Inc. nor the names of its contributors may be
* used to endorse or promote products derived from this software without
* specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AN
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
* OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef WIN_PTHREADS_H
#define WIN_PTHREADS_H
#include <stddef.h>
#include <errno.h>
#include <sys/types.h>
#include <process.h>
#include <limits.h>
#include <signal.h>
#include <sys/timeb.h>
#include "pthread_compat.h"
#ifdef __cplusplus
extern "C" {
#endif
#define __WINPTHREADS_VERSION_MAJOR 0
#define __WINPTHREADS_VERSION_MINOR 5
#define __WINPTHREADS_VERSION_PATCHLEVEL 0
/* MSB 8-bit major version, 8-bit minor version, 16-bit patch level. */
#define __WINPTHREADS_VERSION 0x00050000
#if defined DLL_EXPORT && !defined WINPTHREAD_STATIC
#ifdef IN_WINPTHREAD
#define WINPTHREAD_API __declspec(dllexport)
#else
#define WINPTHREAD_API __declspec(dllimport)
#endif
#else
#define WINPTHREAD_API
#endif
/* #define WINPTHREAD_DBG 1 */
/* Compatibility stuff: */
#define RWLS_PER_THREAD 8
/* Error-codes. */
#ifndef ETIMEDOUT
#define ETIMEDOUT 138
#endif
#ifndef ENOTSUP
#define ENOTSUP 129
#endif
#ifndef EWOULDBLOCK
#define EWOULDBLOCK 140
#endif
/* pthread specific defines. */
#define PTHREAD_CANCEL_DISABLE 0
#define PTHREAD_CANCEL_ENABLE 0x01
#define PTHREAD_CANCEL_DEFERRED 0
#define PTHREAD_CANCEL_ASYNCHRONOUS 0x02
#define PTHREAD_CREATE_JOINABLE 0
#define PTHREAD_CREATE_DETACHED 0x04
#define PTHREAD_EXPLICIT_SCHED 0
#define PTHREAD_INHERIT_SCHED 0x08
#define PTHREAD_SCOPE_PROCESS 0
#define PTHREAD_SCOPE_SYSTEM 0x10
#define PTHREAD_DEFAULT_ATTR (PTHREAD_CANCEL_ENABLE)
#define PTHREAD_CANCELED ((void *) (intptr_t) 0xDEADBEEF)
#define _PTHREAD_NULL_THREAD ((pthread_t) 0)
#define PTHREAD_ONCE_INIT 0
#define PTHREAD_DESTRUCTOR_ITERATIONS 256
#define PTHREAD_KEYS_MAX (1<<20)
#define PTHREAD_MUTEX_NORMAL 0
#define PTHREAD_MUTEX_ERRORCHECK 1
#define PTHREAD_MUTEX_RECURSIVE 2
#define PTHREAD_MUTEX_DEFAULT PTHREAD_MUTEX_NORMAL
#define PTHREAD_MUTEX_SHARED 1
#define PTHREAD_MUTEX_PRIVATE 0
#define PTHREAD_PRIO_NONE 0
#define PTHREAD_PRIO_INHERIT 8
#define PTHREAD_PRIO_PROTECT 16
#define PTHREAD_PRIO_MULT 32
#define PTHREAD_PROCESS_SHARED 1
#define PTHREAD_PROCESS_PRIVATE 0
#define PTHREAD_MUTEX_FAST_NP PTHREAD_MUTEX_NORMAL
#define PTHREAD_MUTEX_TIMED_NP PTHREAD_MUTEX_FAST_NP
#define PTHREAD_MUTEX_ADAPTIVE_NP PTHREAD_MUTEX_FAST_NP
#define PTHREAD_MUTEX_ERRORCHECK_NP PTHREAD_MUTEX_ERRORCHECK
#define PTHREAD_MUTEX_RECURSIVE_NP PTHREAD_MUTEX_RECURSIVE
void * WINPTHREAD_API pthread_timechange_handler_np(void * dummy);
/* int WINPTHREAD_API pthread_delay_np (const struct timespec *interval); */
int WINPTHREAD_API pthread_num_processors_np(void);
int WINPTHREAD_API pthread_set_num_processors_np(int n);
#define PTHREAD_BARRIER_SERIAL_THREAD 1
/* maximum number of times a read lock may be obtained */
#define MAX_READ_LOCKS (INT_MAX - 1)
/* No fork() in windows - so ignore this */
#define pthread_atfork(F1,F2,F3) 0
/* unsupported stuff: */
#define pthread_mutex_getprioceiling(M, P) ENOTSUP
#define pthread_mutex_setprioceiling(M, P) ENOTSUP
#define pthread_getcpuclockid(T, C) ENOTSUP
#define pthread_attr_getguardsize(A, S) ENOTSUP
#define pthread_attr_setgaurdsize(A, S) ENOTSUP
typedef long pthread_once_t;
typedef unsigned pthread_mutexattr_t;
typedef unsigned pthread_key_t;
typedef void *pthread_barrierattr_t;
typedef int pthread_condattr_t;
typedef int pthread_rwlockattr_t;
/*
struct _pthread_v;
typedef struct pthread_t {
struct _pthread_v *p;
int x;
} pthread_t;
*/
typedef uintptr_t pthread_t;
typedef struct _pthread_cleanup _pthread_cleanup;
struct _pthread_cleanup
{
void (*func)(void *);
void *arg;
_pthread_cleanup *next;
};
#define pthread_cleanup_push(F, A)\
{\
const _pthread_cleanup _pthread_cup = {(F), (A), *pthread_getclean()};\
__sync_synchronize();\
*pthread_getclean() = (_pthread_cleanup *) &_pthread_cup;\
__sync_synchronize()
/* Note that if async cancelling is used, then there is a race here */
#define pthread_cleanup_pop(E)\
(*pthread_getclean() = _pthread_cup.next, (E?_pthread_cup.func((pthread_once_t *)_pthread_cup.arg):0));}
/* -------------------------------------------------------------------
* CHEF PATCHES
*
* PREVENT REDECLERATION OF timespec
*
* The original header here assumed that struct timespec was not
* available on windows under mingw. So it redeclared timespec itself.
*
* This currently generates and error. With recent binutils, timespec
* is declared in time.h but in a slightly different manner from the
* traditional posix definition (it involves unions) to account for
* MSVC related issues.
*
* They need to go through a lot of hoops to declare the exact size
* and layout of timespec because MSVC uses a slightly more loltastic
* definition of time_t than everyone else in the universe.
* Traditionally, time_t was an integral quantity that represents the
* number of seconds since the unix epoch and it's 32-bits wide.
* This leads to the Y2038 problem where the timestamp will overflow.
* MSVC "solves" this by changing the definition of time_t to 64-bit
* on 64-bit platforms which wreaks havoc on a large number of
* structs that need to deal with the new layout (including timespec).
* Thankfully, we are using a compiler that sticks to the older
* definition of time_t - so as long as we don't attempt to link it
* to any MSVC generated libraries, we should be ok. The winpthreads
* compatibility layer that ships with TDM GCC was patched and
* compiled under these assumptions.
*
* Since we are assuming that we aren't going to generally be mixing
* MSVC generated and mingw generated dlls and TDM GCC provides us with
* good old-fashioned system libraries and dlls, we can simply delete
* the declaration of timespec here and use parts/time.h from mingwrt
* instead.
*/
#define __need_time_t
#define __need_struct_timespec
#define _FAKE_TIME_H_SOURCED 1
#include <parts/time.h>
/* END OF CHEF PATCHES
* -------------------------------------------------------------------
*/
#ifndef SCHED_OTHER
/* Some POSIX realtime extensions, mostly stubbed */
#define SCHED_OTHER 0
#define SCHED_FIFO 1
#define SCHED_RR 2
#define SCHED_MIN SCHED_OTHER
#define SCHED_MAX SCHED_RR
struct sched_param {
int sched_priority;
};
int WINPTHREAD_API sched_yield(void);
int WINPTHREAD_API sched_get_priority_min(int pol);
int WINPTHREAD_API sched_get_priority_max(int pol);
int WINPTHREAD_API sched_getscheduler(pid_t pid);
int WINPTHREAD_API sched_setscheduler(pid_t pid, int pol, const struct sched_param *param);
#endif
typedef struct pthread_attr_t pthread_attr_t;
struct pthread_attr_t
{
unsigned p_state;
void *stack;
size_t s_size;
struct sched_param param;
};
int WINPTHREAD_API pthread_attr_setschedparam(pthread_attr_t *attr, const struct sched_param *param);
int WINPTHREAD_API pthread_attr_getschedparam(const pthread_attr_t *attr, struct sched_param *param);
int WINPTHREAD_API pthread_getschedparam(pthread_t thread, int *pol, struct sched_param *param);
int WINPTHREAD_API pthread_setschedparam(pthread_t thread, int pol, const struct sched_param *param);
int WINPTHREAD_API pthread_attr_setschedpolicy (pthread_attr_t *attr, int pol);
int WINPTHREAD_API pthread_attr_getschedpolicy (pthread_attr_t *attr, int *pol);
/* synchronization objects */
typedef void *pthread_spinlock_t;
typedef void *pthread_mutex_t;
typedef void *pthread_cond_t;
typedef void *pthread_rwlock_t;
typedef void *pthread_barrier_t;
#define PTHREAD_MUTEX_NORMAL 0
#define PTHREAD_MUTEX_ERRORCHECK 1
#define PTHREAD_MUTEX_RECURSIVE 2
#define GENERIC_INITIALIZER ((void *) (size_t) -1)
#define GENERIC_ERRORCHECK_INITIALIZER ((void *) (size_t) -2)
#define GENERIC_RECURSIVE_INITIALIZER ((void *) (size_t) -3)
#define GENERIC_NORMAL_INITIALIZER ((void *) (size_t) -1)
#define PTHREAD_MUTEX_INITIALIZER (pthread_mutex_t)GENERIC_INITIALIZER
#define PTHREAD_RECURSIVE_MUTEX_INITIALIZER (pthread_mutex_t)GENERIC_RECURSIVE_INITIALIZER
#define PTHREAD_ERRORCHECK_MUTEX_INITIALIZER (pthread_mutex_t)GENERIC_ERRORCHECK_INITIALIZER
#define PTHREAD_NORMAL_MUTEX_INITIALIZER (pthread_mutex_t)GENERIC_NORMAL_INITIALIZER
#define PTHREAD_DEFAULT_MUTEX_INITIALIZER PTHREAD_NORMAL_MUTEX_INITIALIZER
#define PTHREAD_COND_INITIALIZER (pthread_cond_t)GENERIC_INITIALIZER
#define PTHREAD_RWLOCK_INITIALIZER (pthread_rwlock_t)GENERIC_INITIALIZER
#define PTHREAD_SPINLOCK_INITIALIZER (pthread_spinlock_t)GENERIC_INITIALIZER
extern void WINPTHREAD_API (**_pthread_key_dest)(void *);
int WINPTHREAD_API pthread_key_create(pthread_key_t *key, void (* dest)(void *));
int WINPTHREAD_API pthread_key_delete(pthread_key_t key);
void * WINPTHREAD_API pthread_getspecific(pthread_key_t key);
int WINPTHREAD_API pthread_setspecific(pthread_key_t key, const void *value);
pthread_t WINPTHREAD_API pthread_self(void);
int WINPTHREAD_API pthread_once(pthread_once_t *o, void (*func)(void));
void WINPTHREAD_API pthread_testcancel(void);
int WINPTHREAD_API pthread_equal(pthread_t t1, pthread_t t2);
void WINPTHREAD_API pthread_tls_init(void);
void WINPTHREAD_API _pthread_cleanup_dest(pthread_t t);
int WINPTHREAD_API pthread_get_concurrency(int *val);
int WINPTHREAD_API pthread_set_concurrency(int val);
void WINPTHREAD_API pthread_exit(void *res);
void WINPTHREAD_API _pthread_invoke_cancel(void);
int WINPTHREAD_API pthread_cancel(pthread_t t);
int WINPTHREAD_API pthread_kill(pthread_t t, int sig);
unsigned WINPTHREAD_API _pthread_get_state(const pthread_attr_t *attr, unsigned flag);
int WINPTHREAD_API _pthread_set_state(pthread_attr_t *attr, unsigned flag, unsigned val);
int WINPTHREAD_API pthread_setcancelstate(int state, int *oldstate);
int WINPTHREAD_API pthread_setcanceltype(int type, int *oldtype);
int WINPTHREAD_API pthread_create_wrapper(void *args);
int WINPTHREAD_API pthread_create(pthread_t *th, const pthread_attr_t *attr, void *(* func)(void *), void *arg);
int WINPTHREAD_API pthread_join(pthread_t t, void **res);
int WINPTHREAD_API pthread_detach(pthread_t t);
int WINPTHREAD_API pthread_rwlock_init(pthread_rwlock_t *rwlock_, const pthread_rwlockattr_t *attr);
int WINPTHREAD_API pthread_rwlock_wrlock(pthread_rwlock_t *l);
int WINPTHREAD_API pthread_rwlock_timedwrlock(pthread_rwlock_t *rwlock, const struct timespec *ts);
int WINPTHREAD_API pthread_rwlock_rdlock(pthread_rwlock_t *l);
int WINPTHREAD_API pthread_rwlock_timedrdlock(pthread_rwlock_t *l, const struct timespec *ts);
int WINPTHREAD_API pthread_rwlock_unlock(pthread_rwlock_t *l);
int WINPTHREAD_API pthread_rwlock_tryrdlock(pthread_rwlock_t *l);
int WINPTHREAD_API pthread_rwlock_trywrlock(pthread_rwlock_t *l);
int WINPTHREAD_API pthread_rwlock_destroy (pthread_rwlock_t *l);
int WINPTHREAD_API pthread_cond_init(pthread_cond_t *cv, const pthread_condattr_t *a);
int WINPTHREAD_API pthread_cond_destroy(pthread_cond_t *cv);
int WINPTHREAD_API pthread_cond_signal (pthread_cond_t *cv);
int WINPTHREAD_API pthread_cond_broadcast (pthread_cond_t *cv);
int WINPTHREAD_API pthread_cond_wait (pthread_cond_t *cv, pthread_mutex_t *external_mutex);
int WINPTHREAD_API pthread_cond_timedwait(pthread_cond_t *cv, pthread_mutex_t *external_mutex, const struct timespec *t);
int WINPTHREAD_API pthread_cond_timedwait_relative_np(pthread_cond_t *cv, pthread_mutex_t *external_mutex, const struct timespec *t);
int WINPTHREAD_API pthread_mutex_lock(pthread_mutex_t *m);
int WINPTHREAD_API pthread_mutex_timedlock(pthread_mutex_t *m, const struct timespec *ts);
int WINPTHREAD_API pthread_mutex_unlock(pthread_mutex_t *m);
int WINPTHREAD_API pthread_mutex_trylock(pthread_mutex_t *m);
int WINPTHREAD_API pthread_mutex_init(pthread_mutex_t *m, const pthread_mutexattr_t *a);
int WINPTHREAD_API pthread_mutex_destroy(pthread_mutex_t *m);
int WINPTHREAD_API pthread_barrier_destroy(pthread_barrier_t *b);
int WINPTHREAD_API pthread_barrier_init(pthread_barrier_t *b, const void *attr, unsigned int count);
int WINPTHREAD_API pthread_barrier_wait(pthread_barrier_t *b);
int WINPTHREAD_API pthread_spin_init(pthread_spinlock_t *l, int pshared);
int WINPTHREAD_API pthread_spin_destroy(pthread_spinlock_t *l);
/* No-fair spinlock due to lack of knowledge of thread number. */
int WINPTHREAD_API pthread_spin_lock(pthread_spinlock_t *l);
int WINPTHREAD_API pthread_spin_trylock(pthread_spinlock_t *l);
int WINPTHREAD_API pthread_spin_unlock(pthread_spinlock_t *l);
int WINPTHREAD_API pthread_attr_init(pthread_attr_t *attr);
int WINPTHREAD_API pthread_attr_destroy(pthread_attr_t *attr);
int WINPTHREAD_API pthread_attr_setdetachstate(pthread_attr_t *a, int flag);
int WINPTHREAD_API pthread_attr_getdetachstate(const pthread_attr_t *a, int *flag);
int WINPTHREAD_API pthread_attr_setinheritsched(pthread_attr_t *a, int flag);
int WINPTHREAD_API pthread_attr_getinheritsched(const pthread_attr_t *a, int *flag);
int WINPTHREAD_API pthread_attr_setscope(pthread_attr_t *a, int flag);
int WINPTHREAD_API pthread_attr_getscope(const pthread_attr_t *a, int *flag);
int WINPTHREAD_API pthread_attr_getstackaddr(pthread_attr_t *attr, void **stack);
int WINPTHREAD_API pthread_attr_setstackaddr(pthread_attr_t *attr, void *stack);
int WINPTHREAD_API pthread_attr_getstacksize(const pthread_attr_t *attr, size_t *size);
int WINPTHREAD_API pthread_attr_setstacksize(pthread_attr_t *attr, size_t size);
int WINPTHREAD_API pthread_mutexattr_init(pthread_mutexattr_t *a);
int WINPTHREAD_API pthread_mutexattr_destroy(pthread_mutexattr_t *a);
int WINPTHREAD_API pthread_mutexattr_gettype(const pthread_mutexattr_t *a, int *type);
int WINPTHREAD_API pthread_mutexattr_settype(pthread_mutexattr_t *a, int type);
int WINPTHREAD_API pthread_mutexattr_getpshared(const pthread_mutexattr_t *a, int *type);
int WINPTHREAD_API pthread_mutexattr_setpshared(pthread_mutexattr_t * a, int type);
int WINPTHREAD_API pthread_mutexattr_getprotocol(const pthread_mutexattr_t *a, int *type);
int WINPTHREAD_API pthread_mutexattr_setprotocol(pthread_mutexattr_t *a, int type);
int WINPTHREAD_API pthread_mutexattr_getprioceiling(const pthread_mutexattr_t *a, int * prio);
int WINPTHREAD_API pthread_mutexattr_setprioceiling(pthread_mutexattr_t *a, int prio);
int WINPTHREAD_API pthread_getconcurrency(void);
int WINPTHREAD_API pthread_setconcurrency(int new_level);
int WINPTHREAD_API pthread_condattr_destroy(pthread_condattr_t *a);
int WINPTHREAD_API pthread_condattr_init(pthread_condattr_t *a);
int WINPTHREAD_API pthread_condattr_getpshared(const pthread_condattr_t *a, int *s);
int WINPTHREAD_API pthread_condattr_setpshared(pthread_condattr_t *a, int s);
#ifndef __clockid_t_defined
typedef int clockid_t;
#define __clockid_t_defined 1
#endif /* __clockid_t_defined */
int WINPTHREAD_API pthread_condattr_getclock (const pthread_condattr_t *attr,
clockid_t *clock_id);
int WINPTHREAD_API pthread_condattr_setclock(pthread_condattr_t *attr,
clockid_t clock_id);
int WINPTHREAD_API __pthread_clock_nanosleep(clockid_t clock_id, int flags, const struct timespec *rqtp, struct timespec *rmtp);
int WINPTHREAD_API pthread_barrierattr_init(void **attr);
int WINPTHREAD_API pthread_barrierattr_destroy(void **attr);
int WINPTHREAD_API pthread_barrierattr_setpshared(void **attr, int s);
int WINPTHREAD_API pthread_barrierattr_getpshared(void **attr, int *s);
/* Private extensions for analysis and internal use. */
struct _pthread_cleanup ** WINPTHREAD_API pthread_getclean (void);
void * WINPTHREAD_API pthread_gethandle (pthread_t t);
void * WINPTHREAD_API pthread_getevent ();
unsigned long long WINPTHREAD_API _pthread_rel_time_in_ms(const struct timespec *ts);
unsigned long long WINPTHREAD_API _pthread_time_in_ms(void);
unsigned long long WINPTHREAD_API _pthread_time_in_ms_from_timespec(const struct timespec *ts);
int WINPTHREAD_API _pthread_tryjoin (pthread_t t, void **res);
int WINPTHREAD_API pthread_rwlockattr_destroy(pthread_rwlockattr_t *a);
int WINPTHREAD_API pthread_rwlockattr_getpshared(pthread_rwlockattr_t *a, int *s);
int WINPTHREAD_API pthread_rwlockattr_init(pthread_rwlockattr_t *a);
int WINPTHREAD_API pthread_rwlockattr_setpshared(pthread_rwlockattr_t *a, int s);
#ifndef SIG_BLOCK
#define SIG_BLOCK 0
#endif
#ifndef SIG_UNBLOCK
#define SIG_UNBLOCK 1
#endif
#ifndef SIG_SETMASK
#define SIG_SETMASK 2
#endif
#include <pthread_unistd.h>
#undef _POSIX_THREAD_DESTRUCTOR_ITERATIONS
#define _POSIX_THREAD_DESTRUCTOR_ITERATIONS PTHREAD_DESTRUCTOR_ITERATIONS
#undef _POSIX_THREAD_KEYS_MAX
#define _POSIX_THREAD_KEYS_MAX PTHREAD_KEYS_MAX
#undef PTHREAD_THREADS_MAX
#define PTHREAD_THREADS_MAX 2019
#undef _POSIX_SEM_NSEMS_MAX
#define _POSIX_SEM_NSEMS_MAX 256
#undef SEM_NSEMS_MAX
#define SEM_NSEMS_MAX 1024
/* Wrap cancellation points. */
#ifdef __WINPTRHEAD_ENABLE_WRAP_API
#define accept(...) (pthread_testcancel(), accept(__VA_ARGS__))
#define aio_suspend(...) (pthread_testcancel(), aio_suspend(__VA_ARGS__))
#define clock_nanosleep(...) (pthread_testcancel(), clock_nanosleep(__VA_ARGS__))
#define close(...) (pthread_testcancel(), close(__VA_ARGS__))
#define connect(...) (pthread_testcancel(), connect(__VA_ARGS__))
#define creat(...) (pthread_testcancel(), creat(__VA_ARGS__))
#define fcntl(...) (pthread_testcancel(), fcntl(__VA_ARGS__))
#define fdatasync(...) (pthread_testcancel(), fdatasync(__VA_ARGS__))
#define fsync(...) (pthread_testcancel(), fsync(__VA_ARGS__))
#define getmsg(...) (pthread_testcancel(), getmsg(__VA_ARGS__))
#define getpmsg(...) (pthread_testcancel(), getpmsg(__VA_ARGS__))
#define lockf(...) (pthread_testcancel(), lockf(__VA_ARGS__))
#define mg_receive(...) (pthread_testcancel(), mg_receive(__VA_ARGS__))
#define mg_send(...) (pthread_testcancel(), mg_send(__VA_ARGS__))
#define mg_timedreceive(...) (pthread_testcancel(), mg_timedreceive(__VA_ARGS__))
#define mg_timessend(...) (pthread_testcancel(), mg_timedsend(__VA_ARGS__))
#define msgrcv(...) (pthread_testcancel(), msgrecv(__VA_ARGS__))
#define msgsnd(...) (pthread_testcancel(), msgsnd(__VA_ARGS__))
#define msync(...) (pthread_testcancel(), msync(__VA_ARGS__))
#define nanosleep(...) (pthread_testcancel(), nanosleep(__VA_ARGS__))
#define open(...) (pthread_testcancel(), open(__VA_ARGS__))
#define pause(...) (pthread_testcancel(), pause(__VA_ARGS__))
#define poll(...) (pthread_testcancel(), poll(__VA_ARGS__))
#define pread(...) (pthread_testcancel(), pread(__VA_ARGS__))
#define pselect(...) (pthread_testcancel(), pselect(__VA_ARGS__))
#define putmsg(...) (pthread_testcancel(), putmsg(__VA_ARGS__))
#define putpmsg(...) (pthread_testcancel(), putpmsg(__VA_ARGS__))
#define pwrite(...) (pthread_testcancel(), pwrite(__VA_ARGS__))
#define read(...) (pthread_testcancel(), read(__VA_ARGS__))
#define readv(...) (pthread_testcancel(), readv(__VA_ARGS__))
#define recv(...) (pthread_testcancel(), recv(__VA_ARGS__))
#define recvfrom(...) (pthread_testcancel(), recvfrom(__VA_ARGS__))
#define recvmsg(...) (pthread_testcancel(), recvmsg(__VA_ARGS__))
#define select(...) (pthread_testcancel(), select(__VA_ARGS__))
#define sem_timedwait(...) (pthread_testcancel(), sem_timedwait(__VA_ARGS__))
#define sem_wait(...) (pthread_testcancel(), sem_wait(__VA_ARGS__))
#define send(...) (pthread_testcancel(), send(__VA_ARGS__))
#define sendmsg(...) (pthread_testcancel(), sendmsg(__VA_ARGS__))
#define sendto(...) (pthread_testcancel(), sendto(__VA_ARGS__))
#define sigpause(...) (pthread_testcancel(), sigpause(__VA_ARGS__))
#define sigsuspend(...) (pthread_testcancel(), sigsuspend(__VA_ARGS__))
#define sigwait(...) (pthread_testcancel(), sigwait(__VA_ARGS__))
#define sigwaitinfo(...) (pthread_testcancel(), sigwaitinfo(__VA_ARGS__))
#define sleep(...) (pthread_testcancel(), sleep(__VA_ARGS__))
//#define Sleep(...) (pthread_testcancel(), Sleep(__VA_ARGS__))
#define system(...) (pthread_testcancel(), system(__VA_ARGS__))
#define access(...) (pthread_testcancel(), access(__VA_ARGS__))
#define asctime(...) (pthread_testcancel(), asctime(__VA_ARGS__))
#define catclose(...) (pthread_testcancel(), catclose(__VA_ARGS__))
#define catgets(...) (pthread_testcancel(), catgets(__VA_ARGS__))
#define catopen(...) (pthread_testcancel(), catopen(__VA_ARGS__))
#define closedir(...) (pthread_testcancel(), closedir(__VA_ARGS__))
#define closelog(...) (pthread_testcancel(), closelog(__VA_ARGS__))
#define ctermid(...) (pthread_testcancel(), ctermid(__VA_ARGS__))
#define ctime(...) (pthread_testcancel(), ctime(__VA_ARGS__))
#define dbm_close(...) (pthread_testcancel(), dbm_close(__VA_ARGS__))
#define dbm_delete(...) (pthread_testcancel(), dbm_delete(__VA_ARGS__))
#define dbm_fetch(...) (pthread_testcancel(), dbm_fetch(__VA_ARGS__))
#define dbm_nextkey(...) (pthread_testcancel(), dbm_nextkey(__VA_ARGS__))
#define dbm_open(...) (pthread_testcancel(), dbm_open(__VA_ARGS__))
#define dbm_store(...) (pthread_testcancel(), dbm_store(__VA_ARGS__))
#define dlclose(...) (pthread_testcancel(), dlclose(__VA_ARGS__))
#define dlopen(...) (pthread_testcancel(), dlopen(__VA_ARGS__))
#define endgrent(...) (pthread_testcancel(), endgrent(__VA_ARGS__))
#define endhostent(...) (pthread_testcancel(), endhostent(__VA_ARGS__))
#define endnetent(...) (pthread_testcancel(), endnetent(__VA_ARGS__))
#define endprotoent(...) (pthread_testcancel(), endprotoend(__VA_ARGS__))
#define endpwent(...) (pthread_testcancel(), endpwent(__VA_ARGS__))
#define endservent(...) (pthread_testcancel(), endservent(__VA_ARGS__))
#define endutxent(...) (pthread_testcancel(), endutxent(__VA_ARGS__))
#define fclose(...) (pthread_testcancel(), fclose(__VA_ARGS__))
#define fflush(...) (pthread_testcancel(), fflush(__VA_ARGS__))
#define fgetc(...) (pthread_testcancel(), fgetc(__VA_ARGS__))
#define fgetpos(...) (pthread_testcancel(), fgetpos(__VA_ARGS__))
#define fgets(...) (pthread_testcancel(), fgets(__VA_ARGS__))
#define fgetwc(...) (pthread_testcancel(), fgetwc(__VA_ARGS__))
#define fgetws(...) (pthread_testcancel(), fgetws(__VA_ARGS__))
#define fmtmsg(...) (pthread_testcancel(), fmtmsg(__VA_ARGS__))
#define fopen(...) (pthread_testcancel(), fopen(__VA_ARGS__))
#define fpathconf(...) (pthread_testcancel(), fpathconf(__VA_ARGS__))
#define fprintf(...) (pthread_testcancel(), fprintf(__VA_ARGS__))
#define fputc(...) (pthread_testcancel(), fputc(__VA_ARGS__))
#define fputs(...) (pthread_testcancel(), fputs(__VA_ARGS__))
#define fputwc(...) (pthread_testcancel(), fputwc(__VA_ARGS__))
#define fputws(...) (pthread_testcancel(), fputws(__VA_ARGS__))
#define fread(...) (pthread_testcancel(), fread(__VA_ARGS__))
#define freopen(...) (pthread_testcancel(), freopen(__VA_ARGS__))
#define fscanf(...) (pthread_testcancel(), fscanf(__VA_ARGS__))
#define fseek(...) (pthread_testcancel(), fseek(__VA_ARGS__))
#define fseeko(...) (pthread_testcancel(), fseeko(__VA_ARGS__))
#define fsetpos(...) (pthread_testcancel(), fsetpos(__VA_ARGS__))
#define fstat(...) (pthread_testcancel(), fstat(__VA_ARGS__))
#define ftell(...) (pthread_testcancel(), ftell(__VA_ARGS__))
#define ftello(...) (pthread_testcancel(), ftello(__VA_ARGS__))
#define ftw(...) (pthread_testcancel(), ftw(__VA_ARGS__))
#define fwprintf(...) (pthread_testcancel(), fwprintf(__VA_ARGS__))
#define fwrite(...) (pthread_testcancel(), fwrite(__VA_ARGS__))
#define fwscanf(...) (pthread_testcancel(), fwscanf(__VA_ARGS__))
#define getaddrinfo(...) (pthread_testcancel(), getaddrinfo(__VA_ARGS__))
#define getc(...) (pthread_testcancel(), getc(__VA_ARGS__))
#define getc_unlocked(...) (pthread_testcancel(), getc_unlocked(__VA_ARGS__))
#define getchar(...) (pthread_testcancel(), getchar(__VA_ARGS__))
#define getchar_unlocked(...) (pthread_testcancel(), getchar_unlocked(__VA_ARGS__))
#define getcwd(...) (pthread_testcancel(), getcwd(__VA_ARGS__))
#define getdate(...) (pthread_testcancel(), getdate(__VA_ARGS__))
#define getgrent(...) (pthread_testcancel(), getgrent(__VA_ARGS__))
#define getgrgid(...) (pthread_testcancel(), getgrgid(__VA_ARGS__))
#define getgrgid_r(...) (pthread_testcancel(), getgrgid_r(__VA_ARGS__))
#define gergrnam(...) (pthread_testcancel(), getgrnam(__VA_ARGS__))
#define getgrnam_r(...) (pthread_testcancel(), getgrnam_r(__VA_ARGS__))
#define gethostbyaddr(...) (pthread_testcancel(), gethostbyaddr(__VA_ARGS__))
#define gethostbyname(...) (pthread_testcancel(), gethostbyname(__VA_ARGS__))
#define gethostent(...) (pthread_testcancel(), gethostent(__VA_ARGS__))
#define gethostid(...) (pthread_testcancel(), gethostid(__VA_ARGS__))
#define gethostname(...) (pthread_testcancel(), gethostname(__VA_ARGS__))
#define getlogin(...) (pthread_testcancel(), getlogin(__VA_ARGS__))
#define getlogin_r(...) (pthread_testcancel(), getlogin_r(__VA_ARGS__))
#define getnameinfo(...) (pthread_testcancel(), getnameinfo(__VA_ARGS__))
#define getnetbyaddr(...) (pthread_testcancel(), getnetbyaddr(__VA_ARGS__))
#define getnetbyname(...) (pthread_testcancel(), getnetbyname(__VA_ARGS__))
#define getnetent(...) (pthread_testcancel(), getnetent(__VA_ARGS__))
#define getopt(...) (pthread_testcancel(), getopt(__VA_ARGS__))
#define getprotobyname(...) (pthread_testcancel(), getprotobyname(__VA_ARGS__))
#define getprotobynumber(...) (pthread_testcancel(), getprotobynumber(__VA_ARGS__))
#define getprotoent(...) (pthread_testcancel(), getprotoent(__VA_ARGS__))
#define getpwent(...) (pthread_testcancel(), getpwent(__VA_ARGS__))
#define getpwnam(...) (pthread_testcancel(), getpwnam(__VA_ARGS__))
#define getpwnam_r(...) (pthread_testcancel(), getpwnam_r(__VA_ARGS__))
#define getpwuid(...) (pthread_testcancel(), getpwuid(__VA_ARGS__))
#define getpwuid_r(...) (pthread_testcancel(), getpwuid_r(__VA_ARGS__))
#define gets(...) (pthread_testcancel(), gets(__VA_ARGS__))
#define getservbyname(...) (pthread_testcancel(), getservbyname(__VA_ARGS__))
#define getservbyport(...) (pthread_testcancel(), getservbyport(__VA_ARGS__))
#define getservent(...) (pthread_testcancel(), getservent(__VA_ARGS__))
#define getutxent(...) (pthread_testcancel(), getutxent(__VA_ARGS__))
#define getutxid(...) (pthread_testcancel(), getutxid(__VA_ARGS__))
#define getutxline(...) (pthread_testcancel(), getutxline(__VA_ARGS__))
#undef getwc
#define getwc(...) (pthread_testcancel(), getwc(__VA_ARGS__))
#undef getwchar
#define getwchar(...) (pthread_testcancel(), getwchar(__VA_ARGS__))
#define getwd(...) (pthread_testcancel(), getwd(__VA_ARGS__))
#define glob(...) (pthread_testcancel(), glob(__VA_ARGS__))
#define iconv_close(...) (pthread_testcancel(), iconv_close(__VA_ARGS__))
#define iconv_open(...) (pthread_testcancel(), iconv_open(__VA_ARGS__))
#define ioctl(...) (pthread_testcancel(), ioctl(__VA_ARGS__))
#define link(...) (pthread_testcancel(), link(__VA_ARGS__))
#define localtime(...) (pthread_testcancel(), localtime(__VA_ARGS__))
#define lseek(...) (pthread_testcancel(), lseek(__VA_ARGS__))
#define lstat(...) (pthread_testcancel(), lstat(__VA_ARGS__))
#define mkstemp(...) (pthread_testcancel(), mkstemp(__VA_ARGS__))
#define nftw(...) (pthread_testcancel(), nftw(__VA_ARGS__))
#define opendir(...) (pthread_testcancel(), opendir(__VA_ARGS__))
#define openlog(...) (pthread_testcancel(), openlog(__VA_ARGS__))
#define pathconf(...) (pthread_testcancel(), pathconf(__VA_ARGS__))
#define pclose(...) (pthread_testcancel(), pclose(__VA_ARGS__))
#define perror(...) (pthread_testcancel(), perror(__VA_ARGS__))
#define popen(...) (pthread_testcancel(), popen(__VA_ARGS__))
#define posix_fadvise(...) (pthread_testcancel(), posix_fadvise(__VA_ARGS__))
#define posix_fallocate(...) (pthread_testcancel(), posix_fallocate(__VA_ARGS__))
#define posix_madvise(...) (pthread_testcancel(), posix_madvise(__VA_ARGS__))
#define posix_openpt(...) (pthread_testcancel(), posix_openpt(__VA_ARGS__))
#define posix_spawn(...) (pthread_testcancel(), posix_spawn(__VA_ARGS__))
#define posix_spawnp(...) (pthread_testcancel(), posix_spawnp(__VA_ARGS__))
#define posix_trace_clear(...) (pthread_testcancel(), posix_trace_clear(__VA_ARGS__))
#define posix_trace_close(...) (pthread_testcancel(), posix_trace_close(__VA_ARGS__))
#define posix_trace_create(...) (pthread_testcancel(), posix_trace_create(__VA_ARGS__))
#define posix_trace_create_withlog(...) (pthread_testcancel(), posix_trace_create_withlog(__VA_ARGS__))
#define posix_trace_eventtypelist_getne(...) (pthread_testcancel(), posix_trace_eventtypelist_getne(__VA_ARGS__))
#define posix_trace_eventtypelist_rewin(...) (pthread_testcancel(), posix_trace_eventtypelist_rewin(__VA_ARGS__))
#define posix_trace_flush(...) (pthread_testcancel(), posix_trace_flush(__VA_ARGS__))
#define posix_trace_get_attr(...) (pthread_testcancel(), posix_trace_get_attr(__VA_ARGS__))
#define posix_trace_get_filter(...) (pthread_testcancel(), posix_trace_get_filter(__VA_ARGS__))
#define posix_trace_get_status(...) (pthread_testcancel(), posix_trace_get_status(__VA_ARGS__))
#define posix_trace_getnext_event(...) (pthread_testcancel(), posix_trace_getnext_event(__VA_ARGS__))
#define posix_trace_open(...) (pthread_testcancel(), posix_trace_open(__VA_ARGS__))
#define posix_trace_rewind(...) (pthread_testcancel(), posix_trace_rewind(__VA_ARGS__))
#define posix_trace_setfilter(...) (pthread_testcancel(), posix_trace_setfilter(__VA_ARGS__))
#define posix_trace_shutdown(...) (pthread_testcancel(), posix_trace_shutdown(__VA_ARGS__))
#define posix_trace_timedgetnext_event(...) (pthread_testcancel(), posix_trace_timedgetnext_event(__VA_ARGS__))
#define posix_typed_mem_open(...) (pthread_testcancel(), posix_typed_mem_open(__VA_ARGS__))
#define printf(...) (pthread_testcancel(), printf(__VA_ARGS__))
#define putc(...) (pthread_testcancel(), putc(__VA_ARGS__))
#define putc_unlocked(...) (pthread_testcancel(), putc_unlocked(__VA_ARGS__))
#define putchar(...) (pthread_testcancel(), putchar(__VA_ARGS__))
#define putchar_unlocked(...) (pthread_testcancel(), putchar_unlocked(__VA_ARGS__))
#define puts(...) (pthread_testcancel(), puts(__VA_ARGS__))
#define pututxline(...) (pthread_testcancel(), pututxline(__VA_ARGS__))
#undef putwc
#define putwc(...) (pthread_testcancel(), putwc(__VA_ARGS__))
#undef putwchar
#define putwchar(...) (pthread_testcancel(), putwchar(__VA_ARGS__))
#define readdir(...) (pthread_testcancel(), readdir(__VA_ARSG__))
#define readdir_r(...) (pthread_testcancel(), readdir_r(__VA_ARGS__))
#define remove(...) (pthread_testcancel(), remove(__VA_ARGS__))
#define rename(...) (pthread_testcancel(), rename(__VA_ARGS__))
#define rewind(...) (pthread_testcancel(), rewind(__VA_ARGS__))
#define rewinddir(...) (pthread_testcancel(), rewinddir(__VA_ARGS__))
#define scanf(...) (pthread_testcancel(), scanf(__VA_ARGS__))
#define seekdir(...) (pthread_testcancel(), seekdir(__VA_ARGS__))
#define semop(...) (pthread_testcancel(), semop(__VA_ARGS__))
#define setgrent(...) (pthread_testcancel(), setgrent(__VA_ARGS__))
#define sethostent(...) (pthread_testcancel(), sethostemt(__VA_ARGS__))
#define setnetent(...) (pthread_testcancel(), setnetent(__VA_ARGS__))
#define setprotoent(...) (pthread_testcancel(), setprotoent(__VA_ARGS__))
#define setpwent(...) (pthread_testcancel(), setpwent(__VA_ARGS__))
#define setservent(...) (pthread_testcancel(), setservent(__VA_ARGS__))
#define setutxent(...) (pthread_testcancel(), setutxent(__VA_ARGS__))
#define stat(...) (pthread_testcancel(), stat(__VA_ARGS__))
#define strerror(...) (pthread_testcancel(), strerror(__VA_ARGS__))
#define strerror_r(...) (pthread_testcancel(), strerror_r(__VA_ARGS__))
#define strftime(...) (pthread_testcancel(), strftime(__VA_ARGS__))
#define symlink(...) (pthread_testcancel(), symlink(__VA_ARGS__))
#define sync(...) (pthread_testcancel(), sync(__VA_ARGS__))
#define syslog(...) (pthread_testcancel(), syslog(__VA_ARGS__))
#define tmpfile(...) (pthread_testcancel(), tmpfile(__VA_ARGS__))
#define tmpnam(...) (pthread_testcancel(), tmpnam(__VA_ARGS__))
#define ttyname(...) (pthread_testcancel(), ttyname(__VA_ARGS__))
#define ttyname_r(...) (pthread_testcancel(), ttyname_r(__VA_ARGS__))
#define tzset(...) (pthread_testcancel(), tzset(__VA_ARGS__))
#define ungetc(...) (pthread_testcancel(), ungetc(__VA_ARGS__))
#define ungetwc(...) (pthread_testcancel(), ungetwc(__VA_ARGS__))
#define unlink(...) (pthread_testcancel(), unlink(__VA_ARGS__))
#define vfprintf(...) (pthread_testcancel(), vfprintf(__VA_ARGS__))
#define vfwprintf(...) (pthread_testcancel(), vfwprintf(__VA_ARGS__))
#define vprintf(...) (pthread_testcancel(), vprintf(__VA_ARGS__))
#define vwprintf(...) (pthread_testcancel(), vwprintf(__VA_ARGS__))
#define wcsftime(...) (pthread_testcancel(), wcsftime(__VA_ARGS__))
#define wordexp(...) (pthread_testcancel(), wordexp(__VA_ARGS__))
#define wprintf(...) (pthread_testcancel(), wprintf(__VA_ARGS__))
#define wscanf(...) (pthread_testcancel(), wscanf(__VA_ARGS__))
#endif
/* We deal here with a gcc issue for posix threading on Windows.
We would need to change here gcc's gthr-posix.h header, but this
got rejected. So we deal it within this header. */
#ifdef _GTHREAD_USE_MUTEX_INIT_FUNC
#undef _GTHREAD_USE_MUTEX_INIT_FUNC
#endif
#define _GTHREAD_USE_MUTEX_INIT_FUNC 1
#ifdef __cplusplus
}
#endif
#endif /* WIN_PTHREADS_H */

297
cookbooks/mingw/files/default/time.h Normal file
View File

@ -0,0 +1,297 @@
/*
* time.h
*
* Type definitions and function declarations relating to date and time.
*
* $Id: time.h,v ffe8d63c87e3 2015/05/18 12:49:39 keithmarshall $
*
* Written by Rob Savoye <rob@cygnus.com>
* Copyright (C) 1997-2007, 2011, 2015, MinGW.org Project.
*
*
* Permission is hereby granted, free of charge, to any person obtaining a
* copy of this software and associated documentation files (the "Software"),
* to deal in the Software without restriction, including without limitation
* the rights to use, copy, modify, merge, publish, distribute, sublicense,
* and/or sell copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following conditions:
*
* The above copyright notice, this permission notice, and the following
* disclaimer shall be included in all copies or substantial portions of
* the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
* OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OF OR OTHER
* DEALINGS IN THE SOFTWARE.
*
*/
#ifndef _TIME_H
#define _TIME_H
/* All the headers include this file. */
#include <_mingw.h>
/* Number of clock ticks per second. A clock tick is the unit by which
* processor time is measured and is returned by 'clock'.
*/
#define CLOCKS_PER_SEC ((clock_t)(1000))
#define CLK_TCK CLOCKS_PER_SEC
#ifndef RC_INVOKED
/*
* Some elements declared in time.h may also be required by other
* header files, without necessarily including time.h itself; such
* elements are declared in the local parts/time.h system header file.
* Declarations for such elements must be selected prior to inclusion:
*/
#define __need_time_t
#define __need_struct_timespec
#include <parts/time.h>
/* time.h is also required to duplicate the following type definitions,
* which are nominally defined in stddef.h
*/
#define __need_NULL
#define __need_wchar_t
#define __need_size_t
#include <stddef.h>
/* A type for measuring processor time in clock ticks; (no need to
* guard this, since it isn't defined elsewhere).
*/
typedef long clock_t;
#ifndef _TM_DEFINED
/*
* A structure for storing all kinds of useful information about the
* current (or another) time.
*/
struct tm
{
int tm_sec; /* Seconds: 0-59 (K&R says 0-61?) */
int tm_min; /* Minutes: 0-59 */
int tm_hour; /* Hours since midnight: 0-23 */
int tm_mday; /* Day of the month: 1-31 */
int tm_mon; /* Months *since* january: 0-11 */
int tm_year; /* Years since 1900 */
int tm_wday; /* Days since Sunday (0-6) */
int tm_yday; /* Days since Jan. 1: 0-365 */
int tm_isdst; /* +1 Daylight Savings Time, 0 No DST,
* -1 don't know */
};
#define _TM_DEFINED
#endif
_BEGIN_C_DECLS
_CRTIMP clock_t __cdecl __MINGW_NOTHROW clock (void);
#if __MSVCRT_VERSION__ < 0x0800
_CRTIMP time_t __cdecl __MINGW_NOTHROW time (time_t*);
_CRTIMP double __cdecl __MINGW_NOTHROW difftime (time_t, time_t);
_CRTIMP time_t __cdecl __MINGW_NOTHROW mktime (struct tm*);
#endif
/*
* These functions write to and return pointers to static buffers that may
* be overwritten by other function calls. Yikes!
*
* NOTE: localtime, and perhaps the others of the four functions grouped
* below may return NULL if their argument is not 'acceptable'. Also note
* that calling asctime with a NULL pointer will produce an Invalid Page
* Fault and crap out your program. Guess how I know. Hint: stat called on
* a directory gives 'invalid' times in st_atime etc...
*/
_CRTIMP char* __cdecl __MINGW_NOTHROW asctime (const struct tm*);
#if __MSVCRT_VERSION__ < 0x0800
_CRTIMP char* __cdecl __MINGW_NOTHROW ctime (const time_t*);
_CRTIMP struct tm* __cdecl __MINGW_NOTHROW gmtime (const time_t*);
_CRTIMP struct tm* __cdecl __MINGW_NOTHROW localtime (const time_t*);
#endif
_CRTIMP size_t __cdecl __MINGW_NOTHROW strftime (char*, size_t, const char*, const struct tm*);
#ifndef __STRICT_ANSI__
extern _CRTIMP void __cdecl __MINGW_NOTHROW _tzset (void);
#ifndef _NO_OLDNAMES
extern _CRTIMP void __cdecl __MINGW_NOTHROW tzset (void);
#endif
_CRTIMP char* __cdecl __MINGW_NOTHROW _strdate(char*);
_CRTIMP char* __cdecl __MINGW_NOTHROW _strtime(char*);
/* These require newer versions of msvcrt.dll (6.10 or higher). */
#if __MSVCRT_VERSION__ >= 0x0601
_CRTIMP __time64_t __cdecl __MINGW_NOTHROW _time64( __time64_t*);
_CRTIMP __time64_t __cdecl __MINGW_NOTHROW _mktime64 (struct tm*);
_CRTIMP char* __cdecl __MINGW_NOTHROW _ctime64 (const __time64_t*);
_CRTIMP struct tm* __cdecl __MINGW_NOTHROW _gmtime64 (const __time64_t*);
_CRTIMP struct tm* __cdecl __MINGW_NOTHROW _localtime64 (const __time64_t*);
#endif /* __MSVCRT_VERSION__ >= 0x0601 */
/* These require newer versions of msvcrt.dll (8.00 or higher). */
#if __MSVCRT_VERSION__ >= 0x0800
_CRTIMP __time32_t __cdecl __MINGW_NOTHROW _time32 (__time32_t*);
_CRTIMP double __cdecl __MINGW_NOTHROW _difftime32 (__time32_t, __time32_t);
_CRTIMP double __cdecl __MINGW_NOTHROW _difftime64 (__time64_t, __time64_t);
_CRTIMP __time32_t __cdecl __MINGW_NOTHROW _mktime32 (struct tm*);
_CRTIMP __time32_t __cdecl __MINGW_NOTHROW _mkgmtime32 (struct tm*);
_CRTIMP __time64_t __cdecl __MINGW_NOTHROW _mkgmtime64 (struct tm*);
_CRTIMP char* __cdecl __MINGW_NOTHROW _ctime32 (const __time32_t*);
_CRTIMP struct tm* __cdecl __MINGW_NOTHROW _gmtime32 (const __time32_t*);
_CRTIMP struct tm* __cdecl __MINGW_NOTHROW _localtime32 (const __time32_t*);
#ifndef _USE_32BIT_TIME_T
_CRTALIAS time_t __cdecl __MINGW_NOTHROW time (time_t* _v) { return(_time64 (_v)); }
_CRTALIAS double __cdecl __MINGW_NOTHROW difftime (time_t _v1, time_t _v2) { return(_difftime64 (_v1,_v2)); }
_CRTALIAS time_t __cdecl __MINGW_NOTHROW mktime (struct tm* _v) { return(_mktime64 (_v)); }
_CRTALIAS time_t __cdecl __MINGW_NOTHROW _mkgmtime (struct tm* _v) { return(_mkgmtime64 (_v)); }
_CRTALIAS char* __cdecl __MINGW_NOTHROW ctime (const time_t* _v) { return(_ctime64 (_v)); }
_CRTALIAS struct tm* __cdecl __MINGW_NOTHROW gmtime (const time_t* _v) { return(_gmtime64 (_v)); }
_CRTALIAS struct tm* __cdecl __MINGW_NOTHROW localtime (const time_t* _v) { return(_localtime64 (_v)); }
#else
_CRTALIAS time_t __cdecl __MINGW_NOTHROW time (time_t* _v) { return(_time32 (_v)); }
_CRTALIAS double __cdecl __MINGW_NOTHROW difftime (time_t _v1, time_t _v2) { return(_difftime32 (_v1,_v2)); }
_CRTALIAS time_t __cdecl __MINGW_NOTHROW mktime (struct tm* _v) { return(_mktime32 (_v)); }
_CRTALIAS time_t __cdecl __MINGW_NOTHROW _mkgmtime (struct tm* _v) { return(_mkgmtime32 (_v)); }
_CRTALIAS char* __cdecl __MINGW_NOTHROW ctime (const time_t* _v) { return(_ctime32 (_v)); }
_CRTALIAS struct tm* __cdecl __MINGW_NOTHROW gmtime (const time_t* _v) { return(_gmtime32 (_v)); }
_CRTALIAS struct tm* __cdecl __MINGW_NOTHROW localtime (const time_t* _v) { return(_localtime32 (_v)); }
#endif /* !_USE_32BIT_TIME_T */
#endif /* __MSVCRT_VERSION__ >= 0x0800 */
/* _daylight: non zero if daylight savings time is used.
* _timezone: difference in seconds between GMT and local time.
* _tzname: standard/daylight savings time zone names (an array with two
* elements).
*/
#ifdef __MSVCRT__
/* These are for compatibility with pre-VC 5.0 suppied MSVCRT. */
extern _CRTIMP int* __cdecl __MINGW_NOTHROW __p__daylight (void);
extern _CRTIMP long* __cdecl __MINGW_NOTHROW __p__timezone (void);
extern _CRTIMP char** __cdecl __MINGW_NOTHROW __p__tzname (void);
__MINGW_IMPORT int _daylight;
__MINGW_IMPORT long _timezone;
__MINGW_IMPORT char *_tzname[2];
#else /* not __MSVCRT (ie. crtdll) */
#ifndef __DECLSPEC_SUPPORTED
extern int* _imp___daylight_dll;
extern long* _imp___timezone_dll;
extern char** _imp___tzname;
#define _daylight (*_imp___daylight_dll)
#define _timezone (*_imp___timezone_dll)
#define _tzname (*_imp___tzname)
#else /* __DECLSPEC_SUPPORTED */
__MINGW_IMPORT int _daylight_dll;
__MINGW_IMPORT long _timezone_dll;
__MINGW_IMPORT char* _tzname[2];
#define _daylight _daylight_dll
#define _timezone _timezone_dll
#endif /* __DECLSPEC_SUPPORTED */
#endif /* ! __MSVCRT__ */
#endif /* ! __STRICT_ANSI__ */
#ifndef _NO_OLDNAMES
#ifdef __MSVCRT__
/* These go in the oldnames import library for MSVCRT.
*/
__MINGW_IMPORT int daylight;
__MINGW_IMPORT long timezone;
__MINGW_IMPORT char *tzname[2];
#else /* ! __MSVCRT__ */
/*
* CRTDLL is royally messed up when it comes to these macros.
* TODO: import and alias these via oldnames import library instead
* of macros.
*/
#define daylight _daylight
/*
* NOTE: timezone not defined as a macro because it would conflict with
* struct timezone in sys/time.h. Also, tzname used to a be macro, but
* now it's in moldname.
*/
__MINGW_IMPORT char *tzname[2];
#endif /* ! __MSVCRT__ */
#endif /* ! _NO_OLDNAMES */
#ifndef _WTIME_DEFINED
/* wide function prototypes, also declared in wchar.h */
#ifndef __STRICT_ANSI__
#ifdef __MSVCRT__
_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wasctime(const struct tm*);
#if __MSVCRT_VERSION__ < 0x0800
_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wctime(const time_t*);
#endif
_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wstrdate(wchar_t*);
_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wstrtime(wchar_t*);
#if __MSVCRT_VERSION__ >= 0x0601
_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wctime64 (const __time64_t*);
#endif
#if __MSVCRT_VERSION__ >= 0x0800
_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wctime32 (const __time32_t*);
#ifndef _USE_32BIT_TIME_T
_CRTALIAS wchar_t* __cdecl __MINGW_NOTHROW _wctime (const time_t* _v) { return(_wctime64 (_v)); }
#else
_CRTALIAS wchar_t* __cdecl __MINGW_NOTHROW _wctime (const time_t* _v) { return(_wctime32 (_v)); }
#endif
#endif /* __MSVCRT_VERSION__ >= 0x0800 */
#endif /* __MSVCRT__ */
#endif /* __STRICT_ANSI__ */
_CRTIMP size_t __cdecl __MINGW_NOTHROW wcsftime (wchar_t*, size_t, const wchar_t*, const struct tm*);
#define _WTIME_DEFINED
#endif /* _WTIME_DEFINED */
_END_C_DECLS
/* -------------------------------------------------------------------
* CHEF PATCHES
*
* PROVIDE clock_gettime ETC. IN time.h FOR POSIX COMPLIANCE.
*
* This code was copied from the 64-bit TDM gcc compiler headers. It
* is here to allow certain libraries (like libxslt) to compile
* because they assume that they are only going to be built on a POSIX
* system. The C99 standards do not require that these functions be
* available but most POSIX systems provide them unless strict x-play
* compatibility is requested.
*
* On windows, configure could possibly identify that these functions
* are unavailable but since it tests for function availability to
* attempting to link a binary with said functions, these tests
* succeed with our TDM mingw runtime (because we indeed support these
* posix compatibility methods). Hence we pretend like we are a POSIX
* compliant system and export these methods.
*/
/* POSIX 2008 says clock_gettime and timespec are defined in time.h header,
but other systems - like Linux, Solaris, etc - tend to declare such
recent extensions only if the following guards are met. */
#if !defined(IN_WINPTHREAD) && \
((!defined(_STRICT_STDC) && !defined(__XOPEN_OR_POSIX)) || \
(_POSIX_C_SOURCE > 2) || defined(__EXTENSIONS__))
#include <pthread_time.h>
#endif
/* END OF CHEF PATCHES
* -------------------------------------------------------------------
*/
#endif /* ! RC_INVOKED */
#endif /* ! _TIME_H: $RCSfile: time.h,v $: end of file */

38
cookbooks/mingw/libraries/_helper.rb Normal file
View File

@ -0,0 +1,38 @@
#
# Cookbook:: mingw
# Library:: _helper
#
# Copyright:: 2016-2019, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
module Mingw
module Helper
def win_friendly_path(path)
path.gsub(::File::SEPARATOR, ::File::ALT_SEPARATOR || '\\') if path
end
def archive_name(source)
url = ::URI.parse(source)
::File.basename(::URI.unescape(url.path))
end
def tar_name(source)
aname = archive_name(source)
::File.basename(aname, ::File.extname(aname))
end
end
end
Chef::Resource.include Mingw::Helper

36
cookbooks/mingw/metadata.json Normal file
View File

@ -0,0 +1,36 @@
{
"name": "mingw",
"description": "Installs a mingw/msys based toolchain on windows",
"long_description": "",
"maintainer": "Chef Software, Inc.",
"maintainer_email": "cookbooks@chef.io",
"license": "Apache-2.0",
"platforms": {
"windows": ">= 0.0.0"
},
"dependencies": {
"seven_zip": ">= 0.0.0"
},
"providing": {
},
"recipes": {
},
"version": "2.1.7",
"source_url": "https://github.com/chef-cookbooks/mingw",
"issues_url": "https://github.com/chef-cookbooks/mingw/issues",
"privacy": false,
"chef_versions": [
[
">= 12.15"
]
],
"ohai_versions": [
],
"gems": [
],
"eager_load_libraries": true
}

14
cookbooks/mingw/metadata.rb Normal file
View File

@ -0,0 +1,14 @@
name 'mingw'
maintainer 'Chef Software, Inc.'
maintainer_email 'cookbooks@chef.io'
license 'Apache-2.0'
description 'Installs a mingw/msys based toolchain on windows'
version '2.1.7'
supports 'windows'
depends 'seven_zip'
source_url 'https://github.com/chef-cookbooks/mingw'
issues_url 'https://github.com/chef-cookbooks/mingw/issues'
chef_version '>= 12.15'

19
cookbooks/mingw/recipes/default.rb Normal file
View File

@ -0,0 +1,19 @@
#
# Cookbook:: mingw
# Recipe:: default
#
# Copyright:: 2016-2019, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
include_recipe 'seven_zip::default'

17
cookbooks/mingw/renovate.json Normal file
View File

@ -0,0 +1,17 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:base"],
"packageRules": [{
"groupName": "Actions",
"matchUpdateTypes": ["patch", "pin", "digest"],
"automerge": true,
"addLabels": ["Release: Patch", "Skip: Announcements"]
},
{
"groupName": "Actions",
"matchUpdateTypes": ["major"],
"automerge": false,
"addLabels": ["Release: Patch", "Skip: Announcements"]
}
]
}

54
cookbooks/mingw/resources/get.rb Normal file
View File

@ -0,0 +1,54 @@
#
# Cookbook:: mingw
# Resource:: get
#
# Copyright:: 2016-2019, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# Installs the core msys utilities needed for mingw/git/any other posix
# based toolchain at a desired location using mingw-get.exe.
property :package, String, name_property: true
property :root, String, required: true
action_class do
def mingw_do_action(action_cmd)
seven_zip_archive "fetching mingw-get to #{win_friendly_path(root)}" do
source 'http://iweb.dl.sourceforge.net/project/mingw/Installer/mingw-get/mingw-get-0.6.2-beta-20131004-1/mingw-get-0.6.2-mingw32-beta-20131004-1-bin.zip'
path root
checksum '2e0e9688d42adc68c5611759947e064156e169ff871816cae52d33ee0655826d'
not_if do
::File.exist?(::File.join(root, 'bin/mingw-get.exe'))
end
end
execute "performing #{action_cmd} for #{package}" do
command ".\\bin\\mingw-get.exe -v #{action_cmd} #{package}"
cwd root
end
end
end
action :install do
mingw_do_action('install')
end
action :upgrade do
mingw_do_action('upgrade')
end
action :remove do
mingw_do_action('remove')
end

139
cookbooks/mingw/resources/msys2_package.rb Normal file
View File

@ -0,0 +1,139 @@
#
# Cookbook:: mingw
# Resource:: msys2_package
#
# Copyright:: 2016-2019, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# Installs msys2 base system and installs/upgrades packages within in.
#
# Where's the version flag? Where's idempotence you say? Well f*** you
# for trying to version your product. This is arch. They live on the edge.
# You never get anything but the latest version. And if that's broken...
# well that's your problem isn't it? And they don't believe in preserving
# older versions. Good luck!
property :package, String, name_property: true
property :root, String, required: true
provides :msys2_package
action_class do
#
# Runs a command through a bash login shell made by our shim .bat file.
# The bash.bat file defaults %HOME% to #{root}/home/%USERNAME% and requests
# that the command be run in the current working directory.
#
def msys2_exec(comment, cmd)
f_root = win_friendly_path(root)
execute comment do
command ".\\bin\\bash.bat -c '#{cmd}'"
cwd f_root
live_stream true
environment('MSYSTEM' => 'MSYS')
end
end
def msys2_init
cache_dir = ::File.join(root, '.cache')
f_cache_dir = win_friendly_path(cache_dir)
base_url = node['msys2']['url']
base_checksum = node['msys2']['checksum']
unless ::File.exist?(::File.join(root, 'msys2.exe'))
seven_zip_archive "cache msys2 base to #{f_cache_dir}" do
source base_url
path f_cache_dir
checksum base_checksum
overwrite true
end
seven_zip_archive "extract msys2 base archive to #{f_cache_dir}" do
source "#{f_cache_dir}\\#{tar_name(base_url)}"
path f_cache_dir
overwrite true
end
ruby_block 'copy msys2 base files to root' do
block do
# Oh my god msys2 and pacman are picky as hell when it comes to
# updating core files. They use the mtime on certain files to
# determine if they need to updated or not and simply skip various
# steps otherwise.
::FileUtils.cp_r(::Dir.glob("#{cache_dir}/msys64/*"), root, preserve: true)
end
end
end
pacman_key_dir = ::File.join(root, 'etc/pacman.d/gnupg')
bin_dir = ::File.join(root, 'bin')
directory win_friendly_path(bin_dir)
cookbook_file win_friendly_path("#{bin_dir}/bash.bat") do
source 'bash.bat'
cookbook 'mingw'
end
cookbook_file win_friendly_path(::File.join(root, 'custom-upgrade.sh')) do
source 'custom-upgrade.sh'
cookbook 'mingw'
end
cookbook_file win_friendly_path(::File.join(root, 'etc/profile.d/custom_prefix.sh')) do
source 'custom_prefix.sh'
cookbook 'mingw'
end
# $HOME is using files from /etc/skel. The home-directory creation step
# will automatically be performed if other users log in - so if you wish
# to globally modify user first time setup, edit /etc/skel or add
# "post-setup" steps to /etc/post-install/
# The first-time init shell must be restarted and cannot be reused.
msys2_exec('msys2 first time init', 'exit') unless ::File.exist?(pacman_key_dir)
# Update pacman and msys base packages.
if ::File.exist?(::File.join(root, 'usr/bin/update-core')) || !::File.exist?(::File.join(root, 'custom-upgrade.sh'))
msys2_exec('upgrade msys2 core', '/custom-upgrade.sh')
msys2_exec('upgrade msys2 core: part 2', 'pacman -Suu --noconfirm')
# Now we can actually upgrade everything ever.
msys2_exec('upgrade entire msys2 system: 1', 'pacman -Syuu --noconfirm')
# Might need to do it once more to pick up a few stragglers.
msys2_exec('upgrade entire msys2 system: 2', 'pacman -Syuu --noconfirm')
end
end
def msys2_do_action(comment, action_cmd)
msys2_init
msys2_exec(comment, action_cmd)
end
end
action :install do
msys2_do_action("installing #{package}", "pacman -S --needed --noconfirm #{package}")
end
# Package name is ignored. This is arch. Why would you ever upgrade a single
# package and its deps? That'll just break everything else that ever depended
# on a different version of that dep. Because arch is wonderful like that.
# So you only get the choice to move everything to latest or not... it's the
# most agile development possible!
action :upgrade do
msys2_do_action("upgrading #{package}", "pacman -Syu --noconfirm #{package}")
end
action :remove do
msys2_do_action("removing #{package}", "pacman -R --noconfirm #{package}")
end

112
cookbooks/mingw/resources/tdm_gcc.rb Normal file
View File

@ -0,0 +1,112 @@
#
# Cookbook:: mingw
# Resource:: tdm_gcc
#
# Copyright:: 2016-2019, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# Installs a gcc based C/C++ compiler and runtime from TDM GCC.
property :flavor, Symbol, is: [:sjlj_32, :seh_sjlj_64], default: :seh_sjlj_64
property :root, String, required: true
property :version, String, is: ['5.1.0'], name_property: true
tdm_gcc_64 = {
'http://iweb.dl.sourceforge.net/project/tdm-gcc/TDM-GCC%205%20series/5.1.0-tdm64-1/gcc-5.1.0-tdm64-1-core.tar.lzma' =>
'29393aac890847089ad1e93f81a28f6744b1609c00b25afca818f3903e42e4bd',
'http://iweb.dl.sourceforge.net/project/tdm-gcc/MinGW-w64%20runtime/GCC%205%20series/mingw64runtime-v4-git20150618-gcc5-tdm64-1.tar.lzma' =>
'29186e0bb36824b10026d78bdcf238d631d8fc1d90718d2ebbd9ec239b6f94dd',
'http://iweb.dl.sourceforge.net/project/tdm-gcc/GNU%20binutils/binutils-2.25-tdm64-1.tar.lzma' =>
'4722bb7b4d46cef714234109e25e5d1cfd29f4e53365b6d615c8a00735f60e40',
'http://iweb.dl.sourceforge.net/project/tdm-gcc/TDM-GCC%205%20series/5.1.0-tdm64-1/gcc-5.1.0-tdm64-1-c%2B%2B.tar.lzma' =>
'17fd497318d1ac187a113e8665330d746ad9607a0406ab2374db0d8e6f4094d1',
}
tdm_gcc_32 = {
'http://iweb.dl.sourceforge.net/project/tdm-gcc/TDM-GCC%205%20series/5.1.0-tdm-1%20SJLJ/gcc-5.1.0-tdm-1-core.tar.lzma' =>
'9199e6ecbce956ff4704b52098beb38e313176ace610285fb93758a08752870e',
'http://iweb.dl.sourceforge.net/project/tdm-gcc/TDM-GCC%205%20series/5.1.0-tdm-1%20SJLJ/gcc-5.1.0-tdm-1-c%2B%2B.tar.lzma' =>
'19fe46819ce43531d066b438479300027bbf06da57e8a10be5100466f80c28fc',
}
action :install do
cache_dir = ::File.join(root, '.cache')
f_root = win_friendly_path(root)
if flavor == :sjlj_32
[
'binutils-bin=2.25.1',
'libintl-dll=0.18.3.2',
'mingwrt-dll=3.21.1',
'mingwrt-dev=3.21.1',
'w32api-dev=3.17',
].each do |package_fragment|
mingw_get "install #{package_fragment} at #{f_root}" do
package "mingw32-#{package_fragment}-*"
root new_resource.root
end
end
end
to_fetch =
case flavor
when :sjlj_32
tdm_gcc_32
when :seh_sjlj_64
tdm_gcc_64
else
raise "Unknown flavor: #{flavor}"
end
to_fetch.each do |url, hash|
seven_zip_archive "cache #{archive_name(url)} to #{win_friendly_path(cache_dir)}" do
source url
path cache_dir
checksum hash
overwrite true
end
seven_zip_archive "extract #{tar_name(url)} to #{f_root}" do
source ::File.join(cache_dir, tar_name(url))
path root
overwrite true
end
end
# Patch time.h headers for compatibility with winpthreads.
# These patches were made for binutils 2.25.1 for 32-bit TDM GCC only.
if flavor == :sjlj_32
include_dir = win_friendly_path(::File.join(root, 'include'))
cookbook_file "#{include_dir}\\pthread.h" do
cookbook 'mingw'
source 'pthread.h'
end
cookbook_file "#{include_dir}\\time.h" do
cookbook 'mingw'
source 'time.h'
end
end
end
def archive_name(source)
url = ::URI.parse(source)
::File.basename(::URI.unescape(url.path))
end
def tar_name(source)
aname = archive_name(source)
::File.basename(aname, ::File.extname(aname))
end

8
site-cookbooks/kosmos-ipfs/recipes/default.rb
View File

@ -17,28 +17,28 @@ unless node.chef_environment == "development"
include_recipe "kosmos-ipfs::firewall_swarm"
end
firewall_rule 'ipfs_api' do
firewall_rule 'ipfs api' do
port node['kosmos-ipfs']['api_port']
source "10.1.1.0/24"
protocol :tcp
command :allow
end
firewall_rule 'ipfs_gateway' do
firewall_rule 'ipfs gateway' do
port node['kosmos-ipfs']['gateway_port']
source "10.1.1.0/24"
protocol :tcp
command :allow
end
firewall_rule 'ipfs_local_p2p_allow_out' do
firewall_rule 'ipfs local p2p' do
destination "10.1.1.0/24"
direction :out
protocol :none
command :allow
end
firewall_rule 'ipfs_local_p2p_deny_out' do
firewall_rule 'ipfs local p2p' do
destination "10.0.0.0/8"
direction :out
protocol :none

2
site-cookbooks/kosmos-ipfs/recipes/firewall_swarm.rb
View File

@ -4,7 +4,7 @@
#
include_recipe 'firewall'
firewall_rule 'ipfs_swarm_p2p' do
firewall_rule 'ipfs swarm p2p' do
port node['kosmos-ipfs']['swarm_p2p_port']
protocol :tcp
command :allow