diff --git a/Berksfile b/Berksfile index 90a3ddd..7e06ef6 100644 --- a/Berksfile +++ b/Berksfile @@ -11,7 +11,7 @@ cookbook 'php', '~> 8.0.0' cookbook 'composer', '~> 2.7.0' cookbook 'users', '~> 5.3.1' cookbook 'hostname', '= 0.4.2' -cookbook 'firewall', '~> 2.6.3' +cookbook 'firewall', '~> 6.2.16' cookbook 'nginx', '= 9.0.0' cookbook 'fail2ban', '~> 7.0.4' cookbook 'mysql', '~> 8.7.3' diff --git a/Berksfile.lock b/Berksfile.lock index 00a7279..f5ee06d 100644 --- a/Berksfile.lock +++ b/Berksfile.lock @@ -7,7 +7,7 @@ DEPENDENCIES composer (~> 2.7.0) elasticsearch (= 4.3.0) fail2ban (~> 7.0.4) - firewall (~> 2.6.3) + firewall (~> 6.2.16) git (~> 10.0.0) golang (~> 5.3.1) homebrew (= 3.0.0) @@ -44,6 +44,9 @@ GRAPH apt (7.3.0) ark (6.0.3) seven_zip (>= 3.1) + build-essential (8.2.1) + mingw (>= 1.1) + seven_zip (>= 0.0.0) chef-sugar (5.1.12) chocolatey (3.0.0) compat_resource (12.19.0) @@ -58,8 +61,7 @@ GRAPH yum (>= 0.0.0) fail2ban (7.0.4) yum-epel (>= 0.0.0) - firewall (2.6.5) - chef-sugar (>= 0.0.0) + firewall (6.2.16) git (10.0.0) golang (5.3.1) ark (>= 6.0) @@ -81,6 +83,8 @@ GRAPH apache2 (>= 0.0.0) nginx (>= 0.0.0) php (>= 0.0.0) + mingw (2.1.7) + seven_zip (>= 0.0.0) mysql (8.7.4) nginx (9.0.0) build-essential (>= 5.0) diff --git a/cookbooks/build-essential/CHANGELOG.md b/cookbooks/build-essential/CHANGELOG.md new file mode 100644 index 0000000..95c1a29 --- /dev/null +++ b/cookbooks/build-essential/CHANGELOG.md @@ -0,0 +1,285 @@ +# build-essential Cookbook CHANGELOG + +This file is used to list changes made in each version of the build-essential cookbook. + +## 8.2.1 (2018-09-04) + +- Add a note that this cookbook is no longer maintained as the build_essential resource was moved directly into the chef-client making this cookbook no longer necessary. + +## 8.2.0 (2018-08-28) + +- Simplify the if installed logic for macos +- Remove support for FreeBSD < 10 which is VERY much EOL +- Avoid ChefSpec deprecation warnings +- Avoid deprecation warnings in Chef 14.3+ by not loading resources already in Chef + +## 8.1.1 (2018-03-17) + +- Make sure we install the last available xcode command line tool package so we get the latest version + +## 8.1.0 (2018-03-17) + +- Support Amazon Linux 2.0 +- Remove the ChefSpec matchers which are autogenerated now in recent ChefDK releaeses. If your specs fail because of this you need to update to a more recent ChefDK release. +- Swap Debian 7 testing for Amazon 2 & Ubuntu 18.04 testing since Debian 7 is EOL in May + +## 8.0.4 (2017-11-29) + +- Install gcc-c and gcc-c++ for solaris 11 +- Fix dokken's amazonlinux configuration +- Update chef dependency in metadata.rb to Chef 12.7 +- Clean up testing + +## 8.0.3 (2017-05-30) + +- Fix solaris metadata in metadata.rb +- Remove mac_os_x_server from metata as it's not a platform + +## 8.0.2 (2017-05-06) + +- Remove buggy action_class.class_eval usage + +## 8.0.1 (2017-04-14) + +- Test with local delivery and not Rake +- Ensure compatibility with Chef 12.5 +- Update apache2 license string +- Ensure compatibility with Amazon Linux on Chef 13 + +## 8.0.0 (2017-02-14) + +- Require 12.5 or later and remove compat_resource cookbook dependency + +## 7.0.3 (2016-12-22) + +- Require the latest compat_resource +- Cookstyle fixes + +## 7.0.2 (2016-11-07) + +- Fix softwareupdate issue from -v to --verbose + +## 7.0.1 (2016-10-06) + +- Install gcc 4.8 on SUSE < 12 + +## 7.0.0 (2016-09-30) + +- Remove support for OS X < 10.9 and add support for OS X 10.12 +- Refactor the xcode installer resource as a custom resource that does not require updates for each new OS X update +- Use a test recipe with apt_update to avoid needing apt + +## 6.0.6 (2016-09-19) + +- Remove chef 11 compatibility in the metadata +- Solaris 11 needs both make and gnu make + +## 6.0.5 (2016-09-07) + +- Testing updates +- Require the latest compat_resource + +## 6.0.4 (2016-08-19) + +- Install CLTools from dmg with -allowUntrusted on old OSX +- Switch to cookstyle for ruby linting +- Add OS X hosts to the kitchen config +- Remove chefdk included gems from the Gemfile +- Better handle kitchen failures in the Rakefile +- Perform all unit/linting in a single travis job + +## v6.0.3 (2016-07-26) + +- Fix how gcc version specified for Solaris 11 + +## v6.0.2 (2016-07-22) + +- Properly warn on Solaris 10 +- Specify the verson of gcc to install on Solaris 11 + +## v6.0.1 (2016-07-19) + +- Clarify that this cookbook actually required Chef 12.1 or later not 12.0 or later +- Add chef_version metadata + +## v6.0.0 (2016-06-03) + +This cookbook now uses the new msys2 based compiler toolchain on windows. Both 32-bit DW2 and 64-bit SEH based toolchains are available based on the gcc 5.3x series compiler. By default these are located in C:\msys2\mingw32 and C:\msys2\mingw64 + +## v5.0.0 (2016-06-03) + +The cookbook now ships with a 12.5+ style custom resource 'build_essential' which performs the same work that the existing default.rb recipe. The default.rb recipe has been converted to consume that resource to provide backwards compatibility for users that use build-essential::default in their run lists or cookbooks. In converting to this custom resource support for EOL omnios has been removed and warning messages for Solaris 10 users have been removed. See the readme for usage information on the new resource. + +## v4.0.0 (2016-05-12) + +### Breaking change + +This cookbook now requires Chef 12 or later as it includes the new mingw cookbook for installing Windows compilers. Mingw includes 12.5 style custom resources, which will fail to compile on Chef 11\. If you are not running Chef 12 you'll need to pin to 3.x in your environment. + +## v3.2.0 (2016-03-25) + +This version backs out a change in the 3.0 release which attempted to install the version of kernel-devel for the current running kernel on RHEL systems. This change had several unintended consequences and we believe the best solution is to back to change out until a better solution for the original problem is developed. Several of the issues could be resolved by code updates to build-essential, but not all, which complicates rolling forward vs. a roll back. The change caused issues which Chefspec runs on cookbooks where build-essential is a dependency as Fauxhai, used by Chefspec, does not mock out node['virtualization']. Fauxhai is being updated to mock out node['virtualization'], but we'd like to make sure a ChefDK release ships with this new Fauxhai before depending on that change. + +## v3.1.0 (2016-03-23) + +- Install GCC 4.8 if running on OmniOS >= 151008 + +## v3.0.0 (2016-03-23) + +- Install GCC 4.9 on FreeBSD < 10 +- Install the version of kernel-devel that matches the running Kernel on RHEL +- Remove suggests 'pkgutil' from the metadata as suggests does nothing +- Properly warn the user that build-essential does not support Solaris 10 instead of just silently continuing on +- Updated specs to run against more recent OS releases +- Removed the warning for OmniOS users from the Readme as the upstream issue has been resolved +- Switch from 7-zip to seven_zip cookbook as 7-zip has been deprecated +- Add 7-zip to the system path on Windows hosts so the recipe will work out of the box +- Switch from the deprecated 7-zip cookbook to seven_zip + +## v2.4.0 (2016-03-21) + +- Add gettext package to RHEL / FreeBSD to match other platforms +- Fix OS X version detection logic to properly detect OS X 10.10 and 10.11 + +## v2.3.1 (2016-02-18) + +- Restore Chef 11 compatibility and add Travis / Test Kitchen testing for Chef 11 + +## v2.3.0 (2016-02-17) + +- Add mingw/msys based build tools for Windows + +## v2.2.4 (2015-10-06) + +- Add patch package on Fedora systems +- Add additional platforms to Kitchen CI +- Use Chef standard Rubocop file and resolve several issues +- Update contributing and testing docs +- Update Gemfile with the latest testing and development deps +- Add maintainers.md and maintainers.toml files +- Add chefignore file to limit the files uploaded to the Chef server +- Add source_url and issues_url metadata for Supermarket + +## v2.2.3 (2015-04-15) + +- Don't install omnibus-build-essential on Solaris 10 - We decided it's easier to use the old GCC that ships with Solaris 10. +- Use ChefDK for all Travis testing. + +## v2.2.2 (2015-03-27) + +- Update Solar 10's omnibus-build-essential to 0.0.5 + +## v2.2.1 (2015-03-23) + +- Install GNU Patch on Solaris 11 + +## v2.2.0 (2015-03-18) + +- [solaris] Differentiate between Solaris 10 and 11 +- [solaris] Add ucb compat package +- [solaris] Solaris 10 build essential setup +- Fix metadata to use a string instead of a bool (see #56, #57) + +## v2.1.3 (2014-11-18) + +- Update metadata for supported versions of OS X (10.7+) as noted from +- v2.0.0 previously (#38) +- Clarify requirement to have apt package cache updated in README. (#41) +- Fix Xcode CLI installation on OS X (#50) + +## v2.1.2 (2014-10-14) + +- Mac OS X 10.10 Yosemite support + +## v2.1.0 (2014-10-14) + +- Use fully-qualified names when installing FreeBSD package + +## v2.0.6 (2014-08-11) + +- Use the resource form of `remote_file` to prevent context issues + +## v2.0.4 (2014-06-06) + +- [COOK-4661] added patch package to _rhel recipe + +## v2.0.2 (2014-05-02) + +- Updated documentation about older Chef versions +- Added new SVG badges to the README +- Fix a bug where `potentially_at_compile_time` fails on non-resources + +## v2.0.0 (2014-03-13) + +- Updated tested harnesses to use latest ecosystem tools +- Added support for FreeBSD +- Added support for installing XCode Command Line Tools on OSX (10.7, 10.8, 10.9) +- Created a DSL method for wrapping compile_time vs runtime execution +- Install additional developement tools on some platforms +- Add nicer log and warning messages with helpful information + +**Potentially Breaking Changes** + +- Dropped support for OSX 10.6 +- OSX no longer downloads OSX GCC and uses XCode CLI tools instead +- `build_essential` -> `build-essential` in node attributes +- `compiletime` -> `compile_time` in node attributes +- Cookbook version 2.x no longer supports Chef 10.x + +## v1.4.4 (2014-02-27) + +- [COOK-4245] Wrong package name used for developer tools on OS X 10.9 + +## v1.4.2 + +### Bug + +- **[COOK-3318](https://tickets.chef.io/browse/COOK-3318)** - Use Mixlib::ShellOut instead of Chef::ShellOut + +### New Feature + +- **[COOK-3093](https://tickets.chef.io/browse/COOK-3093)** - Add OmniOS support + +### Improvement + +- **[COOK-3024](https://tickets.chef.io/browse/COOK-3024)** - Use newer package on SmartOS + +## v1.4.0 + +This version splits up the default recipe into recipes included based on the node's platform_family. + +- [COOK-2505] - backport omnibus builder improvements + +## v1.3.4 + +- [COOK-2272] - Complete `platform_family` conversion in build-essential + +## v1.3.2 + +- [COOK-2069] - build-essential will install osx-gcc-installer when XCode is present + +## v1.3.0 + +- [COOK-1895] - support smartos + +## v1.2.0 + +- Add test-kitchen support (source repo only) +- [COOK-1677] - build-essential cookbook support for OpenSuse and SLES +- [COOK-1718] - build-essential cookbook metadata should include scientific +- [COOK-1768] - The apt-get update in build-essentials needs to be renamed + +## v1.1.2 + +- [COOK-1620] - support OS X 10.8 + +## v1.1.0 + +- [COOK-1098] - support amazon linux +- [COOK-1149] - support Mac OS X +- [COOK-1296] - allow for compile-time installation of packages through an attribute (see README) + +## v1.0.2 + +- [COOK-1098] - Add Amazon Linux platform support +- [COOK-1149] - Add OS X platform support diff --git a/cookbooks/firewall/CONTRIBUTING.md b/cookbooks/build-essential/CONTRIBUTING.md similarity index 100% rename from cookbooks/firewall/CONTRIBUTING.md rename to cookbooks/build-essential/CONTRIBUTING.md diff --git a/cookbooks/build-essential/README.md b/cookbooks/build-essential/README.md new file mode 100644 index 0000000..10037ef --- /dev/null +++ b/cookbooks/build-essential/README.md @@ -0,0 +1,138 @@ +# build-essential Cookbook + +[![Cookbook Version](http://img.shields.io/cookbook/v/build-essential.svg)][cookbook] [![Build Status](https://travis-ci.org/chef-cookbooks/build-essential.svg?branch=master)](https://travis-ci.org/chef-cookbooks/build-essential) + +Installs packages required for compiling C software from source. Use this cookbook if you wish to compile C programs, or install RubyGems with native extensions. Contains a resource, 'build_essential', as as well as a default recipe that simply calls that same resource. + +Note: The functionality of this cookbook is now built into Chef 14+ in the [build_essential resource](https://docs.chef.io/resource_build_essential.html). This cookbook is no longer being maintained and all future changes will be done directly in the chef-client. We highly recommend you update your chef-client to the latest release and if possible migrate to using the build_essential resources instead of the recipe in this cookbook. + +## Requirements + +### Platforms + +- Debian/Ubuntu +- RHEL/CentOS/Scientific/Amazon/Oracle +- openSUSE / SUSE Enterprise Linux +- SmartOS +- Fedora +- Mac OS X 10.9+ +- FreeBSD + +### Chef + +- Chef 12.7+ + +### Cookbooks + +- seven_zip +- mingw + +**Note for Debian platform family:** On Debian platform-family systems, it is recommended that `apt-get update` be run, to ensure that the package cache is updated. It's not in the scope of this cookbook to do that, as it can [create a duplicate resource](https://tickets.chef.io/browse/CHEF-3694). We recommend using the [apt](https://supermarket.chef.io/cookbooks/apt) cookbook to do this. + +## Attributes + +Attribute | Default | Description +------------------------------------------ | :---------------------------: | ----------------------------------------------------- +`node['build-essential']['compile_time']` | `false` | Execute resources at compile time +`node['build-essential']['msys2']['path']` | `#{ENV['SYSTEMDRIVE']\\msys2` | Destination for msys2 build tool chain (Windows only) + +## Usage + +### Recipe Usage + +The recipe simply calls the build_essential resource, but it ideal for adding to roles or node run lists. + +Include the build-essential recipe in your run list: + +```sh +knife node run_list add NODE "recipe[build-essential::default]" +``` + +or add the build-essential recipe as a dependency and include it from inside another cookbook: + +```ruby +include_recipe 'build-essential::default' +``` + +### Gems with C extensions + +For RubyGems that include native C extensions you wish to use with Chef, you should do the following. + +- Set the `compile_time` attribute to true in your wrapper cookbook or role: + + ```ruby + # Wrapper attribute + default['build-essential']['compile_time'] = true + ``` + + ```ruby + # Role + default_attributes( + 'build-essential' => { + 'compile_time' => true + } + ) + ``` + +- Ensure that the C libraries, which include files and other assorted "dev" + + type packages, are installed in the compile phase after the build-essential + + recipe is executed. For example: + + ```ruby + include_recipe 'build-essential::default' + + package('mypackage-devel') { action :nothing }.run_action(:install) + ``` + +- Use the `chef_gem` resource in your recipe to install the gem with the native + + extension: + + ```ruby + chef_gem 'gem-with-native-extension' + ``` + +### Resource Usage + +The cookbook includes a resource 'build_essential' that can be included in your cookbook to install the necessary build-essential packages + +Simple package installation during the client run: + +```ruby +build_essential 'some name you choose' +``` + +Package installation during the compile phase: + +```ruby +build_essential 'some name you choose' do + compile_time false +end +``` + +## Maintainers + +This cookbook is maintained by Chef's Community Cookbook Engineering team. Our goal is to improve cookbook quality and to aid the community in contributing to cookbooks. To learn more about our team, process, and design goals see our [team documentation](https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/COOKBOOK_TEAM.MD). To learn more about contributing to cookbooks like this see our [contributing documentation](https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/CONTRIBUTING.MD), or if you have general questions about this cookbook come chat with us in #cookbok-engineering on the [Chef Community Slack](http://community-slack.chef.io/) + +## License + +**Copyright:** 2009-2016, Chef Software, Inc. + +``` +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +``` + +[cookbook]: https://supermarket.chef.io/cookbooks/build-essential +[travis]: http://travis-ci.org/chef-cookbooks/build-essential diff --git a/cookbooks/build-essential/attributes/default.rb b/cookbooks/build-essential/attributes/default.rb new file mode 100644 index 0000000..e2bf233 --- /dev/null +++ b/cookbooks/build-essential/attributes/default.rb @@ -0,0 +1,21 @@ +# +# Cookbook:: build-essential +# Attributes:: default +# +# Copyright:: 2008-2017, Chef Software, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +default['build-essential']['compile_time'] = false +default['build-essential']['msys2']['path'] = "#{ENV['SYSTEMDRIVE']}\\msys2" diff --git a/cookbooks/build-essential/metadata.json b/cookbooks/build-essential/metadata.json new file mode 100644 index 0000000..ea34df1 --- /dev/null +++ b/cookbooks/build-essential/metadata.json @@ -0,0 +1 @@ +{"name":"build-essential","version":"8.2.1","description":"Installs C compiler / build tools","long_description":"# build-essential Cookbook\n\n[![Cookbook Version](http://img.shields.io/cookbook/v/build-essential.svg)][cookbook] [![Build Status](https://travis-ci.org/chef-cookbooks/build-essential.svg?branch=master)](https://travis-ci.org/chef-cookbooks/build-essential)\n\nInstalls packages required for compiling C software from source. Use this cookbook if you wish to compile C programs, or install RubyGems with native extensions. Contains a resource, 'build_essential', as as well as a default recipe that simply calls that same resource.\n\nNote: The functionality of this cookbook is now built into Chef 14+ in the [build_essential resource](https://docs.chef.io/resource_build_essential.html). This cookbook is no longer being maintained and all future changes will be done directly in the chef-client. We highly recommend you update your chef-client to the latest release and if possible migrate to using the build_essential resources instead of the recipe in this cookbook.\n\n## Requirements\n\n### Platforms\n\n- Debian/Ubuntu\n- RHEL/CentOS/Scientific/Amazon/Oracle\n- openSUSE / SUSE Enterprise Linux\n- SmartOS\n- Fedora\n- Mac OS X 10.9+\n- FreeBSD\n\n### Chef\n\n- Chef 12.7+\n\n### Cookbooks\n\n- seven_zip\n- mingw\n\n**Note for Debian platform family:** On Debian platform-family systems, it is recommended that `apt-get update` be run, to ensure that the package cache is updated. It's not in the scope of this cookbook to do that, as it can [create a duplicate resource](https://tickets.chef.io/browse/CHEF-3694). We recommend using the [apt](https://supermarket.chef.io/cookbooks/apt) cookbook to do this.\n\n## Attributes\n\nAttribute | Default | Description\n------------------------------------------ | :---------------------------: | -----------------------------------------------------\n`node['build-essential']['compile_time']` | `false` | Execute resources at compile time\n`node['build-essential']['msys2']['path']` | `#{ENV['SYSTEMDRIVE']\\\\msys2` | Destination for msys2 build tool chain (Windows only)\n\n## Usage\n\n### Recipe Usage\n\nThe recipe simply calls the build_essential resource, but it ideal for adding to roles or node run lists.\n\nInclude the build-essential recipe in your run list:\n\n```sh\nknife node run_list add NODE \"recipe[build-essential::default]\"\n```\n\nor add the build-essential recipe as a dependency and include it from inside another cookbook:\n\n```ruby\ninclude_recipe 'build-essential::default'\n```\n\n### Gems with C extensions\n\nFor RubyGems that include native C extensions you wish to use with Chef, you should do the following.\n\n- Set the `compile_time` attribute to true in your wrapper cookbook or role:\n\n ```ruby\n # Wrapper attribute\n default['build-essential']['compile_time'] = true\n ```\n\n ```ruby\n # Role\n default_attributes(\n 'build-essential' => {\n 'compile_time' => true\n }\n )\n ```\n\n- Ensure that the C libraries, which include files and other assorted \"dev\"\n\n type packages, are installed in the compile phase after the build-essential\n\n recipe is executed. For example:\n\n ```ruby\n include_recipe 'build-essential::default'\n\n package('mypackage-devel') { action :nothing }.run_action(:install)\n ```\n\n- Use the `chef_gem` resource in your recipe to install the gem with the native\n\n extension:\n\n ```ruby\n chef_gem 'gem-with-native-extension'\n ```\n\n### Resource Usage\n\nThe cookbook includes a resource 'build_essential' that can be included in your cookbook to install the necessary build-essential packages\n\nSimple package installation during the client run:\n\n```ruby\nbuild_essential 'some name you choose'\n```\n\nPackage installation during the compile phase:\n\n```ruby\nbuild_essential 'some name you choose' do\n compile_time false\nend\n```\n\n## Maintainers\n\nThis cookbook is maintained by Chef's Community Cookbook Engineering team. Our goal is to improve cookbook quality and to aid the community in contributing to cookbooks. To learn more about our team, process, and design goals see our [team documentation](https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/COOKBOOK_TEAM.MD). To learn more about contributing to cookbooks like this see our [contributing documentation](https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/CONTRIBUTING.MD), or if you have general questions about this cookbook come chat with us in #cookbok-engineering on the [Chef Community Slack](http://community-slack.chef.io/)\n\n## License\n\n**Copyright:** 2009-2016, Chef Software, Inc.\n\n```\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```\n\n[cookbook]: https://supermarket.chef.io/cookbooks/build-essential\n[travis]: http://travis-ci.org/chef-cookbooks/build-essential\n","maintainer":"Chef Software, Inc.","maintainer_email":"cookbooks@chef.io","license":"Apache-2.0","platforms":{"amazon":">= 0.0.0","centos":">= 0.0.0","debian":">= 0.0.0","fedora":">= 0.0.0","freebsd":">= 0.0.0","mac_os_x":">= 10.9.0","opensuse":">= 0.0.0","opensuseleap":">= 0.0.0","oracle":">= 0.0.0","redhat":">= 0.0.0","scientific":">= 0.0.0","smartos":">= 0.0.0","solaris2":">= 0.0.0","suse":">= 0.0.0","ubuntu":">= 0.0.0","windows":">= 0.0.0","zlinux":">= 0.0.0"},"dependencies":{"seven_zip":">= 0.0.0","mingw":">= 1.1"},"recommendations":{},"suggestions":{},"conflicting":{},"providing":{},"replacing":{},"attributes":{},"groupings":{},"recipes":{"build-essential":"Installs packages required for compiling C software from source."},"source_url":"https://github.com/chef-cookbooks/build-essential","issues_url":"https://github.com/chef-cookbooks/build-essential/issues","chef_version":[[">= 12.7"]],"ohai_version":[]} \ No newline at end of file diff --git a/cookbooks/build-essential/recipes/_windows.rb b/cookbooks/build-essential/recipes/_windows.rb new file mode 100644 index 0000000..6d317f9 --- /dev/null +++ b/cookbooks/build-essential/recipes/_windows.rb @@ -0,0 +1,53 @@ +# +# Cookbook:: build-essential +# Recipe:: _windows +# +# Copyright:: 2016-2017, Chef Software, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +node.default['seven_zip']['syspath'] = true +include_recipe 'seven_zip::default' + +tool_path = node['build-essential']['msys2']['path'] + +directory tool_path do + action :create + recursive true +end + +[ + 'base-devel', # Brings down msys based bash/make/awk/patch/stuff.. + 'mingw-w64-x86_64-toolchain', # Puts 64-bit SEH mingw toolchain in msys2\mingw64 + 'mingw-w64-i686-toolchain' # Puts 32-bit DW2 mingw toolchain in msys2\ming32 +].each do |package| + msys2_package package do + root tool_path + end +end + +# Certain build steps assume that a tar command is available on the +# system path. The default tar present in msys2\usr\bin is an msys GNU tar +# that expects forward slashes and consider ':' to be a remote tape separator +# or something weird like that. We therefore drop bat file in msys2\bin that +# redirect to the underlying executables without mucking around with +# msys2's /usr/bin itself. +{ + 'bsdtar.exe' => 'tar.bat', + 'patch.exe' => 'patch.bat', +}.each do |reference, link| + file "#{tool_path}\\bin\\#{link}" do + content "@%~dp0..\\usr\\bin\\#{reference} %*" + end +end diff --git a/cookbooks/build-essential/recipes/default.rb b/cookbooks/build-essential/recipes/default.rb new file mode 100644 index 0000000..a5dfed3 --- /dev/null +++ b/cookbooks/build-essential/recipes/default.rb @@ -0,0 +1,24 @@ +# +# Cookbook:: build-essential +# Recipe:: default +# +# Copyright:: 2008-2018, Chef Software, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# Call the build-essential custom resource +# This can also be called directly in your cookbooks anywhere you want +build_essential 'install_packages' do + compile_time node['build-essential']['compile_time'] +end diff --git a/cookbooks/build-essential/resources/build_essential.rb b/cookbooks/build-essential/resources/build_essential.rb new file mode 100644 index 0000000..21898a4 --- /dev/null +++ b/cookbooks/build-essential/resources/build_essential.rb @@ -0,0 +1,107 @@ +# +# Cookbook:: build-essential +# resource:: build_essential +# +# Copyright:: 2008-2018, Chef Software Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +chef_version_for_provides '< 14.0' if respond_to?(:chef_version_for_provides) +provides :build_essential +resource_name :build_essential + +property :compile_time, [true, false], default: false + +action :install do + case node['platform_family'] + when 'debian' + package %w( autoconf binutils-doc bison build-essential flex gettext ncurses-dev ) + when 'amazon', 'fedora', 'rhel' + package %w( autoconf bison flex gcc gcc-c++ gettext kernel-devel make m4 ncurses-devel patch ) + + # Ensure GCC 4 is available on older pre-6 EL + package %w( gcc44 gcc44-c++ ) if !platform?('amazon') && node['platform_version'].to_i < 6 + when 'freebsd' + package 'devel/gmake' + package 'devel/autoconf' + package 'devel/m4' + package 'devel/gettext' + when 'mac_os_x' + xcode_command_line_tools 'install' + when 'omnios' + package 'developer/gcc48' + package 'developer/object-file' + package 'developer/linker' + package 'developer/library/lint' + package 'developer/build/gnu-make' + package 'system/header' + package 'system/library/math/header-math' + + # Per OmniOS documentation, the gcc bin dir isn't in the default + # $PATH, so add it to the running process environment + # http://omnios.omniti.com/wiki.php/DevEnv + ENV['PATH'] = "#{ENV['PATH']}:/opt/gcc-4.7.2/bin" + when 'solaris2' + if node['platform_version'].to_f == 5.10 + Chef::Log.warn('build-essential does not support Solaris 10. You will need to install SUNWbison, SUNWgcc, SUNWggrp, SUNWgmake, and SUNWgtar from the Solaris DVD') + elsif node['platform_version'].to_f == 5.11 + package 'autoconf' + package 'automake' + package 'bison' + package 'gnu-coreutils' + package 'flex' + # lock gcc versions because we don't use 5 yet + %w(gcc gcc-c gcc-c++).each do |pkg| + package pkg do # ~FC009 + accept_license true + version '4.8.2' + end + end + package 'gnu-grep' + package 'gnu-make' + package 'gnu-patch' + package 'gnu-tar' + package 'make' + package 'pkg-config' + package 'ucb' + end + when 'smartos' + package 'autoconf' + package 'binutils' + package 'build-essential' + package 'gcc47' + package 'gmake' + package 'pkg-config' + when 'suse' + package %w( autoconf bison flex gcc gcc-c++ kernel-default-devel make m4 ) + package %w( gcc48 gcc48-c++ ) if node['platform_version'].to_i < 12 + when 'windows' + include_recipe 'build-essential::_windows' + else + Chef::Log.warn <<-EOH + A build-essential recipe does not exist for '#{node['platform_family']}'. This + means the build-essential cookbook does not have support for the + #{node['platform_family']} family. If you are not compiling gems with native + extensions or building packages from source, this will likely not affect you. + EOH + end +end + +# this resource forces itself to run at compile_time +def after_created + return unless compile_time + Array(action).each do |action| + run_action(action) + end +end diff --git a/cookbooks/build-essential/resources/xcode_command_line_tools.rb b/cookbooks/build-essential/resources/xcode_command_line_tools.rb new file mode 100644 index 0000000..44dbfae --- /dev/null +++ b/cookbooks/build-essential/resources/xcode_command_line_tools.rb @@ -0,0 +1,57 @@ +# +# Cookbook:: build-essential +# Resource:: xcode_command_line_tools +# +# Copyright:: 2014-2018, Chef Software, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +resource_name :xcode_command_line_tools + +action :install do + if installed? + Chef::Log.debug("#{new_resource} already installed - skipping") + else + converge_by("Install #{new_resource}") do + # This script was graciously borrowed and modified from Tim Sutton's + # osx-vm-templates at https://github.com/timsutton/osx-vm-templates/blob/b001475df54a9808d3d56d06e71b8fa3001fff42/scripts/xcode-cli-tools.sh + execute 'install XCode Command Line tools' do + command <<-EOH.gsub(/^ {14}/, '') + # create the placeholder file that's checked by CLI updates' .dist code + # in Apple's SUS catalog + touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress + # find the CLI Tools update + PROD=$(softwareupdate -l | grep "\*.*Command Line" | tail -n 1 | awk -F"*" '{print $2}' | sed -e 's/^ *//' | tr -d '\n') + # install it + softwareupdate -i "$PROD" --verbose + # Remove the placeholder to prevent perpetual appearance in the update utility + rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress + EOH + end + end + end +end + +action_class do + # + # Determine if the XCode Command Line Tools are installed + # + # @return [true, false] + # + def installed? + cmd = Mixlib::ShellOut.new('pkgutil --pkgs=com.apple.pkg.CLTools_Executables') + cmd.run_command + cmd.error? ? false : true + end +end diff --git a/cookbooks/firewall/.foodcritic b/cookbooks/firewall/.foodcritic deleted file mode 100644 index b56b353..0000000 --- a/cookbooks/firewall/.foodcritic +++ /dev/null @@ -1,3 +0,0 @@ -~FC001 -~FC057 -~FC019 diff --git a/cookbooks/firewall/.markdownlint-cli2.yaml b/cookbooks/firewall/.markdownlint-cli2.yaml new file mode 100644 index 0000000..6fa8e77 --- /dev/null +++ b/cookbooks/firewall/.markdownlint-cli2.yaml @@ -0,0 +1,5 @@ +config: + ul-indent: false # MD007 + line-length: false # MD013 + no-duplicate-heading: false # MD024 + reference-links-images: false # MD052 diff --git a/cookbooks/firewall/CHANGELOG.md b/cookbooks/firewall/CHANGELOG.md index 92cd7f7..1517fbe 100644 --- a/cookbooks/firewall/CHANGELOG.md +++ b/cookbooks/firewall/CHANGELOG.md @@ -1,291 +1,458 @@ -firewall Cookbook CHANGELOG -======================= +# firewall Cookbook CHANGELOG + This file is used to list changes made in each version of the firewall cookbook. +## 6.2.16 - *2023-05-17* + +## 6.2.15 - *2023-04-26* + +Update CI runner to MacOS 12 + +## 6.2.14 - *2023-04-17* + +## 6.2.13 - *2023-04-11* + +Fix documentation to pass markdown lint + +## 6.2.12 - *2023-04-07* + +Standardise files with files in sous-chefs/repo-management + +## 6.2.11 - *2023-04-04* + +Fixed a typo in the readme + +## 6.2.10 - *2023-04-01* + +## 6.2.9 - *2023-04-01* + +## 6.2.8 - *2023-04-01* + +Standardise files with files in sous-chefs/repo-management + +Standardise files with files in sous-chefs/repo-management + +## 6.2.7 - *2023-03-02* + +## 6.2.6 - *2023-02-23* + +Standardise files with files in sous-chefs/repo-management + +## 6.2.5 - *2023-02-16* + +Standardise files with files in sous-chefs/repo-management + +## 6.2.4 - *2023-02-15* + +Standardise files with files in sous-chefs/repo-management + +## 6.2.3 - *2022-12-08* + +Standardise files with files in sous-chefs/repo-management + +## 6.2.2 - *2022-12-08* + +Standardise files with files in sous-chefs/repo-management + +## 6.2.1 - *2022-12-02* + +## 6.2.0 - *2022-12-02* + +- Add support for for the description attribute when using UFW + +## 6.1.0 - *2022-09-15* + +- Add filepath selection based on OS for nftables.conf + +## 6.0.2 - *2022-05-15* + +Standardise files with files in sous-chefs/repo-management + +## 6.0.1 - *2022-05-13* + +- Standardise files with files in sous-chefs/repo-management + +## 6.0.0 - *2022-05-09* + +- Values for firewalld resources must be specified as one would + specify them to `firewall-cmd`. +- Do not use begin/rescue blocks when adding firewalld-objects, as + that resulted in errors being logged by firewalld. +- Various bug fixes that were found along the way. + +## 5.1.0 - *2022-05-07* + +- Add new providers for firewalld using the dbus-interface of firewalld. + +## 5.0.0 - *2022-04-20* + +- Add support for nftables + +## 4.0.3 - *2022-04-11* + +- Use resuable workflows instead of Chef Delivery + +## 4.0.2 - *2022-02-17* + +- Standardise files with files in sous-chefs/repo-management +- Remove delivery folder + +## 4.0.1 - *2022-01-07* + +- Remove extraneous task file that's no longer needed + +## 4.0.0 - *2021-09-09* + +- Remove dependency on chef-sugar cookbook +- Bump to require Chef Infra Client >= 15.5 for chef-utils +- Update metadata and README to Sous Chefs + +## 3.0.2 - *2021-08-30* + +- Standardise files with files in sous-chefs/repo-management + +## 3.0.1 - *2021-07-08* + +- Restart netfilter service in iptables mode after updating firewall rules + +## 3.0.0 - *2021-06-14* + +- Add Amazon Linux support +- Fix firewall resource actions list +- First attempt to modernize testing +- Various Cookstyle fixes + +## 2.7.1 - *2021-06-01* + +- resolved cookstyle error: libraries/helpers_windows.rb:47:9 convention: `Style/RedundantAssignment` +- resolved cookstyle error: libraries/helpers_windows.rb:48:9 convention: `Layout/IndentationWidth` +- resolved cookstyle error: libraries/helpers_windows.rb:49:16 convention: `Layout/ElseAlignment` +- resolved cookstyle error: libraries/helpers_windows.rb:50:9 convention: `Layout/IndentationWidth` +- resolved cookstyle error: libraries/helpers_windows.rb:51:16 warning: `Layout/EndAlignment` +- resolved cookstyle error: libraries/helpers_windows.rb:52:1 convention: `Layout/EmptyLinesAroundMethodBody` +- resolved cookstyle error: libraries/helpers_windows.rb:52:1 convention: `Layout/TrailingWhitespace` +- resolved cookstyle error: libraries/provider_firewall_firewalld.rb:30:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_firewalld.rb:54:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_firewalld.rb:114:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_firewalld.rb:136:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_firewalld.rb:149:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables.rb:33:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables.rb:63:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables.rb:112:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables.rb:134:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu.rb:34:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu.rb:67:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu.rb:133:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu.rb:156:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu1404.rb:34:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu1404.rb:67:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu1404.rb:133:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_iptables_ubuntu1404.rb:156:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_rule.rb:24:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_ufw.rb:32:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_ufw.rb:61:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_ufw.rb:102:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_ufw.rb:115:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_windows.rb:29:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_windows.rb:42:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_windows.rb:97:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: libraries/provider_firewall_windows.rb:118:5 refactor: `ChefModernize/ActionMethodInResource` +- resolved cookstyle error: attributes/iptables.rb:8:54 refactor: `ChefStyle/AttributeKeys` +- resolved cookstyle error: attributes/iptables.rb:8:54 convention: `Style/StringLiteralsInInterpolation` +- resolved cookstyle error: attributes/iptables.rb:8:63 refactor: `ChefStyle/AttributeKeys` +- resolved cookstyle error: attributes/iptables.rb:8:64 convention: `Style/StringLiteralsInInterpolation` +- resolved cookstyle error: attributes/iptables.rb:9:56 refactor: `ChefStyle/AttributeKeys` +- resolved cookstyle error: attributes/iptables.rb:9:56 convention: `Style/StringLiteralsInInterpolation` +- resolved cookstyle error: attributes/iptables.rb:9:65 refactor: `ChefStyle/AttributeKeys` +- resolved cookstyle error: attributes/iptables.rb:9:66 convention: `Style/StringLiteralsInInterpolation` +- resolved cookstyle error: attributes/iptables.rb:10:55 refactor: `ChefStyle/AttributeKeys` +- resolved cookstyle error: attributes/iptables.rb:10:55 convention: `Style/StringLiteralsInInterpolation` +- resolved cookstyle error: attributes/iptables.rb:10:64 refactor: `ChefStyle/AttributeKeys` +- resolved cookstyle error: attributes/iptables.rb:10:65 convention: `Style/StringLiteralsInInterpolation` + +## 2.7.0 (2018-12-19) + +- Nominal support for Debian 9 (#202) + ## 2.6.5 (2018-07-24) - use platform_family instead of platform to include all rhels -v2.6.4 (2018-07-01) -------------------- -* Stop including chef-sugar when it's >= 4.0.0 (#197) +## v2.6.4 (2018-07-01) -v2.6.3 (2018-02-01) -------------------- -* Fix issue with deep merging of hashes and arrays in recent chef release (#185) +- Stop including chef-sugar when it's >= 4.0.0 (#197) -v2.6.2 (2017-06-01) -------------------- -* Incorrect file checking on Ubuntu, double file write (#173) -* Added testing on CentOS 6.9 -* Clarify metadata that we're not working on Amazon Linux (#172) +## v2.6.3 (2018-02-01) -v2.6.1 (2017-04-21) -------------------- -* Add recipe to disable firewall (#164) +- Fix issue with deep merging of hashes and arrays in recent chef release (#185) -v2.6.0 (2017-04-17) -------------------- -* Initial Chef 13.x support (#160, #159) -* Allow loopback and icmp, when enabled (#161) -* Address various newer rubocop and foodcritic complaints -* Convert rule provider away from DSL (#159) +## v2.6.2 (2017-06-01) -v2.5.4 (2017-02-13) -------------------- -* Update Test Kitchen platforms to the latest -* Update copyright headers -* Allow package options to be passed through to the package install for firewall -* Define policy for Windows Firewall and use the attributes to set desired policy +- Incorrect file checking on Ubuntu, double file write (#173) +- Added testing on CentOS 6.9 +- Clarify metadata that we're not working on Amazon Linux (#172) -v2.5.3 (2016-10-26) -------------------- -* Don't show firewall resource as updated (#133) -* Add :off as a valid logging level (#129) -* Add support for Ubuntu 16.04 (#149) +## v2.6.1 (2017-04-21) -v2.5.2 (2016-06-02) -------------------- -* Don't issue commands when firewalld isn't active (#140) -* Install iptables-services on CentOS >= 7 (#131) -* Update Ruby version on Travis for listen gem +- Add recipe to disable firewall (#164) -v2.5.1 (2016-05-31) -------------------- -* Protocol guard incorrectly prevents "none" protocol type on UFW helper (#128) -* Fix wrongly ordered conditional for converting ports to strings using port_to_s -* Fix notify_firewall attribute crashing firewall_rule provider (#130) -* Add warning if firewall rule opens all traffic (#132) -* Add ipv6 attribute respect to Ubuntu iptables (#138) +## v2.6.0 (2017-04-17) -v2.5.0 (2016-03-08) -------------------- -* Don't modify parameter for port (#120) -* Remove a reference to the wrong variable name under windows (#123) -* Add support for mobile shell default firewall rule (#121) -* New rubocop rules and style fixes -* Correct a README.md example for `action :allow` +- Initial Chef 13.x support (#160, #159) +- Allow loopback and icmp, when enabled (#161) +- Address various newer rubocop and foodcritic complaints +- Convert rule provider away from DSL (#159) -v2.4.0 (2016-01-28) -------------------- -* Expose default iptables ruleset so that raw rules can be used in conjunction -with rulesets for other tables (#101). +## v2.5.4 (2017-02-13) -v2.3.1 (2016-01-08) -------------------- -* Add raw rule support to the ufw firewall provider (#113). +- Update Test Kitchen platforms to the latest +- Update copyright headers +- Allow package options to be passed through to the package install for firewall +- Define policy for Windows Firewall and use the attributes to set desired policy -v2.3.0 (2015-12-23) -------------------- -* Refactor logic so that firewall rules don't add a string rule to the firewall -when their actions run. Just run the action once on the firewall itself. This is -designed to prevent partial application of rules (#106) +## v2.5.3 (2016-10-26) -* Switch to "enabled" (positive logic) instead of "disabled" (negative logic) on -the firewall resource. It was difficult to reason with "disabled false" for some -complicated recipes using firewall downstream. `disabled` is now deprecated. +- Don't show firewall resource as updated (#133) +- Add :off as a valid logging level (#129) +- Add support for Ubuntu 16.04 (#149) -* Add proper Windows testing and serverspec tests back into this cookbook. +## v2.5.2 (2016-06-02) -* Fix the `port_to_s` function so it also works for Windows (#111) +- Don't issue commands when firewalld isn't active (#140) +- Install iptables-services on CentOS >= 7 (#131) +- Update Ruby version on Travis for listen gem -* Fix typo checking action instead of command in iptables helper (#112) +## v2.5.1 (2016-05-31) -* Remove testing ranges of ports on CentOS 5.x, as it's broken there. +- Protocol guard incorrectly prevents "none" protocol type on UFW helper (#128) +- Fix wrongly ordered conditional for converting ports to strings using port_to_s +- Fix notify_firewall attribute crashing firewall_rule provider (#130) +- Add warning if firewall rule opens all traffic (#132) +- Add ipv6 attribute respect to Ubuntu iptables (#138) + +## v2.5.0 (2016-03-08) + +- Don't modify parameter for port (#120) +- Remove a reference to the wrong variable name under windows (#123) +- Add support for mobile shell default firewall rule (#121) +- New rubocop rules and style fixes +- Correct a README.md example for `action :allow` + +## v2.4.0 (2016-01-28) + +- Expose default iptables ruleset so that raw rules can be used in conjunction with rulesets for other tables (#101). + +## v2.3.1 (2016-01-08) + +- Add raw rule support to the ufw firewall provider (#113). + +## v2.3.0 (2015-12-23) + +- Refactor logic so that firewall rules don't add a string rule to the firewall when their actions run. Just run the action once on the firewall itself. This is designed to prevent partial application of rules (#106) + +- Switch to "enabled" (positive logic) instead of "disabled" (negative logic) on the firewall resource. It was difficult to reason with "disabled false" for some complicated recipes using firewall downstream. `disabled` is now deprecated. + +- Add proper Windows testing and serverspec tests back into this cookbook. + +- Fix the `port_to_s` function so it also works for Windows (#111) + +- Fix typo checking action instead of command in iptables helper (#112) + +- Remove testing ranges of ports on CentOS 5.x, as it's broken there. + +## v2.2.0 (2015-11-02) -v2.2.0 (2015-11-02) -------------------- Added permanent as default option for RHEL 7 based systems using firewall-cmd. This defaults to turned off, but it will be enabled by default on the next major version bump. -v2.1.0 (2015-10-15) -------------------- +## v2.1.0 (2015-10-15) + Minor feature release. -* Ensure ICMPv6 is open when `['firewall']['allow_established']` is set to true (the default). ICMPv6 is critical for most IPv6 operations. -v2.0.5 (2015-10-05) -------------------- +- Ensure ICMPv6 is open when `['firewall']['allow_established']` is set to true (the default). ICMPv6 is critical for most IPv6 operations. + +## v2.0.5 (2015-10-05) + Minor bugfix release. -* Ensure provider filtering always yields 1 and only 1 provider, #97 & #98 -* Documentation update #96 -v2.0.4 (2015-09-23) -------------------- +- Ensure provider filtering always yields 1 and only 1 provider, #97 & #98 +- Documentation update #96 + +## v2.0.4 (2015-09-23) + Minor bugfix release. -* Allow override of filter chain policies, #94 -* Fix foodcrtitic and chefspec errors -v2.0.3 (2015-09-14) -------------------- +- Allow override of filter chain policies, #94 +- Fix foodcrtitic and chefspec errors + +## v2.0.3 (2015-09-14) + Minor bugfix release. -* Fix wrong conditional for firewalld ports, #93 -* Fix ipv6 command logic under iptables, #91 -v2.0.2 (2015-09-08) -------------------- -* Release with working CI, Chefspec matchers. +- Fix wrong conditional for firewalld ports, #93 +- Fix ipv6 command logic under iptables, #91 -v2.0.1 (2015-09-01) -------------------- -* Add default related/established rule for iptables +## v2.0.2 (2015-09-08) -v2.0.0 (2015-08-31) -------------------- -* #84, major rewrite: - - Allow relative positioning of rules - - Use delayed notifications to create one firewall ruleset instead of incremental changes - - Remove poise dependency -* #82 - Introduce Windows firewall support and test-kitchen platform. -* #73 - Add the option to disable ipv6 commands on iptables -* #78 - Use Chef-12 style `provides` to address provider mapping issues -* Rubocop and foodcritic cleanup +- Release with working CI, Chefspec matchers. -v1.6.1 (2015-07-24) -------------------- -* #80 - Remove an extra space in port range +## v2.0.1 (2015-09-01) -v1.6.0 (2015-07-15) -------------------- -* #68 - Install firewalld when it does not exist -* #72 - Fix symbol that was a string, breaking comparisons +- Add default related/established rule for iptables -v1.5.2 (2015-07-15) -------------------- -* #75 - Use correct service in iptables save action, Add serverspec tests for iptables suite +## v2.0.0 (2015-08-31) -v1.5.1 (2015-07-13) -------------------- -* #74 - add :save matcher for Chefspec +- 84, major rewrite + - Allow relative positioning of rules + - Use delayed notifications to create one firewall ruleset instead of incremental changes + - Remove poise dependency +- #82 - Introduce Windows firewall support and test-kitchen platform +- #73 - Add the option to disable ipv6 commands on iptables +- #78 - Use Chef-12 style `provides` to address provider mapping issues +- Rubocop and foodcritic cleanup -v1.5.0 (2015-07-06) -------------------- +## v1.6.1 (2015-07-24) -* #70 - Add chef service resource to ensure firewall-related services are enabled/disabled -* - Add testing and support for iptables on ubuntu in iptables provider +- 80 - Remove an extra space in port range -v1.4.0 (2015-06-30) -------------------- +## v1.6.0 (2015-07-15) -* #69 - Support for CentOS/RHEL 5.x +- 68 - Install firewalld when it does not exist +- 72 - Fix symbol that was a string, breaking comparisons -v1.3.0 (2015-06-09) -------------------- -* #63 - Add support for protocol numbers +## v1.5.2 (2015-07-15) -v1.2.0 (2015-05-28) -------------------- -* #64 - Support the newer version of poise +- 75 - Use correct service in iptables save action, Add serverspec tests for iptables suite -v1.1.2 (2015-05-19) -------------------- -* #60 - Always add /32 or /128 to ipv4 or ipv6 addresses, respectively. +## v1.5.1 (2015-07-13) + +- 74 - add :save matcher for Chefspec + +## v1.5.0 (2015-07-06) + +- 70 - Add chef service resource to ensure firewall-related services are enabled/disabled + - Add testing and support for iptables on ubuntu in iptables provider + +## v1.4.0 (2015-06-30) + +- 69 - Support for CentOS/RHEL 5.x + +## v1.3.0 (2015-06-09) + +- 63 - Add support for protocol numbers + +## v1.2.0 (2015-05-28) + +- 64 - Support the newer version of poise + +## v1.1.2 (2015-05-19) + +- 60 - Always add /32 or /128 to ipv4 or ipv6 addresses, respectively - Make comment quoting optional; iptables on Ubuntu strips quotes on strings without any spaces -v1.1.1 (2015-05-11) -------------------- -* #57 - Suppress warning: already initialized constant XXX while Chefspec +## v1.1.1 (2015-05-11) -v1.1.0 (2015-04-27) -------------------- -* #56 - Better ipv6 support for firewalld and iptables -* #54 - Document raw parameter +- 57 - Suppress warning: already initialized constant XXX while Chefspec -v1.0.2 (2015-04-03) -------------------- -* #52 - Typo in :masquerade action name +## v1.1.0 (2015-04-27) -v1.0.1 (2015-03-28) -------------------- -* #49 - Fix position attribute of firewall_rule providers to be correctly used as a string in commands +- 56 - Better ipv6 support for firewalld and iptables +- 54 - Document raw parameter -v1.0.0 (2015-03-25) -------------------- -* Major upgrade and rewrite as HWRP using poise -* Adds support for iptables and firewalld -* Modernize tests and other files -* Fix many bugs from ufw defaults to multiport suppot +## v1.0.2 (2015-04-03) -v0.11.8 (2014-05-20) --------------------- -* Corrects issue where on a secondary converge would not distinguish between inbound and outbound rules +- 52 - Typo in :masquerade action name +## v1.0.1 (2015-03-28) + +- 49 - Fix position attribute of firewall_rule providers to be correctly used as a string in commands + +## v1.0.0 (2015-03-25) + +- Major upgrade and rewrite as HWRP using poise +- Adds support for iptables and firewalld +- Modernize tests and other files +- Fix many bugs from ufw defaults to multiport suppot + +## v0.11.8 (2014-05-20) + +- Corrects issue where on a secondary converge would not distinguish between inbound and outbound rules + +## v0.11.6 (2014-02-28) -v0.11.6 (2014-02-28) --------------------- [COOK-4385] - UFW provider is broken +## v0.11.4 (2014-02-25) -v0.11.4 (2014-02-25) --------------------- [COOK-4140] Only notify when a rule is actually added +## v0.11.2 -v0.11.2 -------- ### Bug -- **[COOK-3615](https://tickets.opscode.com/browse/COOK-3615)** - Install required UFW package on Debian -v0.11.0 -------- +- [COOK-3615]: Install required UFW package on Debian + +## v0.11.0 + ### Improvement + - [COOK-2932]: ufw providers work on debian but cannot be used -v0.10.2 -------- +## v0.10.2 + - [COOK-2250] - improve readme -v0.10.0 ------- +## v0.10.0 + - [COOK-1234] - allow multiple ports per rule -v0.9.2 ------- +## v0.9.2 + - [COOK-1615] - Firewall example docs have incorrect direction syntax -v0.9.0 ------- +## v0.9.0 + The default action for firewall LWRP is now :enable, the default action for firewall_rule LWRP is now :reject. This is in line with a "default deny" policy. - [COOK-1429] - resolve foodcritic warnings -v0.8.0 ------- +## v0.8.0 + - refactor all resources and providers into LWRPs - removed :reset action from firewall resource (couldn't find a good way to make it idempotent) - removed :logging action from firewall resource...just set desired level via the log_level attribute -v0.6.0 ------- +## v0.6.0 + - [COOK-725] Firewall cookbook firewall_rule LWRP needs to support logging attribute. - Firewall cookbook firewall LWRP needs to support :logging -v0.5.7 ------- +## v0.5.7 + - [COOK-696] Firewall cookbook firewall_rule LWRP needs to support interface - [COOK-697] Firewall cookbook firewall_rule LWRP needs to support the direction for the rules -v0.5.6 ------- +## v0.5.6 + - [COOK-695] Firewall cookbook firewall_rule LWRP needs to support destination port -v0.5.5 ------- +## v0.5.5 + - [COOK-709] fixed :nothing action for the 'firewall_rule' resource. -v0.5.4 ------- +## v0.5.4 + - [COOK-694] added :reject action to the 'firewall_rule' resource. -v0.5.3 ------- +## v0.5.3 + - [COOK-698] added :reset action to the 'firewall' resource. -v0.5.2 ------- -- Add missing 'requires' statements. fixes 'NameError: uninitialized constant' error. -thanks to Ernad Husremović for the fix. +## v0.5.2 + +- Add missing 'requires' statements. fixes 'NameError: uninitialized constant' error. Thanks to Ernad Husremović for the fix. + +## v0.5.0 -v0.5.0 ------- - [COOK-686] create firewall and firewall_rule resources - [COOK-687] create UFW providers for all resources diff --git a/cookbooks/firewall/LICENSE b/cookbooks/firewall/LICENSE new file mode 100644 index 0000000..8f71f43 --- /dev/null +++ b/cookbooks/firewall/LICENSE @@ -0,0 +1,202 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "{}" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright {yyyy} {name of copyright owner} + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + diff --git a/cookbooks/firewall/MAINTAINERS.md b/cookbooks/firewall/MAINTAINERS.md deleted file mode 100644 index 5db5fac..0000000 --- a/cookbooks/firewall/MAINTAINERS.md +++ /dev/null @@ -1,19 +0,0 @@ - - -# Maintainers -This file lists how this cookbook project is maintained. When making changes to the system, this -file tells you who needs to review your patch - you need a simple majority of maintainers -for the relevant subsystems to provide a :+1: on your pull request. Additionally, you need -to not receive a veto from a Lieutenant or the Project Lead. - -Check out [How Cookbooks are Maintained](https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/CONTRIBUTING.MD) -for details on the process and how to become a maintainer or the project lead. - -# Project Maintainer -* [Martin Smith](https://github.com/martinb3) - -# Maintainers -* [Jennifer Davis](https://github.com/sigje) -* [Tim Smith](https://github.com/tas50) -* [Thom May](https://github.com/thommay) -* [Martin Smith](https://github.com/martinb3) diff --git a/cookbooks/firewall/README.md b/cookbooks/firewall/README.md index 4a12805..3f6df01 100644 --- a/cookbooks/firewall/README.md +++ b/cookbooks/firewall/README.md @@ -1,59 +1,79 @@ -firewall Cookbook -================= +# firewall Cookbook -[![Build Status](https://travis-ci.org/chef-cookbooks/firewall.svg?branch=master)](http://travis-ci.org/chef-cookbooks/firewall) [![Cookbook Version](https://img.shields.io/cookbook/v/firewall.svg)](https://supermarket.chef.io/cookbooks/firewall) +[![CI State](https://github.com/sous-chefs/firewall/workflows/ci/badge.svg)](https://github.com/sous-chefs/firewall/actions?query=workflow%3Aci) +[![OpenCollective](https://opencollective.com/sous-chefs/backers/badge.svg)](#backers) +[![OpenCollective](https://opencollective.com/sous-chefs/sponsors/badge.svg)](#sponsors) +[![License](https://img.shields.io/badge/License-Apache%202.0-green.svg)](https://opensource.org/licenses/Apache-2.0) Provides a set of primitives for managing firewalls and associated rules. PLEASE NOTE - The resource/providers in this cookbook are under heavy development. An attempt is being made to keep the resource simple/stupid by starting with less sophisticated firewall implementations first and refactor/vet the resource definition with each successive provider. -Requirements ------------- -**Chef 12.5.x+** is required. We are currently testing against Chef 13. If you need Chef 11 support, please try pinning back to a version less than 2.0, e.g.: -``` -depends 'firewall', '< 2.0' +## Maintainers + +This cookbook is maintained by the Sous Chefs. The Sous Chefs are a community of Chef cookbook maintainers working together to maintain important cookbooks. If you’d like to know more please visit [sous-chefs.org](https://sous-chefs.org/) or come chat with us on the Chef Community Slack in [#sous-chefs](https://chefcommunity.slack.com/messages/C2V7B88SF). + +## Requirements + +- Chef Infra Client 15.5+ + +```ruby +depends 'firewall' ``` ### Supported firewalls and platforms -* UFW - Ubuntu, Debian -* IPTables - Red Hat & CentOS, Ubuntu -* FirewallD - Red Hat & CentOS >= 7.0 (IPv4 only support, [needs contributions/testing](https://github.com/chef-cookbooks/firewall/issues/86)) -* Windows Advanced Firewall - 2012 R2 + +- UFW - Ubuntu, Debian (except 9) +- IPTables - Red Hat & CentOS, Ubuntu +- FirewallD - Red Hat & CentOS >= 7.0 (IPv4 only support, [needs contributions/testing](https://github.com/chef-cookbooks/firewall/issues/86)) +- Windows Advanced Firewall - 2012 R2 +- nftables Tested on: -* Ubuntu 14.04, 16.04 with iptables, ufw -* Debian 7, 8 with ufw -* CentOS 6 with iptables -* CentOS 7.1 with firewalld -* Windows Server 2012r2 with Windows Advanced Firewall + +- Ubuntu 16.04 with iptables, ufw +- Debian 9 with iptables +- Debian 11 with nftables +- Debian 11 with new resources for firewalld +- CentOS 6 with iptables +- CentOS 7.1 with firewalld +- Oracle 8 with nftables +- Windows Server 2012r2 with Windows Advanced Firewall By default, Ubuntu chooses ufw. To switch to iptables, set this in an attribute file: -``` + +```ruby default['firewall']['ubuntu_iptables'] = true ``` By default, Red Hat & CentOS >= 7.0 chooses firewalld. To switch to iptables, set this in an attribute file: -``` + +```ruby default['firewall']['redhat7_iptables'] = true ``` -# Considerations that apply to all firewall providers and resources +In order to use nftables, just use the resource `nftables` and +`nftables_rule`. These resources are written in more modern design +styles and are not configurable by node attributes. + +## Considerations that apply to all firewall providers and resources This cookbook comes with two resources, firewall and firewall rule. The typical usage scenario is as follows: - run the `:install` action on the `firewall` resource named 'default', which installs appropriate packages and configures services to start on boot and starts them - - run the `:create` action on every `firewall_rule` resource, which adds to the list of rules that should be configured on the firewall. `firewall_rule` then automatically sends a delayed notification to the `firewall['default']` resource to run the `:restart` action. - - run the delayed notification with action `:restart` on the `firewall` resource. if any rules are different than the last run, the provider will update the current state of the firewall rules to match the expected rules. There is a fundamental mismatch between the idea of a chef action and the action that should be taken on a firewall rule. For this reason, the chef action for a firewall_rule may be `:nothing` (the rule should not be present in the firewall) or `:create` (the rule should be present in the firewall), but the action taken on a packet in a firewall (`DROP`, `ACCEPT`, etc) is denoted as a `command` parameter on the `firewall_rule` resource. -# iptables considerations +The same points hold for the `nftables`- and `nftables_rule`-resources. + +## iptables considerations If you need to use a table other than `*filter`, the best way to do so is like so: -``` + +```ruby node.default['firewall']['iptables']['defaults'][:ruleset] = { '*filter' => 1, ':INPUT DROP' => 2, @@ -71,7 +91,8 @@ node.default['firewall']['iptables']['defaults'][:ruleset] = { Note -- in order to support multiple hash keys containing the same rule, anything found after the underscore will be stripped for: `:OUTPUT :INPUT :POSTROUTING :PREROUTING COMMIT`. This allows an example like the above to be reduced to just repeated lines of `COMMIT` and `:OUTPUT ACCEPT` while still avoiding duplication of other things. Then it's trivial to add additional rules to the `*nat` table using the raw parameter: -``` + +```ruby firewall_rule "postroute" do raw "-A POSTROUTING -o eth1 -p tcp -d 172.28.128.21 -j SNAT --to-source 172.28.128.6" position 150 @@ -81,42 +102,48 @@ end Note that any line starting with `COMMIT` will become just `COMMIT`, as hash keys must be unique but we need multiple commit lines. -# Recipes +## nftables + +Please read the documentation for the +[`nftables` resource](documentation/resource_nftables.md) and the +[`nftables_rule` resource](documentation/resource_nftables_rule.md) + +## Recipes ### default + The default recipe creates a firewall resource with action install. ### disable_firewall + Used to disable platform specific firewall. Many clouds have their own firewall configured outside of the OS instance such as AWS Security Groups. -# Attributes +## Attributes -* `default['firewall']['allow_ssh'] = false`, set true to open port 22 for SSH when the default recipe runs -* `default['firewall']['allow_mosh'] = false`, set to true to open UDP ports 60000 - 61000 for [Mosh][0] when the default recipe runs -* `default['firewall']['allow_winrm'] = false`, set true to open port 5989 for WinRM when the default recipe runs -* `default['firewall']['allow_loopback'] = false`, set to true to allow all traffic on the loopback interface -* `default['firewall']['allow_icmp'] = false`, set true to allow icmp protocol on supported OSes (note: ufw and windows implementations don't support this) +- `default['firewall']['allow_ssh'] = false`, set true to open port 22 for SSH when the default recipe runs +- `default['firewall']['allow_mosh'] = false`, set to true to open UDP ports 60000 - 61000 for [Mosh][0] when the default recipe runs +- `default['firewall']['allow_winrm'] = false`, set true to open port 5989 for WinRM when the default recipe runs +- `default['firewall']['allow_loopback'] = false`, set to true to allow all traffic on the loopback interface +- `default['firewall']['allow_icmp'] = false`, set true to allow icmp protocol on supported OSes (note: ufw and windows implementations don't support this) +- `default['firewall']['ubuntu_iptables'] = false`, set to true to use iptables on Ubuntu / Debian when using the default recipe +- `default['firewall']['redhat7_iptables'] = false`, set to true to use iptables on Red Hat / CentOS 7 when using the default recipe +- `default['firewall']['ufw']['defaults']` hash for template `/etc/default/ufw` +- `default['firewall']['iptables']['defaults']` hash for default policies for 'filter' table's chains` +- `default['firewall']['windows']['defaults']` hash to define inbound / outbound firewall policy on Windows platform +- `default['firewall']['allow_established'] = true`, set to false if you don't want a related/established default rule on iptables +- `default['firewall']['ipv6_enabled'] = true`, set to false if you don't want IPv6 related/established default rule on iptables (this enables ICMPv6, which is required for much of IPv6 communication) +- `default['firewall']['firewalld']['permanent'] = false`, set to true if you want firewalld rules to be added with `--permanent` so they survive a reboot. This will be changed to `true` by default in a future major version release. -* `default['firewall']['ubuntu_iptables'] = false`, set to true to use iptables on Ubuntu / Debian when using the default recipe -* `default['firewall']['redhat7_iptables'] = false`, set to true to use iptables on Red Hat / CentOS 7 when using the default recipe +## Resources -* `default['firewall']['ufw']['defaults']` hash for template `/etc/default/ufw` -* `default['firewall']['iptables']['defaults']` hash for default policies for 'filter' table's chains` - -* `default['firewall']['windows']['defaults']` hash to define inbound / outbound firewall policy on Windows platform - -* `default['firewall']['allow_established'] = true`, set to false if you don't want a related/established default rule on iptables -* `default['firewall']['ipv6_enabled'] = true`, set to false if you don't want IPv6 related/established default rule on iptables (this enables ICMPv6, which is required for much of IPv6 communication) - -* `default['firewall']['firewalld']['permanent'] = false`, set to true if you want firewalld rules to be added with `--permanent` so they survive a reboot. This will be changed to `true` by default in a future major version release. - -# Resources +There is a separate folder for [`firewalld` resources](documentation/README.md). ### firewall ***NB***: The name 'default' of this resource is important as it is used for firewall_rule providers to locate the firewall resource. If you change it, you must also supply the same value to any firewall_rule resources using the `firewall_name` parameter. #### Actions + - `:install` (*default action*): Install and Enable the firewall. This will ensure the appropriate packages are installed and that any services have been started. - `:disable`: Disable the firewall. Drop any rules and put the node in an unprotected state. Flush all current rules. Also erase any internal state used to detect when rules should be applied. - `:flush`: Flush all current rules. Also erase any internal state used to detect when rules should be applied. @@ -132,8 +159,6 @@ Used to disable platform specific firewall. Many clouds have their own firewall - `enabled_zone` (firewalld only): The zone to set on firewalld when the firewall should be enabled. Can be any string in symbol form, e.g. :public, :drop, etc. Defaults to `:drop.` - `package_options`: Used to pass options to the package install of firewall -#### Examples - ```ruby # all defaults firewall 'default' @@ -153,55 +178,36 @@ end ### firewall_rule #### Actions -- `:create` (_default action_): If a firewall_rule runs this action, the rule will be recorded in a chef resource's internal state, and applied when providers automatically notify the firewall resource with action `:reload`. The notification happens automatically. + +- `:create` (*default action*): If a firewall_rule runs this action, the rule will be recorded in a chef resource's internal state, and applied when providers automatically notify the firewall resource with action `:reload`. The notification happens automatically. #### Parameters - `firewall_name`: the matching firewall resource that this rule applies to. Default value: `default` - - `raw`: Used to pass an entire rule as a string, omitting all other parameters. This line will be directly loaded by `iptables-restore`, fed directly into `ufw` on the command line, or run using `firewall-cmd`. - -- `description` (_default: same as rule name_): Used to provide a comment that will be included when adding the firewall rule. - -- `include_comment` (_default: true_): Used to optionally exclude the comment in the rule. - -- `position` (_default: 50_): **relative** position to insert rule at. Position may be any integer between 0 < n < 100 (exclusive), and more than one rule may specify the same position. - +- `description` (*default: same as rule name*): Used to provide a comment that will be included when adding the firewall rule. +- `include_comment` (*default: true*): Used to optionally exclude the comment in the rule. +- `position` (*default: 50*): **relative** position to insert rule at. Position may be any integer between 0 < n < 100 (exclusive), and more than one rule may specify the same position. - `command`: What action to take on a particular packet - - - `:allow` (_default action_): the rule should allow matching packets - - `:deny`: the rule should deny matching packets - - `:reject`: the rule should reject matching packets - - `:masqerade`: Masquerade the matching packets - - `:redirect`: Redirect the matching packets - - `:log`: Configure logging - + - `:allow` (*default action*): the rule should allow matching packets + - `:deny`: the rule should deny matching packets + - `:reject`: the rule should reject matching packets + - `:masquerade`: Masquerade the matching packets + - `:redirect`: Redirect the matching packets + - `:log`: Configure logging - `stateful`: a symbol or array of symbols, such as ``[:related, :established]` that will be passed to the state module in iptables or firewalld. - -- `protocol`: `:tcp` (_default_), `:udp`, `:icmp`, `:none` or protocol number. Using protocol numbers is not supported using the ufw provider (default for debian/ubuntu systems). - -- `direction`: For ufw, direction of the rule. valid values are: `:in` (_default_), `:out`, `:pre`, `:post`. - -- `source` (_Default is `0.0.0.0/0` or `Anywhere`_): source ip address or subnet to filter. - -- `source_port` (_Default is nil_): source port for filtering packets. - +- `protocol`: `:tcp` (*default*), `:udp`, `:icmp`, `:none` or protocol number. Using protocol numbers is not supported using the ufw provider (default for debian/ubuntu systems). +- `direction`: For ufw, direction of the rule. valid values are: `:in` (*default*), `:out`, `:pre`, `:post`. +- `source` (*Default is `0.0.0.0/0` or `Anywhere`*): source ip address or subnet to filter. +- `source_port` (*Default is nil*): source port for filtering packets. - `destination`: ip address or subnet to filter on packet destination, must be a valid IP - - `port` or `dest_port`: target port number (ie. 22 to allow inbound SSH), or an array of incoming port numbers (ie. [80,443] to allow inbound HTTP & HTTPS). - - NOTE: `protocol` attribute is required with multiple ports, or a range of incoming port numbers (ie. 60000..61000 to allow inbound mobile-shell. NOTE: `protocol`, or an attribute is required with a range of ports. - + NOTE: `protocol` attribute is required with multiple ports, or a range of incoming port numbers (ie. 60000..61000 to allow inbound mobile-shell. NOTE: `protocol`, or an attribute is required with a range of ports. - `interface`: (source) interface to apply rule (ie. `eth0`). - - `dest_interface`: interface where packets may be destined to go - - `redirect_port`: redirected port for rules with command `:redirect` - - `logging`: may be added to enable logging for a particular rule. valid values are: `:connections`, `:packets`. In the ufw provider, `:connections` logs new connections while `:packets` logs all packets. -#### Examples - ```ruby # open standard ssh port firewall_rule 'ssh' do @@ -245,7 +251,7 @@ firewall_rule "VRRP" do raw "allow to 224.0.0.18" end -# open UDP ports 60000..61000 for mobile shell (mosh.mit.edu), note +# open UDP ports 60000..61000 for mobile shell (mosh.org), note # that the protocol attribute is required when using port_range firewall_rule 'mosh' do protocol :udp @@ -273,66 +279,71 @@ end Different providers will determine the current state of the rules differently -- parsing the output of a command, maintaining the state in a file, or some other way. If the firewall is adjusted from outside of chef (non-idempotent), it's possible that chef may be caught unaware of the current state of the firewall. The best workaround is to add a `:flush` action to the firewall resource as early as possible in the chef run, if you plan to modify the firewall state outside of chef. -# Troubleshooting +## Troubleshooting To figure out what the position values are for current rules, print the hash that contains the weights: -``` + +```ruby require pp default_firewall = resources(:firewall, 'default') pp default_firewall.rules ``` -# Development +## Development + This section details "quick development" steps. For a detailed explanation, see [[Contributing.md]]. 1. Clone this repository from GitHub: - $ git clone git@github.com:chef-cookbooks/firewall.git +`$ git clone git@github.com:chef-cookbooks/firewall.git` -2. Create a git branch +1. Create a git branch - $ git checkout -b my_bug_fix +`$ git checkout -b my_bug_fix` -3. Install dependencies: +1. Install dependencies: - $ bundle install +`$ bundle install` -4. Make your changes/patches/fixes, committing appropiately -5. **Write tests** -6. Run the tests: - - `bundle exec foodcritic -f any .` - - `bundle exec rspec` - - `bundle exec rubocop` - - `bundle exec kitchen test` +1. Make your changes/patches/fixes, committing appropiately +1. **Write tests** +1. Run the tests: - In detail: - - Foodcritic will catch any Chef-specific style errors - - RSpec will run the unit tests - - Rubocop will check for Ruby-specific style errors - - Test Kitchen will run and converge the recipes +- `bundle exec foodcritic -f any .` +- `bundle exec rspec` +- `bundle exec rubocop` +- `bundle exec kitchen test` +In detail: -# License & Authors - -- Author:: Seth Chisamore () -- Author:: Ronald Doorn () -- Author:: Martin Smith () -- Author:: Sander van Harmelen () +- Foodcritic will catch any Chef-specific style errors +- RSpec will run the unit tests +- Rubocop will check for Ruby-specific style errors +- Test Kitchen will run and converge the recipes -```text -Copyright:: 2011-2015, Chef Software, Inc +## Contributors -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at +This project exists thanks to all the people who [contribute.](https://opencollective.com/sous-chefs/contributors.svg?width=890&button=false) - http://www.apache.org/licenses/LICENSE-2.0 +### Backers -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -``` +Thank you to all our backers! -[0]: https://mosh.mit.edu/ +![https://opencollective.com/sous-chefs#backers](https://opencollective.com/sous-chefs/backers.svg?width=600&avatarHeight=40) + +### Sponsors + +Support this project by becoming a sponsor. Your logo will show up here with a link to your website. + +![https://opencollective.com/sous-chefs/sponsor/0/website](https://opencollective.com/sous-chefs/sponsor/0/avatar.svg?avatarHeight=100) +![https://opencollective.com/sous-chefs/sponsor/1/website](https://opencollective.com/sous-chefs/sponsor/1/avatar.svg?avatarHeight=100) +![https://opencollective.com/sous-chefs/sponsor/2/website](https://opencollective.com/sous-chefs/sponsor/2/avatar.svg?avatarHeight=100) +![https://opencollective.com/sous-chefs/sponsor/3/website](https://opencollective.com/sous-chefs/sponsor/3/avatar.svg?avatarHeight=100) +![https://opencollective.com/sous-chefs/sponsor/4/website](https://opencollective.com/sous-chefs/sponsor/4/avatar.svg?avatarHeight=100) +![https://opencollective.com/sous-chefs/sponsor/5/website](https://opencollective.com/sous-chefs/sponsor/5/avatar.svg?avatarHeight=100) +![https://opencollective.com/sous-chefs/sponsor/6/website](https://opencollective.com/sous-chefs/sponsor/6/avatar.svg?avatarHeight=100) +![https://opencollective.com/sous-chefs/sponsor/7/website](https://opencollective.com/sous-chefs/sponsor/7/avatar.svg?avatarHeight=100) +![https://opencollective.com/sous-chefs/sponsor/8/website](https://opencollective.com/sous-chefs/sponsor/8/avatar.svg?avatarHeight=100) +![https://opencollective.com/sous-chefs/sponsor/9/website](https://opencollective.com/sous-chefs/sponsor/9/avatar.svg?avatarHeight=100) + +[0]: https://mosh.org diff --git a/cookbooks/firewall/TODO.md b/cookbooks/firewall/TODO.md new file mode 100644 index 0000000..34997ff --- /dev/null +++ b/cookbooks/firewall/TODO.md @@ -0,0 +1,6 @@ +# TODO + +- update for rhel-8+ nftables, RHEL docs recommend nftables for new firewalls +- fix windows tests +- iptables' `-S` not supported in libraries/provider_firewall_iptables.rb +- save action might not make sense for firewalls diff --git a/cookbooks/firewall/attributes/iptables.rb b/cookbooks/firewall/attributes/iptables.rb index f26ac55..551916a 100644 --- a/cookbooks/firewall/attributes/iptables.rb +++ b/cookbooks/firewall/attributes/iptables.rb @@ -5,9 +5,9 @@ default['firewall']['iptables']['defaults'][:policy] = { } default['firewall']['iptables']['defaults'][:ruleset] = { '*filter' => 1, - ":INPUT #{node['firewall']['iptables']['defaults'][:policy][:input]}" => 2, - ":FORWARD #{node['firewall']['iptables']['defaults'][:policy][:forward]}" => 3, - ":OUTPUT #{node['firewall']['iptables']['defaults'][:policy][:output]}" => 4, + ":INPUT #{node['firewall']['iptables']['defaults']['policy']['input']}" => 2, + ":FORWARD #{node['firewall']['iptables']['defaults']['policy']['forward']}" => 3, + ":OUTPUT #{node['firewall']['iptables']['defaults']['policy']['output']}" => 4, 'COMMIT_FILTER' => 100, } diff --git a/cookbooks/firewall/chefignore b/cookbooks/firewall/chefignore new file mode 100644 index 0000000..a27b0b2 --- /dev/null +++ b/cookbooks/firewall/chefignore @@ -0,0 +1,115 @@ +# Put files/directories that should be ignored in this file when uploading +# to a Chef Infra Server or Supermarket. +# Lines that start with '# ' are comments. + +# OS generated files # +###################### +.DS_Store +ehthumbs.db +Icon? +nohup.out +Thumbs.db +.envrc + +# EDITORS # +########### +.#* +.project +.settings +*_flymake +*_flymake.* +*.bak +*.sw[a-z] +*.tmproj +*~ +\#* +REVISION +TAGS* +tmtags +.vscode +.editorconfig + +## COMPILED ## +############## +*.class +*.com +*.dll +*.exe +*.o +*.pyc +*.so +*/rdoc/ +a.out +mkmf.log + +# Testing # +########### +.circleci/* +.codeclimate.yml +.delivery/* +.foodcritic +.kitchen* +.mdlrc +.overcommit.yml +.rspec +.rubocop.yml +.travis.yml +.watchr +.yamllint +azure-pipelines.yml +Dangerfile +examples/* +features/* +Guardfile +kitchen*.yml +mlc_config.json +Procfile +Rakefile +spec/* +test/* + +# SCM # +####### +.git +.gitattributes +.gitconfig +.github/* +.gitignore +.gitkeep +.gitmodules +.svn +*/.bzr/* +*/.git +*/.hg/* +*/.svn/* + +# Berkshelf # +############# +Berksfile +Berksfile.lock +cookbooks/* +tmp + +# Bundler # +########### +vendor/* +Gemfile +Gemfile.lock + +# Policyfile # +############## +Policyfile.rb +Policyfile.lock.json + +# Documentation # +############# +CODE_OF_CONDUCT* +CONTRIBUTING* +documentation/* +TESTING* +UPGRADING* + +# Vagrant # +########### +.vagrant +Vagrantfile diff --git a/cookbooks/firewall/libraries/helpers.rb b/cookbooks/firewall/libraries/helpers.rb index 38a8fad..497c586 100644 --- a/cookbooks/firewall/libraries/helpers.rb +++ b/cookbooks/firewall/libraries/helpers.rb @@ -67,8 +67,8 @@ module FirewallCookbook end end - def ubuntu?(current_node) - current_node['platform'] == 'ubuntu' + def debian?(current_node) + current_node['platform_family'] == 'debian' end def build_rule_file(rules) @@ -96,5 +96,10 @@ module FirewallCookbook false end + + def default_description(new_resource) + new_resource.description || + "Generated by chef from #{cookbook_name}[#{recipe_name}] by #{new_resource}" + end end end diff --git a/cookbooks/firewall/libraries/helpers_firewalld.rb b/cookbooks/firewall/libraries/helpers_firewalld.rb index ceb8bd2..5deb402 100644 --- a/cookbooks/firewall/libraries/helpers_firewalld.rb +++ b/cookbooks/firewall/libraries/helpers_firewalld.rb @@ -21,7 +21,7 @@ module FirewallCookbook return false unless firewalld_active? cmd = shell_out('firewall-cmd', '--get-default-zone') - cmd.stdout =~ /^#{z.to_s}$/ + cmd.stdout =~ /^#{z}$/ end def firewalld_default_zone!(z) diff --git a/cookbooks/firewall/libraries/helpers_firewalld_dbus.rb b/cookbooks/firewall/libraries/helpers_firewalld_dbus.rb new file mode 100644 index 0000000..c78b904 --- /dev/null +++ b/cookbooks/firewall/libraries/helpers_firewalld_dbus.rb @@ -0,0 +1,72 @@ +module FirewallCookbook + module Helpers + module FirewalldDBus + def firewalld(system_bus) + system_bus['org.fedoraproject.FirewallD1'] + end + + def firewalld_object(system_bus) + firewalld(system_bus)['/org/fedoraproject/FirewallD1'] + end + + def firewalld_interface(system_bus) + firewalld_object(system_bus)['org.fedoraproject.FirewallD1'] + end + + def config_object(system_bus) + firewalld(system_bus)['/org/fedoraproject/FirewallD1/config'] + end + + def config_interface(system_bus) + config_object(system_bus)['org.fedoraproject.FirewallD1.config'] + end + + def icmptype_interface(dbus, icmptype_path) + icmptype_object = firewalld(dbus)[icmptype_path] + icmptype_object['org.fedoraproject.FirewallD1.config.icmptype'] + end + + def ipset_interface(dbus, ipset_path) + ipset_object = firewalld(dbus)[ipset_path] + ipset_object['org.fedoraproject.FirewallD1.config.ipset'] + end + + def helper_interface(dbus, helper_path) + helper_object = firewalld(dbus)[helper_path] + helper_object['org.fedoraproject.FirewallD1.config.helper'] + end + + def service_interface(dbus, service_path) + service_object = firewalld(dbus)[service_path] + service_object['org.fedoraproject.FirewallD1.config.service'] + end + + def policy_interface(dbus, policy_path) + policy_object = firewalld(dbus)[policy_path] + policy_object['org.fedoraproject.FirewallD1.config.policy'] + end + + def zone_interface(dbus, zone_path) + zone_object = firewalld(dbus)[zone_path] + zone_object['org.fedoraproject.FirewallD1.config.zone'] + end + + # port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] + def parse_forward_ports(forward_ports) + port_regex = %r{port=([\w-]+):proto=([\w]+)(:toport=([\w-]+)|)(:toaddr=([\d\./]+)|)} + captures = forward_ports.match(port_regex).captures + captures.delete_at(4) + captures.delete_at(2) + captures.map { |e| e || '' } + end + + def forward_ports_to_dbus(new_resource) + fwp = new_resource.forward_ports.map do |e| + parse_forward_ports(e) + end + new_resource.forward_ports = fwp + DBus.variant('a(ssss)', new_resource.forward_ports) + end + end + end +end diff --git a/cookbooks/firewall/libraries/helpers_iptables.rb b/cookbooks/firewall/libraries/helpers_iptables.rb index 9f6ea49..3771414 100644 --- a/cookbooks/firewall/libraries/helpers_iptables.rb +++ b/cookbooks/firewall/libraries/helpers_iptables.rb @@ -49,14 +49,14 @@ module FirewallCookbook end def iptables_packages(new_resource) - packages = if ipv6_enabled?(new_resource) + packages = if ipv6_enabled?(new_resource) && !amazon_linux? && node['platform_version'].to_i < 8 %w(iptables iptables-ipv6) else %w(iptables) end # centos 7 requires extra service - if !ubuntu?(node) && node['platform_version'].to_i >= 7 + if (!debian?(node) && node['platform_version'].to_i >= 7) || amazon_linux? packages << %w(iptables-services) end diff --git a/cookbooks/firewall/libraries/helpers_nftables.rb b/cookbooks/firewall/libraries/helpers_nftables.rb new file mode 100644 index 0000000..eeba4e2 --- /dev/null +++ b/cookbooks/firewall/libraries/helpers_nftables.rb @@ -0,0 +1,170 @@ +module FirewallCookbook + module Helpers + module Nftables + include FirewallCookbook::Helpers + + CHAIN ||= { + in: 'INPUT', + out: 'OUTPUT', + pre: 'PREROUTING', + post: 'POSTROUTING', + forward: 'FORWARD', + }.freeze + + TARGET ||= { + accept: 'accept', + allow: 'accept', + counter: 'counter', + deny: 'drop', + drop: 'drop', + log: 'log', + masquerade: 'masquerade', + redirect: 'redirect', + reject: 'reject', + }.freeze + + def port_to_s(ports) + case ports + when String + ports + when Integer + ports.to_s + when Array + p_strings = ports.map { |o| port_to_s(o) } + "{#{p_strings.sort.join(',')}}" + when Range + "#{ports.first}-#{ports.last}" + else + raise "unknown class of port definition: #{ports.class}" + end + end + + def nftables_command_log(rule_resource) + log_prefix = 'prefix ' + log_prefix << if rule_resource.log_prefix.nil? + "\"#{CHAIN[rule_resource.direction]}:\"" + else + "\"#{rule_resource.log_prefix}\"" + end + log_group = if rule_resource.log_group.nil? + nil + else + "group #{rule_resource.log_group} " + end + "log #{log_prefix} #{log_group}" + end + + def nftables_command_redirect(rule_resource) + if rule_resource.redirect_port.nil? + raise 'Specify redirect_port when using :redirect as commmand' + end + + "redirect to #{rule_resource.redirect_port} " + end + + def nftables_commands(rule_resource) + firewall_rule = '' + Array(rule_resource.command).each do |command| + begin + target = TARGET.fetch(command) + rescue KeyError + raise "Invalid command: #{command.inspect}. Use one of #{TARGET.keys}" + end + firewall_rule << case target + when 'log' + nftables_command_log(rule_resource) + when 'redirect' + nftables_command_redirect(rule_resource) + else + "#{TARGET[command.to_sym]} " + end + end + firewall_rule + end + + def build_firewall_rule(rule_resource) + return rule_resource.raw.strip if rule_resource.raw + + ip = ipv6_rule?(rule_resource) ? 'ip6' : 'ip' + table = if [:pre, :post].include?(rule_resource.direction) + 'nat' + else + 'filter' + end + firewall_rule = if table == 'nat' + "add rule #{ip} #{table} " + else + "add rule inet #{table} " + end + firewall_rule << "#{CHAIN.fetch(rule_resource.direction.to_sym, 'FORWARD')} " + + firewall_rule << "iif #{rule_resource.interface} " if rule_resource.interface + firewall_rule << "oif #{rule_resource.outerface} " if rule_resource.outerface + + if rule_resource.source + source_with_mask = ip_with_mask(rule_resource, rule_resource.source) + if source_with_mask != '0.0.0.0/0' && source_with_mask != '::/128' + firewall_rule << "#{ip} saddr #{source_with_mask} " + end + end + firewall_rule << "#{ip} daddr #{rule_resource.destination} " if rule_resource.destination + + case rule_resource.protocol + when :icmp + firewall_rule << 'icmp type echo-request ' + when :'ipv6-icmp', :icmpv6 + firewall_rule << 'icmpv6 type { echo-request, nd-router-solicit, nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } ' + when :tcp, :udp + firewall_rule << "#{rule_resource.protocol} sport #{port_to_s(rule_resource.sport)} " if rule_resource.sport + firewall_rule << "#{rule_resource.protocol} dport #{port_to_s(rule_resource.dport)} " if rule_resource.dport + when :esp, :ah + firewall_rule << "#{ip} #{ip == 'ip6' ? 'nexthdr' : 'protocol'} #{rule_resource.protocol} " + when :ipv6, :none + # nothing to do + end + + firewall_rule << "ct state #{Array(rule_resource.stateful).join(',').downcase} " if rule_resource.stateful + firewall_rule << nftables_commands(rule_resource) + firewall_rule << "comment \"#{rule_resource.description}\" " if rule_resource.include_comment + firewall_rule.strip! + firewall_rule + end + + def default_ruleset(new_resource) + rules = { + 'add table inet filter' => 1, + "add chain inet filter INPUT { type filter hook input priority 0 ; policy #{new_resource.input_policy}; }" => 2, + "add chain inet filter OUTPUT { type filter hook output priority 0 ; policy #{new_resource.output_policy}; }" => 2, + "add chain inet filter FOWARD { type filter hook forward priority 0 ; policy #{new_resource.forward_policy}; }" => 2, + } + if new_resource.table_ip_nat + rules['add table ip nat'] = 1 + rules['add chain ip nat POSTROUTING { type nat hook postrouting priority 100 ;}'] = 2 + rules['add chain ip nat PREROUTING { type nat hook prerouting priority -100 ;}'] = 2 + end + if new_resource.table_ip6_nat + rules['add table ip6 nat'] = 1 + rules['add chain ip6 nat POSTROUTING { type nat hook postrouting priority 100 ;}'] = 2 + rules['add chain ip6 nat PREROUTING { type nat hook prerouting priority -100 ;}'] = 2 + end + rules + end + + def ensure_default_rules_exist(new_resource) + input = new_resource.rules || {} + input.merge!(default_ruleset(new_resource)) + end + + def default_nftables_conf_path + case node['platform_family'] + when 'rhel' + '/etc/sysconfig/nftables.conf' + when 'debian' + '/etc/nftables.conf' + else + raise "default_nftables_conf_path: Unsupported platform_family #{node['platform_family']}." + end + end + end + end +end diff --git a/cookbooks/firewall/libraries/helpers_ufw.rb b/cookbooks/firewall/libraries/helpers_ufw.rb index 9e035c5..5152f64 100644 --- a/cookbooks/firewall/libraries/helpers_ufw.rb +++ b/cookbooks/firewall/libraries/helpers_ufw.rb @@ -74,6 +74,7 @@ module FirewallCookbook rule << rule_proto(new_resource) rule << rule_dest_port(new_resource) rule << rule_source_port(new_resource) + rule << rule_description(new_resource) rule = rule.strip if rule == 'ufw allow in proto tcp to any from any' @@ -97,6 +98,12 @@ module FirewallCookbook rule end + def rule_description(new_resource) + rule = '' + rule << "comment \"#{new_resource.description}\" " if new_resource.description && new_resource.include_comment + rule + end + def rule_dest_port(new_resource) rule = if new_resource.destination "to #{new_resource.destination} " diff --git a/cookbooks/firewall/libraries/helpers_windows.rb b/cookbooks/firewall/libraries/helpers_windows.rb index 391581b..4cb47ac 100644 --- a/cookbooks/firewall/libraries/helpers_windows.rb +++ b/cookbooks/firewall/libraries/helpers_windows.rb @@ -44,12 +44,11 @@ module FirewallCookbook def to_type(new_resource) cmd = new_resource.command - type = if cmd == :reject || cmd == :deny - :block - else - :allow - end - type + if cmd == :reject || cmd == :deny + :block + else + :allow + end end def build_rule(new_resource) @@ -66,13 +65,13 @@ module FirewallCookbook if new_resource.direction.to_sym == :out parameters['localip'] = new_resource.source ? fixup_cidr(new_resource.source) : 'any' parameters['localport'] = new_resource.source_port ? port_to_s(new_resource.source_port) : 'any' - parameters['interfacetype'] = new_resource.interface ? new_resource.interface : 'any' + parameters['interfacetype'] = new_resource.interface || 'any' parameters['remoteip'] = new_resource.destination ? fixup_cidr(new_resource.destination) : 'any' parameters['remoteport'] = new_resource.dest_port ? port_to_s(new_resource.dest_port) : 'any' else - parameters['localip'] = new_resource.destination ? new_resource.destination : 'any' + parameters['localip'] = new_resource.destination || 'any' parameters['localport'] = dport_calc(new_resource) ? port_to_s(dport_calc(new_resource)) : 'any' - parameters['interfacetype'] = new_resource.dest_interface ? new_resource.dest_interface : 'any' + parameters['interfacetype'] = new_resource.dest_interface || 'any' parameters['remoteip'] = new_resource.source ? fixup_cidr(new_resource.source) : 'any' parameters['remoteport'] = new_resource.source_port ? port_to_s(new_resource.source_port) : 'any' end diff --git a/cookbooks/firewall/libraries/matchers.rb b/cookbooks/firewall/libraries/matchers.rb deleted file mode 100644 index 474b3c2..0000000 --- a/cookbooks/firewall/libraries/matchers.rb +++ /dev/null @@ -1,30 +0,0 @@ -if defined?(ChefSpec) - ChefSpec.define_matcher(:firewall) - ChefSpec.define_matcher(:firewall_rule) - - # actions(:install, :restart, :disable, :flush, :save) - - def install_firewall(resource) - ChefSpec::Matchers::ResourceMatcher.new(:firewall, :install, resource) - end - - def restart_firewall(resource) - ChefSpec::Matchers::ResourceMatcher.new(:firewall, :restart, resource) - end - - def disable_firewall(resource) - ChefSpec::Matchers::ResourceMatcher.new(:firewall, :disable, resource) - end - - def flush_firewall(resource) - ChefSpec::Matchers::ResourceMatcher.new(:firewall, :flush, resource) - end - - def save_firewall(resource) - ChefSpec::Matchers::ResourceMatcher.new(:firewall, :save, resource) - end - - def create_firewall_rule(resource) - ChefSpec::Matchers::ResourceMatcher.new(:firewall_rule, :create, resource) - end -end diff --git a/cookbooks/firewall/libraries/provider_firewall_firewalld.rb b/cookbooks/firewall/libraries/provider_firewall_firewalld.rb index b8fc8c5..82056d8 100644 --- a/cookbooks/firewall/libraries/provider_firewall_firewalld.rb +++ b/cookbooks/firewall/libraries/provider_firewall_firewalld.rb @@ -19,15 +19,15 @@ class Chef class Provider::FirewallFirewalld < Chef::Provider::LWRPBase include FirewallCookbook::Helpers::Firewalld - provides :firewall, os: 'linux', platform_family: %w(rhel fedora) do |node| - node['platform_version'].to_f >= 7.0 && !node['firewall']['redhat7_iptables'] + provides :firewall, os: 'linux', platform_family: %w(rhel fedora amazon) do |node| + (node['platform_version'].to_i == 7 && !node['firewall']['redhat7_iptables']) || (amazon_linux? && !node['firewall']['redhat7_iptables']) end def whyrun_supported? false end - def action_install + action :install do return if disabled?(new_resource) firewalld_package = package 'firewalld' do @@ -51,7 +51,7 @@ class Chef end end - def action_restart + action :restart do return if disabled?(new_resource) # ensure it's initialized @@ -111,7 +111,7 @@ class Chef new_resource.updated_by_last_action(true) end - def action_disable + action :disable do return if disabled?(new_resource) if firewalld_active? @@ -133,7 +133,7 @@ class Chef new_resource.updated_by_last_action(rules_file.updated_by_last_action?) end - def action_flush + action :flush do return if disabled?(new_resource) return unless firewalld_active? @@ -146,7 +146,7 @@ class Chef new_resource.updated_by_last_action(rules_file.updated_by_last_action?) end - def action_save + action :save do return if disabled?(new_resource) return if firewalld_all_rules_permanent! diff --git a/cookbooks/firewall/libraries/provider_firewall_iptables.rb b/cookbooks/firewall/libraries/provider_firewall_iptables.rb index 6c1cb81..1878861 100644 --- a/cookbooks/firewall/libraries/provider_firewall_iptables.rb +++ b/cookbooks/firewall/libraries/provider_firewall_iptables.rb @@ -3,7 +3,7 @@ # Cookbook:: firewall # Resource:: default # -# Copyright:: 2011-2016, Chef Software, Inc. +# Copyright:: 2011-2019, Chef Software, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -22,15 +22,15 @@ class Chef include FirewallCookbook::Helpers include FirewallCookbook::Helpers::Iptables - provides :firewall, os: 'linux', platform_family: %w(rhel fedora) do |node| - node['platform_version'].to_f < 7.0 || node['firewall']['redhat7_iptables'] + provides :firewall, os: 'linux', platform_family: %w(rhel fedora amazon) do |node| + (node['platform_version'].to_i < 7 && !amazon_linux?) || node['platform_version'].to_i >= 8 || node['firewall']['redhat7_iptables'] end def whyrun_supported? false end - def action_install + action :install do return if disabled?(new_resource) # Ensure the package is installed @@ -60,7 +60,7 @@ class Chef end end - def action_restart + action :restart do return if disabled?(new_resource) # prints all the firewall rules @@ -104,12 +104,12 @@ class Chef next unless iptables_file.updated_by_last_action? iptables_service = lookup_or_create_service(iptables_type) - new_resource.notifies(:restart, iptables_service, :delayed) + iptables_service.run_action(:restart) new_resource.updated_by_last_action(true) end end - def action_disable + action :disable do return if disabled?(new_resource) iptables_flush!(new_resource) @@ -131,7 +131,7 @@ class Chef end end - def action_flush + action :flush do return if disabled?(new_resource) iptables_flush!(new_resource) diff --git a/cookbooks/firewall/libraries/provider_firewall_iptables_ubuntu.rb b/cookbooks/firewall/libraries/provider_firewall_iptables_ubuntu.rb index d6be1cd..35a3173 100644 --- a/cookbooks/firewall/libraries/provider_firewall_iptables_ubuntu.rb +++ b/cookbooks/firewall/libraries/provider_firewall_iptables_ubuntu.rb @@ -3,7 +3,7 @@ # Cookbook:: firewall # Resource:: default # -# Copyright:: 2011-2016, Chef Software, Inc. +# Copyright:: 2011-2019, Chef Software, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -23,14 +23,15 @@ class Chef include FirewallCookbook::Helpers::Iptables provides :firewall, os: 'linux', platform_family: %w(debian) do |node| - node['platform_version'].to_f > 14.04 && node['firewall'] && node['firewall']['ubuntu_iptables'] + node['firewall'] && node['firewall']['ubuntu_iptables'] && + node['platform_version'].to_f > (node['platform'] == 'ubuntu' ? 14.04 : 7) end def whyrun_supported? false end - def action_install + action :install do return if disabled?(new_resource) # Ensure the package is installed @@ -63,7 +64,7 @@ class Chef end end - def action_restart + action :restart do return if disabled?(new_resource) # prints all the firewall rules @@ -97,6 +98,8 @@ class Chef end end + restart_service = false + rule_files = %w(iptables) rule_files << 'ip6tables' if ipv6_enabled?(new_resource) @@ -119,17 +122,19 @@ class Chef iptables_file.run_action(:create) # if the file was changed, restart iptables - next unless iptables_file.updated_by_last_action? + restart_service = true if iptables_file.updated_by_last_action? + end + + if restart_service service_affected = service 'netfilter-persistent' do action :nothing end - - new_resource.notifies(:restart, service_affected, :delayed) + service_affected.run_action(:restart) new_resource.updated_by_last_action(true) end end - def action_disable + action :disable do return if disabled?(new_resource) iptables_flush!(new_resource) @@ -152,7 +157,7 @@ class Chef end end - def action_flush + action :flush do return if disabled?(new_resource) iptables_flush!(new_resource) diff --git a/cookbooks/firewall/libraries/provider_firewall_iptables_ubuntu1404.rb b/cookbooks/firewall/libraries/provider_firewall_iptables_ubuntu1404.rb index d2c3d74..b8b277a 100644 --- a/cookbooks/firewall/libraries/provider_firewall_iptables_ubuntu1404.rb +++ b/cookbooks/firewall/libraries/provider_firewall_iptables_ubuntu1404.rb @@ -1,9 +1,9 @@ # # Author:: Seth Chisamore () -# Cookbook Name:: firewall +# Cookbook:: firewall # Resource:: default # -# Copyright:: 2011, Opscode, Inc. +# Copyright:: 2011-2019, Chef Software, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -23,14 +23,15 @@ class Chef include FirewallCookbook::Helpers::Iptables provides :firewall, os: 'linux', platform_family: %w(debian) do |node| - node['platform_version'].to_f <= 14.04 && node['firewall'] && node['firewall']['ubuntu_iptables'] + node['firewall'] && node['firewall']['ubuntu_iptables'] && + node['platform_version'].to_f <= (node['platform'] == 'ubuntu' ? 14.04 : 7) end def whyrun_supported? false end - def action_install + action :install do return if disabled?(new_resource) # Ensure the package is installed @@ -63,7 +64,7 @@ class Chef end end - def action_restart + action :restart do return if disabled?(new_resource) # prints all the firewall rules @@ -97,6 +98,8 @@ class Chef end end + restart_service = false + rule_files = %w(iptables) rule_files << 'ip6tables' if ipv6_enabled?(new_resource) @@ -119,17 +122,19 @@ class Chef iptables_file.run_action(:create) # if the file was changed, restart iptables - next unless iptables_file.updated_by_last_action? + restart_service = true if iptables_file.updated_by_last_action? + end + + if restart_service service_affected = service 'iptables-persistent' do action :nothing end - - new_resource.notifies(:restart, service_affected, :delayed) + service_affected.run_action(:restart) new_resource.updated_by_last_action(true) end end - def action_disable + action :disable do return if disabled?(new_resource) iptables_flush!(new_resource) @@ -152,7 +157,7 @@ class Chef end end - def action_flush + action :flush do return if disabled?(new_resource) iptables_flush!(new_resource) diff --git a/cookbooks/firewall/libraries/provider_firewall_rule.rb b/cookbooks/firewall/libraries/provider_firewall_rule.rb index 85a27c5..2352cbc 100644 --- a/cookbooks/firewall/libraries/provider_firewall_rule.rb +++ b/cookbooks/firewall/libraries/provider_firewall_rule.rb @@ -21,7 +21,7 @@ class Chef class Provider::FirewallRuleGeneric < Chef::Provider::LWRPBase provides :firewall_rule - def action_create + action :create do return unless new_resource.notify_firewall firewall_resource = Chef.run_context.resource_collection.find(firewall: new_resource.firewall_name) diff --git a/cookbooks/firewall/libraries/provider_firewall_ufw.rb b/cookbooks/firewall/libraries/provider_firewall_ufw.rb index cc1aeb7..ce05904 100644 --- a/cookbooks/firewall/libraries/provider_firewall_ufw.rb +++ b/cookbooks/firewall/libraries/provider_firewall_ufw.rb @@ -3,7 +3,7 @@ # Cookbook:: firewall # Resource:: default # -# Copyright:: 2011-2016, Chef Software, Inc. +# Copyright:: 2011-2019, Chef Software, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -29,7 +29,7 @@ class Chef false end - def action_install + action :install do return if disabled?(new_resource) pkg_ufw = package 'ufw' do @@ -58,7 +58,7 @@ class Chef new_resource.updated_by_last_action(true) if ufw_file.updated_by_last_action? end - def action_restart + action :restart do return if disabled?(new_resource) # ensure it's initialized @@ -99,7 +99,7 @@ class Chef new_resource.updated_by_last_action(true) end - def action_disable + action :disable do return if disabled?(new_resource) ufw_file = lookup_or_create_rulesfile @@ -112,7 +112,7 @@ class Chef new_resource.updated_by_last_action(true) end - def action_flush + action :flush do return if disabled?(new_resource) ufw_reset! diff --git a/cookbooks/firewall/libraries/provider_firewall_windows.rb b/cookbooks/firewall/libraries/provider_firewall_windows.rb index d261f03..a886ec3 100644 --- a/cookbooks/firewall/libraries/provider_firewall_windows.rb +++ b/cookbooks/firewall/libraries/provider_firewall_windows.rb @@ -26,7 +26,7 @@ class Chef false end - def action_install + action :install do return if disabled?(new_resource) svc = service 'MpsSvc' do @@ -39,7 +39,7 @@ class Chef end end - def action_restart + action :restart do return if disabled?(new_resource) # ensure it's initialized @@ -94,7 +94,7 @@ class Chef new_resource.updated_by_last_action(true) end - def action_disable + action :disable do return if disabled?(new_resource) if active? @@ -115,7 +115,7 @@ class Chef end end - def action_flush + action :flush do return if disabled?(new_resource) reset! diff --git a/cookbooks/firewall/libraries/resource_firewall_rule.rb b/cookbooks/firewall/libraries/resource_firewall_rule.rb index 575deef..045a295 100644 --- a/cookbooks/firewall/libraries/resource_firewall_rule.rb +++ b/cookbooks/firewall/libraries/resource_firewall_rule.rb @@ -6,7 +6,6 @@ class Chef resource_name(:firewall_rule) provides(:firewall_rule) - actions(:create) default_action(:create) attribute(:firewall_name, kind_of: String, default: 'default') @@ -20,12 +19,12 @@ class Chef attribute(:direction, kind_of: Symbol, equal_to: [:in, :out, :pre, :post], default: :in) attribute(:logging, kind_of: Symbol, equal_to: [:connections, :packets]) - attribute(:source, callbacks: { 'must be a valid ip address' => ->(ip) { !!IPAddr.new(ip) } }) + attribute(:source, kind_of: String, callbacks: { 'must be a valid ip address' => ->(ip) { !!IPAddr.new(ip) } }) attribute(:source_port, kind_of: [Integer, Array, Range]) # source port attribute(:interface, kind_of: String) attribute(:port, kind_of: [Integer, Array, Range]) # shorthand for dest_port - attribute(:destination, callbacks: { 'must be a valid ip address' => ->(ip) { !!IPAddr.new(ip) } }) + attribute(:destination, kind_of: String, callbacks: { 'must be a valid ip address' => ->(ip) { !!IPAddr.new(ip) } }) attribute(:dest_port, kind_of: [Integer, Array, Range]) attribute(:dest_interface, kind_of: String) diff --git a/cookbooks/firewall/metadata.json b/cookbooks/firewall/metadata.json index f58eaa1..bc10ea3 100644 --- a/cookbooks/firewall/metadata.json +++ b/cookbooks/firewall/metadata.json @@ -1 +1,40 @@ -{"name":"firewall","version":"2.6.5","description":"Provides a set of primitives for managing firewalls and associated rules.","long_description":"firewall Cookbook\n=================\n\n[![Build Status](https://travis-ci.org/chef-cookbooks/firewall.svg?branch=master)](http://travis-ci.org/chef-cookbooks/firewall)\n[![Cookbook Version](https://img.shields.io/cookbook/v/firewall.svg)](https://supermarket.chef.io/cookbooks/firewall)\n\nProvides a set of primitives for managing firewalls and associated rules.\n\nPLEASE NOTE - The resource/providers in this cookbook are under heavy development. An attempt is being made to keep the resource simple/stupid by starting with less sophisticated firewall implementations first and refactor/vet the resource definition with each successive provider.\n\nRequirements\n------------\n**Chef 12.5.x+** is required. We are currently testing against Chef 13. If you need Chef 11 support, please try pinning back to a version less than 2.0, e.g.:\n```\ndepends 'firewall', '< 2.0'\n```\n\n### Supported firewalls and platforms\n* UFW - Ubuntu, Debian\n* IPTables - Red Hat & CentOS, Ubuntu\n* FirewallD - Red Hat & CentOS >= 7.0 (IPv4 only support, [needs contributions/testing](https://github.com/chef-cookbooks/firewall/issues/86))\n* Windows Advanced Firewall - 2012 R2\n\nTested on:\n* Ubuntu 14.04, 16.04 with iptables, ufw\n* Debian 7, 8 with ufw\n* CentOS 6 with iptables\n* CentOS 7.1 with firewalld\n* Windows Server 2012r2 with Windows Advanced Firewall\n\nBy default, Ubuntu chooses ufw. To switch to iptables, set this in an attribute file:\n```\ndefault['firewall']['ubuntu_iptables'] = true\n```\n\nBy default, Red Hat & CentOS >= 7.0 chooses firewalld. To switch to iptables, set this in an attribute file:\n```\ndefault['firewall']['redhat7_iptables'] = true\n```\n\n# Considerations that apply to all firewall providers and resources\n\nThis cookbook comes with two resources, firewall and firewall rule. The typical usage scenario is as follows:\n\n- run the `:install` action on the `firewall` resource named 'default', which installs appropriate packages and configures services to start on boot and starts them\n\n- run the `:create` action on every `firewall_rule` resource, which adds to the list of rules that should be configured on the firewall. `firewall_rule` then automatically sends a delayed notification to the `firewall['default']` resource to run the `:restart` action.\n\n- run the delayed notification with action `:restart` on the `firewall` resource. if any rules are different than the last run, the provider will update the current state of the firewall rules to match the expected rules.\n\nThere is a fundamental mismatch between the idea of a chef action and the action that should be taken on a firewall rule. For this reason, the chef action for a firewall_rule may be `:nothing` (the rule should not be present in the firewall) or `:create` (the rule should be present in the firewall), but the action taken on a packet in a firewall (`DROP`, `ACCEPT`, etc) is denoted as a `command` parameter on the `firewall_rule` resource.\n\n# iptables considerations\n\nIf you need to use a table other than `*filter`, the best way to do so is like so:\n```\nnode.default['firewall']['iptables']['defaults'][:ruleset] = {\n '*filter' => 1,\n ':INPUT DROP' => 2,\n ':FORWARD DROP' => 3,\n ':OUTPUT ACCEPT_FILTER' => 4,\n 'COMMIT_FILTER' => 100,\n '*nat' => 101,\n ':PREROUTING DROP' => 102,\n ':POSTROUTING DROP' => 103,\n ':OUTPUT ACCEPT_NAT' => 104,\n 'COMMIT_NAT' => 200\n}\n```\n\nNote -- in order to support multiple hash keys containing the same rule, anything found after the underscore will be stripped for: `:OUTPUT :INPUT :POSTROUTING :PREROUTING COMMIT`. This allows an example like the above to be reduced to just repeated lines of `COMMIT` and `:OUTPUT ACCEPT` while still avoiding duplication of other things.\n\nThen it's trivial to add additional rules to the `*nat` table using the raw parameter:\n```\nfirewall_rule \"postroute\" do\n raw \"-A POSTROUTING -o eth1 -p tcp -d 172.28.128.21 -j SNAT --to-source 172.28.128.6\"\n position 150\nend\n```\n\nNote that any line starting with `COMMIT` will become just `COMMIT`, as hash\nkeys must be unique but we need multiple commit lines.\n\n# Recipes\n\n### default\nThe default recipe creates a firewall resource with action install.\n\n### disable_firewall\nUsed to disable platform specific firewall. Many clouds have their own firewall configured outside of the OS instance such as AWS Security Groups.\n\n# Attributes\n\n* `default['firewall']['allow_ssh'] = false`, set true to open port 22 for SSH when the default recipe runs\n* `default['firewall']['allow_mosh'] = false`, set to true to open UDP ports 60000 - 61000 for [Mosh][0] when the default recipe runs\n* `default['firewall']['allow_winrm'] = false`, set true to open port 5989 for WinRM when the default recipe runs\n* `default['firewall']['allow_loopback'] = false`, set to true to allow all traffic on the loopback interface\n* `default['firewall']['allow_icmp'] = false`, set true to allow icmp protocol on supported OSes (note: ufw and windows implementations don't support this)\n\n* `default['firewall']['ubuntu_iptables'] = false`, set to true to use iptables on Ubuntu / Debian when using the default recipe\n* `default['firewall']['redhat7_iptables'] = false`, set to true to use iptables on Red Hat / CentOS 7 when using the default recipe\n\n* `default['firewall']['ufw']['defaults']` hash for template `/etc/default/ufw`\n* `default['firewall']['iptables']['defaults']` hash for default policies for 'filter' table's chains`\n\n* `default['firewall']['windows']['defaults']` hash to define inbound / outbound firewall policy on Windows platform\n\n* `default['firewall']['allow_established'] = true`, set to false if you don't want a related/established default rule on iptables\n* `default['firewall']['ipv6_enabled'] = true`, set to false if you don't want IPv6 related/established default rule on iptables (this enables ICMPv6, which is required for much of IPv6 communication)\n\n* `default['firewall']['firewalld']['permanent'] = false`, set to true if you want firewalld rules to be added with `--permanent` so they survive a reboot. This will be changed to `true` by default in a future major version release.\n\n# Resources\n\n### firewall\n\n***NB***: The name 'default' of this resource is important as it is used for firewall_rule providers to locate the firewall resource. If you change it, you must also supply the same value to any firewall_rule resources using the `firewall_name` parameter.\n\n#### Actions\n- `:install` (*default action*): Install and Enable the firewall. This will ensure the appropriate packages are installed and that any services have been started.\n- `:disable`: Disable the firewall. Drop any rules and put the node in an unprotected state. Flush all current rules. Also erase any internal state used to detect when rules should be applied.\n- `:flush`: Flush all current rules. Also erase any internal state used to detect when rules should be applied.\n- `:save`: Ensure all rules are added permanently under firewalld using `--permanent`. Not supported on ufw, iptables. You must notify this action at the end of the chef run if you want permanent firewalld rules (they are not persistent by default).\n\n#### Parameters\n\n- `disabled` (default to `false`): If set to true, all actions will no-op on this resource. This is a way to prevent included cookbooks from configuring a firewall.\n- `ipv6_enabled` (default to `true`): If set to false, firewall will not perform any ipv6 related work. Currently only supported in iptables.\n- `log_level`: UFW only. Level of verbosity the firewall should log at. valid values are: :low, :medium, :high, :full, :off. default is :low.\n- `rules`: This is used internally for firewall_rule resources to append their rules. You should NOT touch this value unless you plan to supply an entire firewall ruleset at once, and skip using firewall_rule resources.\n- `disabled_zone` (firewalld only): The zone to set on firewalld when the firewall should be disabled. Can be any string in symbol form, e.g. :public, :drop, etc. Defaults to `:public.`\n- `enabled_zone` (firewalld only): The zone to set on firewalld when the firewall should be enabled. Can be any string in symbol form, e.g. :public, :drop, etc. Defaults to `:drop.`\n- `package_options`: Used to pass options to the package install of firewall\n\n#### Examples\n\n```ruby\n# all defaults\nfirewall 'default'\n\n# enable platform default firewall\nfirewall 'default' do\n action :install\nend\n\n# increase logging past default of 'low'\nfirewall 'default' do\n log_level :high\n action :install\nend\n```\n\n### firewall_rule\n\n#### Actions\n- `:create` (_default action_): If a firewall_rule runs this action, the rule will be recorded in a chef resource's internal state, and applied when providers automatically notify the firewall resource with action `:reload`. The notification happens automatically.\n\n#### Parameters\n\n- `firewall_name`: the matching firewall resource that this rule applies to. Default value: `default`\n\n- `raw`: Used to pass an entire rule as a string, omitting all other parameters. This line will be directly loaded by `iptables-restore`, fed directly into `ufw` on the command line, or run using `firewall-cmd`.\n\n- `description` (_default: same as rule name_): Used to provide a comment that will be included when adding the firewall rule.\n\n- `include_comment` (_default: true_): Used to optionally exclude the comment in the rule.\n\n- `position` (_default: 50_): **relative** position to insert rule at. Position may be any integer between 0 < n < 100 (exclusive), and more than one rule may specify the same position.\n\n- `command`: What action to take on a particular packet\n\n - `:allow` (_default action_): the rule should allow matching packets\n - `:deny`: the rule should deny matching packets\n - `:reject`: the rule should reject matching packets\n - `:masqerade`: Masquerade the matching packets\n - `:redirect`: Redirect the matching packets\n - `:log`: Configure logging\n\n- `stateful`: a symbol or array of symbols, such as ``[:related, :established]` that will be passed to the state module in iptables or firewalld.\n\n- `protocol`: `:tcp` (_default_), `:udp`, `:icmp`, `:none` or protocol number. Using protocol numbers is not supported using the ufw provider (default for debian/ubuntu systems).\n\n- `direction`: For ufw, direction of the rule. valid values are: `:in` (_default_), `:out`, `:pre`, `:post`.\n\n- `source` (_Default is `0.0.0.0/0` or `Anywhere`_): source ip address or subnet to filter.\n\n- `source_port` (_Default is nil_): source port for filtering packets.\n\n- `destination`: ip address or subnet to filter on packet destination, must be a valid IP\n\n- `port` or `dest_port`: target port number (ie. 22 to allow inbound SSH), or an array of incoming port numbers (ie. [80,443] to allow inbound HTTP & HTTPS).\n\n NOTE: `protocol` attribute is required with multiple ports, or a range of incoming port numbers (ie. 60000..61000 to allow inbound mobile-shell. NOTE: `protocol`, or an attribute is required with a range of ports.\n\n- `interface`: (source) interface to apply rule (ie. `eth0`).\n\n- `dest_interface`: interface where packets may be destined to go\n\n- `redirect_port`: redirected port for rules with command `:redirect`\n\n- `logging`: may be added to enable logging for a particular rule. valid values are: `:connections`, `:packets`. In the ufw provider, `:connections` logs new connections while `:packets` logs all packets.\n\n#### Examples\n\n```ruby\n# open standard ssh port\nfirewall_rule 'ssh' do\n port 22\n command :allow\nend\n\n# open standard http port to tcp traffic only; insert as first rule\nfirewall_rule 'http' do\n port 80\n protocol :tcp\n position 1\n command :allow\nend\n\n# restrict port 13579 to 10.0.111.0/24 on eth0\nfirewall_rule 'myapplication' do\n port 13579\n source '10.0.111.0/24'\n direction :in\n interface 'eth0'\n command :allow\nend\n\n# specify a protocol number (supported on centos/redhat)\nfirewall_rule 'vrrp' do\n protocol 112\n command :allow\nend\n\n# use the iptables provider to specify protocol number on debian/ubuntu\nfirewall_rule 'vrrp' do\n provider Chef::Provider::FirewallRuleIptables\n protocol 112\n command :allow\nend\n\n# can use :raw command with UFW provider for VRRP\nfirewall_rule \"VRRP\" do\n command :allow\n raw \"allow to 224.0.0.18\"\nend\n\n# open UDP ports 60000..61000 for mobile shell (mosh.mit.edu), note\n# that the protocol attribute is required when using port_range\nfirewall_rule 'mosh' do\n protocol :udp\n port 60000..61000\n command :allow\nend\n\n# open multiple ports for http/https, note that the protocol\n# attribute is required when using ports\nfirewall_rule 'http/https' do\n protocol :tcp\n port [80, 443]\n command :allow\nend\n\nfirewall 'default' do\n enabled false\n action :nothing\nend\n```\n\n#### Providers\n\n- See `libraries/z_provider_mapping.rb` for a full list of providers for each platform and version.\n\nDifferent providers will determine the current state of the rules differently -- parsing the output of a command, maintaining the state in a file, or some other way. If the firewall is adjusted from outside of chef (non-idempotent), it's possible that chef may be caught unaware of the current state of the firewall. The best workaround is to add a `:flush` action to the firewall resource as early as possible in the chef run, if you plan to modify the firewall state outside of chef.\n\n# Troubleshooting\n\nTo figure out what the position values are for current rules, print the hash that contains the weights:\n```\nrequire pp\ndefault_firewall = resources(:firewall, 'default')\npp default_firewall.rules\n```\n\n# Development\nThis section details \"quick development\" steps. For a detailed explanation, see [[Contributing.md]].\n\n1. Clone this repository from GitHub:\n\n $ git clone git@github.com:chef-cookbooks/firewall.git\n\n2. Create a git branch\n\n $ git checkout -b my_bug_fix\n\n3. Install dependencies:\n\n $ bundle install\n\n4. Make your changes/patches/fixes, committing appropiately\n5. **Write tests**\n6. Run the tests:\n - `bundle exec foodcritic -f any .`\n - `bundle exec rspec`\n - `bundle exec rubocop`\n - `bundle exec kitchen test`\n\n In detail:\n - Foodcritic will catch any Chef-specific style errors\n - RSpec will run the unit tests\n - Rubocop will check for Ruby-specific style errors\n - Test Kitchen will run and converge the recipes\n\n\n# License & Authors\n\n- Author:: Seth Chisamore ()\n- Author:: Ronald Doorn ()\n- Author:: Martin Smith ()\n- Author:: Sander van Harmelen ()\n\n```text\nCopyright:: 2011-2015, Chef Software, Inc\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```\n\n[0]: https://mosh.mit.edu/\n","maintainer":"Chef Software, Inc.","maintainer_email":"cookbooks@chef.io","license":"Apache-2.0","platforms":{"centos":">= 0.0.0","debian":">= 0.0.0","ubuntu":">= 0.0.0","windows":">= 0.0.0"},"dependencies":{"chef-sugar":">= 0.0.0"},"recommendations":{},"suggestions":{},"conflicting":{},"providing":{},"replacing":{},"attributes":{},"groupings":{},"recipes":{},"source_url":"https://github.com/chef-cookbooks/firewall","issues_url":"https://github.com/chef-cookbooks/firewall/issues","chef_version":[[">= 12.5"]],"ohai_version":[]} \ No newline at end of file +{ + "name": "firewall", + "description": "Provides a set of primitives for managing firewalls and associated rules.", + "long_description": "", + "maintainer": "Sous Chefs", + "maintainer_email": "help@sous-chefs.org", + "license": "Apache-2.0", + "platforms": { + "amazon": ">= 0.0.0", + "centos": ">= 0.0.0", + "debian": ">= 0.0.0", + "ubuntu": ">= 0.0.0", + "windows": ">= 0.0.0" + }, + "dependencies": { + + }, + "providing": { + + }, + "recipes": { + + }, + "version": "6.2.16", + "source_url": "https://github.com/sous-chefs/firewall", + "issues_url": "https://github.com/sous-chefs/firewall/issues", + "privacy": false, + "chef_versions": [ + [ + ">= 15.5" + ] + ], + "ohai_versions": [ + + ], + "gems": [ + + ], + "eager_load_libraries": true +} diff --git a/cookbooks/firewall/metadata.rb b/cookbooks/firewall/metadata.rb new file mode 100644 index 0000000..297ffa4 --- /dev/null +++ b/cookbooks/firewall/metadata.rb @@ -0,0 +1,15 @@ +name 'firewall' +maintainer 'Sous Chefs' +maintainer_email 'help@sous-chefs.org' +license 'Apache-2.0' +description 'Provides a set of primitives for managing firewalls and associated rules.' +version '6.2.16' +source_url 'https://github.com/sous-chefs/firewall' +issues_url 'https://github.com/sous-chefs/firewall/issues' +chef_version '>= 15.5' + +supports 'amazon' +supports 'centos' +supports 'debian' +supports 'ubuntu' +supports 'windows' diff --git a/cookbooks/firewall/recipes/default.rb b/cookbooks/firewall/recipes/default.rb index e301313..f992794 100644 --- a/cookbooks/firewall/recipes/default.rb +++ b/cookbooks/firewall/recipes/default.rb @@ -2,7 +2,7 @@ # Cookbook:: firewall # Recipe:: default # -# Copyright:: 2011-2016, Chef Software, Inc. +# Copyright:: 2011-2019, Chef Software, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -17,17 +17,13 @@ # limitations under the License. # -chef_sugar_cookbook_version = Gem::Version.new(run_context.cookbook_collection['chef-sugar'].metadata.version) - -include_recipe 'chef-sugar' if chef_sugar_cookbook_version < Gem::Version.new('4.0.0') - firewall 'default' do ipv6_enabled node['firewall']['ipv6_enabled'] action :install end # create a variable to use as a condition on some rules that follow -iptables_firewall = rhel? || node['firewall']['ubuntu_iptables'] +iptables_firewall = rhel? || amazon_linux? || node['firewall']['ubuntu_iptables'] firewall_rule 'allow loopback' do interface 'lo' @@ -41,7 +37,7 @@ firewall_rule 'allow icmp' do command :allow # debian ufw doesn't allow 'icmp' protocol, but does open # icmp by default, so we skip it in default recipe - only_if { (!debian? || iptables_firewall) && node['firewall']['allow_icmp'] } + only_if { iptables_firewall && node['firewall']['allow_icmp'] } end firewall_rule 'allow world to ssh' do diff --git a/cookbooks/firewall/recipes/disable_firewall.rb b/cookbooks/firewall/recipes/disable_firewall.rb index 330953d..a9cc127 100644 --- a/cookbooks/firewall/recipes/disable_firewall.rb +++ b/cookbooks/firewall/recipes/disable_firewall.rb @@ -2,7 +2,7 @@ # Cookbook:: firewall # Recipe:: disable_firewall # -# Copyright:: 2011-2016, Chef Software, Inc. +# Copyright:: 2011-2019, Chef Software, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/cookbooks/firewall/renovate.json b/cookbooks/firewall/renovate.json new file mode 100644 index 0000000..7e7a8ba --- /dev/null +++ b/cookbooks/firewall/renovate.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["config:base"], + "packageRules": [{ + "groupName": "Actions", + "matchUpdateTypes": ["patch", "pin", "digest"], + "automerge": true, + "addLabels": ["Release: Patch", "Skip: Announcements"] + }, + { + "groupName": "Actions", + "matchUpdateTypes": ["major"], + "automerge": false, + "addLabels": ["Release: Patch", "Skip: Announcements"] + } + ] +} diff --git a/cookbooks/firewall/resources/firewalld.rb b/cookbooks/firewall/resources/firewalld.rb new file mode 100644 index 0000000..c805ea7 --- /dev/null +++ b/cookbooks/firewall/resources/firewalld.rb @@ -0,0 +1,28 @@ +unified_mode true + +provides :firewalld, + os: 'linux' + +action :install do + chef_gem 'ruby-dbus' + require 'dbus' + package 'firewalld' +end + +action :reload do + service 'firewalld' do + action :reload + end +end + +action :restart do + service 'firewalld' do + action :restart + end +end + +action :disable do + service 'firewalld' do + action [:disable, :stop] + end +end diff --git a/cookbooks/firewall/resources/firewalld_config.rb b/cookbooks/firewall/resources/firewalld_config.rb new file mode 100644 index 0000000..4860a42 --- /dev/null +++ b/cookbooks/firewall/resources/firewalld_config.rb @@ -0,0 +1,39 @@ +unified_mode true + +provides :firewalld_config, + os: 'linux' + +property :default_zone, + String, + description: 'Set default zone for connections and interfaces where no zone has been selected to zone. Setting the default zone changes the zone for the connections or interfaces, that are using the default zone.' +property :log_denied, + String, + equal_to: %w(all unicast broadcast multicast off), + description: 'Set LogDenied value to value. If LogDenied is enabled, then logging rules are added right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones.' + +load_current_value do |_new_resource| + sysbus = DBus.system_bus + firewalld_service = sysbus['org.fedoraproject.FirewallD1'] + firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1'] + interface = firewalld_object['org.fedoraproject.FirewallD1'] + + default_zone interface.getDefaultZone + log_denied interface.getLogDenied +end + +action :update do + dbus = DBus.system_bus + fw = firewalld_interface(dbus) + + converge_if_changed :default_zone do + fw.setDefaultZone new_resource.default_zone + end + + converge_if_changed :log_denied do + fw.setLogDenied new_resource.log_denied + end +end + +action_class do + include FirewallCookbook::Helpers::FirewalldDBus +end diff --git a/cookbooks/firewall/resources/firewalld_helpers.rb b/cookbooks/firewall/resources/firewalld_helpers.rb new file mode 100644 index 0000000..44fdeb9 --- /dev/null +++ b/cookbooks/firewall/resources/firewalld_helpers.rb @@ -0,0 +1,106 @@ +unified_mode true + +provides :firewalld_helper, + os: 'linux' + +property :version, + String, + default: '', + description: 'see version attribute of helper tag in firewalld.helper(5).' +property :short, + String, + name_property: true, + description: 'see short tag in firewalld.helper(5).' +property :description, + String, + description: 'see description tag in firewalld.helper(5).' +property :family, + String, + equal_to: %w(ipv4 ipv6), + default: 'ipv4', + description: 'see family tag in firewalld.helper(5).' +property :nf_module, + String, + description: 'see module tag in firewalld.helper(5).' +property :ports, + [Array, String], + default: [], + description: 'array of port and protocol pairs. See port tag in firewalld.helper(5).', + coerce: proc { |o| Array(o) } + +load_current_value do |new_resource| + dbus = DBus.system_bus + firewalld_service = dbus['org.fedoraproject.FirewallD1'] + firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config'] + fw_config = firewalld_object['org.fedoraproject.FirewallD1.config'] + if fw_config.getHelperNames.include?(new_resource.short) + helper_path = fw_config.getHelperByName(new_resource.short) + object = firewalld_service[helper_path] + config_helper = object['org.fedoraproject.FirewallD1.config.helper'] + settings = config_helper.getSettings + version settings[0] + # short settings[1] + description settings[2] + family settings[3] + nf_module settings[4] + ports settings[5] + else + Chef::Log.info "Helper #{new_resource.short} does not exist. Will be created." + end +end + +action :update do + dbus = DBus.system_bus + fw = firewalld_interface(dbus) + fw_config = config_interface(dbus) + helper_names = fw_config.getHelperNames + reload = false + if !helper_names.include?(new_resource.short) + values = [ + new_resource.version, + new_resource.short, + default_description(new_resource), + new_resource.family, + new_resource.nf_module, + new_resource.ports.map { |e| e.split('/') }, + ] + converge_by "Add Helper #{new_resource.short}" do + fw_config.addHelper(new_resource.short, values) + end + reload = true + else + helper_path = fw_config.getHelperByName(new_resource.short) + helper = helper_interface(dbus, helper_path) + converge_if_changed :version do + helper.setVersion new_resource.version + reload = true + end + converge_if_changed :description do + helper.setDescription default_description(new_resource) + reload = true + end + converge_if_changed :family do + helper.setFamily new_resource.family + reload = true + end + converge_if_changed :nf_module do + helper.setModule new_resource.nf_module + reload = true + end + converge_if_changed :ports do + helper.setPorts new_resource.ports.map { |e| e.split('/') } + reload = true + end + end + + if reload + converge_by ['reload permanent configuration of firewalld'] do + fw.reload + end + end +end + +action_class do + include FirewallCookbook::Helpers + include FirewallCookbook::Helpers::FirewalldDBus +end diff --git a/cookbooks/firewall/resources/firewalld_icmptype.rb b/cookbooks/firewall/resources/firewalld_icmptype.rb new file mode 100644 index 0000000..73f83dd --- /dev/null +++ b/cookbooks/firewall/resources/firewalld_icmptype.rb @@ -0,0 +1,88 @@ +unified_mode true + +provides :firewalld_icmptype, + os: 'linux' + +property :version, + String, + default: '', + description: 'see version attribute of icmptype tag in firewalld.icmptype(5).' +property :short, + String, + name_property: true, + description: 'see short tag in firewalld.icmptype(5).' +property :description, + String, + description: 'see description tag in firewalld.icmptype(5).' +property :destinations, + Array, + equal_to: [['ipv4'], ['ipv6'], %w(ipv4 ipv6)], + default: 'ipv4', + description: 'array, either empty or containing strings \'ipv4\' and/or \'ipv6\', see destination tag in firewalld.icmptype(5).', + coerce: proc { |o| Array(o) } + +load_current_value do |new_resource| + sysbus = DBus.system_bus + firewalld_service = sysbus['org.fedoraproject.FirewallD1'] + firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config'] + fw_config = firewalld_object['org.fedoraproject.FirewallD1.config'] + if fw_config.getIcmpTypeNames.include?(new_resource.short) + icmptype_path = fw_config.getIcmpTypeByName(new_resource.short) + object = firewalld_service[icmptype_path] + config_icmptype = object['org.fedoraproject.FirewallD1.config.icmptype'] + settings = config_icmptype.getSettings + version settings[0] + # short settings[1] + description settings[2] + destinations settings[3] + else + Chef::Log.info "IcmpType #{new_resource.short} does not exist. Will be created." + end +end + +action :update do + dbus = DBus.system_bus + fw_config = config_interface(dbus) + fw = firewalld_interface(dbus) + reload = false + icmptype_names = fw_config.getIcmpTypeNames + if !icmptype_names.include?(new_resource.short) + values = [ + new_resource.version, + new_resource.short, + default_description(new_resource), + new_resource.destinations, + ] + + converge_by "Add IcmpType #{new_resource.short}" do + fw_config.addIcmpType(new_resource.short, values) + end + reload = true + else + icmptype_path = fw_config.getIcmpTypeByName(new_resource.short) + icmptype = icmptype_interface(dbus, icmptype_path) + converge_if_changed :version do + icmptype.setVersion new_resource.version + reload = true + end + converge_if_changed :description do + icmptype.setDescription default_description(new_resource) + reload = true + end + converge_if_changed :destinations do + icmptype.setDestinations new_resource.destinations + reload = true + end + end + + if reload + converge_by ['reload permanent configuration of firewalld'] do + fw.reload + end + end +end + +action_class do + include FirewallCookbook::Helpers + include FirewallCookbook::Helpers::FirewalldDBus +end diff --git a/cookbooks/firewall/resources/firewalld_ipset.rb b/cookbooks/firewall/resources/firewalld_ipset.rb new file mode 100644 index 0000000..afea626 --- /dev/null +++ b/cookbooks/firewall/resources/firewalld_ipset.rb @@ -0,0 +1,104 @@ +unified_mode true + +provides :firewalld_ipset, + os: 'linux' + +property :version, + String, + description: 'see version attribute of ipset tag in firewalld.ipset(5).' +property :short, + String, + name_property: true, + description: 'see short tag in firewalld.ipset(5).' +property :description, + String, + description: 'see description tag in firewalld.ipset(5).' +property :type, + String, + default: 'hash:ip', + description: 'see type attribute of ipset tag in firewalld.ipset(5).', + equal_to: + %w(hash:ip hash:ip,mark hash:ip,port hash:ip,port,ip hash:ip,port,net hash:mac hash:net hash:net,iface hash:net,net hash:net,port hash:net,port,net) +property :options, + Hash, + description: 'hash of {option : value} . See options tag in firewalld.ipset(5).' +property :entries, + [Array, String], + description: 'array of entries, see entry tag in firewalld.ipset(5).', + coerce: proc { |o| Array(o) } + +load_current_value do |new_resource| + sysbus = DBus.system_bus + firewalld_service = sysbus['org.fedoraproject.FirewallD1'] + firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config'] + fw_config = firewalld_object['org.fedoraproject.FirewallD1.config'] + if fw_config.getIPSetNames.include?(new_resource.short) + ipset_path = fw_config.getIPSetByName(new_resource.short) + object = firewalld_service[ipset_path] + config_ipset = object['org.fedoraproject.FirewallD1.config.ipset'] + settings = config_ipset.getSettings + version settings[0] + # short settings[1] + description settings[2] + type settings[3] + options settings[4] + entries settings[5] + else + Chef::Log.info "Ipset #{new_resource.short} does not exist. Will be created." + end +end + +action :update do + dbus = DBus.system_bus + fw = firewalld_interface(dbus) + fw_config = config_interface(dbus) + reload = false + if !fw_config.getIPSetNames.include?(new_resource.short) + values = [ + new_resource.version || '', + new_resource.short, + default_description(new_resource), + new_resource.type, + new_resource.options || {}, + new_resource.entries, + ] + converge_by "Add ipset #{new_resource.short}" do + fw_config.addIPSet(new_resource.short, values) + end + reload = true + else + ipset_path = fw_config.getIPSetByName(new_resource.short) + ipset = ipset_interface(dbus, ipset_path) + converge_if_changed :version do + ipset.setVersion new_resource.version + reload = true + end + converge_if_changed :description do + ipset.setDescriptions default_description(new_resource) + reload = true + end + converge_if_changed :type do + ipset.setType new_resource.type + reload = true + end + converge_if_changed :options do + ipset.setOptions(new_resource.options || {}) + reload = true + end + converge_if_changed :entries do + ipset.setEntries new_resource.entries + reload = true + end + end + + if reload + converge_by ['reload permanent configuration of firewalld'] do + fw.reload + end + end +end + +action_class do + include FirewallCookbook::Helpers + include FirewallCookbook::Helpers::FirewalldDBus +end diff --git a/cookbooks/firewall/resources/firewalld_policy.rb b/cookbooks/firewall/resources/firewalld_policy.rb new file mode 100644 index 0000000..985d29c --- /dev/null +++ b/cookbooks/firewall/resources/firewalld_policy.rb @@ -0,0 +1,115 @@ +unified_mode true + +provides :firewalld_policy, + os: 'linux' + +property :description, + String, + description: 'see description tag in firewalld.policy(5).' +property :egress_zones, + [Array, String], + description: 'array of zone names. See egress-zone tag in firewalld.policy(5).', + coerce: proc { |o| Array(o) } +property :forward_ports, + [Array, String], + description: 'array of `portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]`. See forward-port tag in firewalld.policy(5).', + coerce: proc { |o| Array(o) } +property :icmp_blocks, + [Array, String], + description: 'array of icmp-blocks. See icmp-block tag in firewalld.policy(5).' +property :ingress_zones, + [Array, String], + description: 'array of zone names. See ingress-zone tag in firewalld.policy(5).', + coerce: proc { |o| Array(o) } +property :masquerade, + [true, false], + description: 'see masquerade tag in firewalld.policy(5).' +property :ports, + [Array, String], + description: 'array of port and protocol pairs. See port tag in firewalld.policy(5).', + coerce: proc { |o| Array(o) } +property :priority, + Integer, + description: 'see priority tag in firewalld.policy(5).' +property :protocols, + [Array, String], + description: 'array of protocols, see protocol tag in firewalld.policy(5).', + coerce: proc { |o| Array(o) } +property :rich_rules, + [Array, String], + description: 'array of rich-language rules. See rule tag in firewalld.policy(5).', + coerce: proc { |o| Array(o) } +property :services, + [Array, String], + description: 'array of service names, see service tag in firewalld.policy(5).', + coerce: proc { |o| Array(o) } +property :short, + String, + description: 'see short tag in firewalld.policy(5).', + name_property: true +property :source_ports, + [Array, String], + description: 'array of port and protocol pairs. See source-port tag in firewalld.policy(5).', + coerce: proc { |o| Array(o) } +property :target, + String, + description: 'see target attribute of policy tag in firewalld.policy(5).' +property :version, + String, + description: 'see version attribute of policy tag in firewalld.policy(5).' + +load_current_value do |new_resource| + sysbus = DBus.system_bus + firewalld_service = sysbus['org.fedoraproject.FirewallD1'] + firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config'] + fw_config = firewalld_object['org.fedoraproject.FirewallD1.config'] + if fw_config.getPolicyNames.include?(new_resource.short) + policy_path = fw_config.getPolicyByName(new_resource.short) + object = firewalld_service[policy_path] + config_policy = object['org.fedoraproject.FirewallD1.config.policy'] + config_policy.getSettings.each do |k, v| + send(k, v) + end + else + Chef::Log.info "Zone #{new_resource.short} does not exist. Will be created." + end +end + +action :update do + dbus = DBus.system_bus + fw = firewalld_interface(dbus) + fw_config = config_interface(dbus) + reload = false + + unless fw_config.getPolicyNames.include?(new_resource.short) + fw_config.addPolicy(new_resource.short, {}) + end + policy_path = fw_config.getPolicyByName(new_resource.short) + policy = policy_interface(dbus, policy_path) + properties = new_resource.class.state_properties.map(&:name) + properties.each do |property| + new_value = new_resource.send(property) + next if new_value.nil? + if [:ports, :source_ports].include?(property) + new_value = DBus.variant('a(ss)', new_value.map { |e| e.split('/') }) + elsif [:forward_ports].include?(property) + new_value = forward_ports_to_dbus(new_resource) + elsif [:priority].include?(property) + new_value = DBus.variant('i', new_value) + end + converge_if_changed property do + policy.update({ property.to_s => new_value }) + reload = true + end + end + + if reload + converge_by ['reload permanent configuration of firewalld'] do + fw.reload + end + end +end + +action_class do + include FirewallCookbook::Helpers::FirewalldDBus +end diff --git a/cookbooks/firewall/resources/firewalld_service.rb b/cookbooks/firewall/resources/firewalld_service.rb new file mode 100644 index 0000000..4479125 --- /dev/null +++ b/cookbooks/firewall/resources/firewalld_service.rb @@ -0,0 +1,98 @@ +unified_mode true + +provides :firewalld_service, + os: 'linux' + +property :version, + String, + description: 'see version attribute of service tag in firewalld.service(5).' +property :short, + String, + name_property: true, + description: 'see short tag in firewalld.service(5).' +property :description, + String, + description: 'see description tag in firewalld.service(5).' +property :ports, + [Array, String], + description: 'array of port and protocol pairs. See port tag in firewalld.service(5).', + coerce: proc { |o| Array(o) } +property :module_names, + [Array, String], + description: 'array of kernel netfilter helpers, see module tag in firewalld.service(5).', + coerce: proc { |o| Array(o) } +property :destination, + Hash, + description: 'hash of {IP family : IP address} where \'IP family\' key can be either \'ipv4\' or \'ipv6\'. See destination tag in firewalld.service(5).' +property :protocols, + [Array, String], + description: 'array of protocols, see protocol tag in firewalld.service(5).', + coerce: proc { |o| Array(o) } +property :source_ports, + [Array, String], + description: 'array of port and protocol pairs. See source-port tag in firewalld.service(5).', + coerce: proc { |o| Array(o) } +property :includes, + [Array, String], + description: 'array of service includes, see include tag in firewalld.service(5).', + coerce: proc { |o| Array(o) } +property :helpers, + [Array, String], + description: 'array of service helpers, see helper tag in firewalld.service(5).', + coerce: proc { |o| Array(o) } + +load_current_value do |new_resource| + sysbus = DBus.system_bus + firewalld_service = sysbus['org.fedoraproject.FirewallD1'] + firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config'] + fw_config = firewalld_object['org.fedoraproject.FirewallD1.config'] + if fw_config.getServiceNames.include?(new_resource.short) + service_path = fw_config.getServiceByName(new_resource.short) + object = firewalld_service[service_path] + config_service = object['org.fedoraproject.FirewallD1.config.service'] + config_service.getSettings2.each do |k, v| + send(k, v) + end + else + Chef::Log.info "Service #{new_resource.short} does not exist. Will be created." + end +end + +action :update do + dbus = DBus.system_bus + fw = firewalld_interface(dbus) + fw_config = config_interface(dbus) + reload = false + unless fw_config.getServiceNames.include?(new_resource.short) + fw_config.addService2(new_resource.short, {}) + end + + service_path = fw_config.getServiceByName(new_resource.short) + service = service_interface(dbus, service_path) + properties = new_resource.class.state_properties.map(&:name) + properties.each do |property| + new_value = new_resource.send(property) + next unless new_value + if [:ports, :source_ports].include?(property) + new_value = DBus.variant('a(ss)', new_value.map { |e| e.split('/') }) + elsif property == :description + new_value = default_description(new_resource) + end + converge_if_changed property do + key = property == :short ? 'name' : property.to_s + service.update2({ key => new_value }) + reload = true + end + end + + if reload + converge_by ['reload permanent configuration of firewalld'] do + fw.reload + end + end +end + +action_class do + include FirewallCookbook::Helpers + include FirewallCookbook::Helpers::FirewalldDBus +end diff --git a/cookbooks/firewall/resources/firewalld_zone.rb b/cookbooks/firewall/resources/firewalld_zone.rb new file mode 100644 index 0000000..d484172 --- /dev/null +++ b/cookbooks/firewall/resources/firewalld_zone.rb @@ -0,0 +1,118 @@ +unified_mode true + +provides :firewalld_zone, + os: 'linux' + +property :description, + String, + description: 'see description tag in firewalld.zone(5).' +property :forward, + [true, false], + description: 'see forward tag in firewalld.zone(5).' +property :forward_ports, + [Array, String], + description: 'array of (port, protocol, to-port, to-addr). See forward-port tag in firewalld.zone(5).', + coerce: proc { |o| Array(o) } +property :icmp_block_inversion, + [true, false], + description: 'see icmp-block-inversion tag in firewalld.zone(5).' +property :icmp_blocks, + [Array, String], + description: 'array of icmp-blocks. See icmp-block tag in firewalld.zone(5).', + coerce: proc { |o| Array(o) } +property :interfaces, + [Array, String], + description: 'array of interfaces. See interface tag in firewalld.zone(5).', + coerce: proc { |o| Array(o) } +property :masquerade, + [true, false], + description: 'see masquerade tag in firewalld.zone(5).' +property :ports, + [Array, String], + description: 'array of port and protocol pairs. See port tag in firewalld.zone(5).', + coerce: proc { |o| Array(o) } +property :protocols, + [Array, String], + description: 'array of protocols, see protocol tag in firewalld.zone(5).', + coerce: proc { |o| Array(o) } +property :rules_str, + [Array, String], + description: 'array of rich-language rules. See rule tag in firewalld.zone(5).', + coerce: proc { |o| Array(o) } +property :services, + [Array, String], + description: 'array of service names, see service tag in firewalld.zone(5).', + coerce: proc { |o| Array(o) } +property :short, + String, + name_property: true, + description: 'see short tag in firewalld.zone(5).' +property :source_ports, + [Array, String], + description: 'array of port and protocol pairs. See source-port tag in firewalld.zone(5).', + coerce: proc { |o| Array(o) } +property :sources, + [Array, String], + description: 'array of source addresses. See source tag in firewalld.zone(5).', + coerce: proc { |o| Array(o) } +property :target, + String, + description: 'see target attribute of zone tag in firewalld.zone(5).' +property :version, + String, + description: 'see version attribute of zone tag in firewalld.zone(5).' + +load_current_value do |new_resource| + sysbus = DBus.system_bus + firewalld_service = sysbus['org.fedoraproject.FirewallD1'] + firewalld_object = firewalld_service['/org/fedoraproject/FirewallD1/config'] + fw_config = firewalld_object['org.fedoraproject.FirewallD1.config'] + if fw_config.getZoneNames.include?(new_resource.short) + zone_path = fw_config.getZoneByName(new_resource.short) + object = firewalld_service[zone_path] + config_zone = object['org.fedoraproject.FirewallD1.config.zone'] + config_zone.getSettings2.each do |k, v| + send(k, v) + end + else + Chef::Log.info "Zone #{new_resource.short} does not exist. Will be created." + end +end + +action :update do + dbus = DBus.system_bus + fw = firewalld_interface(dbus) + fw_config = config_interface(dbus) + + unless fw_config.getZoneNames.include?(new_resource.short) + fw_config.addZone2(new_resource.short, {}) + end + zone_path = fw_config.getZoneByName(new_resource.short) + zone = zone_interface(dbus, zone_path) + + reload = false + properties = new_resource.class.state_properties.map(&:name) + properties.each do |property| + new_value = new_resource.send(property) + next unless new_value + if [:ports, :source_ports].include?(property) + new_value = DBus.variant('a(ss)', new_value.map { |e| e.split('/') }) + elsif [:forward_ports].include?(property) + new_value = forward_ports_to_dbus(new_resource) + end + converge_if_changed property do + zone.update2({ property.to_s => new_value }) + reload = true + end + end + + if reload + converge_by ['reload permanent configuration of firewalld'] do + fw.reload + end + end +end + +action_class do + include FirewallCookbook::Helpers::FirewalldDBus +end diff --git a/cookbooks/firewall/resources/nftables.rb b/cookbooks/firewall/resources/nftables.rb new file mode 100644 index 0000000..7ddb3a2 --- /dev/null +++ b/cookbooks/firewall/resources/nftables.rb @@ -0,0 +1,71 @@ +unified_mode true + +include FirewallCookbook::Helpers +include FirewallCookbook::Helpers::Nftables + +provides :nftables, + os: 'linux' + +property :rules, + Hash, + default: {} +property :input_policy, + String, + equal_to: %w(drop accept), + default: 'accept' +property :output_policy, + String, + equal_to: %w(drop accept), + default: 'accept' +property :forward_policy, + String, + equal_to: %w(drop accept), + default: 'accept' +property :table_ip_nat, + [true, false], + default: false +property :table_ip6_nat, + [true, false], + default: false +property :nftables_conf_path, String, + description: 'nftables.conf filepath', + default: lazy { default_nftables_conf_path } + +action :install do + package 'nftables' do + action :install + notifies :rebuild, "nftables[#{new_resource.name}]" + end +end + +action :rebuild do + ensure_default_rules_exist(new_resource) + + file new_resource.nftables_conf_path do + content <<~NFT + #!/usr/sbin/nft -f + flush ruleset + #{build_rule_file(new_resource.rules)} + NFT + mode '0750' + owner 'root' + group 'root' + notifies :restart, 'service[nftables]' + end + + service 'nftables' do + action [:enable, :start] + end +end + +action :restart do + service 'nftables' do + action :restart + end +end + +action :disable do + service 'nftables' do + action [:disable, :stop] + end +end diff --git a/cookbooks/firewall/resources/nftables_rule.rb b/cookbooks/firewall/resources/nftables_rule.rb new file mode 100644 index 0000000..89c12a8 --- /dev/null +++ b/cookbooks/firewall/resources/nftables_rule.rb @@ -0,0 +1,113 @@ +unified_mode true + +require 'ipaddr' + +action_class do + include FirewallCookbook::Helpers + include FirewallCookbook::Helpers::Nftables + + def return_early?(new_resource) + !new_resource.notify_firewall || + !(new_resource.action.include?(:create) && + !new_resource.should_skip?(:create)) + end +end + +provides :nftables_rule +default_action :create + +property :firewall_name, + String, + default: 'default' +property :command, + [Array, Symbol], + default: :accept +property :protocol, + [Integer, Symbol], + default: :tcp, + callbacks: { + 'must be either :tcp, :udp, :icmp, :\'ipv6-icmp\', :icmpv6, :none, or a valid IP protocol number' => lambda do |p| + %i(udp tcp icmp icmpv6 ipv6-icmp esp ah ipv6 none).include?(p) || (0..142).include?(p) + end, + } +property :direction, + Symbol, + equal_to: [:in, :out, :pre, :post, :forward], + default: :in +# nftables handles ip6 and ip simultaneously. Except for directions +# :pre and :post, where where either :ip6 or :ip must be specified. +# callback should prevent from mixing that up. +property :family, + Symbol, + equal_to: [:ip6, :ip], + default: :ip +property :source, + [String, Array], + callbacks: { + 'must be a valid ip address' => lambda do |ips| + Array(ips).inject(false) do |a, ip| + a || !!IPAddr.new(ip) + end + end, + } +property :sport, + [Integer, String, Array, Range] +property :interface, + String + +property :dport, + [Integer, String, Array, Range] +property :destination, + [String, Array], + callbacks: { + 'must be a valid ip address' => lambda do |ips| + Array(ips).inject(false) do |a, ip| + a || !!IPAddr.new(ip) + end + end, + } +property :outerface, + String + +property :position, + Integer, + default: 50 +property :stateful, + [Symbol, Array] +property :redirect_port, + Integer +property :description, + String, + name_property: true +property :include_comment, + [true, false], + default: true +property :log_prefix, + String +property :log_group, + Integer +# for when you just want to pass a raw rule +property :raw, + String + +# do you want this rule to notify the firewall to recalculate +# (and potentially reapply) the firewall_rule(s) it finds? +property :notify_firewall, + [true, false], + default: true + +action :create do + return if return_early?(new_resource) + fwr = build_firewall_rule(new_resource) + + with_run_context :root do + edit_resource!('nftables', new_resource.firewall_name) do |fw_rule| + r = rules.dup || {} + r.merge!({ + fwr => fw_rule.position, + }) + rules(r) + delayed_action :rebuild + end + end +end diff --git a/cookbooks/mingw/.markdownlint-cli2.yaml b/cookbooks/mingw/.markdownlint-cli2.yaml new file mode 100644 index 0000000..dffb96a --- /dev/null +++ b/cookbooks/mingw/.markdownlint-cli2.yaml @@ -0,0 +1,4 @@ +config: + ul-indent: false # MD007 + line-length: false # MD013 + no-duplicate-heading/no-duplicate-header: false # MD024 diff --git a/cookbooks/mingw/CHANGELOG.md b/cookbooks/mingw/CHANGELOG.md new file mode 100644 index 0000000..cc69c82 --- /dev/null +++ b/cookbooks/mingw/CHANGELOG.md @@ -0,0 +1,83 @@ +# mingw Cookbook CHANGELOG + +This file is used to list changes made in each version of the mingw cookbook. + +## 2.1.7 - *2023-06-01* + +## 2.1.6 - *2023-04-01* + +## 2.1.5 - *2023-03-03* + +## 2.1.4 - *2022-02-08* + +- Remove delivery folder + +## 2.1.3 - *2021-08-31* + +- Standardise files with files in sous-chefs/repo-management + +## 2.1.1 (2020-06-02) + +- Resolve cookstyle 5.8 warnings - [@tas50](https://github.com/tas50) +- Require Chef 12.15+ - [@tas50](https://github.com/tas50) +- Fix compatibility with Chef Infra Client 16 - [@xorimabot](https://github.com/xorimabot) + - resolved cookstyle error: resources/get.rb:26:1 warning: `ChefDeprecations/ResourceUsesOnlyResourceName` + - resolved cookstyle error: resources/msys2_package.rb:31:1 warning: `ChefDeprecations/ResourceUsesOnlyResourceName` + - resolved cookstyle error: resources/tdm_gcc.rb:26:1 warning: `ChefDeprecations/ResourceUsesOnlyResourceName` + +## 2.1.0 (2018-07-24) + +- refactor msys2 package source and checksum to attributes + +## 2.0.2 (2018-02-15) + +- Remove kind_of usage in the custom resources (FC117) + +## 2.0.1 (2017-04-26) + +- Test with Local Delivery instead of Rake +- Add chef_version to the metadata +- Use standardize Apache 2 license string + +## 2.0.0 (2017-02-27) + +- Require Chef 12.5 and remove compat_resource dependency + +## 1.2.5 (2017-01-18) + +- Require a working compat_resource + +## v1.2.4 (2016-07-26) + +- New msys2 shells do not inherit PATH from windows. Provide a way for + clients to do this. + +## v1.2.3 (2016-07-25) + +- If PKG_CONFIG_PATH is already defined, honor it in the msys2 shell. + +## v1.2.2 (2016-06-24) + +- Download msys2 from the primary download url (instead of a specific mirror). + +## v1.2.1 (2016-06-23) + +- Fix msys2 initial install/upgrade steps that dependended on file modification time. +- Make msys2_package :install idempotent - it should not reinstall packages. +- Do not allow bash.exe to be called if MSYSTEM is undefined. + +## v1.2.0 (2016-06-03) + +- Updating to fix the issue where msys2 bash does not inherit the cwd correctly + +## v1.1.0 (2016-06-03) + +- Add msys2 based compiler support using the new msys2_package resource + +## v1.0.0 (2016-05-11) + +- Remove unnecessary default_action from the resources +- Depend on compat_resource cookbook to add Chef 12.1 - 12.4 compatbility +- Add this changelog file +- Fix license metadata in metadata.rb +- Disable FC016 check diff --git a/cookbooks/mingw/LICENSE b/cookbooks/mingw/LICENSE new file mode 100644 index 0000000..8f71f43 --- /dev/null +++ b/cookbooks/mingw/LICENSE @@ -0,0 +1,202 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "{}" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright {yyyy} {name of copyright owner} + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + diff --git a/cookbooks/mingw/README.md b/cookbooks/mingw/README.md new file mode 100644 index 0000000..ec3c241 --- /dev/null +++ b/cookbooks/mingw/README.md @@ -0,0 +1,68 @@ +# mingw Cookbook + +[![Cookbook Version](http://img.shields.io/cookbook/v/mingw.svg)][cookbook] [![Build Status](http://img.shields.io/travis/chef-cookbooks/mingw.svg?branch=master)][travis] + +Installs a mingw/msys based compiler tools chain on windows. This is required for compiling C software from source. + +## Requirements + +### Platforms + +- Windows + +### Chef + +- Chef 12.15+ + +### Cookbooks + +- seven_zip + +## Usage + +Add this cookbook as a dependency to your cookbook in its `metadata.rb` and include the default recipe in one of your recipes. + +```ruby +# metadata.rb +depends 'mingw' +``` + +```ruby +# your recipe.rb +include_recipe 'mingw::default' +``` + +Use the `msys2_package` resource in any recipe to fetch msys2 based packages. Use the `mingw_get` resource in any recipe to fetch mingw packages. Use the `mingw_tdm_gcc` resource to fetch a version of the TDM GCC compiler. + +By default, you should prefer the msys2 packages as they are newer and better supported. C/C++ compilers on windows use various different exception formats and you need to pick the right one for your task. In the 32-bit world, you have SJLJ (set-jump/long-jump) based exception handling and DWARF-2 (shortened to DW2) based exception handling. SJLJ produces code that can happily throw exceptions across stack frames of code compiled by MSVC. DW2 involves more extensive metadata but produces code that cannot unwind MSVC generated stack-frames - hence you need to ensure that you don't have any code that throws across a "system call". Certain languages and runtimes have specific requirements as to the exception format supported. As an example, if you are building code for Rust, you will probably need a modern gcc from msys2 with DW2 support as that's what the panic/exception formatter in Rust depends on. In a 64-bit world, you may still use SJLJ but compilers all commonly support SEH (structured exception handling). + +Of course, to further complicate matters, different versions of different compilers support different exception handling. The default compilers that come with mingw_get are 32-bit only compilers and support DW2\. The TDM compilers come in 3 flavors: a 32-bit only version with SJLJ support, a 32-bit only version with DW2 support and a "multilib" compiler which supports only SJLJ in 32-bit mode but can produce 64-bit SEH code. The standard library support varies drastically between these various compiler flavors (even within the same version). In msys2, you can install a mingw-w64 based compilers for either 32-bit DW2 support or 64-bit SEH support. If all this hurts your brain, I can only apologize. + +## Resources + +- [minw_get](./documentation/mingw_get.md) +- [mingw_tdm_gcc](./documentation/mingw_tdm_gcc.md) +- [msys2_package](./documentation/msys2_package.md) + +## License & Authors + +**Author:** Cookbook Engineering Team ([cookbooks@chef.io](mailto:cookbooks@chef.io)) + +**Copyright:** 2009-2016, Chef Software, Inc. + +```text +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +``` + +[cookbook]: https://supermarket.chef.io/cookbooks/mingw +[travis]: http://travis-ci.org/chef-cookbooks/mingw diff --git a/cookbooks/mingw/attributes/default.rb b/cookbooks/mingw/attributes/default.rb new file mode 100644 index 0000000..9176ec3 --- /dev/null +++ b/cookbooks/mingw/attributes/default.rb @@ -0,0 +1,3 @@ +# override these attributes to pull the msys2 package from a custom url +default['msys2']['url'] = 'http://downloads.sourceforge.net/project/msys2/Base/x86_64/msys2-base-x86_64-20160205.tar.xz' +default['msys2']['checksum'] = '7e97e2af042e1b6f62cf0298fe84839014ef3d4a3e7825cffc6931c66cc0fc20' diff --git a/cookbooks/mingw/chefignore b/cookbooks/mingw/chefignore new file mode 100644 index 0000000..cc170ea --- /dev/null +++ b/cookbooks/mingw/chefignore @@ -0,0 +1,115 @@ +# Put files/directories that should be ignored in this file when uploading +# to a Chef Infra Server or Supermarket. +# Lines that start with '# ' are comments. + +# OS generated files # +###################### +.DS_Store +ehthumbs.db +Icon? +nohup.out +Thumbs.db +.envrc + +# EDITORS # +########### +.#* +.project +.settings +*_flymake +*_flymake.* +*.bak +*.sw[a-z] +*.tmproj +*~ +\#* +REVISION +TAGS* +tmtags +.vscode +.editorconfig + +## COMPILED ## +############## +*.class +*.com +*.dll +*.exe +*.o +*.pyc +*.so +*/rdoc/ +a.out +mkmf.log + +# Testing # +########### +.circleci/* +.codeclimate.yml +.delivery/* +.foodcritic +.kitchen* +.mdlrc +.overcommit.yml +.rspec +.rubocop.yml +.travis.yml +.watchr +.yamllint +azure-pipelines.yml +Dangerfile +examples/* +features/* +Guardfile +kitchen.yml* +mlc_config.json +Procfile +Rakefile +spec/* +test/* + +# SCM # +####### +.git +.gitattributes +.gitconfig +.github/* +.gitignore +.gitkeep +.gitmodules +.svn +*/.bzr/* +*/.git +*/.hg/* +*/.svn/* + +# Berkshelf # +############# +Berksfile +Berksfile.lock +cookbooks/* +tmp + +# Bundler # +########### +vendor/* +Gemfile +Gemfile.lock + +# Policyfile # +############## +Policyfile.rb +Policyfile.lock.json + +# Documentation # +############# +CODE_OF_CONDUCT* +CONTRIBUTING* +documentation/* +TESTING* +UPGRADING* + +# Vagrant # +########### +.vagrant +Vagrantfile diff --git a/cookbooks/mingw/files/default/bash.bat b/cookbooks/mingw/files/default/bash.bat new file mode 100644 index 0000000..97a7f99 --- /dev/null +++ b/cookbooks/mingw/files/default/bash.bat @@ -0,0 +1,17 @@ +@echo off +set HOME=/home/%USERNAME% + +IF "%MSYSTEM%"=="" ( + echo MSYSTEM is NOT defined + exit +) + +rem Ask MSYS to initialize with a minimal path by default. +rem This will put only the windows system paths into the msys path. +set MSYS2_PATH_TYPE=minimal + +rem See /etc/profile - it should invoke post-install step 05-home-dir.post +rem which uses this environment variable to change directories. +set CHERE_INVOKING=1 + +%~dp0..\usr\bin\bash.exe -l %* diff --git a/cookbooks/mingw/files/default/custom-upgrade.sh b/cookbooks/mingw/files/default/custom-upgrade.sh new file mode 100644 index 0000000..db729eb --- /dev/null +++ b/cookbooks/mingw/files/default/custom-upgrade.sh @@ -0,0 +1,23 @@ +declare -r CRITICAL_PACKAGES="bash pacman msys2-runtime" +declare -r OPTIONAL_PACKAGES="msys2-runtime-devel" + +# set pacman command if not already defined +PACMAN=${PACMAN:-pacman} +# save full path to command as PATH may change when sourcing /etc/profile +PACMAN_PATH=$(type -P $PACMAN) + +run_pacman() { + local cmd + cmd=("$PACMAN_PATH" "$@") + "${cmd[@]}" +} + +if ! run_pacman -Sy; then + exit 1 +fi + +run_pacman -Qu ${CRITICAL_PACKAGES} + +if ! run_pacman -S --noconfirm --needed ${CRITICAL_PACKAGES} ${OPTIONAL_PACKAGES}; then + exit 1 +fi diff --git a/cookbooks/mingw/files/default/custom_prefix.sh b/cookbooks/mingw/files/default/custom_prefix.sh new file mode 100644 index 0000000..85a1e2e --- /dev/null +++ b/cookbooks/mingw/files/default/custom_prefix.sh @@ -0,0 +1,13 @@ +# Prepend values from the parent environment to msys2 environment variables. + +export PKG_CONFIG_PATH="${PREMSYS2_PKG_CONFIG_PATH:+${PREMSYS2_PKG_CONFIG_PATH}:}${PKG_CONFIG_PATH}" + +# Instead of placing our entire windows path into msys2, we can selectively +# prepend just the important parts that we need. This also ensures that +# we don't accidentally add other unnecessary chef or git msys2 library +# files in the path. +export PATH="${PREMSYS2_PATH:+${PREMSYS2_PATH}:}${PATH}" + +# TODO: If there are other variabled we want to control like MANPATH or ACLOCALPATH, +# add those here. + diff --git a/cookbooks/mingw/files/default/pthread.h b/cookbooks/mingw/files/default/pthread.h new file mode 100644 index 0000000..ac8fb37 --- /dev/null +++ b/cookbooks/mingw/files/default/pthread.h @@ -0,0 +1,719 @@ +/* + Copyright (c) 2011-2013 mingw-w64 project + + Permission is hereby granted, free of charge, to any person obtaining a + copy of this software and associated documentation files (the "Software"), + to deal in the Software without restriction, including without limitation + the rights to use, copy, modify, merge, publish, distribute, sublicense, + and/or sell copies of the Software, and to permit persons to whom the + Software is furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. +*/ + +/* + * Parts of this library are derived by: + * + * Posix Threads library for Microsoft Windows + * + * Use at own risk, there is no implied warranty to this code. + * It uses undocumented features of Microsoft Windows that can change + * at any time in the future. + * + * (C) 2010 Lockless Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without modification, + * are permitted provided that the following conditions are met: + * + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * * Neither the name of Lockless Inc. nor the names of its contributors may be + * used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AN + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE + * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + */ +#ifndef WIN_PTHREADS_H +#define WIN_PTHREADS_H + +#include +#include +#include + +#include +#include +#include + +#include + +#include "pthread_compat.h" + +#ifdef __cplusplus +extern "C" { +#endif + +#define __WINPTHREADS_VERSION_MAJOR 0 +#define __WINPTHREADS_VERSION_MINOR 5 +#define __WINPTHREADS_VERSION_PATCHLEVEL 0 + +/* MSB 8-bit major version, 8-bit minor version, 16-bit patch level. */ +#define __WINPTHREADS_VERSION 0x00050000 + +#if defined DLL_EXPORT && !defined WINPTHREAD_STATIC +#ifdef IN_WINPTHREAD +#define WINPTHREAD_API __declspec(dllexport) +#else +#define WINPTHREAD_API __declspec(dllimport) +#endif +#else +#define WINPTHREAD_API +#endif + +/* #define WINPTHREAD_DBG 1 */ + +/* Compatibility stuff: */ +#define RWLS_PER_THREAD 8 + +/* Error-codes. */ +#ifndef ETIMEDOUT +#define ETIMEDOUT 138 +#endif +#ifndef ENOTSUP +#define ENOTSUP 129 +#endif +#ifndef EWOULDBLOCK +#define EWOULDBLOCK 140 +#endif + +/* pthread specific defines. */ + +#define PTHREAD_CANCEL_DISABLE 0 +#define PTHREAD_CANCEL_ENABLE 0x01 + +#define PTHREAD_CANCEL_DEFERRED 0 +#define PTHREAD_CANCEL_ASYNCHRONOUS 0x02 + +#define PTHREAD_CREATE_JOINABLE 0 +#define PTHREAD_CREATE_DETACHED 0x04 + +#define PTHREAD_EXPLICIT_SCHED 0 +#define PTHREAD_INHERIT_SCHED 0x08 + +#define PTHREAD_SCOPE_PROCESS 0 +#define PTHREAD_SCOPE_SYSTEM 0x10 + +#define PTHREAD_DEFAULT_ATTR (PTHREAD_CANCEL_ENABLE) + +#define PTHREAD_CANCELED ((void *) (intptr_t) 0xDEADBEEF) + +#define _PTHREAD_NULL_THREAD ((pthread_t) 0) + +#define PTHREAD_ONCE_INIT 0 + +#define PTHREAD_DESTRUCTOR_ITERATIONS 256 +#define PTHREAD_KEYS_MAX (1<<20) + +#define PTHREAD_MUTEX_NORMAL 0 +#define PTHREAD_MUTEX_ERRORCHECK 1 +#define PTHREAD_MUTEX_RECURSIVE 2 +#define PTHREAD_MUTEX_DEFAULT PTHREAD_MUTEX_NORMAL + +#define PTHREAD_MUTEX_SHARED 1 +#define PTHREAD_MUTEX_PRIVATE 0 + +#define PTHREAD_PRIO_NONE 0 +#define PTHREAD_PRIO_INHERIT 8 +#define PTHREAD_PRIO_PROTECT 16 +#define PTHREAD_PRIO_MULT 32 +#define PTHREAD_PROCESS_SHARED 1 +#define PTHREAD_PROCESS_PRIVATE 0 + +#define PTHREAD_MUTEX_FAST_NP PTHREAD_MUTEX_NORMAL +#define PTHREAD_MUTEX_TIMED_NP PTHREAD_MUTEX_FAST_NP +#define PTHREAD_MUTEX_ADAPTIVE_NP PTHREAD_MUTEX_FAST_NP +#define PTHREAD_MUTEX_ERRORCHECK_NP PTHREAD_MUTEX_ERRORCHECK +#define PTHREAD_MUTEX_RECURSIVE_NP PTHREAD_MUTEX_RECURSIVE + +void * WINPTHREAD_API pthread_timechange_handler_np(void * dummy); +/* int WINPTHREAD_API pthread_delay_np (const struct timespec *interval); */ +int WINPTHREAD_API pthread_num_processors_np(void); +int WINPTHREAD_API pthread_set_num_processors_np(int n); + +#define PTHREAD_BARRIER_SERIAL_THREAD 1 + +/* maximum number of times a read lock may be obtained */ +#define MAX_READ_LOCKS (INT_MAX - 1) + +/* No fork() in windows - so ignore this */ +#define pthread_atfork(F1,F2,F3) 0 + +/* unsupported stuff: */ +#define pthread_mutex_getprioceiling(M, P) ENOTSUP +#define pthread_mutex_setprioceiling(M, P) ENOTSUP +#define pthread_getcpuclockid(T, C) ENOTSUP +#define pthread_attr_getguardsize(A, S) ENOTSUP +#define pthread_attr_setgaurdsize(A, S) ENOTSUP + +typedef long pthread_once_t; +typedef unsigned pthread_mutexattr_t; +typedef unsigned pthread_key_t; +typedef void *pthread_barrierattr_t; +typedef int pthread_condattr_t; +typedef int pthread_rwlockattr_t; + +/* +struct _pthread_v; + +typedef struct pthread_t { + struct _pthread_v *p; + int x; +} pthread_t; +*/ + +typedef uintptr_t pthread_t; + +typedef struct _pthread_cleanup _pthread_cleanup; +struct _pthread_cleanup +{ + void (*func)(void *); + void *arg; + _pthread_cleanup *next; +}; + +#define pthread_cleanup_push(F, A)\ +{\ + const _pthread_cleanup _pthread_cup = {(F), (A), *pthread_getclean()};\ + __sync_synchronize();\ + *pthread_getclean() = (_pthread_cleanup *) &_pthread_cup;\ + __sync_synchronize() + +/* Note that if async cancelling is used, then there is a race here */ +#define pthread_cleanup_pop(E)\ + (*pthread_getclean() = _pthread_cup.next, (E?_pthread_cup.func((pthread_once_t *)_pthread_cup.arg):0));} + +/* ------------------------------------------------------------------- + * CHEF PATCHES + * + * PREVENT REDECLERATION OF timespec + * + * The original header here assumed that struct timespec was not + * available on windows under mingw. So it redeclared timespec itself. + * + * This currently generates and error. With recent binutils, timespec + * is declared in time.h but in a slightly different manner from the + * traditional posix definition (it involves unions) to account for + * MSVC related issues. + * + * They need to go through a lot of hoops to declare the exact size + * and layout of timespec because MSVC uses a slightly more loltastic + * definition of time_t than everyone else in the universe. + * Traditionally, time_t was an integral quantity that represents the + * number of seconds since the unix epoch and it's 32-bits wide. + * This leads to the Y2038 problem where the timestamp will overflow. + * MSVC "solves" this by changing the definition of time_t to 64-bit + * on 64-bit platforms which wreaks havoc on a large number of + * structs that need to deal with the new layout (including timespec). + * Thankfully, we are using a compiler that sticks to the older + * definition of time_t - so as long as we don't attempt to link it + * to any MSVC generated libraries, we should be ok. The winpthreads + * compatibility layer that ships with TDM GCC was patched and + * compiled under these assumptions. + * + * Since we are assuming that we aren't going to generally be mixing + * MSVC generated and mingw generated dlls and TDM GCC provides us with + * good old-fashioned system libraries and dlls, we can simply delete + * the declaration of timespec here and use parts/time.h from mingwrt + * instead. + */ + +#define __need_time_t +#define __need_struct_timespec +#define _FAKE_TIME_H_SOURCED 1 +#include + +/* END OF CHEF PATCHES + * ------------------------------------------------------------------- + */ + +#ifndef SCHED_OTHER +/* Some POSIX realtime extensions, mostly stubbed */ +#define SCHED_OTHER 0 +#define SCHED_FIFO 1 +#define SCHED_RR 2 +#define SCHED_MIN SCHED_OTHER +#define SCHED_MAX SCHED_RR + +struct sched_param { + int sched_priority; +}; + +int WINPTHREAD_API sched_yield(void); +int WINPTHREAD_API sched_get_priority_min(int pol); +int WINPTHREAD_API sched_get_priority_max(int pol); +int WINPTHREAD_API sched_getscheduler(pid_t pid); +int WINPTHREAD_API sched_setscheduler(pid_t pid, int pol, const struct sched_param *param); + +#endif + +typedef struct pthread_attr_t pthread_attr_t; +struct pthread_attr_t +{ + unsigned p_state; + void *stack; + size_t s_size; + struct sched_param param; +}; + +int WINPTHREAD_API pthread_attr_setschedparam(pthread_attr_t *attr, const struct sched_param *param); +int WINPTHREAD_API pthread_attr_getschedparam(const pthread_attr_t *attr, struct sched_param *param); +int WINPTHREAD_API pthread_getschedparam(pthread_t thread, int *pol, struct sched_param *param); +int WINPTHREAD_API pthread_setschedparam(pthread_t thread, int pol, const struct sched_param *param); +int WINPTHREAD_API pthread_attr_setschedpolicy (pthread_attr_t *attr, int pol); +int WINPTHREAD_API pthread_attr_getschedpolicy (pthread_attr_t *attr, int *pol); + +/* synchronization objects */ +typedef void *pthread_spinlock_t; +typedef void *pthread_mutex_t; +typedef void *pthread_cond_t; +typedef void *pthread_rwlock_t; +typedef void *pthread_barrier_t; + +#define PTHREAD_MUTEX_NORMAL 0 +#define PTHREAD_MUTEX_ERRORCHECK 1 +#define PTHREAD_MUTEX_RECURSIVE 2 + +#define GENERIC_INITIALIZER ((void *) (size_t) -1) +#define GENERIC_ERRORCHECK_INITIALIZER ((void *) (size_t) -2) +#define GENERIC_RECURSIVE_INITIALIZER ((void *) (size_t) -3) +#define GENERIC_NORMAL_INITIALIZER ((void *) (size_t) -1) +#define PTHREAD_MUTEX_INITIALIZER (pthread_mutex_t)GENERIC_INITIALIZER +#define PTHREAD_RECURSIVE_MUTEX_INITIALIZER (pthread_mutex_t)GENERIC_RECURSIVE_INITIALIZER +#define PTHREAD_ERRORCHECK_MUTEX_INITIALIZER (pthread_mutex_t)GENERIC_ERRORCHECK_INITIALIZER +#define PTHREAD_NORMAL_MUTEX_INITIALIZER (pthread_mutex_t)GENERIC_NORMAL_INITIALIZER +#define PTHREAD_DEFAULT_MUTEX_INITIALIZER PTHREAD_NORMAL_MUTEX_INITIALIZER +#define PTHREAD_COND_INITIALIZER (pthread_cond_t)GENERIC_INITIALIZER +#define PTHREAD_RWLOCK_INITIALIZER (pthread_rwlock_t)GENERIC_INITIALIZER +#define PTHREAD_SPINLOCK_INITIALIZER (pthread_spinlock_t)GENERIC_INITIALIZER + +extern void WINPTHREAD_API (**_pthread_key_dest)(void *); +int WINPTHREAD_API pthread_key_create(pthread_key_t *key, void (* dest)(void *)); +int WINPTHREAD_API pthread_key_delete(pthread_key_t key); +void * WINPTHREAD_API pthread_getspecific(pthread_key_t key); +int WINPTHREAD_API pthread_setspecific(pthread_key_t key, const void *value); + +pthread_t WINPTHREAD_API pthread_self(void); +int WINPTHREAD_API pthread_once(pthread_once_t *o, void (*func)(void)); +void WINPTHREAD_API pthread_testcancel(void); +int WINPTHREAD_API pthread_equal(pthread_t t1, pthread_t t2); +void WINPTHREAD_API pthread_tls_init(void); +void WINPTHREAD_API _pthread_cleanup_dest(pthread_t t); +int WINPTHREAD_API pthread_get_concurrency(int *val); +int WINPTHREAD_API pthread_set_concurrency(int val); +void WINPTHREAD_API pthread_exit(void *res); +void WINPTHREAD_API _pthread_invoke_cancel(void); +int WINPTHREAD_API pthread_cancel(pthread_t t); +int WINPTHREAD_API pthread_kill(pthread_t t, int sig); +unsigned WINPTHREAD_API _pthread_get_state(const pthread_attr_t *attr, unsigned flag); +int WINPTHREAD_API _pthread_set_state(pthread_attr_t *attr, unsigned flag, unsigned val); +int WINPTHREAD_API pthread_setcancelstate(int state, int *oldstate); +int WINPTHREAD_API pthread_setcanceltype(int type, int *oldtype); +int WINPTHREAD_API pthread_create_wrapper(void *args); +int WINPTHREAD_API pthread_create(pthread_t *th, const pthread_attr_t *attr, void *(* func)(void *), void *arg); +int WINPTHREAD_API pthread_join(pthread_t t, void **res); +int WINPTHREAD_API pthread_detach(pthread_t t); + +int WINPTHREAD_API pthread_rwlock_init(pthread_rwlock_t *rwlock_, const pthread_rwlockattr_t *attr); +int WINPTHREAD_API pthread_rwlock_wrlock(pthread_rwlock_t *l); +int WINPTHREAD_API pthread_rwlock_timedwrlock(pthread_rwlock_t *rwlock, const struct timespec *ts); +int WINPTHREAD_API pthread_rwlock_rdlock(pthread_rwlock_t *l); +int WINPTHREAD_API pthread_rwlock_timedrdlock(pthread_rwlock_t *l, const struct timespec *ts); +int WINPTHREAD_API pthread_rwlock_unlock(pthread_rwlock_t *l); +int WINPTHREAD_API pthread_rwlock_tryrdlock(pthread_rwlock_t *l); +int WINPTHREAD_API pthread_rwlock_trywrlock(pthread_rwlock_t *l); +int WINPTHREAD_API pthread_rwlock_destroy (pthread_rwlock_t *l); + +int WINPTHREAD_API pthread_cond_init(pthread_cond_t *cv, const pthread_condattr_t *a); +int WINPTHREAD_API pthread_cond_destroy(pthread_cond_t *cv); +int WINPTHREAD_API pthread_cond_signal (pthread_cond_t *cv); +int WINPTHREAD_API pthread_cond_broadcast (pthread_cond_t *cv); +int WINPTHREAD_API pthread_cond_wait (pthread_cond_t *cv, pthread_mutex_t *external_mutex); +int WINPTHREAD_API pthread_cond_timedwait(pthread_cond_t *cv, pthread_mutex_t *external_mutex, const struct timespec *t); +int WINPTHREAD_API pthread_cond_timedwait_relative_np(pthread_cond_t *cv, pthread_mutex_t *external_mutex, const struct timespec *t); + +int WINPTHREAD_API pthread_mutex_lock(pthread_mutex_t *m); +int WINPTHREAD_API pthread_mutex_timedlock(pthread_mutex_t *m, const struct timespec *ts); +int WINPTHREAD_API pthread_mutex_unlock(pthread_mutex_t *m); +int WINPTHREAD_API pthread_mutex_trylock(pthread_mutex_t *m); +int WINPTHREAD_API pthread_mutex_init(pthread_mutex_t *m, const pthread_mutexattr_t *a); +int WINPTHREAD_API pthread_mutex_destroy(pthread_mutex_t *m); + +int WINPTHREAD_API pthread_barrier_destroy(pthread_barrier_t *b); +int WINPTHREAD_API pthread_barrier_init(pthread_barrier_t *b, const void *attr, unsigned int count); +int WINPTHREAD_API pthread_barrier_wait(pthread_barrier_t *b); + +int WINPTHREAD_API pthread_spin_init(pthread_spinlock_t *l, int pshared); +int WINPTHREAD_API pthread_spin_destroy(pthread_spinlock_t *l); +/* No-fair spinlock due to lack of knowledge of thread number. */ +int WINPTHREAD_API pthread_spin_lock(pthread_spinlock_t *l); +int WINPTHREAD_API pthread_spin_trylock(pthread_spinlock_t *l); +int WINPTHREAD_API pthread_spin_unlock(pthread_spinlock_t *l); + +int WINPTHREAD_API pthread_attr_init(pthread_attr_t *attr); +int WINPTHREAD_API pthread_attr_destroy(pthread_attr_t *attr); +int WINPTHREAD_API pthread_attr_setdetachstate(pthread_attr_t *a, int flag); +int WINPTHREAD_API pthread_attr_getdetachstate(const pthread_attr_t *a, int *flag); +int WINPTHREAD_API pthread_attr_setinheritsched(pthread_attr_t *a, int flag); +int WINPTHREAD_API pthread_attr_getinheritsched(const pthread_attr_t *a, int *flag); +int WINPTHREAD_API pthread_attr_setscope(pthread_attr_t *a, int flag); +int WINPTHREAD_API pthread_attr_getscope(const pthread_attr_t *a, int *flag); +int WINPTHREAD_API pthread_attr_getstackaddr(pthread_attr_t *attr, void **stack); +int WINPTHREAD_API pthread_attr_setstackaddr(pthread_attr_t *attr, void *stack); +int WINPTHREAD_API pthread_attr_getstacksize(const pthread_attr_t *attr, size_t *size); +int WINPTHREAD_API pthread_attr_setstacksize(pthread_attr_t *attr, size_t size); + +int WINPTHREAD_API pthread_mutexattr_init(pthread_mutexattr_t *a); +int WINPTHREAD_API pthread_mutexattr_destroy(pthread_mutexattr_t *a); +int WINPTHREAD_API pthread_mutexattr_gettype(const pthread_mutexattr_t *a, int *type); +int WINPTHREAD_API pthread_mutexattr_settype(pthread_mutexattr_t *a, int type); +int WINPTHREAD_API pthread_mutexattr_getpshared(const pthread_mutexattr_t *a, int *type); +int WINPTHREAD_API pthread_mutexattr_setpshared(pthread_mutexattr_t * a, int type); +int WINPTHREAD_API pthread_mutexattr_getprotocol(const pthread_mutexattr_t *a, int *type); +int WINPTHREAD_API pthread_mutexattr_setprotocol(pthread_mutexattr_t *a, int type); +int WINPTHREAD_API pthread_mutexattr_getprioceiling(const pthread_mutexattr_t *a, int * prio); +int WINPTHREAD_API pthread_mutexattr_setprioceiling(pthread_mutexattr_t *a, int prio); +int WINPTHREAD_API pthread_getconcurrency(void); +int WINPTHREAD_API pthread_setconcurrency(int new_level); + +int WINPTHREAD_API pthread_condattr_destroy(pthread_condattr_t *a); +int WINPTHREAD_API pthread_condattr_init(pthread_condattr_t *a); +int WINPTHREAD_API pthread_condattr_getpshared(const pthread_condattr_t *a, int *s); +int WINPTHREAD_API pthread_condattr_setpshared(pthread_condattr_t *a, int s); + +#ifndef __clockid_t_defined +typedef int clockid_t; +#define __clockid_t_defined 1 +#endif /* __clockid_t_defined */ + +int WINPTHREAD_API pthread_condattr_getclock (const pthread_condattr_t *attr, + clockid_t *clock_id); +int WINPTHREAD_API pthread_condattr_setclock(pthread_condattr_t *attr, + clockid_t clock_id); +int WINPTHREAD_API __pthread_clock_nanosleep(clockid_t clock_id, int flags, const struct timespec *rqtp, struct timespec *rmtp); + +int WINPTHREAD_API pthread_barrierattr_init(void **attr); +int WINPTHREAD_API pthread_barrierattr_destroy(void **attr); +int WINPTHREAD_API pthread_barrierattr_setpshared(void **attr, int s); +int WINPTHREAD_API pthread_barrierattr_getpshared(void **attr, int *s); + +/* Private extensions for analysis and internal use. */ +struct _pthread_cleanup ** WINPTHREAD_API pthread_getclean (void); +void * WINPTHREAD_API pthread_gethandle (pthread_t t); +void * WINPTHREAD_API pthread_getevent (); + +unsigned long long WINPTHREAD_API _pthread_rel_time_in_ms(const struct timespec *ts); +unsigned long long WINPTHREAD_API _pthread_time_in_ms(void); +unsigned long long WINPTHREAD_API _pthread_time_in_ms_from_timespec(const struct timespec *ts); +int WINPTHREAD_API _pthread_tryjoin (pthread_t t, void **res); +int WINPTHREAD_API pthread_rwlockattr_destroy(pthread_rwlockattr_t *a); +int WINPTHREAD_API pthread_rwlockattr_getpshared(pthread_rwlockattr_t *a, int *s); +int WINPTHREAD_API pthread_rwlockattr_init(pthread_rwlockattr_t *a); +int WINPTHREAD_API pthread_rwlockattr_setpshared(pthread_rwlockattr_t *a, int s); + +#ifndef SIG_BLOCK +#define SIG_BLOCK 0 +#endif +#ifndef SIG_UNBLOCK +#define SIG_UNBLOCK 1 +#endif +#ifndef SIG_SETMASK +#define SIG_SETMASK 2 +#endif + +#include + +#undef _POSIX_THREAD_DESTRUCTOR_ITERATIONS +#define _POSIX_THREAD_DESTRUCTOR_ITERATIONS PTHREAD_DESTRUCTOR_ITERATIONS + +#undef _POSIX_THREAD_KEYS_MAX +#define _POSIX_THREAD_KEYS_MAX PTHREAD_KEYS_MAX + +#undef PTHREAD_THREADS_MAX +#define PTHREAD_THREADS_MAX 2019 + +#undef _POSIX_SEM_NSEMS_MAX +#define _POSIX_SEM_NSEMS_MAX 256 + +#undef SEM_NSEMS_MAX +#define SEM_NSEMS_MAX 1024 + +/* Wrap cancellation points. */ +#ifdef __WINPTRHEAD_ENABLE_WRAP_API +#define accept(...) (pthread_testcancel(), accept(__VA_ARGS__)) +#define aio_suspend(...) (pthread_testcancel(), aio_suspend(__VA_ARGS__)) +#define clock_nanosleep(...) (pthread_testcancel(), clock_nanosleep(__VA_ARGS__)) +#define close(...) (pthread_testcancel(), close(__VA_ARGS__)) +#define connect(...) (pthread_testcancel(), connect(__VA_ARGS__)) +#define creat(...) (pthread_testcancel(), creat(__VA_ARGS__)) +#define fcntl(...) (pthread_testcancel(), fcntl(__VA_ARGS__)) +#define fdatasync(...) (pthread_testcancel(), fdatasync(__VA_ARGS__)) +#define fsync(...) (pthread_testcancel(), fsync(__VA_ARGS__)) +#define getmsg(...) (pthread_testcancel(), getmsg(__VA_ARGS__)) +#define getpmsg(...) (pthread_testcancel(), getpmsg(__VA_ARGS__)) +#define lockf(...) (pthread_testcancel(), lockf(__VA_ARGS__)) +#define mg_receive(...) (pthread_testcancel(), mg_receive(__VA_ARGS__)) +#define mg_send(...) (pthread_testcancel(), mg_send(__VA_ARGS__)) +#define mg_timedreceive(...) (pthread_testcancel(), mg_timedreceive(__VA_ARGS__)) +#define mg_timessend(...) (pthread_testcancel(), mg_timedsend(__VA_ARGS__)) +#define msgrcv(...) (pthread_testcancel(), msgrecv(__VA_ARGS__)) +#define msgsnd(...) (pthread_testcancel(), msgsnd(__VA_ARGS__)) +#define msync(...) (pthread_testcancel(), msync(__VA_ARGS__)) +#define nanosleep(...) (pthread_testcancel(), nanosleep(__VA_ARGS__)) +#define open(...) (pthread_testcancel(), open(__VA_ARGS__)) +#define pause(...) (pthread_testcancel(), pause(__VA_ARGS__)) +#define poll(...) (pthread_testcancel(), poll(__VA_ARGS__)) +#define pread(...) (pthread_testcancel(), pread(__VA_ARGS__)) +#define pselect(...) (pthread_testcancel(), pselect(__VA_ARGS__)) +#define putmsg(...) (pthread_testcancel(), putmsg(__VA_ARGS__)) +#define putpmsg(...) (pthread_testcancel(), putpmsg(__VA_ARGS__)) +#define pwrite(...) (pthread_testcancel(), pwrite(__VA_ARGS__)) +#define read(...) (pthread_testcancel(), read(__VA_ARGS__)) +#define readv(...) (pthread_testcancel(), readv(__VA_ARGS__)) +#define recv(...) (pthread_testcancel(), recv(__VA_ARGS__)) +#define recvfrom(...) (pthread_testcancel(), recvfrom(__VA_ARGS__)) +#define recvmsg(...) (pthread_testcancel(), recvmsg(__VA_ARGS__)) +#define select(...) (pthread_testcancel(), select(__VA_ARGS__)) +#define sem_timedwait(...) (pthread_testcancel(), sem_timedwait(__VA_ARGS__)) +#define sem_wait(...) (pthread_testcancel(), sem_wait(__VA_ARGS__)) +#define send(...) (pthread_testcancel(), send(__VA_ARGS__)) +#define sendmsg(...) (pthread_testcancel(), sendmsg(__VA_ARGS__)) +#define sendto(...) (pthread_testcancel(), sendto(__VA_ARGS__)) +#define sigpause(...) (pthread_testcancel(), sigpause(__VA_ARGS__)) +#define sigsuspend(...) (pthread_testcancel(), sigsuspend(__VA_ARGS__)) +#define sigwait(...) (pthread_testcancel(), sigwait(__VA_ARGS__)) +#define sigwaitinfo(...) (pthread_testcancel(), sigwaitinfo(__VA_ARGS__)) +#define sleep(...) (pthread_testcancel(), sleep(__VA_ARGS__)) +//#define Sleep(...) (pthread_testcancel(), Sleep(__VA_ARGS__)) +#define system(...) (pthread_testcancel(), system(__VA_ARGS__)) +#define access(...) (pthread_testcancel(), access(__VA_ARGS__)) +#define asctime(...) (pthread_testcancel(), asctime(__VA_ARGS__)) +#define catclose(...) (pthread_testcancel(), catclose(__VA_ARGS__)) +#define catgets(...) (pthread_testcancel(), catgets(__VA_ARGS__)) +#define catopen(...) (pthread_testcancel(), catopen(__VA_ARGS__)) +#define closedir(...) (pthread_testcancel(), closedir(__VA_ARGS__)) +#define closelog(...) (pthread_testcancel(), closelog(__VA_ARGS__)) +#define ctermid(...) (pthread_testcancel(), ctermid(__VA_ARGS__)) +#define ctime(...) (pthread_testcancel(), ctime(__VA_ARGS__)) +#define dbm_close(...) (pthread_testcancel(), dbm_close(__VA_ARGS__)) +#define dbm_delete(...) (pthread_testcancel(), dbm_delete(__VA_ARGS__)) +#define dbm_fetch(...) (pthread_testcancel(), dbm_fetch(__VA_ARGS__)) +#define dbm_nextkey(...) (pthread_testcancel(), dbm_nextkey(__VA_ARGS__)) +#define dbm_open(...) (pthread_testcancel(), dbm_open(__VA_ARGS__)) +#define dbm_store(...) (pthread_testcancel(), dbm_store(__VA_ARGS__)) +#define dlclose(...) (pthread_testcancel(), dlclose(__VA_ARGS__)) +#define dlopen(...) (pthread_testcancel(), dlopen(__VA_ARGS__)) +#define endgrent(...) (pthread_testcancel(), endgrent(__VA_ARGS__)) +#define endhostent(...) (pthread_testcancel(), endhostent(__VA_ARGS__)) +#define endnetent(...) (pthread_testcancel(), endnetent(__VA_ARGS__)) +#define endprotoent(...) (pthread_testcancel(), endprotoend(__VA_ARGS__)) +#define endpwent(...) (pthread_testcancel(), endpwent(__VA_ARGS__)) +#define endservent(...) (pthread_testcancel(), endservent(__VA_ARGS__)) +#define endutxent(...) (pthread_testcancel(), endutxent(__VA_ARGS__)) +#define fclose(...) (pthread_testcancel(), fclose(__VA_ARGS__)) +#define fflush(...) (pthread_testcancel(), fflush(__VA_ARGS__)) +#define fgetc(...) (pthread_testcancel(), fgetc(__VA_ARGS__)) +#define fgetpos(...) (pthread_testcancel(), fgetpos(__VA_ARGS__)) +#define fgets(...) (pthread_testcancel(), fgets(__VA_ARGS__)) +#define fgetwc(...) (pthread_testcancel(), fgetwc(__VA_ARGS__)) +#define fgetws(...) (pthread_testcancel(), fgetws(__VA_ARGS__)) +#define fmtmsg(...) (pthread_testcancel(), fmtmsg(__VA_ARGS__)) +#define fopen(...) (pthread_testcancel(), fopen(__VA_ARGS__)) +#define fpathconf(...) (pthread_testcancel(), fpathconf(__VA_ARGS__)) +#define fprintf(...) (pthread_testcancel(), fprintf(__VA_ARGS__)) +#define fputc(...) (pthread_testcancel(), fputc(__VA_ARGS__)) +#define fputs(...) (pthread_testcancel(), fputs(__VA_ARGS__)) +#define fputwc(...) (pthread_testcancel(), fputwc(__VA_ARGS__)) +#define fputws(...) (pthread_testcancel(), fputws(__VA_ARGS__)) +#define fread(...) (pthread_testcancel(), fread(__VA_ARGS__)) +#define freopen(...) (pthread_testcancel(), freopen(__VA_ARGS__)) +#define fscanf(...) (pthread_testcancel(), fscanf(__VA_ARGS__)) +#define fseek(...) (pthread_testcancel(), fseek(__VA_ARGS__)) +#define fseeko(...) (pthread_testcancel(), fseeko(__VA_ARGS__)) +#define fsetpos(...) (pthread_testcancel(), fsetpos(__VA_ARGS__)) +#define fstat(...) (pthread_testcancel(), fstat(__VA_ARGS__)) +#define ftell(...) (pthread_testcancel(), ftell(__VA_ARGS__)) +#define ftello(...) (pthread_testcancel(), ftello(__VA_ARGS__)) +#define ftw(...) (pthread_testcancel(), ftw(__VA_ARGS__)) +#define fwprintf(...) (pthread_testcancel(), fwprintf(__VA_ARGS__)) +#define fwrite(...) (pthread_testcancel(), fwrite(__VA_ARGS__)) +#define fwscanf(...) (pthread_testcancel(), fwscanf(__VA_ARGS__)) +#define getaddrinfo(...) (pthread_testcancel(), getaddrinfo(__VA_ARGS__)) +#define getc(...) (pthread_testcancel(), getc(__VA_ARGS__)) +#define getc_unlocked(...) (pthread_testcancel(), getc_unlocked(__VA_ARGS__)) +#define getchar(...) (pthread_testcancel(), getchar(__VA_ARGS__)) +#define getchar_unlocked(...) (pthread_testcancel(), getchar_unlocked(__VA_ARGS__)) +#define getcwd(...) (pthread_testcancel(), getcwd(__VA_ARGS__)) +#define getdate(...) (pthread_testcancel(), getdate(__VA_ARGS__)) +#define getgrent(...) (pthread_testcancel(), getgrent(__VA_ARGS__)) +#define getgrgid(...) (pthread_testcancel(), getgrgid(__VA_ARGS__)) +#define getgrgid_r(...) (pthread_testcancel(), getgrgid_r(__VA_ARGS__)) +#define gergrnam(...) (pthread_testcancel(), getgrnam(__VA_ARGS__)) +#define getgrnam_r(...) (pthread_testcancel(), getgrnam_r(__VA_ARGS__)) +#define gethostbyaddr(...) (pthread_testcancel(), gethostbyaddr(__VA_ARGS__)) +#define gethostbyname(...) (pthread_testcancel(), gethostbyname(__VA_ARGS__)) +#define gethostent(...) (pthread_testcancel(), gethostent(__VA_ARGS__)) +#define gethostid(...) (pthread_testcancel(), gethostid(__VA_ARGS__)) +#define gethostname(...) (pthread_testcancel(), gethostname(__VA_ARGS__)) +#define getlogin(...) (pthread_testcancel(), getlogin(__VA_ARGS__)) +#define getlogin_r(...) (pthread_testcancel(), getlogin_r(__VA_ARGS__)) +#define getnameinfo(...) (pthread_testcancel(), getnameinfo(__VA_ARGS__)) +#define getnetbyaddr(...) (pthread_testcancel(), getnetbyaddr(__VA_ARGS__)) +#define getnetbyname(...) (pthread_testcancel(), getnetbyname(__VA_ARGS__)) +#define getnetent(...) (pthread_testcancel(), getnetent(__VA_ARGS__)) +#define getopt(...) (pthread_testcancel(), getopt(__VA_ARGS__)) +#define getprotobyname(...) (pthread_testcancel(), getprotobyname(__VA_ARGS__)) +#define getprotobynumber(...) (pthread_testcancel(), getprotobynumber(__VA_ARGS__)) +#define getprotoent(...) (pthread_testcancel(), getprotoent(__VA_ARGS__)) +#define getpwent(...) (pthread_testcancel(), getpwent(__VA_ARGS__)) +#define getpwnam(...) (pthread_testcancel(), getpwnam(__VA_ARGS__)) +#define getpwnam_r(...) (pthread_testcancel(), getpwnam_r(__VA_ARGS__)) +#define getpwuid(...) (pthread_testcancel(), getpwuid(__VA_ARGS__)) +#define getpwuid_r(...) (pthread_testcancel(), getpwuid_r(__VA_ARGS__)) +#define gets(...) (pthread_testcancel(), gets(__VA_ARGS__)) +#define getservbyname(...) (pthread_testcancel(), getservbyname(__VA_ARGS__)) +#define getservbyport(...) (pthread_testcancel(), getservbyport(__VA_ARGS__)) +#define getservent(...) (pthread_testcancel(), getservent(__VA_ARGS__)) +#define getutxent(...) (pthread_testcancel(), getutxent(__VA_ARGS__)) +#define getutxid(...) (pthread_testcancel(), getutxid(__VA_ARGS__)) +#define getutxline(...) (pthread_testcancel(), getutxline(__VA_ARGS__)) +#undef getwc +#define getwc(...) (pthread_testcancel(), getwc(__VA_ARGS__)) +#undef getwchar +#define getwchar(...) (pthread_testcancel(), getwchar(__VA_ARGS__)) +#define getwd(...) (pthread_testcancel(), getwd(__VA_ARGS__)) +#define glob(...) (pthread_testcancel(), glob(__VA_ARGS__)) +#define iconv_close(...) (pthread_testcancel(), iconv_close(__VA_ARGS__)) +#define iconv_open(...) (pthread_testcancel(), iconv_open(__VA_ARGS__)) +#define ioctl(...) (pthread_testcancel(), ioctl(__VA_ARGS__)) +#define link(...) (pthread_testcancel(), link(__VA_ARGS__)) +#define localtime(...) (pthread_testcancel(), localtime(__VA_ARGS__)) +#define lseek(...) (pthread_testcancel(), lseek(__VA_ARGS__)) +#define lstat(...) (pthread_testcancel(), lstat(__VA_ARGS__)) +#define mkstemp(...) (pthread_testcancel(), mkstemp(__VA_ARGS__)) +#define nftw(...) (pthread_testcancel(), nftw(__VA_ARGS__)) +#define opendir(...) (pthread_testcancel(), opendir(__VA_ARGS__)) +#define openlog(...) (pthread_testcancel(), openlog(__VA_ARGS__)) +#define pathconf(...) (pthread_testcancel(), pathconf(__VA_ARGS__)) +#define pclose(...) (pthread_testcancel(), pclose(__VA_ARGS__)) +#define perror(...) (pthread_testcancel(), perror(__VA_ARGS__)) +#define popen(...) (pthread_testcancel(), popen(__VA_ARGS__)) +#define posix_fadvise(...) (pthread_testcancel(), posix_fadvise(__VA_ARGS__)) +#define posix_fallocate(...) (pthread_testcancel(), posix_fallocate(__VA_ARGS__)) +#define posix_madvise(...) (pthread_testcancel(), posix_madvise(__VA_ARGS__)) +#define posix_openpt(...) (pthread_testcancel(), posix_openpt(__VA_ARGS__)) +#define posix_spawn(...) (pthread_testcancel(), posix_spawn(__VA_ARGS__)) +#define posix_spawnp(...) (pthread_testcancel(), posix_spawnp(__VA_ARGS__)) +#define posix_trace_clear(...) (pthread_testcancel(), posix_trace_clear(__VA_ARGS__)) +#define posix_trace_close(...) (pthread_testcancel(), posix_trace_close(__VA_ARGS__)) +#define posix_trace_create(...) (pthread_testcancel(), posix_trace_create(__VA_ARGS__)) +#define posix_trace_create_withlog(...) (pthread_testcancel(), posix_trace_create_withlog(__VA_ARGS__)) +#define posix_trace_eventtypelist_getne(...) (pthread_testcancel(), posix_trace_eventtypelist_getne(__VA_ARGS__)) +#define posix_trace_eventtypelist_rewin(...) (pthread_testcancel(), posix_trace_eventtypelist_rewin(__VA_ARGS__)) +#define posix_trace_flush(...) (pthread_testcancel(), posix_trace_flush(__VA_ARGS__)) +#define posix_trace_get_attr(...) (pthread_testcancel(), posix_trace_get_attr(__VA_ARGS__)) +#define posix_trace_get_filter(...) (pthread_testcancel(), posix_trace_get_filter(__VA_ARGS__)) +#define posix_trace_get_status(...) (pthread_testcancel(), posix_trace_get_status(__VA_ARGS__)) +#define posix_trace_getnext_event(...) (pthread_testcancel(), posix_trace_getnext_event(__VA_ARGS__)) +#define posix_trace_open(...) (pthread_testcancel(), posix_trace_open(__VA_ARGS__)) +#define posix_trace_rewind(...) (pthread_testcancel(), posix_trace_rewind(__VA_ARGS__)) +#define posix_trace_setfilter(...) (pthread_testcancel(), posix_trace_setfilter(__VA_ARGS__)) +#define posix_trace_shutdown(...) (pthread_testcancel(), posix_trace_shutdown(__VA_ARGS__)) +#define posix_trace_timedgetnext_event(...) (pthread_testcancel(), posix_trace_timedgetnext_event(__VA_ARGS__)) +#define posix_typed_mem_open(...) (pthread_testcancel(), posix_typed_mem_open(__VA_ARGS__)) +#define printf(...) (pthread_testcancel(), printf(__VA_ARGS__)) +#define putc(...) (pthread_testcancel(), putc(__VA_ARGS__)) +#define putc_unlocked(...) (pthread_testcancel(), putc_unlocked(__VA_ARGS__)) +#define putchar(...) (pthread_testcancel(), putchar(__VA_ARGS__)) +#define putchar_unlocked(...) (pthread_testcancel(), putchar_unlocked(__VA_ARGS__)) +#define puts(...) (pthread_testcancel(), puts(__VA_ARGS__)) +#define pututxline(...) (pthread_testcancel(), pututxline(__VA_ARGS__)) +#undef putwc +#define putwc(...) (pthread_testcancel(), putwc(__VA_ARGS__)) +#undef putwchar +#define putwchar(...) (pthread_testcancel(), putwchar(__VA_ARGS__)) +#define readdir(...) (pthread_testcancel(), readdir(__VA_ARSG__)) +#define readdir_r(...) (pthread_testcancel(), readdir_r(__VA_ARGS__)) +#define remove(...) (pthread_testcancel(), remove(__VA_ARGS__)) +#define rename(...) (pthread_testcancel(), rename(__VA_ARGS__)) +#define rewind(...) (pthread_testcancel(), rewind(__VA_ARGS__)) +#define rewinddir(...) (pthread_testcancel(), rewinddir(__VA_ARGS__)) +#define scanf(...) (pthread_testcancel(), scanf(__VA_ARGS__)) +#define seekdir(...) (pthread_testcancel(), seekdir(__VA_ARGS__)) +#define semop(...) (pthread_testcancel(), semop(__VA_ARGS__)) +#define setgrent(...) (pthread_testcancel(), setgrent(__VA_ARGS__)) +#define sethostent(...) (pthread_testcancel(), sethostemt(__VA_ARGS__)) +#define setnetent(...) (pthread_testcancel(), setnetent(__VA_ARGS__)) +#define setprotoent(...) (pthread_testcancel(), setprotoent(__VA_ARGS__)) +#define setpwent(...) (pthread_testcancel(), setpwent(__VA_ARGS__)) +#define setservent(...) (pthread_testcancel(), setservent(__VA_ARGS__)) +#define setutxent(...) (pthread_testcancel(), setutxent(__VA_ARGS__)) +#define stat(...) (pthread_testcancel(), stat(__VA_ARGS__)) +#define strerror(...) (pthread_testcancel(), strerror(__VA_ARGS__)) +#define strerror_r(...) (pthread_testcancel(), strerror_r(__VA_ARGS__)) +#define strftime(...) (pthread_testcancel(), strftime(__VA_ARGS__)) +#define symlink(...) (pthread_testcancel(), symlink(__VA_ARGS__)) +#define sync(...) (pthread_testcancel(), sync(__VA_ARGS__)) +#define syslog(...) (pthread_testcancel(), syslog(__VA_ARGS__)) +#define tmpfile(...) (pthread_testcancel(), tmpfile(__VA_ARGS__)) +#define tmpnam(...) (pthread_testcancel(), tmpnam(__VA_ARGS__)) +#define ttyname(...) (pthread_testcancel(), ttyname(__VA_ARGS__)) +#define ttyname_r(...) (pthread_testcancel(), ttyname_r(__VA_ARGS__)) +#define tzset(...) (pthread_testcancel(), tzset(__VA_ARGS__)) +#define ungetc(...) (pthread_testcancel(), ungetc(__VA_ARGS__)) +#define ungetwc(...) (pthread_testcancel(), ungetwc(__VA_ARGS__)) +#define unlink(...) (pthread_testcancel(), unlink(__VA_ARGS__)) +#define vfprintf(...) (pthread_testcancel(), vfprintf(__VA_ARGS__)) +#define vfwprintf(...) (pthread_testcancel(), vfwprintf(__VA_ARGS__)) +#define vprintf(...) (pthread_testcancel(), vprintf(__VA_ARGS__)) +#define vwprintf(...) (pthread_testcancel(), vwprintf(__VA_ARGS__)) +#define wcsftime(...) (pthread_testcancel(), wcsftime(__VA_ARGS__)) +#define wordexp(...) (pthread_testcancel(), wordexp(__VA_ARGS__)) +#define wprintf(...) (pthread_testcancel(), wprintf(__VA_ARGS__)) +#define wscanf(...) (pthread_testcancel(), wscanf(__VA_ARGS__)) +#endif + +/* We deal here with a gcc issue for posix threading on Windows. + We would need to change here gcc's gthr-posix.h header, but this + got rejected. So we deal it within this header. */ +#ifdef _GTHREAD_USE_MUTEX_INIT_FUNC +#undef _GTHREAD_USE_MUTEX_INIT_FUNC +#endif +#define _GTHREAD_USE_MUTEX_INIT_FUNC 1 + +#ifdef __cplusplus +} +#endif + +#endif /* WIN_PTHREADS_H */ diff --git a/cookbooks/mingw/files/default/time.h b/cookbooks/mingw/files/default/time.h new file mode 100644 index 0000000..1800b43 --- /dev/null +++ b/cookbooks/mingw/files/default/time.h @@ -0,0 +1,297 @@ +/* + * time.h + * + * Type definitions and function declarations relating to date and time. + * + * $Id: time.h,v ffe8d63c87e3 2015/05/18 12:49:39 keithmarshall $ + * + * Written by Rob Savoye + * Copyright (C) 1997-2007, 2011, 2015, MinGW.org Project. + * + * + * Permission is hereby granted, free of charge, to any person obtaining a + * copy of this software and associated documentation files (the "Software"), + * to deal in the Software without restriction, including without limitation + * the rights to use, copy, modify, merge, publish, distribute, sublicense, + * and/or sell copies of the Software, and to permit persons to whom the + * Software is furnished to do so, subject to the following conditions: + * + * The above copyright notice, this permission notice, and the following + * disclaimer shall be included in all copies or substantial portions of + * the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS + * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OF OR OTHER + * DEALINGS IN THE SOFTWARE. + * + */ +#ifndef _TIME_H +#define _TIME_H + +/* All the headers include this file. */ +#include <_mingw.h> + +/* Number of clock ticks per second. A clock tick is the unit by which + * processor time is measured and is returned by 'clock'. + */ +#define CLOCKS_PER_SEC ((clock_t)(1000)) +#define CLK_TCK CLOCKS_PER_SEC + +#ifndef RC_INVOKED +/* + * Some elements declared in time.h may also be required by other + * header files, without necessarily including time.h itself; such + * elements are declared in the local parts/time.h system header file. + * Declarations for such elements must be selected prior to inclusion: + */ +#define __need_time_t +#define __need_struct_timespec +#include + +/* time.h is also required to duplicate the following type definitions, + * which are nominally defined in stddef.h + */ +#define __need_NULL +#define __need_wchar_t +#define __need_size_t +#include + +/* A type for measuring processor time in clock ticks; (no need to + * guard this, since it isn't defined elsewhere). + */ +typedef long clock_t; + +#ifndef _TM_DEFINED +/* + * A structure for storing all kinds of useful information about the + * current (or another) time. + */ +struct tm +{ + int tm_sec; /* Seconds: 0-59 (K&R says 0-61?) */ + int tm_min; /* Minutes: 0-59 */ + int tm_hour; /* Hours since midnight: 0-23 */ + int tm_mday; /* Day of the month: 1-31 */ + int tm_mon; /* Months *since* january: 0-11 */ + int tm_year; /* Years since 1900 */ + int tm_wday; /* Days since Sunday (0-6) */ + int tm_yday; /* Days since Jan. 1: 0-365 */ + int tm_isdst; /* +1 Daylight Savings Time, 0 No DST, + * -1 don't know */ +}; +#define _TM_DEFINED +#endif + +_BEGIN_C_DECLS + +_CRTIMP clock_t __cdecl __MINGW_NOTHROW clock (void); +#if __MSVCRT_VERSION__ < 0x0800 +_CRTIMP time_t __cdecl __MINGW_NOTHROW time (time_t*); +_CRTIMP double __cdecl __MINGW_NOTHROW difftime (time_t, time_t); +_CRTIMP time_t __cdecl __MINGW_NOTHROW mktime (struct tm*); +#endif + +/* + * These functions write to and return pointers to static buffers that may + * be overwritten by other function calls. Yikes! + * + * NOTE: localtime, and perhaps the others of the four functions grouped + * below may return NULL if their argument is not 'acceptable'. Also note + * that calling asctime with a NULL pointer will produce an Invalid Page + * Fault and crap out your program. Guess how I know. Hint: stat called on + * a directory gives 'invalid' times in st_atime etc... + */ +_CRTIMP char* __cdecl __MINGW_NOTHROW asctime (const struct tm*); +#if __MSVCRT_VERSION__ < 0x0800 +_CRTIMP char* __cdecl __MINGW_NOTHROW ctime (const time_t*); +_CRTIMP struct tm* __cdecl __MINGW_NOTHROW gmtime (const time_t*); +_CRTIMP struct tm* __cdecl __MINGW_NOTHROW localtime (const time_t*); +#endif + +_CRTIMP size_t __cdecl __MINGW_NOTHROW strftime (char*, size_t, const char*, const struct tm*); + +#ifndef __STRICT_ANSI__ + +extern _CRTIMP void __cdecl __MINGW_NOTHROW _tzset (void); + +#ifndef _NO_OLDNAMES +extern _CRTIMP void __cdecl __MINGW_NOTHROW tzset (void); +#endif + +_CRTIMP char* __cdecl __MINGW_NOTHROW _strdate(char*); +_CRTIMP char* __cdecl __MINGW_NOTHROW _strtime(char*); + +/* These require newer versions of msvcrt.dll (6.10 or higher). */ +#if __MSVCRT_VERSION__ >= 0x0601 +_CRTIMP __time64_t __cdecl __MINGW_NOTHROW _time64( __time64_t*); +_CRTIMP __time64_t __cdecl __MINGW_NOTHROW _mktime64 (struct tm*); +_CRTIMP char* __cdecl __MINGW_NOTHROW _ctime64 (const __time64_t*); +_CRTIMP struct tm* __cdecl __MINGW_NOTHROW _gmtime64 (const __time64_t*); +_CRTIMP struct tm* __cdecl __MINGW_NOTHROW _localtime64 (const __time64_t*); +#endif /* __MSVCRT_VERSION__ >= 0x0601 */ + +/* These require newer versions of msvcrt.dll (8.00 or higher). */ +#if __MSVCRT_VERSION__ >= 0x0800 +_CRTIMP __time32_t __cdecl __MINGW_NOTHROW _time32 (__time32_t*); +_CRTIMP double __cdecl __MINGW_NOTHROW _difftime32 (__time32_t, __time32_t); +_CRTIMP double __cdecl __MINGW_NOTHROW _difftime64 (__time64_t, __time64_t); +_CRTIMP __time32_t __cdecl __MINGW_NOTHROW _mktime32 (struct tm*); +_CRTIMP __time32_t __cdecl __MINGW_NOTHROW _mkgmtime32 (struct tm*); +_CRTIMP __time64_t __cdecl __MINGW_NOTHROW _mkgmtime64 (struct tm*); +_CRTIMP char* __cdecl __MINGW_NOTHROW _ctime32 (const __time32_t*); +_CRTIMP struct tm* __cdecl __MINGW_NOTHROW _gmtime32 (const __time32_t*); +_CRTIMP struct tm* __cdecl __MINGW_NOTHROW _localtime32 (const __time32_t*); +#ifndef _USE_32BIT_TIME_T +_CRTALIAS time_t __cdecl __MINGW_NOTHROW time (time_t* _v) { return(_time64 (_v)); } +_CRTALIAS double __cdecl __MINGW_NOTHROW difftime (time_t _v1, time_t _v2) { return(_difftime64 (_v1,_v2)); } +_CRTALIAS time_t __cdecl __MINGW_NOTHROW mktime (struct tm* _v) { return(_mktime64 (_v)); } +_CRTALIAS time_t __cdecl __MINGW_NOTHROW _mkgmtime (struct tm* _v) { return(_mkgmtime64 (_v)); } +_CRTALIAS char* __cdecl __MINGW_NOTHROW ctime (const time_t* _v) { return(_ctime64 (_v)); } +_CRTALIAS struct tm* __cdecl __MINGW_NOTHROW gmtime (const time_t* _v) { return(_gmtime64 (_v)); } +_CRTALIAS struct tm* __cdecl __MINGW_NOTHROW localtime (const time_t* _v) { return(_localtime64 (_v)); } +#else +_CRTALIAS time_t __cdecl __MINGW_NOTHROW time (time_t* _v) { return(_time32 (_v)); } +_CRTALIAS double __cdecl __MINGW_NOTHROW difftime (time_t _v1, time_t _v2) { return(_difftime32 (_v1,_v2)); } +_CRTALIAS time_t __cdecl __MINGW_NOTHROW mktime (struct tm* _v) { return(_mktime32 (_v)); } +_CRTALIAS time_t __cdecl __MINGW_NOTHROW _mkgmtime (struct tm* _v) { return(_mkgmtime32 (_v)); } +_CRTALIAS char* __cdecl __MINGW_NOTHROW ctime (const time_t* _v) { return(_ctime32 (_v)); } +_CRTALIAS struct tm* __cdecl __MINGW_NOTHROW gmtime (const time_t* _v) { return(_gmtime32 (_v)); } +_CRTALIAS struct tm* __cdecl __MINGW_NOTHROW localtime (const time_t* _v) { return(_localtime32 (_v)); } +#endif /* !_USE_32BIT_TIME_T */ +#endif /* __MSVCRT_VERSION__ >= 0x0800 */ + +/* _daylight: non zero if daylight savings time is used. + * _timezone: difference in seconds between GMT and local time. + * _tzname: standard/daylight savings time zone names (an array with two + * elements). + */ +#ifdef __MSVCRT__ + +/* These are for compatibility with pre-VC 5.0 suppied MSVCRT. */ +extern _CRTIMP int* __cdecl __MINGW_NOTHROW __p__daylight (void); +extern _CRTIMP long* __cdecl __MINGW_NOTHROW __p__timezone (void); +extern _CRTIMP char** __cdecl __MINGW_NOTHROW __p__tzname (void); + +__MINGW_IMPORT int _daylight; +__MINGW_IMPORT long _timezone; +__MINGW_IMPORT char *_tzname[2]; + +#else /* not __MSVCRT (ie. crtdll) */ + +#ifndef __DECLSPEC_SUPPORTED + +extern int* _imp___daylight_dll; +extern long* _imp___timezone_dll; +extern char** _imp___tzname; + +#define _daylight (*_imp___daylight_dll) +#define _timezone (*_imp___timezone_dll) +#define _tzname (*_imp___tzname) + +#else /* __DECLSPEC_SUPPORTED */ + +__MINGW_IMPORT int _daylight_dll; +__MINGW_IMPORT long _timezone_dll; +__MINGW_IMPORT char* _tzname[2]; + +#define _daylight _daylight_dll +#define _timezone _timezone_dll + +#endif /* __DECLSPEC_SUPPORTED */ +#endif /* ! __MSVCRT__ */ +#endif /* ! __STRICT_ANSI__ */ + +#ifndef _NO_OLDNAMES +#ifdef __MSVCRT__ + +/* These go in the oldnames import library for MSVCRT. + */ +__MINGW_IMPORT int daylight; +__MINGW_IMPORT long timezone; +__MINGW_IMPORT char *tzname[2]; + +#else /* ! __MSVCRT__ */ +/* + * CRTDLL is royally messed up when it comes to these macros. + * TODO: import and alias these via oldnames import library instead + * of macros. + */ +#define daylight _daylight +/* + * NOTE: timezone not defined as a macro because it would conflict with + * struct timezone in sys/time.h. Also, tzname used to a be macro, but + * now it's in moldname. + */ +__MINGW_IMPORT char *tzname[2]; + +#endif /* ! __MSVCRT__ */ +#endif /* ! _NO_OLDNAMES */ + +#ifndef _WTIME_DEFINED +/* wide function prototypes, also declared in wchar.h */ +#ifndef __STRICT_ANSI__ +#ifdef __MSVCRT__ +_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wasctime(const struct tm*); +#if __MSVCRT_VERSION__ < 0x0800 +_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wctime(const time_t*); +#endif +_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wstrdate(wchar_t*); +_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wstrtime(wchar_t*); +#if __MSVCRT_VERSION__ >= 0x0601 +_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wctime64 (const __time64_t*); +#endif +#if __MSVCRT_VERSION__ >= 0x0800 +_CRTIMP wchar_t* __cdecl __MINGW_NOTHROW _wctime32 (const __time32_t*); +#ifndef _USE_32BIT_TIME_T +_CRTALIAS wchar_t* __cdecl __MINGW_NOTHROW _wctime (const time_t* _v) { return(_wctime64 (_v)); } +#else +_CRTALIAS wchar_t* __cdecl __MINGW_NOTHROW _wctime (const time_t* _v) { return(_wctime32 (_v)); } +#endif +#endif /* __MSVCRT_VERSION__ >= 0x0800 */ +#endif /* __MSVCRT__ */ +#endif /* __STRICT_ANSI__ */ +_CRTIMP size_t __cdecl __MINGW_NOTHROW wcsftime (wchar_t*, size_t, const wchar_t*, const struct tm*); +#define _WTIME_DEFINED +#endif /* _WTIME_DEFINED */ + +_END_C_DECLS + +/* ------------------------------------------------------------------- + * CHEF PATCHES + * + * PROVIDE clock_gettime ETC. IN time.h FOR POSIX COMPLIANCE. + * + * This code was copied from the 64-bit TDM gcc compiler headers. It + * is here to allow certain libraries (like libxslt) to compile + * because they assume that they are only going to be built on a POSIX + * system. The C99 standards do not require that these functions be + * available but most POSIX systems provide them unless strict x-play + * compatibility is requested. + * + * On windows, configure could possibly identify that these functions + * are unavailable but since it tests for function availability to + * attempting to link a binary with said functions, these tests + * succeed with our TDM mingw runtime (because we indeed support these + * posix compatibility methods). Hence we pretend like we are a POSIX + * compliant system and export these methods. + */ + +/* POSIX 2008 says clock_gettime and timespec are defined in time.h header, + but other systems - like Linux, Solaris, etc - tend to declare such + recent extensions only if the following guards are met. */ +#if !defined(IN_WINPTHREAD) && \ + ((!defined(_STRICT_STDC) && !defined(__XOPEN_OR_POSIX)) || \ + (_POSIX_C_SOURCE > 2) || defined(__EXTENSIONS__)) +#include +#endif + +/* END OF CHEF PATCHES + * ------------------------------------------------------------------- + */ + +#endif /* ! RC_INVOKED */ +#endif /* ! _TIME_H: $RCSfile: time.h,v $: end of file */ diff --git a/cookbooks/mingw/libraries/_helper.rb b/cookbooks/mingw/libraries/_helper.rb new file mode 100644 index 0000000..662faa2 --- /dev/null +++ b/cookbooks/mingw/libraries/_helper.rb @@ -0,0 +1,38 @@ +# +# Cookbook:: mingw +# Library:: _helper +# +# Copyright:: 2016-2019, Chef Software, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +module Mingw + module Helper + def win_friendly_path(path) + path.gsub(::File::SEPARATOR, ::File::ALT_SEPARATOR || '\\') if path + end + + def archive_name(source) + url = ::URI.parse(source) + ::File.basename(::URI.unescape(url.path)) + end + + def tar_name(source) + aname = archive_name(source) + ::File.basename(aname, ::File.extname(aname)) + end + end +end + +Chef::Resource.include Mingw::Helper diff --git a/cookbooks/mingw/metadata.json b/cookbooks/mingw/metadata.json new file mode 100644 index 0000000..98cf457 --- /dev/null +++ b/cookbooks/mingw/metadata.json @@ -0,0 +1,36 @@ +{ + "name": "mingw", + "description": "Installs a mingw/msys based toolchain on windows", + "long_description": "", + "maintainer": "Chef Software, Inc.", + "maintainer_email": "cookbooks@chef.io", + "license": "Apache-2.0", + "platforms": { + "windows": ">= 0.0.0" + }, + "dependencies": { + "seven_zip": ">= 0.0.0" + }, + "providing": { + + }, + "recipes": { + + }, + "version": "2.1.7", + "source_url": "https://github.com/chef-cookbooks/mingw", + "issues_url": "https://github.com/chef-cookbooks/mingw/issues", + "privacy": false, + "chef_versions": [ + [ + ">= 12.15" + ] + ], + "ohai_versions": [ + + ], + "gems": [ + + ], + "eager_load_libraries": true +} diff --git a/cookbooks/mingw/metadata.rb b/cookbooks/mingw/metadata.rb new file mode 100644 index 0000000..f899f16 --- /dev/null +++ b/cookbooks/mingw/metadata.rb @@ -0,0 +1,14 @@ +name 'mingw' +maintainer 'Chef Software, Inc.' +maintainer_email 'cookbooks@chef.io' +license 'Apache-2.0' +description 'Installs a mingw/msys based toolchain on windows' +version '2.1.7' + +supports 'windows' + +depends 'seven_zip' + +source_url 'https://github.com/chef-cookbooks/mingw' +issues_url 'https://github.com/chef-cookbooks/mingw/issues' +chef_version '>= 12.15' diff --git a/cookbooks/mingw/recipes/default.rb b/cookbooks/mingw/recipes/default.rb new file mode 100644 index 0000000..a766653 --- /dev/null +++ b/cookbooks/mingw/recipes/default.rb @@ -0,0 +1,19 @@ +# +# Cookbook:: mingw +# Recipe:: default +# +# Copyright:: 2016-2019, Chef Software, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +include_recipe 'seven_zip::default' diff --git a/cookbooks/mingw/renovate.json b/cookbooks/mingw/renovate.json new file mode 100644 index 0000000..7e7a8ba --- /dev/null +++ b/cookbooks/mingw/renovate.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["config:base"], + "packageRules": [{ + "groupName": "Actions", + "matchUpdateTypes": ["patch", "pin", "digest"], + "automerge": true, + "addLabels": ["Release: Patch", "Skip: Announcements"] + }, + { + "groupName": "Actions", + "matchUpdateTypes": ["major"], + "automerge": false, + "addLabels": ["Release: Patch", "Skip: Announcements"] + } + ] +} diff --git a/cookbooks/mingw/resources/get.rb b/cookbooks/mingw/resources/get.rb new file mode 100644 index 0000000..a102b0e --- /dev/null +++ b/cookbooks/mingw/resources/get.rb @@ -0,0 +1,54 @@ +# +# Cookbook:: mingw +# Resource:: get +# +# Copyright:: 2016-2019, Chef Software, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# Installs the core msys utilities needed for mingw/git/any other posix +# based toolchain at a desired location using mingw-get.exe. + +property :package, String, name_property: true +property :root, String, required: true + +action_class do + def mingw_do_action(action_cmd) + seven_zip_archive "fetching mingw-get to #{win_friendly_path(root)}" do + source 'http://iweb.dl.sourceforge.net/project/mingw/Installer/mingw-get/mingw-get-0.6.2-beta-20131004-1/mingw-get-0.6.2-mingw32-beta-20131004-1-bin.zip' + path root + checksum '2e0e9688d42adc68c5611759947e064156e169ff871816cae52d33ee0655826d' + not_if do + ::File.exist?(::File.join(root, 'bin/mingw-get.exe')) + end + end + + execute "performing #{action_cmd} for #{package}" do + command ".\\bin\\mingw-get.exe -v #{action_cmd} #{package}" + cwd root + end + end +end + +action :install do + mingw_do_action('install') +end + +action :upgrade do + mingw_do_action('upgrade') +end + +action :remove do + mingw_do_action('remove') +end diff --git a/cookbooks/mingw/resources/msys2_package.rb b/cookbooks/mingw/resources/msys2_package.rb new file mode 100644 index 0000000..f4a5c0b --- /dev/null +++ b/cookbooks/mingw/resources/msys2_package.rb @@ -0,0 +1,139 @@ +# +# Cookbook:: mingw +# Resource:: msys2_package +# +# Copyright:: 2016-2019, Chef Software, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# Installs msys2 base system and installs/upgrades packages within in. +# +# Where's the version flag? Where's idempotence you say? Well f*** you +# for trying to version your product. This is arch. They live on the edge. +# You never get anything but the latest version. And if that's broken... +# well that's your problem isn't it? And they don't believe in preserving +# older versions. Good luck! + +property :package, String, name_property: true +property :root, String, required: true + +provides :msys2_package + +action_class do + # + # Runs a command through a bash login shell made by our shim .bat file. + # The bash.bat file defaults %HOME% to #{root}/home/%USERNAME% and requests + # that the command be run in the current working directory. + # + def msys2_exec(comment, cmd) + f_root = win_friendly_path(root) + execute comment do + command ".\\bin\\bash.bat -c '#{cmd}'" + cwd f_root + live_stream true + environment('MSYSTEM' => 'MSYS') + end + end + + def msys2_init + cache_dir = ::File.join(root, '.cache') + f_cache_dir = win_friendly_path(cache_dir) + base_url = node['msys2']['url'] + base_checksum = node['msys2']['checksum'] + + unless ::File.exist?(::File.join(root, 'msys2.exe')) + seven_zip_archive "cache msys2 base to #{f_cache_dir}" do + source base_url + path f_cache_dir + checksum base_checksum + overwrite true + end + + seven_zip_archive "extract msys2 base archive to #{f_cache_dir}" do + source "#{f_cache_dir}\\#{tar_name(base_url)}" + path f_cache_dir + overwrite true + end + + ruby_block 'copy msys2 base files to root' do + block do + # Oh my god msys2 and pacman are picky as hell when it comes to + # updating core files. They use the mtime on certain files to + # determine if they need to updated or not and simply skip various + # steps otherwise. + ::FileUtils.cp_r(::Dir.glob("#{cache_dir}/msys64/*"), root, preserve: true) + end + end + end + + pacman_key_dir = ::File.join(root, 'etc/pacman.d/gnupg') + bin_dir = ::File.join(root, 'bin') + + directory win_friendly_path(bin_dir) + + cookbook_file win_friendly_path("#{bin_dir}/bash.bat") do + source 'bash.bat' + cookbook 'mingw' + end + + cookbook_file win_friendly_path(::File.join(root, 'custom-upgrade.sh')) do + source 'custom-upgrade.sh' + cookbook 'mingw' + end + + cookbook_file win_friendly_path(::File.join(root, 'etc/profile.d/custom_prefix.sh')) do + source 'custom_prefix.sh' + cookbook 'mingw' + end + + # $HOME is using files from /etc/skel. The home-directory creation step + # will automatically be performed if other users log in - so if you wish + # to globally modify user first time setup, edit /etc/skel or add + # "post-setup" steps to /etc/post-install/ + # The first-time init shell must be restarted and cannot be reused. + msys2_exec('msys2 first time init', 'exit') unless ::File.exist?(pacman_key_dir) + + # Update pacman and msys base packages. + if ::File.exist?(::File.join(root, 'usr/bin/update-core')) || !::File.exist?(::File.join(root, 'custom-upgrade.sh')) + msys2_exec('upgrade msys2 core', '/custom-upgrade.sh') + msys2_exec('upgrade msys2 core: part 2', 'pacman -Suu --noconfirm') + # Now we can actually upgrade everything ever. + msys2_exec('upgrade entire msys2 system: 1', 'pacman -Syuu --noconfirm') + # Might need to do it once more to pick up a few stragglers. + msys2_exec('upgrade entire msys2 system: 2', 'pacman -Syuu --noconfirm') + end + end + + def msys2_do_action(comment, action_cmd) + msys2_init + msys2_exec(comment, action_cmd) + end +end + +action :install do + msys2_do_action("installing #{package}", "pacman -S --needed --noconfirm #{package}") +end + +# Package name is ignored. This is arch. Why would you ever upgrade a single +# package and its deps? That'll just break everything else that ever depended +# on a different version of that dep. Because arch is wonderful like that. +# So you only get the choice to move everything to latest or not... it's the +# most agile development possible! +action :upgrade do + msys2_do_action("upgrading #{package}", "pacman -Syu --noconfirm #{package}") +end + +action :remove do + msys2_do_action("removing #{package}", "pacman -R --noconfirm #{package}") +end diff --git a/cookbooks/mingw/resources/tdm_gcc.rb b/cookbooks/mingw/resources/tdm_gcc.rb new file mode 100644 index 0000000..c30a70c --- /dev/null +++ b/cookbooks/mingw/resources/tdm_gcc.rb @@ -0,0 +1,112 @@ +# +# Cookbook:: mingw +# Resource:: tdm_gcc +# +# Copyright:: 2016-2019, Chef Software, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# Installs a gcc based C/C++ compiler and runtime from TDM GCC. + +property :flavor, Symbol, is: [:sjlj_32, :seh_sjlj_64], default: :seh_sjlj_64 +property :root, String, required: true +property :version, String, is: ['5.1.0'], name_property: true + +tdm_gcc_64 = { + 'http://iweb.dl.sourceforge.net/project/tdm-gcc/TDM-GCC%205%20series/5.1.0-tdm64-1/gcc-5.1.0-tdm64-1-core.tar.lzma' => + '29393aac890847089ad1e93f81a28f6744b1609c00b25afca818f3903e42e4bd', + 'http://iweb.dl.sourceforge.net/project/tdm-gcc/MinGW-w64%20runtime/GCC%205%20series/mingw64runtime-v4-git20150618-gcc5-tdm64-1.tar.lzma' => + '29186e0bb36824b10026d78bdcf238d631d8fc1d90718d2ebbd9ec239b6f94dd', + 'http://iweb.dl.sourceforge.net/project/tdm-gcc/GNU%20binutils/binutils-2.25-tdm64-1.tar.lzma' => + '4722bb7b4d46cef714234109e25e5d1cfd29f4e53365b6d615c8a00735f60e40', + 'http://iweb.dl.sourceforge.net/project/tdm-gcc/TDM-GCC%205%20series/5.1.0-tdm64-1/gcc-5.1.0-tdm64-1-c%2B%2B.tar.lzma' => + '17fd497318d1ac187a113e8665330d746ad9607a0406ab2374db0d8e6f4094d1', +} + +tdm_gcc_32 = { + 'http://iweb.dl.sourceforge.net/project/tdm-gcc/TDM-GCC%205%20series/5.1.0-tdm-1%20SJLJ/gcc-5.1.0-tdm-1-core.tar.lzma' => + '9199e6ecbce956ff4704b52098beb38e313176ace610285fb93758a08752870e', + 'http://iweb.dl.sourceforge.net/project/tdm-gcc/TDM-GCC%205%20series/5.1.0-tdm-1%20SJLJ/gcc-5.1.0-tdm-1-c%2B%2B.tar.lzma' => + '19fe46819ce43531d066b438479300027bbf06da57e8a10be5100466f80c28fc', +} + +action :install do + cache_dir = ::File.join(root, '.cache') + f_root = win_friendly_path(root) + + if flavor == :sjlj_32 + [ + 'binutils-bin=2.25.1', + 'libintl-dll=0.18.3.2', + 'mingwrt-dll=3.21.1', + 'mingwrt-dev=3.21.1', + 'w32api-dev=3.17', + ].each do |package_fragment| + mingw_get "install #{package_fragment} at #{f_root}" do + package "mingw32-#{package_fragment}-*" + root new_resource.root + end + end + end + + to_fetch = + case flavor + when :sjlj_32 + tdm_gcc_32 + when :seh_sjlj_64 + tdm_gcc_64 + else + raise "Unknown flavor: #{flavor}" + end + + to_fetch.each do |url, hash| + seven_zip_archive "cache #{archive_name(url)} to #{win_friendly_path(cache_dir)}" do + source url + path cache_dir + checksum hash + overwrite true + end + + seven_zip_archive "extract #{tar_name(url)} to #{f_root}" do + source ::File.join(cache_dir, tar_name(url)) + path root + overwrite true + end + end + + # Patch time.h headers for compatibility with winpthreads. + # These patches were made for binutils 2.25.1 for 32-bit TDM GCC only. + if flavor == :sjlj_32 + include_dir = win_friendly_path(::File.join(root, 'include')) + cookbook_file "#{include_dir}\\pthread.h" do + cookbook 'mingw' + source 'pthread.h' + end + + cookbook_file "#{include_dir}\\time.h" do + cookbook 'mingw' + source 'time.h' + end + end +end + +def archive_name(source) + url = ::URI.parse(source) + ::File.basename(::URI.unescape(url.path)) +end + +def tar_name(source) + aname = archive_name(source) + ::File.basename(aname, ::File.extname(aname)) +end diff --git a/site-cookbooks/kosmos-ipfs/recipes/default.rb b/site-cookbooks/kosmos-ipfs/recipes/default.rb index a8761c2..7be4ba5 100644 --- a/site-cookbooks/kosmos-ipfs/recipes/default.rb +++ b/site-cookbooks/kosmos-ipfs/recipes/default.rb @@ -17,28 +17,28 @@ unless node.chef_environment == "development" include_recipe "kosmos-ipfs::firewall_swarm" end -firewall_rule 'ipfs_api' do +firewall_rule 'ipfs api' do port node['kosmos-ipfs']['api_port'] source "10.1.1.0/24" protocol :tcp command :allow end -firewall_rule 'ipfs_gateway' do +firewall_rule 'ipfs gateway' do port node['kosmos-ipfs']['gateway_port'] source "10.1.1.0/24" protocol :tcp command :allow end -firewall_rule 'ipfs_local_p2p_allow_out' do +firewall_rule 'ipfs local p2p' do destination "10.1.1.0/24" direction :out protocol :none command :allow end -firewall_rule 'ipfs_local_p2p_deny_out' do +firewall_rule 'ipfs local p2p' do destination "10.0.0.0/8" direction :out protocol :none diff --git a/site-cookbooks/kosmos-ipfs/recipes/firewall_swarm.rb b/site-cookbooks/kosmos-ipfs/recipes/firewall_swarm.rb index 3c3aeeb..a1636d4 100644 --- a/site-cookbooks/kosmos-ipfs/recipes/firewall_swarm.rb +++ b/site-cookbooks/kosmos-ipfs/recipes/firewall_swarm.rb @@ -4,7 +4,7 @@ # include_recipe 'firewall' -firewall_rule 'ipfs_swarm_p2p' do +firewall_rule 'ipfs swarm p2p' do port node['kosmos-ipfs']['swarm_p2p_port'] protocol :tcp command :allow