undefined method interface & log_level with 7.0.0 not seen in 6.3.9

[bill538]

🗣️ Foreword

Thank for taking the time to fill this bug report fully. Without it we may not be able to fix the bug, and the issue may be closed without resolution.

👻 Brief Description

It looks like in 7.0.0 the log_level method in the firewall resource and interface method in the firewall_rule resource are no longer supported but the documentation shows as supported.

🥞 Cookbook version

Issue started in version 7.0.0 but not an issue in 6.3.9 of firewall cookbook.

👩‍🍳 Chef-Infra Version

     chef_version=18.5.0
     platform=oracle
     platform_version=8.9
     ruby=ruby 3.1.4p223 (2023-03-30 revision 957bb7cb81) [x86_64-linux]
     program_name=/opt/chef/bin/chef-client
     executable=/opt/chef/bin/chef-client

🎩 Platform details

OEL Linux 7, 8 and 9

Steps To Reproduce

Steps to reproduce the behavior:
Below is sample code.

      # enable platform default firewall
      firewall 'install firewalld service' do
        log_level :low
        action :install
      end

      firewall_rule 'local ldap build testing ports' do
        dest_port 33349...33408
        source    '127.0.0.1/32'
        interface 'lo'
        command :allow
      end

🚓 Expected behavior

I would expect log_level & interface methods to be supported as they are key config parms

➕ Additional context

I do see a potential odd reference in both undefined method errors firewall_firewall_rule_firewalld & firewall_firewall_firewalld where firewall is listed twice. I will test more locally this looks to be a bug.

`

     Recipe Compile Error in /tmp/kitchen/cache/cookbooks/geidm_teamcity_site/recipes/default.rb
     ================================================================================

     NoMethodError
     -------------
     undefined method `log_level' for Custom resource firewall_firewall_firewalld from cookbook firewall

     Cookbook Trace: (most recent call first)
     ----------------------------------------
       /tmp/kitchen/cache/cookbooks/server/recipes/firewall.rb:47:in `block in from_file'
       /tmp/kitchen/cache/cookbooks/server/recipes/firewall.rb:46:in `from_file'
       /tmp/kitchen/cache/cookbooks/server/recipes/default.rb:20:in `from_file'
       /tmp/kitchen/cache/cookbooks/teamcity/recipes/server.rb:11:in `from_file'
       /tmp/kitchen/cache/cookbooks/teamcity/recipes/default.rb:9:in `from_file'

     Relevant File Content:
     ----------------------
     /tmp/kitchen/cache/cookbooks/server/recipes/firewall.rb:

      44:
      45:  # enable platform default firewall
      46:  firewall 'install firewalld service' do
      47>>   log_level :"#{node['firewall']['loglevel']}"
      48:    action :install
      49:  end
      50:

     System Info:
     ------------
     chef_version=18.5.0
     platform=oracle
     platform_version=8.9
     ruby=ruby 3.1.4p223 (2023-03-30 revision 957bb7cb81) [x86_64-linux]
     program_name=/opt/chef/bin/chef-client
     executable=/opt/chef/bin/chef-client


     ================================================================================
     Recipe Compile Error in /tmp/kitchen/cache/cookbooks/teamcity/recipes/default.rb
     ================================================================================

     NoMethodError
     -------------
     undefined method `interface' for Custom resource firewall_firewall_rule_firewalld from cookbook firewall

     Cookbook Trace: (most recent call first)
     ----------------------------------------
       /tmp/kitchen/cache/cookbooks/teamcity/recipes/firewall.rb:47:in `block in from_file'
       /tmp/kitchen/cache/cookbooks/teamcity/recipes/firewall.rb:44:in `from_file'
       /tmp/kitchen/cache/cookbooks/teamcity/recipes/default.rb:10:in `from_file'

     Relevant File Content:
     ----------------------
     /tmp/kitchen/cache/cookbooks/teamcity/recipes/firewall.rb:

      40:    end
      41:  end
      42:
      43:  if node['teamcity']['install_type']['build_agent']
      44:    firewall_rule 'local ldap build testing ports' do
      45:      dest_port 33349...33408
      46:      source    '127.0.0.1/32'
      47>>     interface 'lo'
      48:      command :allow
      49:    end
      50:

     System Info:
     ------------
     chef_version=18.5.0
     platform=oracle
     platform_version=8.9
     ruby=ruby 3.1.4p223 (2023-03-30 revision 957bb7cb81) [x86_64-linux]
     program_name=/opt/chef/bin/chef-client

`

[decoyjoe]

This is actually the expected behavior, although I admit it's not obvious.

You're running Oracle Linux which defaults to firewalld and those properties you're using are not supported on firewalld. From resource docs:

• log_level: UFW only.
• interface: iptables, UFW, Windows.

The previous version of this cookbook quietly ignored those properties if they weren't supported on the current platform. The behavior was changed in 7.0.0 to fail so users are aware they're using a property that isn't doing anything because it's important that you're notified if your firewall isn't behaving like you expect it to behave.

If you want to use UFW or iptables on your system instead, then you can set ['firewall']['solution'] attribute according, e.g. default['firewall']['solution'] = 'iptables'.

We should probably be more explicit about it and fail with an error message that indicates the property isn't supported on the current firewall solution.

[bill538]

Thanks for the details on this. I have pinned my builds to firewall 6.3.9 for now and will work on my cleanup on this issue. I will upgrade to 7.0.1 when the other issue #307 "protocol method is not defaulting to :tcp and is required" has been published.

…

On Mon, Jan 27, 2025 at 2:51 PM Joseph Larionov ***@***.***> wrote: This is actually the expected behavior, although I admit it's not obvious. You're running Oracle Linux which defaults to firewalld <https://github.com/sous-chefs/firewall?tab=readme-ov-file#supported-firewalls-and-platforms> and those properties you're using are not supported on firewalld. From resource docs <https://github.com/sous-chefs/firewall?tab=readme-ov-file#firewall>: - log_level: UFW only. - interface: iptables, UFW, Windows. The previous version of this cookbook quietly ignored those properties if they weren't supported on the current platform. The behavior was changed in 7.0.0 to fail so users are aware they're using a property that isn't doing anything because it's important that you're notified if your firewall isn't behaving like you expect it to behave. If you want to use UFW or iptables on your system instead, then you can set ['firewall']['solution'] attribute according, e.g. default['firewall']['solution'] = 'iptables'. We should probably be more explicit about it and fail with an error message that indicates the property isn't supported on the current firewall solution. — Reply to this email directly, view it on GitHub <#306 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACJIGR5YVM4UJYJ2GAMQHIL2M2E57AVCNFSM6AAAAABV6NZ5KSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMJWG42TIOJZHE> . You are receiving this because you authored the thread.Message ID: ***@***.***>