I would like to know why you did'nt use the firewalld Modules and States?

For exemple your doing in the init.sls file:

reload_firewalld:
  cmd.wait:
    - name: 'firewall-cmd --reload'
    - require:
      - service: service_firewalld

But the Modules do the same things:

reload_firewalld:
  modules.wait:
    - name: firewalld.reload_rules
    - require:
      - service: service_firewalld

Why you don't use the states firewalld.present ? This states reload firewalld if something changed.

Is your feature request related to a problem?

Newer versions of firewalld support a priority attribute for rich rules. Migrating from iptables to nftables I need this functionality as direct-rules can no longer be used for what I want.

Describe the solution you'd like

Add a rich_rule priority key such that <rule priority={{ rule.priority }}> is the output.

Additional context

I might get around to creating a PR. /shrug

Like this maybe:

diff --git a/firewalld/files/service.xml b/firewalld/files/service.xml
index 7f82938..2998443 100644
--- a/firewalld/files/service.xml
+++ b/firewalld/files/service.xml
@@ -24,6 +24,9 @@
   {%- endfor %}
 {%- endif %}
 {%- endif %}
+{%- if 'protocol' in service %}
+  <protocol value="{{ service.protocol }}" />
+{%- endif %}
 {%- if 'destinations' in service %}
   {%- if 'ipv4' in service.destinations %}
     {%- for v in service.destinations.ipv4 %}

Is your feature request related to a problem?

For compatibility reasons, RHEL/CentOS 7/8 firewalld packages come with zone drifting enabled by default, while best practices are to keep it disabled.

Describe the solution you'd like

Disabling zone drifting requires adding AllowZoneDrifting = no to /etc/firewalld/firewalld.conf. Since this file is managed by the firewalld formula, it would be interesting to add support for this option to the formula.

Describe alternatives you've considered

None.

Additional context

None.

Your setup

Formula commit hash / release tag

v1.0.0

Versions reports (master & minion)

3000.2

Pillar / config used

Working:

firewalld:
  zones:
    public:
      ports:
        - comment: "test"
          port: 8080
          protocol: tcp

Not working:

firewalld:
  zones:
    public:
      test_ports:
        - comment: "test"
          port: 8080
          protocol: tcp

Bug details

Describe the bug

When using *_ports instead of ports in pillar config, the comment is not present in rendered /etc/firewalld/zones/public.xml

Steps to reproduce the bug

Use a the above pillar config.

Expected behaviour

Comment is rendered to /etc/firewalld/zones/public.xml

Kitchen is failing with CentOS 8.

Getting below error.

   ----------
             ID: reload_firewalld
       Function: cmd.wait
           Name: firewall-cmd --reload
         Result: False
        Comment: Command "firewall-cmd --reload" run
        Started: 07:47:16.273429
       Duration: 906.76 ms
        Changes:
          ----------
          pid:
              381
          retcode:
              13
          stderr:
              Error: COMMAND_FAILED: 'handle'
          stdout:

   Summary for local
   -------------
   Succeeded: 13 (changed=6)
   Failed:     1
   -------------
   Total states run:     14
   Total run time:   23.381 s

------Exception-------
Class: Kitchen::ActionFailed
Message: 1 actions failed.
Converge failed on instance . Please see .kitchen/logs/default-centos-8-3003-3-py3.log for more details

Please see .kitchen/logs/kitchen.log for more details
Also try running kitchen diagnose --all for configuration

Log file ... .kitchen/logs/default-centos-8-3003-3-py3.log

I, [2021-11-29T01:47:17.223037 #1067803] INFO -- default-centos-8-3003-3-py3: ^[[0;32mSucceeded: 13^[[0;0m (^[[0;32mchanged=6^[[0;0m)
I, [2021-11-29T01:47:17.223052 #1067803] INFO -- default-centos-8-3003-3-py3: ^[[0;31mFailed: 1^[[0;0m
I, [2021-11-29T01:47:17.223067 #1067803] INFO -- default-centos-8-3003-3-py3: ^[[0;36m-------------
I, [2021-11-29T01:47:17.223081 #1067803] INFO -- default-centos-8-3003-3-py3: Total states run: 14^[[0;0m
I, [2021-11-29T01:47:17.223096 #1067803] INFO -- default-centos-8-3003-3-py3: ^[[0;36mTotal run time: 23.381 s^[[0;0m
E, [2021-11-29T01:47:17.557454 #1067803] ERROR -- default-centos-8-3003-3-py3: Converge failed on instance .
E, [2021-11-29T01:47:17.557712 #1067803] ERROR -- default-centos-8-3003-3-py3: ------Exception-------
E, [2021-11-29T01:47:17.557749 #1067803] ERROR -- default-centos-8-3003-3-py3: Class: Kitchen::ActionFailed
E, [2021-11-29T01:47:17.557765 #1067803] ERROR -- default-centos-8-3003-3-py3: Message: SSH exited (2) for command: [sudo -E chmod +x /tmp/kitchen/.sh;sudo -E /tmp/kitchen/dependencies.sh;sudo -E salt-call --state-output=changes --config-dir=/tmp/kitchen/etc/salt state.highstate --log-level=debug --retcode-passthrough]
E, [2021-11-29T01:47:17.557779 #1067803] ERROR -- default-centos-8-3003-3-py3: ----------------------
E, [2021-11-29T01:47:17.557791 #1067803] ERROR -- default-centos-8-3003-3-py3: ------Backtrace-------
E, [2021-11-29T01:47:17.557802 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/provisioner/base.rb:100:in rescue in call' E, [2021-11-29T01:47:17.557813 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/provisioner/base.rb:99:in call'
E, [2021-11-29T01:47:17.557825 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:419:in block in converge_action' E, [2021-11-29T01:47:17.557836 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:563:in synchronize_or_call'
E, [2021-11-29T01:47:17.557847 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:524:in block in action' E, [2021-11-29T01:47:17.557858 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/rubies/ruby-2.6.6/lib/ruby/2.6.0/benchmark.rb:293:in measure'
E, [2021-11-29T01:47:17.557890 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:523:in action' E, [2021-11-29T01:47:17.557905 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:414:in converge_action'
E, [2021-11-29T01:47:17.557917 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:392:in block (2 levels) in transition_to' E, [2021-11-29T01:47:17.557928 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/lifecycle_hooks.rb:47:in run_with_hooks'
E, [2021-11-29T01:47:17.557939 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:391:in block in transition_to' E, [2021-11-29T01:47:17.557950 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:390:in each'
E, [2021-11-29T01:47:17.557962 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:390:in transition_to' E, [2021-11-29T01:47:17.557973 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:139:in converge'
E, [2021-11-29T01:47:17.557984 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/command.rb:195:in public_send' E, [2021-11-29T01:47:17.557996 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/command.rb:195:in run_action_in_thread'
E, [2021-11-29T01:47:17.558007 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/command.rb:166:in block (2 levels) in run_action' E, [2021-11-29T01:47:17.558018 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/logging-2.3.0/lib/logging/diagnostic_context.rb:474:in block in create_with_logging_context'
E, [2021-11-29T01:47:17.558034 #1067803] ERROR -- default-centos-8-3003-3-py3: ----End Backtrace-----
E, [2021-11-29T01:47:17.558046 #1067803] ERROR -- default-centos-8-3003-3-py3: ---Nested Exception---
E, [2021-11-29T01:47:17.558057 #1067803] ERROR -- default-centos-8-3003-3-py3: Class: Kitchen::Transport::SshFailed
E, [2021-11-29T01:47:17.558068 #1067803] ERROR -- default-centos-8-3003-3-py3: Message: SSH exited (2) for command: [sudo -E chmod +x /tmp/kitchen/.sh;sudo -E /tmp/kitchen/dependencies.sh;sudo -E salt-call --state-output=changes --config-dir=/tmp/kitchen/etc/salt state.highstate --log-level=debug --retcode-passthrough]
E, [2021-11-29T01:47:17.558080 #1067803] ERROR -- default-centos-8-3003-3-py3: ----------------------
E, [2021-11-29T01:47:17.558091 #1067803] ERROR -- default-centos-8-3003-3-py3: ------Backtrace-------
E, [2021-11-29T01:47:17.558102 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/provisioner/base.rb:100:in rescue in call' E, [2021-11-29T01:47:17.558114 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/provisioner/base.rb:99:in call'
E, [2021-11-29T01:47:17.558125 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:419:in block in converge_action' E, [2021-11-29T01:47:17.558136 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:563:in synchronize_or_call'
E, [2021-11-29T01:47:17.558148 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:524:in block in action' E, [2021-11-29T01:47:17.558159 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/rubies/ruby-2.6.6/lib/ruby/2.6.0/benchmark.rb:293:in measure'
E, [2021-11-29T01:47:17.558170 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:523:in action' E, [2021-11-29T01:47:17.558181 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:414:in converge_action'
E, [2021-11-29T01:47:17.558193 #1067803] ERROR -- default-centos-8-3003-3-py3: /home/a555066/.rvm/gems/ruby-2.6.6/gems/test-kitchen-3.2.0/lib/kitchen/instance.rb:392:in `block (2 levels) in transition_to'

firewalld-formular will render the following pillar data into a XML service file:

  services:
    monitoring:
      short: monitoring
      description: >-
        These ports are required for monitoring based on check_mk & NRPE.
      ports:
        tcp:
          - 5665
          - 6556

However it does not encode XML entities (such as & into &, which leads to the service not being loaded into firewalld` and the following error message:

ERROR: Failed to load service file
'/etc/firewalld/services/monitoring.xml': INVALID_SERVICE: not a valid
service file: not well-formed (invalid token): line 9, column 74

Hence, this service will not be loaded and the firewall behaves differently than expected.

Apparently firewalld service can run on Suse. This should be looked into.

Migration from SuSEfirewall2
Migrating from one firewall solution to another is not always a trivial process and moving from SuSEfirewall2 to firewalld is no different. However, a simple script has been developed in order to make this migration as smooth as possible. Depending on your setup, the script may simply do the right thing and be done with it or fail to do anything useful. The package is called susefirewall2-to-firewalld and you can use it as follows:

sudo zypper install susefirewall2-to-firewalld
sudo susefirewall2-to-firewalld

I'd like to be able to use this formula as part of DevOps within a company, hosting it on our own git servers (for reasons of no external dependencies), possibly having the ability to change the files as well without having to post them externally (although I'd obviously be happy to provide PR for genuinely usefull additions). IANAL means that I cannot be sure whether the extra clause in the licence file conflicts with our use case.

Even a reply here placating these concerns, again because IANAL, means I still don't know whether we can use it.

The simplest for us would be a change of the LICENSE to be a standard Apache Licence as most other saltstack formulas are.

Section I'd like removed:
EXCEPTIONS:
You MAY NOT upload parts or the whole work of this product on Github or
any other platform again UNLESS you are in possession of an agreement
by the author OR use the function called "FORK" provided on Github itself.
Other parts of the specified license above are not affected.

this formula needs to accomodate for ipset rules:

• ipset files:

fail2ban-sshd.xml
<?xml version="1.0" encoding="utf-8"?>
<ipset type="hash:ip">
  <option name="maxelem" value="65536"/>
  <option name="timeout" value="600"/>
  <option name="hashsize" value="1024"/>
</ipset>

and rich_rules in zone.xml:

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="dns"/>
  <service name="ssdp"/>
  <service name="deluge-client"/>
  <service name="dhcpv6-client"/>
  <service name="mdns"/>
  <service name="plexmediaserver"/>
  <rule>
    <source ipset="fail2ban-sshd-ddos"/>
    <drop/>
  </rule>
  <rule>
    <source ipset="fail2ban-sshd-ddos"/>
    <drop/>
  </rule>
</zone>

Thanks for the formula! Is it possible to re-use ports like this (below). Where I have port 3232 overlapping a service definition, and applied to two different groups of hosts? I'm trying to get this to work, but it seems like when ports overlap it fails to render the SLS. I'm in the process of setting up another test environment to test it more.

# FirewallD pillar examples:
firewalld:
  enabled: True
  ipset: True
  default_zone: public

  services:
    sshcustom:
      short: sshcustom
      description: SSH
      ports:
        tcp:
          - 3232
          - 5252
   
    sshcustom2:
      short: sshcustom2
      description: SSH
      ports:
        tcp:
          - 3232
          - 522
    

  zones:
    public:
      short: Public
      description: "For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted."
      services:
      
     # Our first set of hosts
      {% if grains['id'] == 'salt.example.com' %}
        - sshcustom
        - sshcustom2
      {% endif %}

     #  Another set of hosts
     {% if grains['id'] == 'hosts.anotherdomain.com' %}
        - sshcustom
        - sshcustom2
      {% endif %}

        - http
        - https
        - salt-minion