Merge pull request #160 from chef-cookbooks/chef13

Initial Chef 13.x support

.foodcritic

@@ -0,0 +1,3 @@
+~FC001
+~FC057
+~FC019

.kitchen.yml

@@ -3,7 +3,7 @@ driver:
 
 provisioner:
   name: chef_zero
-  require_chef_omnibus: 12.8.1
+  require_chef_omnibus: 13.0.118
   attributes:
     firewall:
       allow_ssh: true
@@ -12,7 +12,6 @@ provisioner:
         permanent: true
 
 platforms:
-  - name: centos-5.11
   - name: centos-6.8
   - name: centos-7.2
   - name: debian-7.11
@@ -21,18 +20,13 @@ platforms:
   - name: debian-8.6
     run_list:
       - recipe[apt]
-  - name: ubuntu-12.04
-    run_list:
-      - recipe[apt::default]
   - name: ubuntu-14.04
     run_list:
       - recipe[apt::default]
   - name: ubuntu-16.04
     run_list:
       - recipe[apt::default]
   - name: windows-2012r2
-    driver_config:
-      box: windows2012r2
 
 suites:
   - name: default

Gemfile

@@ -1,29 +1,29 @@
 source 'https://rubygems.org'
 
 group :lint do
-  gem 'foodcritic', '~> 5.0'
-  gem 'rubocop', '~> 0.34'
-  gem 'cookstyle', '~> 0.0.1'
+  gem 'cookstyle', '~> 1.3'
+  gem 'foodcritic', '~> 10.3'
+  gem 'rubocop', '~> 0.47'
 end
 
 group :unit do
-  gem 'berkshelf', '~> 4.0'
-  gem 'chefspec'
+  gem 'berkshelf', '~> 5.6'
+  gem 'chef', '>= 13'
   gem 'chef-sugar'
-  gem 'chef', '>= 12'
+  gem 'chefspec'
 end
 
 group :kitchen_windows do
-  gem 'winrm-transport'
-  gem 'winrm-fs', '~> 0.4.1'
+  gem 'winrm', '~> 2.0'
+  gem 'winrm-fs', '~> 1.0'
 end
 
 group :kitchen_common do
-  gem 'test-kitchen', '~> 1.4'
+  gem 'test-kitchen', '~> 1.16'
 end
 
 group :kitchen_vagrant do
-  gem 'kitchen-vagrant', '~> 0.19'
+  gem 'kitchen-vagrant', '~> 1.1'
   gem 'vagrant-wrapper'
 end
 
@@ -33,14 +33,14 @@ group :kitchen_cloud do
 end
 
 group :development do
-  gem 'ruby_gntp'
   gem 'growl'
-  gem 'rb-fsevent'
   gem 'guard'
-  gem 'guard-kitchen'
   gem 'guard-foodcritic'
+  gem 'guard-kitchen'
   gem 'guard-rspec'
   gem 'guard-rubocop'
   gem 'rake', '~> 11.0'
+  gem 'rb-fsevent'
+  gem 'ruby_gntp'
   gem 'stove'
 end

attributes/iptables.rb

@@ -1,14 +1,14 @@
 default['firewall']['iptables']['defaults'][:policy] = {
   input: 'DROP',
   forward: 'DROP',
-  output: 'ACCEPT'
+  output: 'ACCEPT',
 }
 default['firewall']['iptables']['defaults'][:ruleset] = {
   '*filter' => 1,
   ":INPUT #{node['firewall']['iptables']['defaults'][:policy][:input]}" => 2,
   ":FORWARD #{node['firewall']['iptables']['defaults'][:policy][:forward]}" => 3,
   ":OUTPUT #{node['firewall']['iptables']['defaults'][:policy][:output]}" => 4,
-  'COMMIT_FILTER' => 100
+  'COMMIT_FILTER' => 100,
 }
 
 default['firewall']['ubuntu_iptables'] = false

attributes/ufw.rb

@@ -7,6 +7,6 @@
     input: 'DROP',
     output: 'ACCEPT',
     forward: 'DROP',
-    application: 'SKIP'
-  }
+    application: 'SKIP',
+  },
 }

attributes/windows.rb

@@ -3,6 +3,6 @@
 default['firewall']['windows']['defaults'] = {
   policy: {
     input: 'blockinbound',
-    output: 'allowoutbound'
-  }
+    output: 'allowoutbound',
+  },
 }

libraries/helpers_firewalld.rb

@@ -18,14 +18,14 @@ def firewalld_active?
       end
 
       def firewalld_default_zone?(z)
-        raise false unless firewalld_active?
+        return false unless firewalld_active?
 
         cmd = shell_out('firewall-cmd', '--get-default-zone')
         cmd.stdout =~ /^#{z.to_s}$/
       end
 
       def firewalld_default_zone!(z)
-        raise 'firewall not active' unless firewalld_active?
+        raise 'firewalld not active' unless firewalld_active?
 
         shell_out!('firewall-cmd', "--set-default-zone=#{z}")
       end

libraries/provider_firewall_firewalld.rb

@@ -27,36 +27,39 @@ def whyrun_supported?
       false
     end
 
-    action :install do
-      next if disabled?(new_resource)
+    def action_install
+      return if disabled?(new_resource)
 
-      converge_by('install firewalld, create template for /etc/sysconfig') do
-        package 'firewalld' do
-          action :install
-          options new_resource.package_options
-        end
-
-        service 'firewalld' do
-          action [:enable, :start]
-        end
+      firewalld_package = package 'firewalld' do
+        action :nothing
+        options new_resource.package_options
+      end
+      firewalld_package.run_action(:install)
+      new_resource.updated_by_last_action(firewalld_package.updated_by_last_action?)
+
+      unless ::File.exist?(firewalld_rules_filename)
+        rules_file = lookup_or_create_rulesfile
+        rules_file.content '# created by chef to allow service to start'
+        rules_file.run_action(:create)
+        new_resource.updated_by_last_action(rules_file.updated_by_last_action?)
+      end
 
-        file "create empty #{firewalld_rules_filename}" do
-          path firewalld_rules_filename
-          content '# created by chef to allow service to start'
-          not_if { ::File.exist?(firewalld_rules_filename) }
-        end
+      firewalld_service = lookup_or_create_service
+      [:enable, :start].each do |a|
+        firewalld_service.run_action(a)
+        new_resource.updated_by_last_action(firewalld_service.updated_by_last_action?)
       end
     end
 
-    action :restart do
-      next if disabled?(new_resource)
+    def action_restart
+      return if disabled?(new_resource)
 
       # ensure it's initialized
       new_resource.rules({}) unless new_resource.rules
       new_resource.rules['firewalld'] = {} unless new_resource.rules['firewalld']
 
       # this populates the hash of rules from firewall_rule resources
-      firewall_rules = run_context.resource_collection.select { |item| item.is_a?(Chef::Resource::FirewallRule) }
+      firewall_rules = Chef.run_context.resource_collection.select { |item| item.is_a?(Chef::Resource::FirewallRule) }
       firewall_rules.each do |firewall_rule|
         next unless firewall_rule.action.include?(:create) && !firewall_rule.should_skip?(:create)
 
@@ -79,23 +82,15 @@ def whyrun_supported?
       end
 
       # ensure a file resource exists with the current firewalld rules
-      begin
-        firewalld_file = run_context.resource_collection.find(file: firewalld_rules_filename)
-      rescue
-        firewalld_file = file firewalld_rules_filename do
-          action :nothing
-        end
-      end
-      firewalld_file.content build_rule_file(new_resource.rules['firewalld'])
-      firewalld_file.run_action(:create)
+      rules_file = lookup_or_create_rulesfile
+      rules_file.content build_rule_file(new_resource.rules['firewalld'])
+      rules_file.run_action(:create)
 
       # ensure the service is running without waiting.
-      firewall_service = service 'firewalld' do
-        action :nothing
-      end
+      firewalld_service = lookup_or_create_service
       [:enable, :start].each do |a|
-        firewall_service.run_action(a)
-        new_resource.updated_by_last_action(firewall_service.updated_by_last_action?)
+        firewalld_service.run_action(a)
+        new_resource.updated_by_last_action(firewalld_service.updated_by_last_action?)
       end
 
       # mark updated if we changed the zone
@@ -105,59 +100,80 @@ def whyrun_supported?
       end
 
       # if the file was changed, load new ruleset
-      if firewalld_file.updated_by_last_action?
-        firewalld_flush!
-        # TODO: support logging
-
-        new_resource.rules['firewalld'].sort_by { |_k, v| v }.map { |k, _v| k }.each do |cmd|
-          firewalld_rule!(cmd)
-        end
+      return unless rules_file.updated_by_last_action?
+      firewalld_flush!
+      # TODO: support logging
 
-        new_resource.updated_by_last_action(true)
+      new_resource.rules['firewalld'].sort_by { |_k, v| v }.map { |k, _v| k }.each do |cmd|
+        firewalld_rule!(cmd)
       end
+
+      new_resource.updated_by_last_action(true)
     end
 
-    action :disable do
-      next if disabled?(new_resource)
+    def action_disable
+      return if disabled?(new_resource)
 
       if firewalld_active?
         firewalld_flush!
         firewalld_default_zone!(new_resource.disabled_zone)
         new_resource.updated_by_last_action(true)
       end
 
-      service 'firewalld' do
-        action [:disable, :stop]
+      # ensure the service is stopped without waiting.
+      firewalld_service = lookup_or_create_service
+      [:disable, :stop].each do |a|
+        firewalld_service.run_action(a)
+        new_resource.updated_by_last_action(firewalld_service.updated_by_last_action?)
       end
 
-      file "create empty #{firewalld_rules_filename}" do
-        path firewalld_rules_filename
-        content '# created by chef to allow service to start'
-        action :create
-      end
+      rules_file = lookup_or_create_rulesfile
+      rules_file.content '# created by chef to allow service to start'
+      rules_file.run_action(:create)
+      new_resource.updated_by_last_action(rules_file.updated_by_last_action?)
     end
 
-    action :flush do
-      next if disabled?(new_resource)
-      next unless firewalld_active?
+    def action_flush
+      return if disabled?(new_resource)
+      return unless firewalld_active?
 
       firewalld_flush!
       new_resource.updated_by_last_action(true)
 
-      file "create empty #{firewalld_rules_filename}" do
-        path firewalld_rules_filename
-        content '# created by chef to allow service to start'
-        action :create
-      end
+      rules_file = lookup_or_create_rulesfile
+      rules_file.content '# created by chef to allow service to start'
+      rules_file.run_action(:create)
+      new_resource.updated_by_last_action(rules_file.updated_by_last_action?)
     end
 
-    action :save do
-      next if disabled?(new_resource)
+    def action_save
+      return if disabled?(new_resource)
+      return if firewalld_all_rules_permanent!
 
-      unless firewalld_all_rules_permanent!
-        firewalld_save!
-        new_resource.updated_by_last_action(true)
+      firewalld_save!
+      new_resource.updated_by_last_action(true)
+    end
+
+    def lookup_or_create_service
+      begin
+        firewalld_service = Chef.run_context.resource_collection.find(service: 'firewalld')
+      rescue
+        firewalld_service = service 'firewalld' do
+          action :nothing
+        end
+      end
+      firewalld_service
+    end
+
+    def lookup_or_create_rulesfile
+      begin
+        firewalld_file = Chef.run_context.resource_collection.find(file: firewalld_rules_filename)
+      rescue
+        firewalld_file = file firewalld_rules_filename do
+          action :nothing
+        end
       end
+      firewalld_file
     end
   end
 end