\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5×\D6?\BDê\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2€ \00 $\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4ê\E9\F2á\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// File Manager

File Manager

Path: /opt/chef/embedded/lib/ruby/gems/2.7.0/gems/inspec-core-4.22.1/lib/inspec/resources/

Viewing File: firewalld.rb

require "inspec/resources/command"

module Inspec::Resources
  class FirewallD < Inspec.resource(1)
    ###
    #  This recourse assumes that the file sudo vim /etc/polkit-1/rules.d/49-nopasswd_global.rules has been
    #  set to allow users in group "wheel" to perform any commands without authentication.
    ###

    name "firewalld"
    supports platform: "linux"
    desc "Use the firewalld resource to check and see if firewalld is configured to grand or deny access to specific hosts or services"
    example <<~EXAMPLE
      describe firewalld do
        it { should be_running }
        its('default_zone') { should eq 'public' }
        it { should have_service_enabled_in_zone('ssh', 'public') }
        it { should have_rule_enabled('rule family=ipv4 source address=192.168.0.14 accept', 'public') }
      end

      describe firewalld.where { zone == 'public' } do
        its('interfaces') { should cmp ['enp0s3', 'eno2'] }
        its('sources') { should cmp ['ssh', 'icmp'] }
        its('services') { should cmp ['192.168.1.0/24', '192.168.1.2'] }
      end
    EXAMPLE

    attr_reader :params

    filter = FilterTable.create
    filter.register_column(:zone, field: "zone")
      .register_column(:interfaces, field: "interfaces")
      .register_column(:sources,    field: "sources")
      .register_column(:services,   field: "services")

    filter.install_filter_methods_on_resource(self, :params)

    def initialize
      @params = parse_active_zones(active_zones)
    end

    def installed?
      inspec.command("firewall-cmd").exist?
    end

    def has_zone?(query_zone)
      return false unless installed?

      result = firewalld_command("--get-zones").split(" ")
      result.include?(query_zone)
    end

    def running?
      return false unless installed?

      result = firewalld_command("--state")
      result =~ /^running/ ? true : false
    end

    def default_zone
      # return: word associated with the name of the default zone
      # example: 'public'
      firewalld_command("--get-default-zone")
    end

    def has_service_enabled_in_zone?(query_service, query_zone = default_zone)
      firewalld_command("--zone=#{query_zone} --query-service=#{query_service}") == "yes"
    end

    def service_ports_enabled_in_zone(query_service, query_zone = default_zone)
      # return: String of ports open
      # example: ['22/tcp', '4722/tcp']
      firewalld_command("--zone=#{query_zone} --service=#{query_service} --get-ports --permanent").split(" ")
    end

    def service_protocols_enabled_in_zone(query_service, query_zone = default_zone)
      # return: String of protocoals open
      # example: ['icmp', 'ipv4', 'igmp']
      firewalld_command("--zone=#{query_zone} --service=#{query_service} --get-protocols --permanent").split(" ")
    end

    def has_port_enabled_in_zone?(query_port, query_zone = default_zone)
      firewalld_command("--zone=#{query_zone} --query-port=#{query_port}") == "yes"
    end

    def has_rule_enabled?(rule, query_zone = default_zone)
      rule = "rule #{rule}" unless rule.start_with?("rule")
      firewalld_command("--zone=#{query_zone} --query-rich-rule='#{rule}'") == "yes"
    end

    def to_s
      "Firewall Rules"
    end

    private

    def active_zones
      # return syntax:
      #   [default-zone-name]
      #       interfaces: [open interfases]
      #
      # example:
      #   public
      #       interfaces: enp0s3
      firewalld_command("--get-active-zones")
    end

    def parse_active_zones(content)
      # Split by every second line, which contains the zone and the interfaces.
      content = content.split(/\n/).each_slice(2).map { |slice| slice.join("\n") }
      content.map do |line|
        parse_line(line)
      end.compact
    end

    def parse_line(line)
      zone = line.split("\n")[0]
      {
        "zone" => zone,
        "interfaces" => line.split(":")[1].split(" "),
        "services" => services_bound(zone),
        "sources" => sources_bound(zone),
      }
    end

    def sources_bound(query_zone)
      # result: a list containing either an ip address or ip address with a mask, or a ipset or an ipset with the ipset prefix.
      # example: ['192.168.0.4', '192.168.0.0/16', '2111:DB28:ABC:12::', '2111:db89:ab3d:0112::0/64']
      firewalld_command("--zone=#{query_zone} --list-sources").split(" ")
    end

    def services_bound(query_zone)
      # result: a list of services bound to a zone.
      # example: ['ssh', 'dhcpv6-client']
      firewalld_command("--zone=#{query_zone} --list-services").split(" ")
    end

    def firewalld_command(command)
      command = "firewall-cmd #{command}"
      result = inspec.command(command)
      if result.stderr != ""
        return "Error on command #{command}: #{result.stderr}"
      end

      result.stdout.strip
    end
  end
end