Iptables

.gitignore

@@ -1,5 +1,6 @@
 # Ignore .swp files
 *.swp
+*~
 
 # Ignore Vagrant temp files
 .vagrant

Berksfile

@@ -3,4 +3,8 @@
 
 metadata
 
+cookbook "iptables",
+    git: "git://github.com/RSEmail/iptables.git",
+    branch: "master"
+
 # vim:et:fdm=marker:sts=4:sw=4:ts=4:

attributes/default.rb

@@ -53,4 +53,6 @@
     }
 }
 
+default["cassandra"]["open_ports"] = [22, 7000, 7001, 8081]
+
 # vim:et:fdm=marker:sts=4:sw=4:ts=4:

metadata.rb

@@ -9,6 +9,7 @@
 depends             "yum", "= 2.0.2"
 depends             "apt", "= 1.5.0"
 depends             "java", "= 1.6.4"
+depends             "iptables", "= 0.11.0"
 
 supports            "ubuntu", ">= 10.04"
 #supports            "debian", ">= 6.0"

recipes/default.rb

@@ -18,6 +18,8 @@
 #
 
 include_recipe "java"
+include_recipe "iptables"
+include_recipe "#{@cookbook_name}::iptables"
 include_recipe "#{@cookbook_name}::repos"
 include_recipe "#{@cookbook_name}::packages"
 include_recipe "#{@cookbook_name}::configs"

recipes/iptables.rb

@@ -0,0 +1,27 @@
+# Cookbook Name:: casserole
+# Recipe:: firewall
+#
+# Copyright 2012, Arif Khokar, Joshua Rush, and Kyle Morgan
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#Open ports
+iptables_rule "open_cassandra_ports" do
+    source "iptables/open_cassandra_ports.erb"
+    variables(
+        :iptables_chain => "FWR",
+        :ports => node["cassandra"]["open_ports"]
+    )
+end
+
+# vim:et:fdm=marker:sts=4:sw=4:ts=4:

spec/default_spec.rb

@@ -5,9 +5,10 @@
 
     before(:each) do
         chef_run.node.automatic_attrs["platform_family"] = "rhel"
-        %w{java casserole::repos casserole::packages}.each do |r|
+        %w{java iptables casserole::repos casserole::packages}.each do |r|
             chef_run.node.run_state.seen_recipes[r] = true
         end
+        Chef::Recipe.any_instance.stub(:iptables_rule) {}
     end
 
     it "should install Oracle Java" do

templates/default/iptables/open_cassandra_ports.erb

@@ -0,0 +1 @@
+-A <%= @iptables_chain %> -p tcp -m multiport --dports <%= @ports.join(',') %> -m state --state NEW -j ACCEPT

test/kitchen/Kitchenfile

@@ -6,10 +6,16 @@ cookbook "casserole" do
     configuration "repos"
     configuration "packages"
     configuration "configs"
+    configuration "iptables"
 
     # Fail immediately on a Foodcritic check and call ChefSpec before
     # spending the time to spawn test servers
     preflight_command <<-END.gsub(/^\s+/, "")
+        pushd test/kitchen &&
+        librarian-chef clean &&
+        librarian-chef install &&
+        popd &&
+        knife cookbook metadata -o .. casserole &&
         knife cookbook test -o .. casserole &&
         foodcritic -f any . &&
         rspec