如何从文件读取IP /子网并在Chef防火墙配方中使用

Question

I want to use a file on a the local system to populate UFW firewall rules using Chef. The firewall recipe ( https://supermarket.chef.io/cookbooks/firewall ) has the functionality to do this but I get errors when trying to pass a variable to the blocks.

If I hard code the IP addresses/subnets everything works fine. If I put that exact same IP/subnet into the file, I get an Invalid IP Address error.

In the code below the first firewall_rule block will execute but the second and subsequent blocks with "#{subnet}" do not. I have also tried just passing the variable directly instead of with string substitution with the same results.

# Try to read from the client list of IPs

if File.exist?("/secure/targs/client.lst") then
  File.open("/secure/targs/client.lst", "r") do |subnets|
    subnets.each_line do |subnet|

      # Only allow outbound connection to in-scope targs
      firewall_rule 'client-out-ether' do
        interface     'eno1'
        destination   "10.0.0.128/25"
        direction     :out
        command       :allow
      end

      firewall_rule 'client-out-wifi' do
        interface     'wlp58s0'
        destination   "#{subnet}"
        direction     :out
        command       :allow
      end

      # Allow inbound connections from in-scope targs
      # Ideally we scope this to specific ports
      # OR remove this and do it manually as needed
      firewall_rule 'client-in-eth' do
        dest_interface  'eno0'
        source          "#{subnet}"
        command         :allow
      end

      firewall_rule 'client-in-wifi' do
        dest_interface  'wlp58s0'
        source          "#{subnet}"
        command         :allow
      end
    end
  end

  # Default allow all out on client interfaces if scope not defined
  else
    firewall_rule 'client-out-ether' do
      interface 'eno1'
      direction :out
      command   :allow
    end

    firewall_rule 'client-out-wifi' do
      interface 'wlp58s0'
      direction :out
      command   :allow
    end
end

I am guessing this is a syntax issue but this seems to be normal Ruby syntax that should work. It seems that maybe the recipe is reading the supplied variable as a literal?

Answer 1

The file injects either whitespace or control characters. Doing subnet.strip solved the problem.