Duplicate HTTP Port Declarations For Different Bind IPs Produces SELinux Duplicate Resource Declaration Error

[kahoffman]

Affected Module versions/distributions

• Module version: v2.0.0

How to reproduce (e.g Puppet code you use)

squid::http_port { "192.168.1.1:443":  ssl => true,  }
squid::http_port { "192.168.1.2:443":  ssl => true,  }

What are you seeing

We have a use case of hosting about a dozen different proxy servers with one squid instance. Each server is bound to a different IP with different certs but the same port number. A Selinux::Port resource is declared for every http_port instance. If you have the same port number bound to different ips, this produces a duplicate resource declaration error and a failure to compile.

Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Resource Statement, Duplicate declaration: Selinux::Port[selinux port squid_port_t 443] is already declared at  (file: <...>/modules/squid/manifests/http_port.pp, line: 54); cannot redeclare (file: <...>/modules/squid/manifests/http_port.pp, line: 54) (file: <...>/modules/squid/manifests/http_port.pp, line: 54, column: 5) 

What behavior did you expect instead

The squid module should be able to handle multiple server declarations for the same port on different IPs.

[kahoffman]

Looking at the code, one possible solution is to add an selinux parameter to http_port & https_port that can be set to true or false. (Default true) That would allow the choice to set the SELinux context for a port declaration. You could then choose not to have it set up at all or set it up for only one instance of a particular port but not the additional instances thus avoiding the duplicate declaration.

[ekohl]

This may be a case for ensure_resource though I wouldn't object to an explicit parameter either.

[ekohl]

This was solved in #152