Change already created rules/exceptions

[azhurbilo]

How to reproduce (e.g Puppet code you use)

# run first time with
windows_firewall::exception { 'WINRM':
  ensure       => present,
  direction    => 'in',
  action       => 'Allow',
  enabled      => 'yes',
  protocol     => 'TCP',
  local_port   => '5985',
  remote_port  => 'any',
  display_name => 'Windows Remote Management HTTP-In',
  description  => 'Inbound rule for Windows Remote Management via WS-Management. [TCP 5985]',
}

# run second time with 'disabled' rule
windows_firewall::exception { 'WINRM':
  ensure       => present,
  direction    => 'in',
  action       => 'Allow',
  enabled      => 'no',
  protocol     => 'TCP',
  local_port   => '5985',
  remote_port  => 'any',
  display_name => 'Windows Remote Management HTTP-In',
  description  => 'Inbound rule for Windows Remote Management via WS-Management. [TCP 5985]',
}

What are you seeing

rule still enabled

What behaviour did you expect instead

rule disabled

Any additional information you'd like to impart

it because of

# Set command to check for existing rules
$check_rule_existance= "C:\\Windows\\System32\\netsh.exe advfirewall firewall show rule name=\"${display_name}\""
$unless = $check_rule_existance

if rule already exist you cannot change anything

[azap1111]

It would be helpful to have the ability to modify a firewall rule that has already been applied. For instance, being able to modify the remote_ip's that are allowed to make the connection would be helpful.

[tgm4883]

This would be helpful to be able to change existing rules. I took a cursory glance at the code and it seems it would be easy to get it to change the rule, but possibly difficult to get it to only change it once and not every puppet run.

[RamblingCookieMonster]

Going to comment here to keep this on the radar, as this module is essentially non-functional without this issue being addressed. Worse, it gives no indication that it is omitting intended changes. One might drop a subnet from a rule, and not realize the subnet can still access a system, for example.

For what it's worth, this seems to be sort of a critical part of what this module should provide, no? One tends not to care as much about the name of a firewall rule, as for the actual functionality of the rule that is being ignored here?