fix: parsing random_fully in ip6tables

Looks like
https://github.com/puppetlabs/puppetlabs-firewall/commit/9a4bc6a81cf0cd4a56ba458fadac830a2c4df529
added relevant params only to iptables, not ip6tables.

This results in warnings like
```
Warning: Puppet::Type::Firewall::ProviderIp6tables: Skipping unparsable iptables rule: keys (3) and values (4) count mismatch on line: -A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE --random-fully
```

diff --git a/lib/puppet/provider/firewall/ip6tables.rb b/lib/puppet/provider/firewall/ip6tables.rb
index 6a925fee8ab9707fb6387afc6ce1c7a94067dce6..54911ef6fa372eb86c9340083ab52213342c0146 100644 (file)
--- a/lib/puppet/provider/firewall/ip6tables.rb
+++ b/lib/puppet/provider/firewall/ip6tables.rb
@@ -143,6 +143,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
     proto: '-p',
     queue_num: '--queue-num',
     queue_bypass: '--queue-bypass',
+    random_fully: '--random-fully',
     rdest: '--rdest',
     reap: '--reap',
     recent: '-m recent',
@@ -222,6 +223,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
     :log_tcp_sequence,
     :log_tcp_options,
     :log_ip_options,
+    :random_fully,
     :rsource,
     :rdest,
     :reap,
@@ -308,7 +310,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
                     :icmp, :hop_limit, :limit, :burst, :length, :recent, :rseconds, :reap,
                     :rhitcount, :rttl, :rname, :mask, :rsource, :rdest, :ipset, :string, :string_hex, :string_algo,
                     :string_from, :string_to, :jump, :nflog_group, :nflog_prefix, :nflog_range, :nflog_threshold, :clamp_mss_to_pmtu, :gateway, :todest,
-                    :tosource, :toports, :checksum_fill, :log_level, :log_prefix, :log_uid, :log_tcp_sequence, :log_tcp_options, :log_ip_options,
+                    :tosource, :toports, :checksum_fill, :log_level, :log_prefix, :log_uid, :log_tcp_sequence, :log_tcp_options, :log_ip_options, :random_fully,
                     :reject, :set_mss, :set_dscp, :set_dscp_class, :mss, :queue_num, :queue_bypass,
                     :set_mark, :match_mark, :connlimit_above, :connlimit_mask, :connmark, :time_start, :time_stop, :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone,
                     :src_cc, :dst_cc, :hashlimit_upto, :hashlimit_above, :hashlimit_name, :hashlimit_burst,

diff --git a/spec/fixtures/ip6tables/conversion_hash.rb b/spec/fixtures/ip6tables/conversion_hash.rb
index 844bfac5f4ea4a400fc9a1661c1ef031d5c897a4..1f27ced927d24c4eb5b72573cf8ac808007d5da3 100644 (file)
--- a/spec/fixtures/ip6tables/conversion_hash.rb
+++ b/spec/fixtures/ip6tables/conversion_hash.rb
@@ -41,6 +41,14 @@ ARGS_TO_HASH6 = {
       string_hex: '|0000FF0001|',
       string_algo: 'bm',
     },
+  },
+  'random-fully' => {
+    line: '-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE --random-fully',
+    table: 'filter',
+    provider: 'ip6tables',
+    params: {
+      random_fully: 'true',
+    }
   }
 }.freeze