(MODULES-8615) Fix rules with ipvs not parsing

diff --git a/lib/puppet/provider/firewall/iptables.rb b/lib/puppet/provider/firewall/iptables.rb
index 2d0e8d7b1ba30274e3eb423ecb55b523b33d8dc3..754d64a8ca73d6f19ac4ffcba88aa652bb45103e 100644 (file)
--- a/lib/puppet/provider/firewall/iptables.rb
+++ b/lib/puppet/provider/firewall/iptables.rb
@@ -42,6 +42,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
   has_feature :string_matching
   has_feature :queue_num
   has_feature :queue_bypass
+  has_feature :ipvs
 
   optional_commands(iptables: 'iptables',
                     iptables_save: 'iptables-save')
@@ -168,6 +169,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
     hashlimit_htable_expire: '--hashlimit-htable-expire',
     hashlimit_htable_gcinterval: '--hashlimit-htable-gcinterval',
     bytecode: '-m bpf --bytecode',
+    ipvs: '-m ipvs --ipvs',
   }
 
   # These are known booleans that do not take a value, but we want to munge
@@ -190,6 +192,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
     :kernel_timezone,
     :clusterip_new,
     :queue_bypass,
+    :ipvs,
   ]
 
   # Properties that use "-m <ipt module name>" (with the potential to have multiple

diff --git a/lib/puppet/type/firewall.rb b/lib/puppet/type/firewall.rb
index b9feff49bceec3ade4be0ad8ad6713fb2c27a8fa..2ffa925f624577dd4d232b64e8e0c25489fec404 100644 (file)
--- a/lib/puppet/type/firewall.rb
+++ b/lib/puppet/type/firewall.rb
@@ -69,6 +69,7 @@ Puppet::Type.newtype(:firewall) do
   feature :queue_bypass, 'If nothing is listening on queue_num, allow packets to bypass the queue'
   feature :hashlimit, 'Hashlimit features'
   feature :bpf, 'Berkeley Paket Filter feature'
+  feature :ipvs, 'Packet belongs to an IP Virtual Server connection'
 
   # provider specific features
   feature :iptables, 'The provider provides iptables features.'
@@ -1745,6 +1746,12 @@ Puppet::Type.newtype(:firewall) do
     PUPPETCODE
   end
 
+  newproperty(:ipvs, required_features: :ipvs) do
+    desc <<-PUPPETCODE
+      Indicates that the current packet belongs to an IPVS connection.
+    PUPPETCODE
+  end
+
   autorequire(:firewallchain) do
     reqs = []
     protocol = nil

diff --git a/spec/acceptance/firewall_attributes_happy_path_spec.rb b/spec/acceptance/firewall_attributes_happy_path_spec.rb
index e6947d17cbadf53a848851c82348cbd3b652084a..ddad46b2f081a225642032fecacf2f6827a1b7f6 100644 (file)
--- a/spec/acceptance/firewall_attributes_happy_path_spec.rb
+++ b/spec/acceptance/firewall_attributes_happy_path_spec.rb
@@ -18,7 +18,6 @@ describe 'firewall attribute testing, happy path' do
             log_level  => '3',
             log_prefix => 'IPTABLES dropped invalid: ',
           }
-
           firewall { '501 - connlimit':
             proto           => tcp,
             dport           => '2222',
@@ -350,6 +349,11 @@ describe 'firewall attribute testing, happy path' do
             chain          => 'OUTPUT',
             table          => 'mangle',
           }
+          firewall { '1002 - set ipvs':
+            proto          => 'tcp',
+            dport           => '4321',
+            chain          => 'OUTPUT',
+          }
       PUPPETCODE
       apply_manifest(pp, catch_failures: true)
       apply_manifest(pp, catch_changes: do_catch_changes)