Add support for clamp-mss-to-pmtu

diff --git a/lib/puppet/provider/firewall/ip6tables.rb b/lib/puppet/provider/firewall/ip6tables.rb
index 1e2f2ed09585cf90e188a14c7e2ad971fd5f87d1..2a05dcf69753a5627d45257bf65d972554d8a123 100644 (file)
--- a/lib/puppet/provider/firewall/ip6tables.rb
+++ b/lib/puppet/provider/firewall/ip6tables.rb
@@ -67,6 +67,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, :parent => :iptables, :source =
   @resource_map = {
     :burst              => "--limit-burst",
     :checksum_fill      => "--checksum-fill",
+    :clamp_mss_to_pmtu  => "--clamp-mss-to-pmtu",
     :connlimit_above    => "-m connlimit --connlimit-above",
     :connlimit_mask     => "--connlimit-mask",
     :connmark           => "-m connmark --mark",
@@ -143,6 +144,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, :parent => :iptables, :source =
   # to true if they exist.
   @known_booleans = [
     :checksum_fill,
+    :clamp_mss_to_pmtu,
     :ishasmorefrags,
     :islastfrag,
     :isfirstfrag,
@@ -215,7 +217,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, :parent => :iptables, :source =
     :tcp_flags, :uid, :gid, :mac_source, :sport, :dport, :port, :src_type,
     :dst_type, :socket, :pkttype, :name, :ipsec_dir, :ipsec_policy, :state,
     :ctstate, :icmp, :hop_limit, :limit, :burst, :recent, :rseconds, :reap,
-    :rhitcount, :rttl, :rname, :mask, :rsource, :rdest, :ipset, :jump, :gateway, :todest,
+    :rhitcount, :rttl, :rname, :mask, :rsource, :rdest, :ipset, :jump, :clamp_mss_to_pmtu, :gateway, :todest,
     :tosource, :toports, :checksum_fill, :log_level, :log_prefix, :reject, :set_mss, :mss,
     :set_mark, :match_mark, :connlimit_above, :connlimit_mask, :connmark, :time_start, :time_stop, :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone]
 

diff --git a/lib/puppet/provider/firewall/iptables.rb b/lib/puppet/provider/firewall/iptables.rb
index 7557ac71a0ef0bdb53f7f04ec82355848a1f8eb2..9c099fee74b76c32fa82f6758e9bfcd52eeb9dec 100644 (file)
--- a/lib/puppet/provider/firewall/iptables.rb
+++ b/lib/puppet/provider/firewall/iptables.rb
@@ -53,6 +53,7 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
   @resource_map = {
     :burst              => "--limit-burst",
     :checksum_fill      => "--checksum-fill",
+    :clamp_mss_to_pmtu  => "--clamp-mss-to-pmtu",
     :connlimit_above    => "-m connlimit --connlimit-above",
     :connlimit_mask     => "--connlimit-mask",
     :connmark           => "-m connmark --mark",
@@ -128,6 +129,7 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
   # to true if they exist.
   @known_booleans = [
     :checksum_fill,
+    :clamp_mss_to_pmtu,
     :isfragment,
     :random,
     :rdest,
@@ -240,7 +242,7 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
     :src_range, :dst_range, :tcp_flags, :uid, :gid, :mac_source, :sport, :dport, :port,
     :src_type, :dst_type, :socket, :pkttype, :name, :ipsec_dir, :ipsec_policy,
     :state, :ctstate, :icmp, :limit, :burst, :recent, :rseconds, :reap,
-    :rhitcount, :rttl, :rname, :mask, :rsource, :rdest, :ipset, :jump, :gateway, :set_mss, :todest,
+    :rhitcount, :rttl, :rname, :mask, :rsource, :rdest, :ipset, :jump, :clamp_mss_to_pmtu, :gateway, :set_mss, :todest,
     :tosource, :toports, :to, :checksum_fill, :random, :log_prefix, :log_level, :reject, :set_mark, :match_mark, :mss,
     :connlimit_above, :connlimit_mask, :connmark, :time_start, :time_stop, :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone
   ]

diff --git a/lib/puppet/type/firewall.rb b/lib/puppet/type/firewall.rb
index 0994504cb16ba562b50fe65c45de97126e86c3a2..9af7d3eee6befe65e494e495a1f2ebb5e20398f3 100644 (file)
--- a/lib/puppet/type/firewall.rb
+++ b/lib/puppet/type/firewall.rb
@@ -860,6 +860,14 @@ Puppet::Type.newtype(:firewall) do
     end
   end
 
+  newproperty(:clamp_mss_to_pmtu, :required_features => :iptables) do
+    desc <<-EOS
+      Sets the clamp mss to pmtu flag.
+    EOS
+
+    newvalues(:true, :false)
+  end
+
   newproperty(:set_mss, :required_features => :iptables) do
     desc <<-EOS
       Sets the TCP MSS value for packets.
@@ -1341,8 +1349,8 @@ Puppet::Type.newtype(:firewall) do
     end
 
     if value(:jump).to_s == "TCPMSS"
-      unless value(:set_mss)
-        self.fail "When using jump => TCPMSS, the set_mss property is required"
+      unless value(:set_mss) || value(:clamp_mss_to_pmtu)
+        self.fail "When using jump => TCPMSS, the set_mss or clamp_mss_to_pmtu property is required"
       end
     end
 

diff --git a/spec/acceptance/firewall_mss_spec.rb b/spec/acceptance/firewall_mss_spec.rb
index 379801550509fdf9f25a4c2131d17a201ad161b1..167c9586e8299a03cee7ad9900f6ac1a014d6e9c 100644 (file)
--- a/spec/acceptance/firewall_mss_spec.rb
+++ b/spec/acceptance/firewall_mss_spec.rb
@@ -7,7 +7,7 @@ describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfami
     shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
   end
 
-  describe 'set_mss' do
+  describe 'mss ipv4 tests' do
     context '1360' do
       it 'applies' do
         pp = <<-EOS
@@ -33,10 +33,34 @@ describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfami
         end
       end
     end
+
+    context 'clamp_mss_to_pmtu' do
+      it 'applies' do
+        pp = <<-EOS
+          class { '::firewall': }
+          firewall {
+            '503 - clamp_mss_to_pmtu':
+              proto             => 'tcp',
+              chain             => 'FORWARD',
+              tcp_flags         => 'SYN,RST SYN',
+              jump              => 'TCPMSS',
+              clamp_mss_to_pmtu => true,
+          }
+        EOS
+
+        apply_manifest(pp, :catch_failures => true)
+      end
+
+      it 'should contain the rule' do
+        shell('iptables-save') do |r|
+          expect(r.stdout).to match(/-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "503 - clamp_mss_to_pmtu" -j TCPMSS --clamp-mss-to-pmtu/)
+        end
+      end
+    end
   end
 
   if default['platform'] !~ /el-5/
-    describe 'set_mss6' do
+    describe 'mss ipv6 tests' do
       context '1360' do
         it 'applies' do
           pp = <<-EOS
@@ -63,6 +87,31 @@ describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfami
           end
         end
       end
+
+      context 'clamp_mss_to_pmtu' do
+        it 'applies' do
+          pp = <<-EOS
+            class { '::firewall': }
+            firewall {
+              '503 - clamp_mss_to_pmtu':
+                proto             => 'tcp',
+                chain             => 'FORWARD',
+                tcp_flags         => 'SYN,RST SYN',
+                jump              => 'TCPMSS',
+                clamp_mss_to_pmtu => true,
+                provider          => 'ip6tables',
+            }
+          EOS
+
+          apply_manifest(pp, :catch_failures => true)
+        end
+
+        it 'should contain the rule' do
+          shell('ip6tables-save') do |r|
+            expect(r.stdout).to match(/-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "503 - clamp_mss_to_pmtu" -j TCPMSS --clamp-mss-to-pmtu/)
+          end
+        end
+      end
     end
   end
 

diff --git a/spec/fixtures/iptables/conversion_hash.rb b/spec/fixtures/iptables/conversion_hash.rb
index 7ccaf48ea7856a51522d564abb697617056c2d89..ecd0887fc063995d7496257314f604c03fa7b647 100644 (file)
--- a/spec/fixtures/iptables/conversion_hash.rb
+++ b/spec/fixtures/iptables/conversion_hash.rb
@@ -554,6 +554,18 @@ ARGS_TO_HASH = {
       :action          => 'reject',
     },
   },
+  'clamp_mss_to_pmtu' => {
+    :line => '-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "067 change max segment size" -j TCPMSS --clamp-mss-to-pmtu',
+    :table => 'filter',
+    :params => {
+      :name              => '067 change max segment size',
+      :table             => 'filter',
+      :proto             => 'tcp',
+      :tcp_flags         => 'SYN,RST SYN',
+      :jump              => 'TCPMSS',
+      :clamp_mss_to_pmtu => true,
+    },
+  },
 }
 
 # This hash is for testing converting a hash to an argument line.
@@ -1069,4 +1081,15 @@ HASH_TO_ARGS = {
     },
     :args => ["-t", :filter, "-p", :tcp, "-m", "comment", "--comment", "066 REJECT connlimit_above 10 with mask 32 and mark matches", "-j", "REJECT", "-m", "mark", "--mark", "0x1", "-m", "connlimit", "--connlimit-above", "10", "--connlimit-mask", "32"],
   },
+  'clamp_mss_to_pmtu' => {
+    :params => {
+      :name              => '067 change max segment size',
+      :table             => 'filter',
+      :proto             => 'tcp',
+      :tcp_flags         => 'SYN,RST SYN',
+      :jump              => 'TCPMSS',
+      :clamp_mss_to_pmtu => true,
+    },
+    :args => ["-t", :filter, "-p", :tcp, "-m", "tcp", "--tcp-flags", "SYN,RST", "SYN", "-m", "comment", "--comment", "067 change max segment size", "-j", "TCPMSS", "--clamp-mss-to-pmtu"],
+  },
 }