Add --notrack flag

diff --git a/lib/puppet/provider/firewall/ip6tables.rb b/lib/puppet/provider/firewall/ip6tables.rb
index 23b0e9ba6b020771eb154f40fc049f0744912085..bcf35fa4d998024cc3c3792f7825cc71049695ac 100644 (file)
--- a/lib/puppet/provider/firewall/ip6tables.rb
+++ b/lib/puppet/provider/firewall/ip6tables.rb
@@ -203,6 +203,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
     bytecode: '-m bpf --bytecode',
     zone: '--zone',
     helper: '--helper',
+    notrack: '--notrack',
   }
 
   # These are known booleans that do not take a value, but we want to munge
@@ -229,6 +230,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
     :time_contiguous,
     :kernel_timezone,
     :queue_bypass,
+    :notrack,
   ]
 
   # Properties that use "-m <ipt module name>" (with the potential to have multiple
@@ -306,5 +308,5 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
                     :set_mark, :match_mark, :connlimit_above, :connlimit_mask, :connmark, :time_start, :time_stop, :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone,
                     :src_cc, :dst_cc, :hashlimit_upto, :hashlimit_above, :hashlimit_name, :hashlimit_burst,
                     :hashlimit_mode, :hashlimit_srcmask, :hashlimit_dstmask, :hashlimit_htable_size,
-                    :hashlimit_htable_max, :hashlimit_htable_expire, :hashlimit_htable_gcinterval, :bytecode, :zone, :helper, :rpfilter, :name]
+                    :hashlimit_htable_max, :hashlimit_htable_expire, :hashlimit_htable_gcinterval, :bytecode, :zone, :helper, :rpfilter, :name, :notrack]
 end

diff --git a/lib/puppet/provider/firewall/iptables.rb b/lib/puppet/provider/firewall/iptables.rb
index 6068aad3951e62c12e0613b8a41177fbd7241e83..580d5653a91f5a6b427b752d3b1f3a296c3a9d39 100644 (file)
--- a/lib/puppet/provider/firewall/iptables.rb
+++ b/lib/puppet/provider/firewall/iptables.rb
@@ -204,6 +204,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
     zone: '--zone',
     helper: '--helper',
     cgroup: '-m cgroup --cgroup',
+    notrack: '--notrack',
   }
 
   # These are known booleans that do not take a value, but we want to munge
@@ -231,6 +232,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
     :clusterip_new,
     :queue_bypass,
     :ipvs,
+    :notrack,
   ]
 
   # Properties that use "-m <ipt module name>" (with the potential to have multiple
@@ -346,8 +348,12 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
     :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone,
     :src_cc, :dst_cc, :hashlimit_upto, :hashlimit_above, :hashlimit_name, :hashlimit_burst,
     :hashlimit_mode, :hashlimit_srcmask, :hashlimit_dstmask, :hashlimit_htable_size,
+<<<<<<< HEAD
     :hashlimit_htable_max, :hashlimit_htable_expire, :hashlimit_htable_gcinterval, :bytecode, :ipvs, :zone, :helper, :cgroup,
     :rpfilter, :name
+=======
+    :hashlimit_htable_max, :hashlimit_htable_expire, :hashlimit_htable_gcinterval, :bytecode, :ipvs, :zone, :helper, :rpfilter, :name, :notrack,
+>>>>>>> 6124426... Add --notrack flag
   ]
 
   def insert

diff --git a/lib/puppet/type/firewall.rb b/lib/puppet/type/firewall.rb
index c1accc3c66c685d9c861859d0de9fca5d931acb9..db36080df21cc9f3380af9bfb768ffc142b9807e 100644 (file)
--- a/lib/puppet/type/firewall.rb
+++ b/lib/puppet/type/firewall.rb
@@ -2243,6 +2243,14 @@ Puppet::Type.newtype(:firewall) do
     PUPPETCODE
   end
 
+  newproperty(:notrack, required_features: :ct_target) do
+    # use this parameter with latest version of iptables
+    desc <<-PUPPETCODE
+     Invoke the disable connection tracking for this packet.
+    PUPPETCODE
+    newvalues(:true, :false)
+  end
+
   autorequire(:firewallchain) do
     reqs = []
     protocol = nil
@@ -2467,6 +2475,12 @@ Puppet::Type.newtype(:firewall) do
       end
     end
 
+    if value(:notrack)
+      unless value(:jump).to_s == 'CT'
+        raise 'Parameter notrack requires jump => CT'
+      end
+    end
+
     if value(:jump).to_s == 'CT'
       unless value(:table).to_s =~ %r{raw}
         raise 'Parameter jump => CT only applies to table => raw'