(#16004) array_matching is contraindicated.

With ":array_matching =>:all", uid/gid rules are reloaded with every
Puppet run.  This is ugly and annoying, and arguably wrong.

diff --git a/lib/puppet/type/firewall.rb b/lib/puppet/type/firewall.rb
index 59234f10c134557e178d8fa27d0136be631cdb78..6d6f28953a2bbb9d8bf606525d3043cf1bd86f1e 100644 (file)
--- a/lib/puppet/type/firewall.rb
+++ b/lib/puppet/type/firewall.rb
@@ -469,7 +469,7 @@ Puppet::Type.newtype(:firewall) do
     newvalue(/^\d+$/)
   end
 
-  newproperty(:uid, :array_matching =>:all, :required_features => :owner) do
+  newproperty(:uid, :required_features => :owner) do
     desc <<-EOS
       UID or Username owner matching rule.  Accepts a string argument
       only, as iptables does not accept multiple uid in a single
@@ -477,7 +477,7 @@ Puppet::Type.newtype(:firewall) do
     EOS
   end
 
-  newproperty(:gid, :array_matching =>:all, :required_features => :owner) do
+  newproperty(:gid, :required_features => :owner) do
     desc <<-EOS
       GID or Group owner matching rule.  Accepts a string argument
       only, as iptables does not accept multiple gid in a single

diff --git a/spec/unit/puppet/type/firewall_spec.rb b/spec/unit/puppet/type/firewall_spec.rb
index 95fff979bdc74143feb5a68cf1a0f996d30dab8c..ead5c9aff8782b5d563a4afb792ad40222b772a7 100755 (executable)
--- a/spec/unit/puppet/type/firewall_spec.rb
+++ b/spec/unit/puppet/type/firewall_spec.rb
@@ -310,19 +310,19 @@ describe firewall do
   describe ':gid and :uid' do
     it 'should allow me to set uid' do
       @resource[:uid] = 'root'
-      @resource[:uid].should == ['root']
+      @resource[:uid].should == 'root'
     end
-    it 'should allow me to set uid as an array, breaking iptables' do
+    it 'should allow me to set uid as an array, and silently hide my error' do
       @resource[:uid] = ['root', 'bobby']
-      @resource[:uid].should == ['root', 'bobby']
+      @resource[:uid].should == 'root'
     end
     it 'should allow me to set gid' do
       @resource[:gid] = 'root'
-      @resource[:gid].should == ['root']
+      @resource[:gid].should == 'root'
     end
-    it 'should allow me to set gid as an array, breaking iptables' do
+    it 'should allow me to set gid as an array, and silently hide my error' do
       @resource[:gid] = ['root', 'bobby']
-      @resource[:gid].should == ['root', 'bobby']
+      @resource[:gid].should == 'root'
     end
   end