(#215) Add support for IP range

Add support for filtering by source and destination IP range, equivalent to '-m iprange --src-range|--dst-range',
which is only allowing a specified IP range. Excluding an IP range, '! --src-range or ! --dst-range', is not supported.

Add ':src_range' and ':dst_range' to iptables.rb

diff --git a/lib/puppet/provider/firewall/iptables.rb b/lib/puppet/provider/firewall/iptables.rb
index 19dd8b3f3e8d7d73b0a523584fd51126728dbd52..1e8617e9a5cae78639a8d97c9f18b6db8df40573 100644 (file)
--- a/lib/puppet/provider/firewall/iptables.rb
+++ b/lib/puppet/provider/firewall/iptables.rb
@@ -23,6 +23,7 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
   has_feature :isfragment
   has_feature :socket
   has_feature :address_type
+  has_feature :iprange
 
   optional_commands({
     :iptables => 'iptables',
@@ -44,6 +45,7 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
     :burst => "--limit-burst",
     :destination => "-d",
     :dst_type => "-m addrtype --dst-type",
+    :dst_range => "-m iprange --dst-range",
     :dport => ["-m multiport --dports", "-m (udp|tcp) --dport"],
     :gid => "-m owner --gid-owner",
     :icmp => "-m icmp --icmp-type",
@@ -61,6 +63,7 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
     :socket => "-m socket",
     :source => "-s",
     :src_type => "-m addrtype --src-type",
+    :src_range => "-m iprange --src-range",
     :sport => ["-m multiport --sports", "-m (udp|tcp) --sport"],
     :state => "-m state --state",
     :table => "-t",
@@ -88,7 +91,7 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
   # we need it to properly parse and apply rules, if the order of resource
   # changes between puppet runs, the changed rules will be re-applied again.
   # This order can be determined by going through iptables source code or just tweaking and trying manually
-  @resource_list = [:table, :source, :destination, :iniface, :outiface,
+  @resource_list = [:table, :source, :src_range, :destination, :dst_range, :iniface, :outiface,
     :proto, :isfragment, :tcp_flags, :gid, :uid, :sport, :dport, :port,
     :dst_type, :src_type, :socket, :pkttype, :name, :state, :icmp,
     :limit, :burst, :jump, :todest, :tosource, :toports, :log_prefix,