Use a more generic way for parsing negated options, not only for destination and...

diff --git a/lib/puppet/provider/firewall/iptables.rb b/lib/puppet/provider/firewall/iptables.rb
index 81f8b1931b87d84a3000af69ff31142659ca1f8d..90e7926efc4ece3a8037cde18ed16b6e4d214711 100644 (file)
--- a/lib/puppet/provider/firewall/iptables.rb
+++ b/lib/puppet/provider/firewall/iptables.rb
@@ -168,11 +168,9 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
     # so it behaves like --comment
     values = values.sub(/--tcp-flags (\S*) (\S*)/, '--tcp-flags "\1 \2"')
     # we do a simular thing for negated address masks (source and destination).
-    values = values.sub(/-s (!)\s?(\S*)/, '-s "\1 \2"')
-    values = values.sub(/-d (!)\s?(\S*)/,'-d "\1 \2"')
+    values = values.sub(/(-\S+) (!)\s?(\S*)/,'\1 "\2 \3"')
     # the actual rule will have the ! mark before the option.
-    values = values.sub(/(!)\s*-s\s*(\S*)/, '-s "\1 \2"')
-    values = values.sub(/(!)\s*-d\s*(\S*)/, '-d "\1 \2"')
+    values = values.sub(/(!)\s*(-\S+)\s*(\S*)/, '\2 "\1 \3"')
 
     # Trick the system for booleans
     @known_booleans.each do |bool|