Use host_to_mask so we can negate a mask. Also added documentation.

A custom provider should probably be aware that these kind of masks are possible.

diff --git a/lib/puppet/type/firewall.rb b/lib/puppet/type/firewall.rb
index f88719438402919b39179db67ead5f0717b1cb25..ec14e7f8c5821c692ffcc1cd769828f6ccf32b99 100644 (file)
--- a/lib/puppet/type/firewall.rb
+++ b/lib/puppet/type/firewall.rb
@@ -107,12 +107,16 @@ Puppet::Type.newtype(:firewall) do
 
           source => '192.168.2.0/24'
 
+      You can also negate a mask by putting ! in front. For example:
+
+          source => '! 192.168.2.0/24'
+
       The source can also be an IPv6 address if your provider supports it.
     EOS
 
     munge do |value|
       begin
-        @resource.host_to_ip(value)
+        @resource.host_to_mask(value)
       rescue Exception => e
         self.fail("host_to_ip failed for #{value}, exception #{e}")
       end
@@ -138,12 +142,16 @@ Puppet::Type.newtype(:firewall) do
 
           destination => '192.168.1.0/24'
 
+      You can also negate a mask by putting ! in front. For example:
+
+          destination  => '! 192.168.2.0/24'
+
       The destination can also be an IPv6 address if your provider supports it.
     EOS
 
     munge do |value|
       begin
-        @resource.host_to_ip(value)
+        @resource.host_to_mask(value)
       rescue Exception => e
         self.fail("host_to_ip failed for #{value}, exception #{e}")
       end