(#10690) Create new port property

This new property will allow you to specify ports that match both destination
and source.

This works the same as dport and sport parameters, so it provides array
support and hyphen separated ranges of ports as well.

diff --git a/examples/iptables/test.pp b/examples/iptables/test.pp
index bb8921fe04c3d7cb967f4d716da236b4342e852d..4f0598708fd649f16ae77b308c1f43113bb3ebca 100644 (file)
--- a/examples/iptables/test.pp
+++ b/examples/iptables/test.pp
@@ -87,6 +87,12 @@ firewall { '055 INPUT allow DNS':
   sport => 'domain'
 }
 
+firewall { '056 INPUT allow web in and out':
+  action => accept,
+  proto  => 'tcp',
+  port  => 80
+}
+
 firewall { '999 FORWARD drop':
   action => drop,
   chain => 'FORWARD',

diff --git a/lib/puppet/provider/firewall/iptables.rb b/lib/puppet/provider/firewall/iptables.rb
index f2518e82ffef7f9277738c5e9699afff46db7091..7ce469a220931b5db1fe6488b600b7d8dac5e983 100644 (file)
--- a/lib/puppet/provider/firewall/iptables.rb
+++ b/lib/puppet/provider/firewall/iptables.rb
@@ -34,6 +34,7 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
     :log_prefix => "--log-prefix",
     :name => "-m comment --comment",
     :outiface => "-o",
+    :port => '-m multiport --ports',
     :proto => "-p",
     :reject => "--reject-with",
     :source => "-s",
@@ -45,9 +46,9 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
     :tosource => "--to-source",
   }
 
-  @resource_list = [:table, :source, :destination, :iniface, :outiface, 
-    :proto, :sport, :dport, :name, :state, :icmp, :limit, :burst, :jump, 
-    :todest, :tosource, :toports, :log_level, :log_prefix, :reject]
+  @resource_list = [:table, :source, :destination, :iniface, :outiface,
+    :proto, :sport, :dport, :port, :name, :state, :icmp, :limit, :burst,
+    :jump, :todest, :tosource, :toports, :log_level, :log_prefix, :reject]
 
   def insert
     debug 'Inserting rule %s' % resource[:name]
@@ -117,14 +118,14 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
 
     keys.zip(values.scan(/"[^"]*"|\S+/).reverse) { |f, v| hash[f] = v.gsub(/"/, '') }
     
-    [:dport, :sport, :state].each do |prop|
+    [:dport, :sport, :port, :state].each do |prop|
       hash[prop] = hash[prop].split(',') if ! hash[prop].nil?
     end
 
     # Our type prefers hyphens over colons for ranges so ...
     # Iterate across all ports replacing colons with hyphens so that ranges match
     # the types expectations.
-    [:dport, :sport].each do |prop|
+    [:dport, :sport, :port].each do |prop|
       next unless hash[prop]
       hash[prop] = hash[prop].collect do |elem|
         elem.gsub(/:/,'-')
@@ -223,7 +224,7 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
 
       # For sport and dport, convert hyphens to colons since the type
       # expects hyphens for ranges of ports.
-      if [:sport, :dport].include?(res) then
+      if [:sport, :dport, :port].include?(res) then
         resource_value = resource_value.collect do |elem|
           elem.gsub(/-/, ':')
         end

diff --git a/lib/puppet/type/firewall.rb b/lib/puppet/type/firewall.rb
index 0889268c0f35f149071c4d9742fbe298224508db..8fcb1f66cfd4934485f17c2217d70d3576eccb55 100644 (file)
--- a/lib/puppet/type/firewall.rb
+++ b/lib/puppet/type/firewall.rb
@@ -151,6 +151,32 @@ Puppet::Type.newtype(:firewall) do
     end
   end
 
+  newproperty(:port, :array_matching => :all) do
+    desc <<-EOS
+      The destination or source port to match for this filter (if the protocol
+      supports ports). Will accept a single element or an array.
+
+      For some firewall providers you can pass a range of ports in the format:
+
+          <start_number>-<ending_number>
+
+      For example:
+
+          1-1024
+
+      This would cover ports 1 to 1024.
+    EOS
+
+    munge do |value|
+      @resource.string_to_port(value)
+    end
+
+    def should_to_s(value)
+      value = [value] unless value.is_a?(Array)
+      value.join(',')
+    end
+  end
+
   newproperty(:proto) do
     desc <<-EOS
       The specific protocol to match for this rule. By default this is 

diff --git a/spec/fixtures/iptables/conversion_hash.rb b/spec/fixtures/iptables/conversion_hash.rb
index e2807b346d1b09909a4b6acc823895121a84c45e..6390fefc51169ac4d9d2fed55ac6bd627ce4152c 100644 (file)
--- a/spec/fixtures/iptables/conversion_hash.rb
+++ b/spec/fixtures/iptables/conversion_hash.rb
@@ -191,4 +191,12 @@ HASH_TO_ARGS = {
     },
     :args => ['-t', :filter, '-s', '192.168.0.1', '-p', :tcp, '-m', 'comment', '--comment', '000 allow from 192.168.0.1, please'],
   },
+  'port_property' => {
+    :params => {
+      :name => '001 port property',
+      :table => 'filter',
+      :port => '80',
+    },
+    :args => ['-t', :filter, '-p', :tcp, '-m', 'multiport', '--ports', '80', '-m', 'comment', '--comment', '001 port property'],
+  },
 }