Fix parsing negated values

diff --git a/lib/puppet/provider/firewall/iptables.rb b/lib/puppet/provider/firewall/iptables.rb
index d2845684bd6adfb0e7d10d6143bd7bd2ec5906c1..b69af917e5870af52b6aa86e1c6f9f08abddcc95 100644 (file)
--- a/lib/puppet/provider/firewall/iptables.rb
+++ b/lib/puppet/provider/firewall/iptables.rb
@@ -166,7 +166,10 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
 
     # --tcp-flags takes two values; we cheat by adding " around it
     # so it behaves like --comment
+    # we do a simular thing for negated address masks (source and destination).
     values = values.sub(/--tcp-flags (\S*) (\S*)/, '--tcp-flags "\1 \2"')
+    values = values.sub(/-s (!)\s?(\S*)/, '-s "\1 \2"')
+    values = values.sub(/-d (!)\s?(\S*)/,'-d "\1 \2"')
 
     # Trick the system for booleans
     @known_booleans.each do |bool|
@@ -224,7 +227,10 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir
 
     # Normalise all rules to CIDR notation.
     [:source, :destination].each do |prop|
-      hash[prop] = Puppet::Util::IPCidr.new(hash[prop]).cidr unless hash[prop].nil?
+      next if hash[prop].nil?
+      m = hash[prop].match(/(!?)\s?(.*)/)
+      neg = "! " if m[1] == "!"
+      hash[prop] = "#{neg}#{Puppet::Util::IPCidr.new(m[2]).cidr}"
     end
 
     [:dport, :sport, :port, :state, :ctstate].each do |prop|