Add support for NFLOG options to ip6tables

diff --git a/REFERENCE.md b/REFERENCE.md
index 4b57a52f38c6fd74c2adcc03d574e876ab0aa8d7..af2d2702f51808bd9ac82e50cc4a70e06a42b683 100644 (file)
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -126,7 +126,7 @@ installed.
     * Supported features: address_type, connection_limiting, conntrack, dnat, hop_limiting, icmp_match,
     interface_match, iprange, ipsec_dir, ipsec_policy, ipset, iptables, isfirstfrag,
     ishasmorefrags, islastfrag, length, log_level, log_prefix, log_uid,
-    log_tcp_sequence, log_tcp_options, log_ip_options, mask, mss,
+    log_tcp_sequence, log_tcp_options, log_ip_options, mask, mss, nflog_group, nflog_prefix, nflog_range, nflog_threshold,
     owner, pkttype, queue_bypass, queue_num, rate_limiting, recent_limiting, reject_type,
     snat, socket, state_match, string_matching, tcp_flags, hashlimit, bpf.
 

diff --git a/lib/puppet/provider/firewall/ip6tables.rb b/lib/puppet/provider/firewall/ip6tables.rb
index ddba026eabd039862a07434eba494d011019909b..702072c5e16fc4d6a06423b44323970837e1c061 100644 (file)
--- a/lib/puppet/provider/firewall/ip6tables.rb
+++ b/lib/puppet/provider/firewall/ip6tables.rb
@@ -22,6 +22,10 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
   has_feature :log_ip_options
   has_feature :mark
   has_feature :mss
+  has_feature :nflog_group
+  has_feature :nflog_prefix
+  has_feature :nflog_range
+  has_feature :nflog_threshold
   has_feature :tcp_flags
   has_feature :pkttype
   has_feature :ishasmorefrags
@@ -125,6 +129,10 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
     name: '-m comment --comment',
     mac_source: ['-m mac --mac-source', '--mac-source'],
     mss: '-m tcpmss --mss',
+    nflog_group: '--nflog-group',
+    nflog_prefix: '--nflog-prefix',
+    nflog_range: '--nflog-range',
+    nflog_threshold: '--nflog-threshold',
     outiface: '-o',
     pkttype: '-m pkttype --pkt-type',
     port: '-m multiport --ports',
@@ -291,7 +299,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
                     :ctorigsrcport, :ctorigdstport, :ctreplsrcport, :ctrepldstport, :ctstatus, :ctexpire, :ctdir,
                     :icmp, :hop_limit, :limit, :burst, :length, :recent, :rseconds, :reap,
                     :rhitcount, :rttl, :rname, :mask, :rsource, :rdest, :ipset, :string, :string_algo,
-                    :string_from, :string_to, :jump, :clamp_mss_to_pmtu, :gateway, :todest,
+                    :string_from, :string_to, :jump, :nflog_group, :nflog_prefix, :nflog_range, :nflog_threshold, :clamp_mss_to_pmtu, :gateway, :todest,
                     :tosource, :toports, :checksum_fill, :log_level, :log_prefix, :log_uid, :log_tcp_sequence, :log_tcp_options, :log_ip_options,
                     :reject, :set_mss, :set_dscp, :set_dscp_class, :mss, :queue_num, :queue_bypass,
                     :set_mark, :match_mark, :connlimit_above, :connlimit_mask, :connmark, :time_start, :time_stop, :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone,