Support ctdir

diff --git a/lib/puppet/provider/firewall/ip6tables.rb b/lib/puppet/provider/firewall/ip6tables.rb
index eca66df95bcf7959bbcd5beff0e60f831008c5bc..b28ddbb095ee5482c49db29ecc592205fb6421e3 100644 (file)
--- a/lib/puppet/provider/firewall/ip6tables.rb
+++ b/lib/puppet/provider/firewall/ip6tables.rb
@@ -72,6 +72,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
     connlimit_mask: '--connlimit-mask',
     connmark: '-m connmark --mark',
     ctstate: '-m conntrack --ctstate',
+    ctdir: '--ctdir',
     destination: '-d',
     dport: ['-m multiport --dports', '--dport'],
     dst_range: '--dst-range',
@@ -253,7 +254,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
                     :proto, :ishasmorefrags, :islastfrag, :isfirstfrag, :src_range, :dst_range,
                     :tcp_flags, :uid, :gid, :mac_source, :sport, :dport, :port, :src_type,
                     :dst_type, :socket, :pkttype, :ipsec_dir, :ipsec_policy, :state,
-                    :ctstate, :icmp, :hop_limit, :limit, :burst, :length, :recent, :rseconds, :reap,
+                    :ctstate, :ctdir, :icmp, :hop_limit, :limit, :burst, :length, :recent, :rseconds, :reap,
                     :rhitcount, :rttl, :rname, :mask, :rsource, :rdest, :ipset, :string, :string_algo,
                     :string_from, :string_to, :jump, :clamp_mss_to_pmtu, :gateway, :todest,
                     :tosource, :toports, :checksum_fill, :log_level, :log_prefix, :log_uid, :reject, :set_mss, :set_dscp, :set_dscp_class, :mss, :queue_num, :queue_bypass,

diff --git a/lib/puppet/provider/firewall/iptables.rb b/lib/puppet/provider/firewall/iptables.rb
index 381906061dc66bb5a0ffc33fde50183c546a387f..e00b2c3497820d52a04dffa8287a71c7844c0b88 100644 (file)
--- a/lib/puppet/provider/firewall/iptables.rb
+++ b/lib/puppet/provider/firewall/iptables.rb
@@ -68,6 +68,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
     connlimit_mask: '--connlimit-mask',
     connmark: '-m connmark --mark',
     ctstate: '-m conntrack --ctstate',
+    ctdir: '--ctdir',
     destination: '-d',
     dport: ['-m multiport --dports', '--dport'],
     dst_range: '--dst-range',
@@ -296,7 +297,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
     :proto, :isfragment, :stat_mode, :stat_every, :stat_packet, :stat_probability,
     :src_range, :dst_range, :tcp_flags, :uid, :gid, :mac_source, :sport, :dport, :port,
     :src_type, :dst_type, :socket, :pkttype, :ipsec_dir, :ipsec_policy,
-    :state, :ctstate, :icmp, :limit, :burst, :length, :recent, :rseconds, :reap,
+    :state, :ctstate, :ctdir, :icmp, :limit, :burst, :length, :recent, :rseconds, :reap,
     :rhitcount, :rttl, :rname, :mask, :rsource, :rdest, :ipset, :string, :string_algo,
     :string_from, :string_to, :jump, :goto, :clusterip_new, :clusterip_hashmode,
     :clusterip_clustermac, :clusterip_total_nodes, :clusterip_local_node, :clusterip_hash_init, :queue_num, :queue_bypass,

diff --git a/lib/puppet/type/firewall.rb b/lib/puppet/type/firewall.rb
index cf27165369bf09290d1d325461f4180235aa8e65..1bc8f83d4ab85ff12bbe5f8917720a5143c65477 100644 (file)
--- a/lib/puppet/type/firewall.rb
+++ b/lib/puppet/type/firewall.rb
@@ -940,6 +940,10 @@ Puppet::Type.newtype(:firewall) do
     end
   end
 
+  newproperty(:ctdir) do
+    newvalues(:REPLY, :ORIGINAL)
+  end
+
   # Connection mark
   newproperty(:connmark, required_features: :mark) do
     desc <<-PUPPETCODE

diff --git a/spec/fixtures/iptables/conversion_hash.rb b/spec/fixtures/iptables/conversion_hash.rb
index b99db650b3e58ff05228019b2557617e9f19e9fe..6c92c2eef24d8e7c64d9ddf5866fe0d122e0ec8b 100644 (file)
--- a/spec/fixtures/iptables/conversion_hash.rb
+++ b/spec/fixtures/iptables/conversion_hash.rb
@@ -980,6 +980,15 @@ HASH_TO_ARGS = {
     },
     args: ['-t', :filter, '-p', :tcp, '-m', 'conntrack', '--ctstate', 'ESTABLISHED,INVALID', '-m', 'comment', '--comment', '100 ctstates_set_from_array'],
   },
+  'ctstates_and_ctdir' => {
+    params: {
+      name: '100 ctstates_and_ctdir',
+      table: 'filter',
+      ctstate: ['ESTABLISHED'],
+      ctdir: 'REPLY',
+    },
+    args: ['-t', :filter, '-p', :tcp, '-m', 'conntrack', '--ctstate', 'ESTABLISHED', '--ctdir', :REPLY, '-m', 'comment', '--comment', '100 ctstates_and_ctdir'],
+  },
   'comment_string_character_validation' => {
     params: {
       name: '000 allow from 192.168.0.1, please',