From 1131ffe8bf839e59b078021655e3aa985a74be36 Mon Sep 17 00:00:00 2001 From: Dan Carley Date: Thu, 24 May 2012 19:02:06 +0100 Subject: [PATCH] (#9364 #10085) Normalise iptables-save to CIDR Normalise all source and destination addresses to CIDR notation as they are reverse-parsed from iptables-save. This ensures that they match how addresses are forward-parsed by the type with Util::Firewall.host_to_ip. Fixes two issues which both principally affect EL5 and may affect other providers in the future. Issue #9364: Single IP addresses not representing a range should be qualified in CIDR notation with /32 for IPv4 and /128 for IPv6. Issue #10085: Addresses with a dotted quad netmask representing a range should be qualifed with in CIDR notation instead. --- lib/puppet/provider/firewall/iptables.rb | 5 ++ spec/fixtures/iptables/conversion_hash.rb | 68 +++++++++++++++++++++++ 2 files changed, 73 insertions(+) diff --git a/lib/puppet/provider/firewall/iptables.rb b/lib/puppet/provider/firewall/iptables.rb index 1701a78..a3fb163 100644 --- a/lib/puppet/provider/firewall/iptables.rb +++ b/lib/puppet/provider/firewall/iptables.rb @@ -133,6 +133,11 @@ Puppet::Type.type(:firewall).provide :iptables, :parent => Puppet::Provider::Fir keys.zip(values.scan(/"[^"]*"|\S+/).reverse) { |f, v| hash[f] = v.gsub(/"/, '') } + # Normalise all rules to CIDR notation. + [:source, :destination].each do |prop| + hash[prop] = Puppet::Util::IPCidr.new(hash[prop]).cidr unless hash[prop].nil? + end + [:dport, :sport, :port, :state].each do |prop| hash[prop] = hash[prop].split(',') if ! hash[prop].nil? end diff --git a/spec/fixtures/iptables/conversion_hash.rb b/spec/fixtures/iptables/conversion_hash.rb index c165151..b8e34ca 100644 --- a/spec/fixtures/iptables/conversion_hash.rb +++ b/spec/fixtures/iptables/conversion_hash.rb @@ -57,6 +57,38 @@ ARGS_TO_HASH = { :action => nil, }, }, + 'source_destination_ipv4_no_cidr' => { + :line => '-A INPUT -s 1.1.1.1 -d 2.2.2.2 -m comment --comment "000 source destination ipv4 no cidr"', + :table => 'filter', + :params => { + :source => '1.1.1.1/32', + :destination => '2.2.2.2/32', + }, + }, + 'source_destination_ipv6_no_cidr' => { + :line => '-A INPUT -s 2001:db8:85a3::8a2e:370:7334 -d 2001:db8:85a3::8a2e:370:7334 -m comment --comment "000 source destination ipv6 no cidr"', + :table => 'filter', + :params => { + :source => '2001:db8:85a3::8a2e:370:7334/128', + :destination => '2001:db8:85a3::8a2e:370:7334/128', + }, + }, + 'source_destination_ipv4_netmask' => { + :line => '-A INPUT -s 1.1.1.0/255.255.255.0 -d 2.2.0.0/255.255.0.0 -m comment --comment "000 source destination ipv4 netmask"', + :table => 'filter', + :params => { + :source => '1.1.1.0/24', + :destination => '2.2.0.0/16', + }, + }, + 'source_destination_ipv6_netmask' => { + :line => '-A INPUT -s 2001:db8:1234::/ffff:ffff:ffff:0000:0000:0000:0000:0000 -d 2001:db8:4321::/ffff:ffff:ffff:0000:0000:0000:0000:0000 -m comment --comment "000 source destination ipv6 netmask"', + :table => 'filter', + :params => { + :source => '2001:db8:1234::/48', + :destination => '2001:db8:4321::/48', + }, + }, 'dport_range_1' => { :line => '-A INPUT -m multiport --dports 1:1024 -m comment --comment "000 allow foo"', :table => 'filter', @@ -309,6 +341,42 @@ HASH_TO_ARGS = { }, :args => ['-t', :filter, '-p', :tcp, '-m', 'comment', '--comment', '100 zero prefix length ipv6'], }, + 'source_destination_ipv4_no_cidr' => { + :params => { + :name => '000 source destination ipv4 no cidr', + :table => 'filter', + :source => '1.1.1.1', + :destination => '2.2.2.2', + }, + :args => ['-t', :filter, '-s', '1.1.1.1/32', '-d', '2.2.2.2/32', '-p', :tcp, '-m', 'comment', '--comment', '000 source destination ipv4 no cidr'], + }, + 'source_destination_ipv6_no_cidr' => { + :params => { + :name => '000 source destination ipv6 no cidr', + :table => 'filter', + :source => '2001:db8:1234::', + :destination => '2001:db8:4321::', + }, + :args => ['-t', :filter, '-s', '2001:db8:1234::/128', '-d', '2001:db8:4321::/128', '-p', :tcp, '-m', 'comment', '--comment', '000 source destination ipv6 no cidr'], + }, + 'source_destination_ipv4_netmask' => { + :params => { + :name => '000 source destination ipv4 netmask', + :table => 'filter', + :source => '1.1.1.0/255.255.255.0', + :destination => '2.2.0.0/255.255.0.0', + }, + :args => ['-t', :filter, '-s', '1.1.1.0/24', '-d', '2.2.0.0/16', '-p', :tcp, '-m', 'comment', '--comment', '000 source destination ipv4 netmask'], + }, + 'source_destination_ipv6_netmask' => { + :params => { + :name => '000 source destination ipv6 netmask', + :table => 'filter', + :source => '2001:db8:1234::/ffff:ffff:ffff:0000:0000:0000:0000:0000', + :destination => '2001:db8:4321::/ffff:ffff:ffff:0000:0000:0000:0000:0000', + }, + :args => ['-t', :filter, '-s', '2001:db8:1234::/48', '-d', '2001:db8:4321::/48', '-p', :tcp, '-m', 'comment', '--comment', '000 source destination ipv6 netmask'], + }, 'sport_range_1' => { :params => { :name => "100 sport range", -- 2.45.2