From e9801a2e8f8a8b9d232c2bd9a3c3a3611d914cdc Mon Sep 17 00:00:00 2001
From: =?utf8?q?Samuli=20Sepp=C3=A4nen?= <samuli@openvpn.net>
Date: Fri, 31 Jan 2020 12:03:11 +0200
Subject: [PATCH] MODULES-10522: Add support for the --condition parameter
---
lib/puppet/provider/firewall/ip6tables.rb | 5 ++++-
lib/puppet/provider/firewall/iptables.rb | 6 +++++-
lib/puppet/type/firewall.rb | 16 ++++++++++++++++
spec/unit/puppet/type/firewall_spec.rb | 7 +++++++
4 files changed, 32 insertions(+), 2 deletions(-)
diff --git a/lib/puppet/provider/firewall/ip6tables.rb b/lib/puppet/provider/firewall/ip6tables.rb
index bcf35fa..53d161d 100644
--- a/lib/puppet/provider/firewall/ip6tables.rb
+++ b/lib/puppet/provider/firewall/ip6tables.rb
@@ -2,6 +2,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
@doc = 'Ip6tables type provider'
has_feature :iptables
+ has_feature :condition
has_feature :connection_limiting
has_feature :conntrack
has_feature :hop_limiting
@@ -83,6 +84,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
burst: '--limit-burst',
checksum_fill: '--checksum-fill',
clamp_mss_to_pmtu: '--clamp-mss-to-pmtu',
+ condition: '--condition',
connlimit_above: '-m connlimit --connlimit-above',
connlimit_mask: '--connlimit-mask',
connmark: '-m connmark --mark',
@@ -250,6 +252,7 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
addrtype: [:src_type, :dst_type],
iprange: [:src_range, :dst_range],
owner: [:uid, :gid],
+ condition: [:condition],
conntrack: [:ctstate, :ctproto, :ctorigsrc, :ctorigdst, :ctreplsrc, :ctrepldst,
:ctorigsrcport, :ctorigdstport, :ctreplsrcport, :ctrepldstport, :ctstatus, :ctexpire, :ctdir],
time: [:time_start, :time_stop, :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone],
@@ -308,5 +311,5 @@ Puppet::Type.type(:firewall).provide :ip6tables, parent: :iptables, source: :ip6
:set_mark, :match_mark, :connlimit_above, :connlimit_mask, :connmark, :time_start, :time_stop, :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone,
:src_cc, :dst_cc, :hashlimit_upto, :hashlimit_above, :hashlimit_name, :hashlimit_burst,
:hashlimit_mode, :hashlimit_srcmask, :hashlimit_dstmask, :hashlimit_htable_size,
- :hashlimit_htable_max, :hashlimit_htable_expire, :hashlimit_htable_gcinterval, :bytecode, :zone, :helper, :rpfilter, :name, :notrack]
+ :hashlimit_htable_max, :hashlimit_htable_expire, :hashlimit_htable_gcinterval, :bytecode, :zone, :helper, :rpfilter, :name, :notrack, :condition]
end
diff --git a/lib/puppet/provider/firewall/iptables.rb b/lib/puppet/provider/firewall/iptables.rb
index 76dc990..2963017 100644
--- a/lib/puppet/provider/firewall/iptables.rb
+++ b/lib/puppet/provider/firewall/iptables.rb
@@ -7,6 +7,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
@doc = 'Iptables type provider'
has_feature :iptables
+ has_feature :condition
has_feature :connection_limiting
has_feature :conntrack
has_feature :rate_limiting
@@ -75,6 +76,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
burst: '--limit-burst',
checksum_fill: '--checksum-fill',
clamp_mss_to_pmtu: '--clamp-mss-to-pmtu',
+ condition: '--condition',
connlimit_above: '-m connlimit --connlimit-above',
connlimit_mask: '--connlimit-mask',
connmark: '-m connmark --mark',
@@ -252,6 +254,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
addrtype: [:src_type, :dst_type],
iprange: [:src_range, :dst_range],
owner: [:uid, :gid],
+ condition: [:condition],
conntrack: [:ctstate, :ctproto, :ctorigsrc, :ctorigdst, :ctreplsrc, :ctrepldst,
:ctorigsrcport, :ctorigdstport, :ctreplsrcport, :ctrepldstport, :ctstatus, :ctexpire, :ctdir],
time: [:time_start, :time_stop, :month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone],
@@ -348,7 +351,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
:month_days, :week_days, :date_start, :date_stop, :time_contiguous, :kernel_timezone,
:src_cc, :dst_cc, :hashlimit_upto, :hashlimit_above, :hashlimit_name, :hashlimit_burst,
:hashlimit_mode, :hashlimit_srcmask, :hashlimit_dstmask, :hashlimit_htable_size,
- :hashlimit_htable_max, :hashlimit_htable_expire, :hashlimit_htable_gcinterval, :bytecode, :ipvs, :zone, :helper, :cgroup, :rpfilter, :name, :notrack
+ :hashlimit_htable_max, :hashlimit_htable_expire, :hashlimit_htable_gcinterval, :bytecode, :ipvs, :zone, :helper, :cgroup, :rpfilter, :name, :notrack, :condition
]
def insert
@@ -653,6 +656,7 @@ Puppet::Type.type(:firewall).provide :iptables, parent: Puppet::Provider::Firewa
# Invert any rules that are prefixed with a '!'
[
:connmark,
+ :condition,
:ctstate,
:ctproto,
:ctorigsrc,
diff --git a/lib/puppet/type/firewall.rb b/lib/puppet/type/firewall.rb
index 74db820..71199d1 100644
--- a/lib/puppet/type/firewall.rb
+++ b/lib/puppet/type/firewall.rb
@@ -56,6 +56,8 @@ Puppet::Type.newtype(:firewall) do
* clusterip: Configure a simple cluster of nodes that share a certain IP and MAC address without an explicit load balancer in front of them.
+ * condition: Match if a specific condition variable is (un)set (requires xtables-addons)
+
* connection_limiting: Connection limiting features.
* conntrack: Connection tracking features.
@@ -146,6 +148,7 @@ Puppet::Type.newtype(:firewall) do
PUPPETCODE
feature :connection_limiting, 'Connection limiting features.'
+ feature :condition, 'Match if a specific condition variable is (un)set.'
feature :conntrack, 'Connection tracking features.'
feature :hop_limiting, 'Hop limiting features.'
feature :rate_limiting, 'Rate limiting features.'
@@ -2251,6 +2254,19 @@ Puppet::Type.newtype(:firewall) do
PUPPETCODE
newvalues(:true, :false)
end
+
+ newproperty(:condition, required_features: :condition) do
+ desc <<-PUPPETCODE
+ Match on boolean value (0/1) stored in /proc/net/nf_condition/name.
+ PUPPETCODE
+ validate do |value|
+ unless value.is_a?(String)
+ raise ArgumentError, <<-PUPPETCODE
+ Condition must be a string.
+ PUPPETCODE
+ end
+ end
+ end
autorequire(:firewallchain) do
reqs = []
diff --git a/spec/unit/puppet/type/firewall_spec.rb b/spec/unit/puppet/type/firewall_spec.rb
index fbe65eb..70d026f 100755
--- a/spec/unit/puppet/type/firewall_spec.rb
+++ b/spec/unit/puppet/type/firewall_spec.rb
@@ -823,6 +823,13 @@ describe firewall do # rubocop:disable RSpec/MultipleDescribes
end
end
+ describe ':condition' do
+ it 'accepts value as a string' do
+ resource[:condition] = 'somefile'
+ expect(resource[:condition]).to eq('somefile')
+ end
+ end
+
describe 'autorequire packages' do
[:iptables, :ip6tables].each do |provider|
it "provider #{provider} should autorequire package iptables" do
--
2.45.2