Permalink
Browse files

Merge branch 'ticket/master/14949'

* ticket/master/14949:
  (#14949) Added pkttype property
  • Loading branch information...
2 parents 5355bc9 + 95db3e0 commit c991c2b54bc262d111abdf588c249b7f528b27b8 @kbarber kbarber committed Jun 20, 2012
@@ -14,6 +14,7 @@
has_feature :log_prefix
has_feature :mark
has_feature :tcp_flags
+ has_feature :pkttype
commands :iptables => '/sbin/ip6tables'
commands :iptables_save => '/sbin/ip6tables-save'
@@ -42,14 +43,15 @@
:toports => "--to-ports",
:tosource => "--to-source",
:uid => "-m owner --uid-owner",
+ :pkttype => "-m pkttype --pkt-type"
}
# This is the order of resources as they appear in iptables-save output,
# we need it to properly parse and apply rules, if the order of resource
# changes between puppet runs, the changed rules will be re-applied again.
# This order can be determined by going through iptables source code or just tweaking and trying manually
@resource_list = [:table, :source, :destination, :iniface, :outiface,
- :proto, :gid, :uid, :sport, :dport, :port, :name, :state, :icmp, :limit, :burst, :jump,
+ :proto, :gid, :uid, :sport, :dport, :port, :pkttype, :name, :state, :icmp, :limit, :burst, :jump,
:todest, :tosource, :toports, :log_level, :log_prefix, :reject]
end
@@ -19,6 +19,7 @@
has_feature :log_prefix
has_feature :mark
has_feature :tcp_flags
+ has_feature :pkttype
commands :iptables => '/sbin/iptables'
commands :iptables_save => '/sbin/iptables-save'
@@ -51,14 +52,15 @@
:tosource => "--to-source",
:uid => "-m owner --uid-owner",
:set_mark => "--set-mark",
+ :pkttype => "-m pkttype --pkt-type"
}
# This is the order of resources as they appear in iptables-save output,
# we need it to properly parse and apply rules, if the order of resource
# changes between puppet runs, the changed rules will be re-applied again.
# This order can be determined by going through iptables source code or just tweaking and trying manually
@resource_list = [:table, :source, :destination, :iniface, :outiface,
- :proto, :tcp_flags, :gid, :uid, :sport, :dport, :port, :name, :state, :icmp, :limit, :burst,
+ :proto, :tcp_flags, :gid, :uid, :sport, :dport, :port, :pkttype, :name, :state, :icmp, :limit, :burst,
:jump, :todest, :tosource, :toports, :log_level, :log_prefix, :reject, :set_mark]
def insert
@@ -33,6 +33,7 @@
feature :log_prefix, "The ability to add prefixes to log messages"
feature :mark, "Set the netfilter mark value associated with the packet"
feature :tcp_flags, "The ability to match on particular TCP flag settings"
+ feature :pkttype, "Match a packet type"
# provider specific features
feature :iptables, "The provider provides iptables features."
@@ -488,6 +489,14 @@ def should_to_s(value)
end
end
+ newproperty(:pkttype, :required_features => :pkttype) do
+ desc <<-EOS
+ Sets the packet type to match.
+ EOS
+
+ newvalues(:unicast, :broadcast, :multicast)
+ end
+
newparam(:line) do
desc <<-EOS
Read-only property for caching the rule line.
@@ -281,6 +281,14 @@
:outiface => 'eth+',
},
},
+ 'pkttype multicast' => {
+ :line => '-A INPUT -m pkttype --pkt-type multicast -j ACCEPT',
+ :table => 'filter',
+ :params => {
+ :action => 'accept',
+ :pkttype => 'multicast',
+ },
+ },
}
# This hash is for testing converting a hash to an argument line.
@@ -594,4 +602,15 @@
},
:args => ["-t", :filter, "-o", "eth+", "-p", :tcp, "-m", "comment", "--comment", "060 outiface", "-j", "DROP"],
},
+ 'pkttype multicast' => {
+ :params => {
+ :name => '062 pkttype multicast',
+ :table => "filter",
+ :action => 'accept',
+ :chain => 'INPUT',
+ :iniface => 'eth0',
+ :pkttype => 'multicast',
+ },
+ :args => ["-t", :filter, "-i", "eth0", "-p", :tcp, "-m", "pkttype", "--pkt-type", :multicast, "-m", "comment", "--comment", "062 pkttype multicast", "-j", "ACCEPT"],
+ },
}
@@ -396,4 +396,17 @@
rel[1].target.ref.should == @resource.ref
end
end
+
+ describe ':pkttype' do
+ [:multicast, :broadcast, :unicast].each do |pkttype|
+ it "should accept pkttype value #{pkttype}" do
+ @resource[:pkttype] = pkttype
+ @resource[:pkttype].should == pkttype
+ end
+ end
+
+ it 'should fail when the pkttype value is not recognized' do
+ lambda { @resource[:pkttype] = 'not valid' }.should raise_error(Puppet::Error)
+ end
+ end
end

0 comments on commit c991c2b

Please sign in to comment.