Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for parsing and using --tcp-option #1126

Merged
merged 6 commits into from
Jun 21, 2023
Merged

Add support for parsing and using --tcp-option #1126

merged 6 commits into from
Jun 21, 2023

Commits on May 26, 2023

  1. Fix Rubocop 'Metrics/BlockLength' config 

    Rubocop's maximum value for allowed block length needs to be incremented
by hand each time the 'firewall' type gains a new feature, because the
maximum block length is hand-tuned to the size of that 'newtype' block.
Having the 'Metrics/BlockLength' cop instead ignore lengths for the
'newtype' and 'provider' methods (which inherently have very long
blocks) instead solves the problem for all 'newtype' and 'provider'
blocks at one fell swoop, and with addition of one inline disable
comment for the 'validate' block in the 'firewall' type, means all
remaining block length warnings are squelched by a max value of only 64
lines.
    @greatflyingsteve
    greatflyingsteve committed May 26, 2023
    Configuration menu
    Copy the full SHA
    3dfe1b4 View commit details
    Browse the repository at this point in the history

  2. Support parsing iptables rules with --tcp-option 

    Add the ability to parse iptables rules we encounter that include the
'--tcp-option' flag, instead of issuing a "Skipping unparseable
iptables rule" warning.  Every Firewall resource requires a full parse
of all rules, and the warning appears each time the problem rule is
parsed; therefore these warning messages are noisy (especially on long
rule sets), and there is no way to work around this, make the parser
ignore the rule, or create other rules with Puppet in any order aside
from "above the unparseable rule."
    @greatflyingsteve
    greatflyingsteve committed May 26, 2023
    Configuration menu
    Copy the full SHA
    c2a06ce View commit details
    Browse the repository at this point in the history

  3. Support creating rules that match a TCP option 

    Add support (and unit tests) for creating rules that use iptables'
'--tcp-option' flag to match the presence or non-presence of numbered
TCP options.  Remove special casing from '--tcp-flags', previously the
only argument from the TCP match extension other than '--dport' and
'--sport', and have the TCP match extension treated as a module only
during rule assembly, because due to its inconsistent usage in
iptables-save output when multiport portspecs are used, '-m tcp' or
'-m udp' will throw off parsing badly if preset.

Resolves puppetlabs#1124
    @greatflyingsteve
    greatflyingsteve committed May 26, 2023
    Configuration menu
    Copy the full SHA
    7a7db40 View commit details
    Browse the repository at this point in the history

  4. Move ip6tables provider tests to correct file 

    Move tests for the ip6tables provider into the ip6tables provider unit
test file.  Even if it's subclassed from iptables, it should be
reasonable to expect running all tests in the ip6tables provider's
tests file to include all tests for the ip6tables provider.  Also update
several test definitions that had fallen out of sync with the iptables
provider's test framework so the test cases for ip6tables are also no
longer sensitive to specific hash order and stringified 'true'.
    @greatflyingsteve
    greatflyingsteve committed May 26, 2023
    Configuration menu
    Copy the full SHA
    8ac01cd View commit details
    Browse the repository at this point in the history

  5. Support parsing and creating IPv6 TCP Option rules 

    Provide the same support for rule parse and create for IPv6 as the
previous commit provided for IPv4
    @greatflyingsteve
    greatflyingsteve committed May 26, 2023
    Configuration menu
    Copy the full SHA
    1d283f2 View commit details
    Browse the repository at this point in the history

  6. Increment module version

    @greatflyingsteve
    greatflyingsteve committed May 26, 2023
    Configuration menu
    Copy the full SHA
    a82cd69 View commit details
    Browse the repository at this point in the history