Support proto for IPSec policy extension in iptables state

[jfindlay]

What does this PR do?

Support --proto for iptables IPSec policy extension in iptables state.

What issues does this PR fix or reference?

I found no issues (open or closed) referencing this problem.

Previous Behavior

Consider the following state:

ipt-test:
  iptables.append:
    - name: ipt-test
    - table: filter
    - chain: INPUT
    - source: 10.20.0.0/24
    - destination: 10.10.0.0/24
    - in-interface: eth0
    - match: policy
    - proto: esp
    - dir: in
    - pol: ipsec
    - reqid: 1
    - jump: ACCEPT

Prior to this fix, applying ipt-test would produce this incorrect iptables rule:

# iptables -vL
...
 pkts bytes target     prot opt in     out     source               destination
...
    0     0 ACCEPT     esp  --  eth0   any     10.20.0.0/24         10.10.0.0/24         policy match dir in pol ipsec reqid 1
...
# iptables-save
...
-A INPUT -s 10.20.0.0/24 -d 10.10.0.0/24 -i eth0 -p esp -m policy --dir in --pol ipsec --reqid 1 -j ACCEPT
...

New Behavior

The state ipt-test now produces the correct iptables rule:

# iptables -vL
...
 pkts bytes target     prot opt in     out     source               destination
...
    0     0 ACCEPT     all  --  eth0   any     10.20.0.0/24         10.10.0.0/24         policy match dir in pol ipsec reqid 1 proto esp
...
# iptables-save
...
-A INPUT -s 10.20.0.0/24 -d 10.10.0.0/24 -i eth0 -m policy --dir in --pol ipsec --reqid 1 --proto esp -j ACCEPT
...

Notice how the proto is now interpreted as a parameter of the IPSec policy extension of iptables.

Tests written?

Automating tests for this would require iptables to be installed and working on the test system. If requested, I will attempt to make the necessary changes to SaltTesting. The full test case I used is copied below. The details of the state failure are shown in the Previous Behavior section. I compared the rules generated by the execution and state modules before and after the change against the rules generated with the raw iptables commands.

Raw commands

iptables -A INPUT -s 10.20.0.0/24 -d 10.10.0.0/24 -i eth0 -m policy --protocol esp --dir in --pol ipsec --reqid 1 -j ACCEPT
iptables -A INPUT --proto esp -s 10.20.0.0/24 -d 10.10.0.0/24 -i eth0 -m policy --proto esp --dir in --pol ipsec --reqid 1 -j ACCEPT
iptables -A INPUT -s 10.20.0.0/24 -d 10.10.0.0/24 -i eth0 -m policy --proto esp --dir in --pol ipsec --reqid 1 -j ACCEPT

salt iptables.append command line

salt-call --local iptables.append filter INPUT rule='-s 10.20.0.0/24 -d 10.10.0.0/24 -i eth0 -m policy --protocol esp --dir in --pol ipsec --reqid 1 -j ACCEPT'
salt-call --local iptables.append filter INPUT rule='--proto esp -s 10.20.0.0/24 -d 10.10.0.0/24 -i eth0 -m policy --proto esp --dir in --pol ipsec --reqid 1 -j ACCEPT'
salt-call --local iptables.append filter INPUT rule='-s 10.20.0.0/24 -d 10.10.0.0/24 -i eth0 -m policy --proto esp --dir in --pol ipsec --reqid 1 -j ACCEPT'

salt state.single iptables.append command line

salt-call --local state.single iptables.append name=ipt-test table=filter chain=INPUT source=10.20.0.0/24 destination=10.10.0.0/24 in-interface=eth0 match=policy protocol=esp dir=in pol=ipsec reqid=1 jump=ACCEPT
salt-call --local state.single iptables.append name=ipt-test table=filter chain=INPUT protocol=esp source=10.20.0.0/24 destination=10.10.0.0/24 in-interface=eth0 match=policy proto=esp dir=in pol=ipsec reqid=1 jump=ACCEPT
salt-call --local state.single iptables.append name=ipt-test table=filter chain=INPUT source=10.20.0.0/24 destination=10.10.0.0/24 in-interface=eth0 match=policy proto=esp dir=in pol=ipsec reqid=1 jump=ACCEPT

iptables-save output

-A INPUT -s 10.20.0.0/24 -d 10.10.0.0/24 -i eth0 -p esp -m policy --dir in --pol ipsec --reqid 1 -j ACCEPT
-A INPUT -s 10.20.0.0/24 -d 10.10.0.0/24 -i eth0 -p esp -m policy --dir in --pol ipsec --reqid 1 --proto esp -j ACCEPT
-A INPUT -s 10.20.0.0/24 -d 10.10.0.0/24 -i eth0 -m policy --dir in --pol ipsec --reqid 1 --proto esp -j ACCEPT

iptables -vL output

    0     0 ACCEPT     esp  --  eth0   any     10.20.0.0/24         10.10.0.0/24         policy match dir in pol ipsec reqid 1
    0     0 ACCEPT     esp  --  eth0   any     10.20.0.0/24         10.10.0.0/24         policy match dir in pol ipsec reqid 1 proto esp
    0     0 ACCEPT     all  --  eth0   any     10.20.0.0/24         10.10.0.0/24         policy match dir in pol ipsec reqid 1 proto esp

Results

Mode	Before	After
exec module	pass	pass
state module	fail	pass

Commits signed with GPG?

Yes

[gtmanfred]

Looks good other than the one small change.

[gtmanfred]

This should probably also be kwargs.get('match')