Skip to content

Commit 1d283f2

Browse files
greatflyingstevegreatflyingsteve
committed
Support parsing and creating IPv6 TCP Option rules
Provide the same support for rule parse and create for IPv6 as the previous commit provided for IPv4
1 parent 8ac01cd commit 1d283f2

File tree

2 files changed

+143
-3
lines changed

2 files changed

+143
-3
lines changed

‎lib/puppet/provider/firewall/ip6tables.rb‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
has_feature :nflog_prefix
3030
has_feature :nflog_range
3131
has_feature :nflog_threshold
32+
has_feature :tcp_option
3233
has_feature :tcp_flags
3334
has_feature :pkttype
3435
has_feature :ishasmorefrags
@@ -183,7 +184,8 @@ def self.iptables_save(*args)
183184
string_from: '--from',
184185
string_to: '--to',
185186
table: '-t',
186-
tcp_flags: '-m tcp --tcp-flags',
187+
tcp_option: '--tcp-option',
188+
tcp_flags: '--tcp-flags',
187189
todest: '--to-destination',
188190
toports: '--to-ports',
189191
tosource: '--to-source',
@@ -312,7 +314,7 @@ def self.iptables_save(*args)
312314
@resource_list = [:table, :source, :destination, :iniface, :outiface, :physdev_in,
313315
:physdev_out, :physdev_is_bridged, :physdev_is_in, :physdev_is_out,
314316
:proto, :ishasmorefrags, :islastfrag, :isfirstfrag, :src_range, :dst_range,
315-
:tcp_flags, :uid, :gid, :mac_source, :sport, :dport, :port, :src_type,
317+
:tcp_option, :tcp_flags, :uid, :gid, :mac_source, :sport, :dport, :port, :src_type,
316318
:dst_type, :socket, :pkttype, :ipsec_dir, :ipsec_policy, :state,
317319
:ctstate, :ctproto, :ctorigsrc, :ctorigdst, :ctreplsrc, :ctrepldst,
318320
:ctorigsrcport, :ctorigdstport, :ctreplsrcport, :ctrepldstport, :ctstatus, :ctexpire, :ctdir,

‎spec/fixtures/ip6tables/conversion_hash.rb‎

Lines changed: 139 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,94 @@
4949
params: {
5050
random_fully: 'true',
5151
}
52-
}
52+
},
53+
'tcp_flags_1' => {
54+
line: '-A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK,FIN SYN -m comment --comment "000 initiation"',
55+
compare_all: true,
56+
table: 'filter',
57+
chain: 'INPUT',
58+
proto: 'tcp',
59+
params: {
60+
name: '000 initiation',
61+
tcp_flags: 'SYN,RST,ACK,FIN SYN',
62+
proto: 'tcp',
63+
chain: 'INPUT',
64+
line: '-A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK,FIN SYN -m comment --comment "000 initiation"',
65+
provider: 'ip6tables',
66+
table: 'filter',
67+
ensure: :present,
68+
},
69+
},
70+
'tcp_option_1' => {
71+
line: '-A INPUT -p tcp -m tcp --tcp-option 8 -m comment --comment "001 tcp_option works alone"',
72+
compare_all: true,
73+
table: 'filter',
74+
chain: 'INPUT',
75+
proto: 'tcp',
76+
params: {
77+
chain: 'INPUT',
78+
ensure: :present,
79+
line: '-A INPUT -p tcp -m tcp --tcp-option 8 -m comment --comment "001 tcp_option works alone"',
80+
name: '001 tcp_option works alone',
81+
proto: 'tcp',
82+
provider: 'ip6tables',
83+
table: 'filter',
84+
tcp_option: '8',
85+
},
86+
},
87+
'tcp_option_2' => {
88+
line: '-A INPUT -p tcp -m tcp ! --tcp-option 8 -m comment --comment "002 tcp_option works alone, negated"',
89+
compare_all: true,
90+
table: 'filter',
91+
chain: 'INPUT',
92+
proto: 'tcp',
93+
params: {
94+
chain: 'INPUT',
95+
ensure: :present,
96+
line: '-A INPUT -p tcp -m tcp ! --tcp-option 8 -m comment --comment "002 tcp_option works alone, negated"',
97+
name: '002 tcp_option works alone, negated',
98+
proto: 'tcp',
99+
provider: 'ip6tables',
100+
table: 'filter',
101+
tcp_option: '! 8',
102+
},
103+
},
104+
'tcp_option_with_tcp_flags_1' => {
105+
line: '-A INPUT -p tcp -m tcp --tcp-option 8 --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "000 initiation"',
106+
table: 'filter',
107+
compare_all: true,
108+
chain: 'INPUT',
109+
proto: 'tcp',
110+
params: {
111+
chain: 'INPUT',
112+
ensure: :present,
113+
line: '-A INPUT -p tcp -m tcp --tcp-option 8 --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "000 initiation"',
114+
name: '000 initiation',
115+
proto: 'tcp',
116+
provider: 'ip6tables',
117+
table: 'filter',
118+
tcp_flags: 'FIN,SYN,RST,ACK SYN',
119+
tcp_option: '8',
120+
},
121+
},
122+
'tcp_option_with_tcp_flags_2' => {
123+
line: '-A INPUT -p tcp -m tcp ! --tcp-option 8 --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "000 initiation"',
124+
table: 'filter',
125+
compare_all: true,
126+
chain: 'INPUT',
127+
proto: 'tcp',
128+
params: {
129+
chain: 'INPUT',
130+
ensure: :present,
131+
line: '-A INPUT -p tcp -m tcp ! --tcp-option 8 --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "000 initiation"',
132+
name: '000 initiation',
133+
proto: 'tcp',
134+
provider: 'ip6tables',
135+
table: 'filter',
136+
tcp_flags: 'FIN,SYN,RST,ACK SYN',
137+
tcp_option: '! 8',
138+
},
139+
},
53140
}.freeze
54141

55142
# This hash is for testing converting a hash to an argument line.
@@ -141,4 +228,55 @@
141228
},
142229
args: ['-t', :filter, '-p', :tcp, '-j', 'NFLOG', '--nflog-group', 1, '--nflog-prefix', 'myprefix', '-m', 'comment', '--comment', '100 nflog'],
143230
},
231+
'tcp_flags_1' => {
232+
params: {
233+
name: '000 initiation',
234+
tcp_flags: 'SYN,RST,ACK,FIN SYN',
235+
table: 'filter',
236+
},
237+
238+
args: ['-t', :filter, '-p', :tcp, '-m', 'tcp', '--tcp-flags', 'SYN,RST,ACK,FIN', 'SYN', '-m', 'comment', '--comment', '000 initiation'],
239+
},
240+
'tcp_option_1' => {
241+
params: {
242+
name: '000 initiation',
243+
table: 'filter',
244+
chain: 'INPUT',
245+
proto: 'tcp',
246+
tcp_option: '8',
247+
},
248+
args: ['-t', :filter, '-p', :tcp, '-m', 'tcp', '--tcp-option', '8', '-m', 'comment', '--comment', '000 initiation'],
249+
},
250+
'tcp_option_2' => {
251+
params: {
252+
name: '000 initiation',
253+
table: 'filter',
254+
chain: 'INPUT',
255+
proto: 'tcp',
256+
tcp_option: '! 8',
257+
},
258+
args: ['-t', :filter, '-p', :tcp, '-m', 'tcp', '!', '--tcp-option', '8', '-m', 'comment', '--comment', '000 initiation'],
259+
},
260+
'tcp_option_with_tcp_flags_1' => {
261+
params: {
262+
name: '000 initiation',
263+
table: 'filter',
264+
chain: 'INPUT',
265+
proto: 'tcp',
266+
tcp_flags: 'FIN,SYN,RST,ACK SYN',
267+
tcp_option: '8',
268+
},
269+
args: ['-t', :filter, '-p', :tcp, '-m', 'tcp', '--tcp-option', '8', '--tcp-flags', 'FIN,SYN,RST,ACK', 'SYN', '-m', 'comment', '--comment', '000 initiation'],
270+
},
271+
'tcp_option_with_tcp_flags_2' => {
272+
params: {
273+
name: '000 initiation',
274+
table: 'filter',
275+
chain: 'INPUT',
276+
proto: 'tcp',
277+
tcp_flags: 'FIN,SYN,RST,ACK SYN',
278+
tcp_option: '! 8',
279+
},
280+
args: ['-t', :filter, '-p', :tcp, '-m', 'tcp', '!', '--tcp-option', '8', '--tcp-flags', 'FIN,SYN,RST,ACK', 'SYN', '-m', 'comment', '--comment', '000 initiation'],
281+
},
144282
}.freeze

0 commit comments

Comments
 (0)