(#10164) Reject and document icmp => "any"

iptables accepts the string "any" as an ICMP type and stores it behind the
scenes as the fake (IANA reserved) numeric 255. This is functionally
equivalent to not specifying an `--icmp-type` argument.

ip6tables didn't carry this "feature" over. Like many other providers, the
matching of any ICMP packet type is only achieved by omitting the
`--icmpv6-type` arugment.

For the purpose of simpler logic and future provider compatibility we
prevent people from using the value "any" and advise them to omit/undefine
the param instead.

Include a test that somewhat duplicates the prevention of invalid strings
but would preserve this behaviour should icmp_name_to_number() ever change.
(#14590) Fix for when iptables-save spews out "FATAL" errors.

On some broken Virtuozzo containers, /lib/modules/$(uname -r)/modules.dep is
absent. This causes iptables-save to give some "FATAL" errors.  This patch
fixes the parser to ignore them instead of generating garbage rules that make
for errors in the puppet agent run.
Merge branch 'ignore_errors'

* ignore_errors:
  (#14590) Fix for when iptables-save spews out "FATAL" errors.
(#14641) Fix for incorrect limit command arguments for ip6tables provider
(#10274) Document Util::Firewall.host_to_ip

Document the current behaviour of Util::Firewall.host_to_ip before it is
modified to handle addresses with zero prefix lengths.
(#10274) Nullify addresses with zero prefixlen

Modify the behaviour of Util::Firewall.host_to_ip, as used by the type to
parse source and destination addresses, to return nil if the resulting CIDR
represented address has a prefix length of zero. Includes type and provider
tests for IPv4 and IPv6.

IPtables silently omits rules with source and destination addresses that
have a prefix length of zero (eg. 0.0.0.0/0) because they are functionally
equivialent to not specifying any address. This was causing rules to be
unecessarily reloaded.

The behaviour of Util::IPcidr remains the same. Now includes some additional
tests for it's identification of zero prefixlen IPv4 and IPv6 addresses.
Merge pull request #80 from dcarley/10274-zero_prefixlen_addresses

(#10274) Nullify addresses with zero prefixlen
Merge pull request #79 from mediatemple/limitfix

(#14641) Fix for incorrect limit command arguments for ip6tables provider
Merge pull request #60 from dcarley/10164-icmp_any

(#10164) Reject and document icmp => "any"
(#10025) Add support for --tcp-flags
(#10025) Make tcp_flags support a feature.
Merge branch 'ticket/10025-TCP-flags-matching-support'

* ticket/10025-TCP-flags-matching-support:
  (#10025) Make tcp_flags support a feature.
  (#10025) Add support for --tcp-flags
(#13560) OUTPUT is a valid chain for the mangle table
Merge branch '13560'

* 13560:
  (#13560) OUTPUT is a valid chain for the mangle table
(maint) Enable travis-ci support.
Merge branch 'travis_ci'

* travis_ci:
  (maint) Enable travis-ci support.
(#14938) Add more test variations for travis testing

Include different variations of Puppet to be tested, and fix any pending issues
so all tests pass.
Merge branch 'ticket/master/14938-travis_matrices'

* ticket/master/14938-travis_matrices:
  (#14938) Add more test variations for travis testing
(#9364 #10085) Convert an existing test to CIDR

Modify an existing test which has a source IP address without CIDR notation.
This will break after normalisation because [:params][:source] is expected
to be CIDR. Updating -s within [:line] too, since we aren't explcitly testing
that behaviour with this fixture.
(#9364 #10085) Normalise iptables-save to CIDR

Normalise all source and destination addresses to CIDR notation as they are
reverse-parsed from iptables-save. This ensures that they match how
addresses are forward-parsed by the type with Util::Firewall.host_to_ip.

Fixes two issues which both principally affect EL5 and may affect other
providers in the future.

Issue #9364:
    Single IP addresses not representing a range should be qualified in CIDR
    notation with /32 for IPv4 and /128 for IPv6.

Issue #10085:
    Addresses with a dotted quad netmask representing a range should be
    qualifed with in CIDR notation instead.