puppetlabs/puppetlabs-firewall — pull request #229 by senax (2013-07-25 10:36:50+00:00)
Title: Generate of options to parse in the correct order from @resource_map

Hi,

when parsing the 'original' iptable configuration on RedHat6, the parser got a bit confused. The ordering of iptables-save may be a bit different than expected.

being able to parse existing iptables rules should make it easier to switch existing servers/scripts to using puppet.

# iptables-save
..
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [24:2432]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

# puppet resource firewall
...
firewall { '9004 dc0f1adfee77aa04ef7fdf348860a701':
ensure => 'present',
action => 'accept',
chain => 'INPUT',
dport => ['NEW'],
proto => 'tcp',
state => ['22'],
table => 'filter',
}
...

# After patching iptables.rb:

firewall { '9004 dc0f1adfee77aa04ef7fdf348860a701':
ensure => 'present',
action => 'accept',
chain => 'INPUT',
dport => ['22'],
proto => 'tcp',
state => ['NEW'],
table => 'filter',
}

Thanks,
Frank