puppetlabs/puppetlabs-firewall — pull request #348 by phemmer (2014-04-26 16:27:00+00:00)
Title: add ipset support

This adds support for ipset matching.

On a side note, the implementation of this was undesirable due to limitations in the firewall module. I wanted to be able to do:

```
firewall { '005 ipset blacklist':
chain => 'INPUT',
ipset => 'blacklist',
ipset_match => ['src','dst'],
action => 'drop',
}
```

but couldn't because the command line form is `--match-set blacklist src,dst`, and the firewall module does not support multi-argument parameters. So it had to be done as a single space-delimited option:

```
firewall { '005 ipset blacklist':
chain => 'INPUT',
ipset => 'blacklist src,dst',
action => 'drop',
}
```