Fix rpfilter parameter #1013
Fix rpfilter parameter #1013
Conversation
|
It looks like the proposed improvement highlighted the issue with testing environment, the CentOS-6 doesn't appear to have support for the |
onyxmaster
force-pushed
the
feature/fix-rpfilter
branch
from
0b0d088 to
5f80dda
Compare
onyxmaster
force-pushed
the
feature/fix-rpfilter
branch
from
5f80dda to
f5a5e33
Compare
|
Well, it looks like I fixed the problem with CentOS 6 by adding proper version checks. @adrianiurca, could you please take a look? |
|
This PR has been marked as stale because it has been open for a while and has had no recent activity. If this PR is still important to you please drop a comment below and we will add this to our backlog to complete. Otherwise, it will be closed in 7 days. |
|
This PR is important, but there is no feedback on it :( |
|
Hi @onyxmaster, sorry for the delay in feedback. Our team has been undergoing some major changes over the last few months and that has translated into a lower level of engagement from our side with the community. I will remove the 'stale' label and, hopefully, a member from our team might be able to take a look soon at your PR. |
|
Hi @onyxmaster, your changes make sense to me and all checks are green, happy to merge this! Regarding the bigger issue affecting the module, you can report it by creating a new issue here in GH. Please make sure you add as much relevant information as you can (even linking this PR would help) so that the next person that starts working on it has an easier time troubleshooting. Thanks for your contribution. |
Hi,
In the current version of the module, the
rpfilterparameter works as a no-op, no matter which value is provided since the feature is not specified. This commit fixes this issue.Unfortunately, this is not the only issue with the parameter in question. The xt_rpfilter is one of the few extensions that perform meaningful work even when there are no extra parameters specified (in fact the default
strictmode is invoked by just the-m rpfilterstanza), and currently, the Puppet module requires for the mode to be set to one ofloose/validmark/accept-local/invert. In fact, all of these are optional flags and can be enabled simultaneously or not enabled at all. I'm not sure how to fix this and whether I should report this issue somewhere else.So while this PR addresses part of the problem with
rpfilterparameter just doing nothing, it doesn't fix the main issue withrpfiltersupport. Currently, to use defaultstrictmatching one can work around the issue by using one of the flags that do not significantly affect the processing most of the time (such as settingrpfilter => 'validmark'), but this is only a hacky workaround, not a complete solution. Please advise on where should I report the issue so it could be fixed completely.