diff --git a/lib/puppet/provider/firewalld_rich_rule/firewall_cmd.rb b/lib/puppet/provider/firewalld_rich_rule/firewall_cmd.rb index 08525f9f..3112f55b 100644 --- a/lib/puppet/provider/firewalld_rich_rule/firewall_cmd.rb +++ b/lib/puppet/provider/firewalld_rich_rule/firewall_cmd.rb @@ -44,7 +44,7 @@ def eval_dest end def elements - [:service, :port, :protocol, :icmp_block, :masquerade, :forward_port] + [:service, :port, :protocol, :icmp_block, :icmp_type, :masquerade, :forward_port] end def eval_element @@ -59,6 +59,8 @@ def eval_element args << quote_keyval('protocol', @resource[:port]['protocol']) when :icmp_block args << quote_keyval('name', @resource[:icmp_block]) + when :icmp_type + args << quote_keyval('name', @resource[:icmp_type]) # when :masquerade # `masquerade` doesn't accept any arguments. when :forward_port diff --git a/lib/puppet/type/firewalld_rich_rule.rb b/lib/puppet/type/firewalld_rich_rule.rb index 21b67841..447f3da8 100644 --- a/lib/puppet/type/firewalld_rich_rule.rb +++ b/lib/puppet/type/firewalld_rich_rule.rb @@ -77,6 +77,10 @@ desc 'Specify the element as an icmp-block' end + newparam(:icmp_type) do + desc 'Specify the element as an icmp-type' + end + newparam(:masquerade) do desc 'Specify the element as masquerade' end @@ -115,7 +119,7 @@ def _validate_action(value) end def elements - [:service, :port, :protocol, :icmp_block, :masquerade, :forward_port] + [:service, :port, :protocol, :icmp_block, :icmp_type, :masquerade, :forward_port] end validate do diff --git a/spec/unit/puppet/provider/firewalld_rich_rule_spec.rb b/spec/unit/puppet/provider/firewalld_rich_rule_spec.rb index 807afc58..1f671607 100644 --- a/spec/unit/puppet/provider/firewalld_rich_rule_spec.rb +++ b/spec/unit/puppet/provider/firewalld_rich_rule_spec.rb @@ -33,6 +33,7 @@ resource.expects(:[]).with(:port).returns(nil) resource.expects(:[]).with(:protocol).returns(nil) resource.expects(:[]).with(:icmp_block).returns(nil) + resource.expects(:[]).with(:icmp_type).returns(nil) resource.expects(:[]).with(:masquerade).returns(nil) resource.expects(:[]).with(:forward_port).returns(nil) resource.expects(:[]).with(:log).returns(nil) @@ -51,6 +52,7 @@ resource.expects(:[]).with(:port).returns(nil) resource.expects(:[]).with(:protocol).returns(nil) resource.expects(:[]).with(:icmp_block).returns(nil) + resource.expects(:[]).with(:icmp_type).returns(nil) resource.expects(:[]).with(:masquerade).returns(nil) resource.expects(:[]).with(:forward_port).returns(nil) resource.expects(:[]).with(:log).returns(nil) diff --git a/spec/unit/puppet/type/firewalld_rich_rule_spec.rb b/spec/unit/puppet/type/firewalld_rich_rule_spec.rb index 160c8167..6fd166e4 100644 --- a/spec/unit/puppet/type/firewalld_rich_rule_spec.rb +++ b/spec/unit/puppet/type/firewalld_rich_rule_spec.rb @@ -14,6 +14,7 @@ :action, :protocol, :icmp_block, + :icmp_type, :masquerade, :forward_port, :log, @@ -171,7 +172,19 @@ forward_port: { 'port' => '8080', 'protocol' => 'tcp', 'to_addr' => '10.72.1.10', 'to_port' => '80' }, zone: 'restricted', log: { 'level' => 'debug' } - } => 'rule family="ipv4" forward-port port="8080" protocol="tcp" to-port="80" to-addr="10.72.1.10" log level="debug"' + } => 'rule family="ipv4" forward-port port="8080" protocol="tcp" to-port="80" to-addr="10.72.1.10" log level="debug"', + + ## test icmp-type + { + name: 'accept echo', + ensure: 'present', + family: 'ipv4', + zone: 'restricted', + dest: '10.0.1.2/24', + icmp_type: 'echo', + log: { 'level' => 'debug' }, + action: 'accept' + } => 'rule family="ipv4" destination address="10.0.1.2/24" icmp-type name="echo" log level="debug" accept' }