diff --git a/REFERENCE.md b/REFERENCE.md index c3df93e..d321d51 100644 --- a/REFERENCE.md +++ b/REFERENCE.md @@ -310,6 +310,8 @@ Struct[{ Optional[maxelem] => Integer[128], Optional[netmask] => IP::Address, Optional[timeout] => Integer[1], + Optional[range] => String, + Optional[comment] => String, }] ``` @@ -364,6 +366,6 @@ type to allow all different hash setups for ipsets Alias of ```puppet -Enum['hash:ip', 'hash:ip,port', 'hash:ip,port,ip', 'hash:ip,port,net', 'hash:ip,mark', 'hash:net', 'hash:net,net', 'hash:net,iface', 'hash:net,port', 'hash:net,port,net', 'hash:mac'] +Enum['bitmap:ip','bitmap:ip,mac','bitmap:port','hash:ip','hash:mac','hash:ip,mac','hash:net','hash:net,net','hash:ip,port','hash:net,port','hash:ip,port,ip','hash:ip,port,net','hash:ip,mark','hash:net,port,net','hash:net,iface','list:set'] ``` diff --git a/manifests/set.pp b/manifests/set.pp index eb610cb..c7ee919 100644 --- a/manifests/set.pp +++ b/manifests/set.pp @@ -82,10 +82,17 @@ $config_path = $ipset::config_path - $default_options = { - 'family' => 'inet', - 'hashsize' => '1024', - 'maxelem' => '65536', + case $type { + default: { + $default_options = {} + } + 'hash:ip', 'hash:net': { + $default_options = { + 'family' => 'inet', + 'hashsize' => '1024', + 'maxelem' => '65536', + } + } } $actual_options = merge($default_options, $options) diff --git a/spec/acceptance/ipset_spec.rb b/spec/acceptance/ipset_spec.rb index 21f5208..74e1d1a 100644 --- a/spec/acceptance/ipset_spec.rb +++ b/spec/acceptance/ipset_spec.rb @@ -36,6 +36,28 @@ end end + context 'with a port ipset' do + it 'works idempotently with no errors' do + pp = <<-EOS + include ipset + ipset::set{'port-set': + set => ['5000', '5001', '5999'], + type => 'bitmap:port', + options => { + range => '5000-6000', + }, + } + EOS + # Run it twice and test for idempotency + apply_manifest(pp, catch_failures: true) + apply_manifest(pp, catch_changes: true) + end + + describe command('ipset list port-set') do + its(:stdout) { is_expected.to match %r{.*port-set.*Type: bitmap:port.*5000.*}m } + end + end + context 'can delete ipsets' do it 'works even here idempotently with no errors' do pp = <<-EOS diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb index 6e9764a..fadca4b 100644 --- a/spec/classes/init_spec.rb +++ b/spec/classes/init_spec.rb @@ -63,6 +63,13 @@ 'options' => { 'family' => 'inet6' } + }, + 'port-set' => { + 'set' => '[5000, 5001, 5999]', + 'type' => 'bitmap:port', + 'options' => { + 'range' => '5000-6000' + } } } } @@ -82,6 +89,14 @@ 'family' => 'inet6' } ) + expect(subject).to contain_ipset__set('port-set').\ + with( + 'set' => '[5000, 5001, 5999]', + 'type' => 'bitmap:port', + 'options' => { + 'range' => '5000-6000' + } + ) end end end diff --git a/spec/defines/init_spec.rb b/spec/defines/init_spec.rb index dcbbed8..1e1567a 100644 --- a/spec/defines/init_spec.rb +++ b/spec/defines/init_spec.rb @@ -41,6 +41,11 @@ def check_exec_sync(name, attributes) end simple_test_cases = [ + [ + 'array', + [5000, 5001, 5999], + { content: "5000\n5001\n5999\n" } + ], [ 'array', ['10.0.0.1', '192.168.0.1'], diff --git a/types/options.pp b/types/options.pp index fe30ecb..17595de 100644 --- a/types/options.pp +++ b/types/options.pp @@ -9,4 +9,6 @@ Optional[maxelem] => Integer[128], Optional[netmask] => IP::Address, Optional[timeout] => Integer[1], + Optional[range] => String, + Optional[comment] => String, }] diff --git a/types/set/array.pp b/types/set/array.pp index 792524c..9753726 100644 --- a/types/set/array.pp +++ b/types/set/array.pp @@ -1,4 +1,4 @@ # # @summary type to allow an array of ip addresses # -type IPSet::Set::Array = Array[String] +type IPSet::Set::Array = Variant[Array[String], Array[Stdlib::Port]] diff --git a/types/type.pp b/types/type.pp index a4c7eef..10c48c5 100644 --- a/types/type.pp +++ b/types/type.pp @@ -4,15 +4,20 @@ # @see http://ipset.netfilter.org/ipset.man.html#lbAW documentation for all different hash options # type IPSet::Type = Enum[ + 'bitmap:ip', + 'bitmap:ip,mac', + 'bitmap:port', 'hash:ip', + 'hash:mac', + 'hash:ip,mac', + 'hash:net', + 'hash:net,net', 'hash:ip,port', + 'hash:net,port', 'hash:ip,port,ip', 'hash:ip,port,net', 'hash:ip,mark', - 'hash:net', - 'hash:net,net', - 'hash:net,iface', - 'hash:net,port', 'hash:net,port,net', - 'hash:mac', + 'hash:net,iface', + 'list:set', ]