From 51bf7ed8c1dd11ab452abd222da01fb5e6d1d4c2 Mon Sep 17 00:00:00 2001
From: Dan Prince <dprince@redhat.com>
Date: Fri, 1 Mar 2013 09:55:57 -0500
Subject: [PATCH] Add RHEL support to iptables module.

Updates the iptables module so that it uses parameters
to define the package, service, and files used to setup and
configure persistent iptables rules.

With these updates the module should now support both
RHEL and Ubuntu.

Change-Id: I45af4e72065c9baaf1d9a03f18b47f6effdce322
Reviewed-on: https://review.openstack.org/23278
Reviewed-by: Clark Boylan <clark.boylan@gmail.com>
Approved: Jeremy Stanley <fungi@yuggoth.org>
Reviewed-by: Jeremy Stanley <fungi@yuggoth.org>
Tested-by: Jenkins
---
 modules/iptables/manifests/init.pp   | 55 ++++++++++++++--------------
 modules/iptables/manifests/params.pp | 38 +++++++++++++++++++
 2 files changed, 66 insertions(+), 27 deletions(-)
 create mode 100644 modules/iptables/manifests/params.pp

diff --git a/modules/iptables/manifests/init.pp b/modules/iptables/manifests/init.pp
index 491485cf3c..c7c95373d1 100644
--- a/modules/iptables/manifests/init.pp
+++ b/modules/iptables/manifests/init.pp
@@ -15,64 +15,65 @@ class iptables(
   $public_tcp_ports = [],
   $public_udp_ports = []
 ) {
-  package { 'iptables-persistent':
+
+  include iptables::params
+
+  package { 'iptables':
     ensure => present,
+    name   => $::iptables::params::package_name,
   }
 
-  service { 'iptables-persistent':
-    require    => Package['iptables-persistent'],
-    # Because there is no running process for this service, the normal status
-    # checks fail.  Because puppet then thinks the service has been manually
-    # stopped, it won't restart it.  This fake status command will trick puppet
-    # into thinking the service is *always* running (which in a way it is, as
-    # iptables is part of the kernel.)
-    hasstatus  => true,
-    status     => true,
-    # Under Debian, the "restart" parameter does not reload the rules, so tell
-    # Puppet to fall back to stop/start, which does work.
-    hasrestart => false,
+  service { 'iptables':
+    name       => $::iptables::params::service_name,
+    require    => Package['iptables'],
+    hasstatus  => $::iptables::params::service_has_status,
+    status     => $::iptables::params::service_status_cmd,
+    hasrestart => $::iptables::params::service_has_restart,
   }
 
-  file { '/etc/iptables':
-    ensure => directory,
+  file { $::iptables::params::rules_dir:
+    ensure     => directory,
+    require    => Package['iptables'],
   }
 
-  file { '/etc/iptables/rules':
+  # This file is not required on Red Hat distros... but it
+  # won't hurt to softlink to it either
+  file { "${::iptables::params::rules_dir}/rules":
     ensure  => present,
     owner   => 'root',
     group   => 'root',
     mode    => '0640',
     content => template('iptables/rules.erb'),
     require => [
-      Package['iptables-persistent'],
-      File['/etc/iptables'],
+      Package['iptables'],
+      File[$::iptables::params::rules_dir],
     ],
     # When this file is updated, make sure the rules get reloaded.
-    notify  => Service['iptables-persistent'],
+    notify  => Service['iptables'],
   }
 
-  file { '/etc/iptables/rules.v4':
+  file { $::iptables::params::ipv4_rules:
     ensure  => link,
     owner   => 'root',
     group   => 'root',
     mode    => '0640',
-    target  => '/etc/iptables/rules',
-    require => File['/etc/iptables/rules'],
-    notify  => Service['iptables-persistent'],
+    target  => "${::iptables::params::rules_dir}/rules",
+    require => File["${::iptables::params::rules_dir}/rules"],
+    notify  => Service['iptables'],
   }
 
-  file { '/etc/iptables/rules.v6':
+  file { $::iptables::params::ipv6_rules:
     ensure  => present,
     owner   => 'root',
     group   => 'root',
     mode    => '0640',
     content => template('iptables/rules.v6.erb'),
     require => [
-      Package['iptables-persistent'],
-      File['/etc/iptables'],
+      Package['iptables'],
+      File[$::iptables::params::rules_dir],
     ],
     # When this file is updated, make sure the rules get reloaded.
-    notify  => Service['iptables-persistent'],
+    notify  => Service['iptables'],
     replace => true,
   }
 }
diff --git a/modules/iptables/manifests/params.pp b/modules/iptables/manifests/params.pp
new file mode 100644
index 0000000000..dc41a33a19
--- /dev/null
+++ b/modules/iptables/manifests/params.pp
@@ -0,0 +1,38 @@
+# Class: iptables::params
+#
+# This class holds parameters that need to be
+# accessed by other classes.
+class iptables::params {
+  case $::osfamily {
+    'Redhat': {
+      $package_name = 'iptables'
+      $service_name = 'iptables'
+      $rules_dir = '/etc/sysconfig'
+      $ipv4_rules = '/etc/sysconfig/iptables'
+      $ipv6_rules = '/etc/sysconfig/ip6tables'
+      $service_has_status = true
+      $service_status_cmd = undef
+      $service_has_restart = false
+    }
+    'Debian', 'Ubuntu': {
+      $package_name = 'iptables-persistent'
+      $service_name = 'iptables-persistent'
+      $rules_dir = '/etc/iptables'
+      $ipv4_rules = '/etc/iptables/rules.v4'
+      $ipv6_rules = '/etc/iptables/rules.v6'
+      # Because there is no running process for this service, the normal status
+      # checks fail.  Because puppet then thinks the service has been manually
+      # stopped, it won't restart it.  This fake status command will trick
+      # puppet into thinking the service is *always* running (which in a way
+      # it is, as iptables is part of the kernel.)
+      $service_has_status = true
+      $service_status_cmd = true
+      # Under Debian, the "restart" parameter does not reload the rules, so
+      # tell Puppet to fall back to stop/start, which does work.
+      $service_has_restart = false
+    }
+    default: {
+      fail("Unsupported osfamily: ${::osfamily} The 'iptables' module only supports osfamily Ubuntu or Redhat(slaves only).")
+    }
+  }
+}