GitHub puppet-ipset

Puppet module to manage ipset tooling and actual sets

modulesync 5.4.0

Add purging to $config_path dir to remove floating ipset config files

Pull Request (PR) description

Add support for comments (#5) and the types from the man page.

counters skbinfo markmask options are not implemented, they are boolean options. If anyone has any advice on how to implement that cleanly ...

example with using hiera data for bitmap:port:
yaml
data::from::hiera::ports:
- 5005
- 5006
- 5007
- 5008
- 5009
- 5010
- 5023
- 5027
- 5028
- 5031


puppet
ipset::set { 'port-server1':
set => lookup('data::from::hiera::ports'),
type => 'bitmap:port',
options => {
range => '5000-6000',
},
}


If you want to limit to udp:
puppet
ipset::set { 'port-server2':
set => lookup('data::from::hiera::ports').map |$value| { "udp:${value}" },
type => 'bitmap:port',
options => {
range => '5000-6000',
},
}


This was primarily implemented to be able to create non consecutive port lists as iptables only support a maximum of 15 ports with the --multiports and the XT_MULTI_PORTS compile setting source

This PR will enable using nested arrays for parameter 'set'.

It's required (e.g.) when grouping networks in Hiera.
```
ip4subnetaclass00: '10.0.1.0/24'
ip4subnetaclass01: '10.0.2.0/24'
ip4subnetsaclass:
- "%{alias('ip4subnetaclass00')}"
- "%{alias('ip4subnetaclass01')}"

ip4subnetcclass00: '192.168.0.0/24'
ip4subnetcclass01: '192.168.1.0/24'
ip4subnetscclass:
- "%{alias('ip4subnetcclass00')}"
- "%{alias('ip4subnetcclass01')}"

ip4subnets:
- "%{alias('ip4subnetsaclass')}"
- "%{alias('ip4subnets_cclass')}"

ipset::sets:
ip4subnets:
set: "%{alias('ip4subnets')}"
type: 'hash:net'
```