(MODULES-4200) Add simple sanity check for the rule to hash parser #666
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Parser fails in some cases with combined arguments e.g. if some other argument is set between match name and match option, like dport in this example: -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN If the parsed keys and values count is not the same, the error is raised with the problematic rule line.
comel
changed the title
|
Is there anything else I have to do to get this merged or to get some feedback? |
|
FWIW the sanity check is the indirect cause of https://tickets.puppetlabs.com/browse/MODULES-6029 Puppet fails to parse some (fairly simple) pre-existing iptables rules. Instead of stopping the Puppet run on this, we should probably just issue a warning and skip the rule. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We have manual and puppet controlled chains, and someone manually added rule like this:
-A INPUT -s 1.2.3.4/32 -p tcp -m -tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "some comment" -j ACCEPTand puppet started throwing errors like:
Could not evaluate: Invalid address from IPAddr.new: 80After some digging I've found that the rule is not properly parsed because of the
--dport 80between-m tcpand--tcp-flags. Similar issues can be expected with other combined arguments from the resource_map. It's hard to cover all those cases so I've added simple sanity check for the parser.https://tickets.puppetlabs.com/browse/MODULES-4200