Customer-Found
Prod-Related: CEEMCP-19
Prod-Related: PROD-22620

Change-Id: Ib14838becc409c2f735d93b5fa8a8ead6ea1a5ec

There is a way to manage tables in rules, but there is no way to
manage tables for chains when setting policy.

Looks like pillar structure is bad from the beginning and to
not break backward compatibility, as same chain names may occur in
different tables, so it is proposed to check if 'chain.policy' is
map. And if it is, specific policies would be ensured for specific
tables, otherwise table 'filter' would be used as a fallback.

To ensure chains in specific tables we iterate over all rules in
each chain.

This hash is valid:

parameters:
  iptables:
    service:
      enabled: true
      chain:
        OUTPUT:
          policy: ACCEPT
        FORWARD:
          policy:
          - table: mangle
            policy: DROP
        INPUT:
          policy:
          - table: nat
            policy: ACCEPT
          rules:
          - jump: ACCEPT
            protocol: icmp
        POSTROUTING:
          rules:
          - jump: MASQUERADE
            protocol: icmp
            out_interface: ens3
            table: nat

Prod-Related: CEEMCP-12
Prod-Related: EME-313

Change-Id: Ib5ba97dad165d3ef2dec7e053b391ea36a996103

Change-Id: I6b37adb81766abd2f27da7ada7ba14681b47e07f

If some rules references other chains that are not yet present
state fails. Make sure all chains are created before any rules by
configuring requirement constraint.

Change-Id: Iaf506919f330ff962891baab8132c3b46c49a47c
Closes-Bug: PROD-18821

Change-Id: I3fe9e15a42b12265524403b466c5016d1de86e93

Change-Id: I9a9053e3771d920ecfea30115bd6191c0c6959f6

state iptables.rules may fail if grains_yaml is None

Change-Id: Ibd59c33345f1af97267a7632d3e5b64d885c41e8

Change-Id: Iba7d940b7d909b8f70fe6b7490ce5149ad3cdbb4

Change-Id: I268199df924a742f14d1c965b96eb7c5ef30d70a

Change-Id: Ifd4fe5d0fa70a891169c7214c24f1d8b80bfc039

Change-Id: Ie0cacec0eb6c69349db7a12a0a79965c6069ae7c

Change-Id: I8e14a443b25155465efcec80f6568d7c5a717c2b

* change file mode to 644

* change file mode to 644

* Fix problem with stringvariable in pillar

* change file mode to 644

* change file mode to 644

New parameters

Change-Id: I9d93052cfc197a364b42240448344d5543e8805f

Change-Id: I07d6d020f629c9c34bb31e5ed81654b528fe3fcc

Change-Id: I9f1df379fbceab316598ad1f683c0b516aa2cff6

Change-Id: I93c3c26a65a233ea0b3854e98efa04df02028858

* Allow custom chains to be present, other than the INPUT, FORWARD, OUTPUT default chains.

* Adding missing endif

* Require the packages to be installed first.

* Test should use rules as key, not rule.

* Making it a array list, instead of a dict.

* convert rules to a list instead of a dict.

* Only if policy is defined, include this statement.

* Only ensure chains if not container :)

* The chain is only ensured if we are not a container.

* Do not run at all for containers.

Update .travis.yml and notififcations

Correct parameters spelling

Update Travis Notifications and disable sending email notifications

Add travis condition to only send notifications for master branch [WIP]

show 'make test' errors in Travis

Added Kitchen tests and Travis

Closes: #2 

* add the option to specify the family per rule to support ipv6

* include policy updates for ipv6

* update documentation to mention ipv6

* Make ipv6 optional; remove spurious tabs from the readme.

* set ipv6 policies only if ipv6 is enabled on the host and not explicitly turned off for this service