diff --git a/README.md b/README.md index e4f659a..7b6f5ab 100644 --- a/README.md +++ b/README.md @@ -148,6 +148,12 @@ in ssh_config. - *Default*: undef +sshd_addressfamily +---------------- +Specifies the value of the AddressFamily setting in sshd_config. Valid values are 'any', 'inet' (IPv4 only), 'inet6' (IPv6 only) and undef. A value of undef will ensure that AddressFamily is not in the configuration. + +- *Default*: 'any' + sshd_config_path ---------------- Path to sshd_config. diff --git a/manifests/init.pp b/manifests/init.pp index e623a0c..2e382ba 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -79,6 +79,7 @@ class ssh ( $sshd_ignoreuserknownhosts = 'no', $sshd_ignorerhosts = 'yes', $manage_service = true, + $sshd_addressfamily = 'any', $service_ensure = 'running', $service_name = 'USE_DEFAULTS', $service_enable = true, @@ -768,4 +769,9 @@ class ssh ( validate_hash($keys_real) create_resources('ssh_authorized_key', $keys_real) } + + if $sshd_addressfamily != undef { + validate_re($sshd_addressfamily, '^(any|inet|inet6)$', + "ssh::sshd_addressfamily can be undef, 'any', 'inet' or 'inet6' and is set to ${sshd_addressfamily}.") + } } diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb index 8f80327..c3e9b9a 100644 --- a/spec/classes/init_spec.rb +++ b/spec/classes/init_spec.rb @@ -3414,4 +3414,30 @@ describe 'ssh' do end end + describe 'with parameter sshd_addressfamily' do + let(:facts) do + { :fqdn => 'monkey.example.com', + :osfamily => 'RedHat', + :sshrsakey => 'AAAAB3NzaC1yc2EAAAABIwAAAQEArGElx46pD6NNnlxVaTbp0ZJMgBKCmbTCT3RaeCk0ZUJtQ8wkcwTtqIXmmiuFsynUT0DFSd8UIodnBOPqitimmooAVAiAi30TtJVzADfPScMiUnBJKZajIBkEMkwUcqsfh630jyBvLPE/kyQcxbEeGtbu1DG3monkeymanOBW1AKc5o+cJLXcInLnbowMG7NXzujT3BRYn/9s5vtT1V9cuZJs4XLRXQ50NluxJI7sVfRPVvQI9EMbTS4AFBXUej3yfgaLSV+nPZC/lmJ2gR4t/tKvMFF9m16f8IcZKK7o0rK7v81G/tREbOT5YhcKLK+0wBfR6RsmHzwy4EddZloyLQ==' + } + end + + ['any','inet','inet6'].each do |value| + context "set to a valid entry of #{value}" do + let(:params) { { :sshd_addressfamily => value } } + it { should contain_file('sshd_config').with_content(/^AddressFamily #{value}$/) } + end + end + + ['foo','bar',123].each do |value| + context "specified as invalid value #{value}" do + let(:params) { { :sshd_addressfamily => value } } + it do + expect { + should contain_class('ssh') + }.to raise_error(Puppet::Error,/ssh::sshd_addressfamily can be undef, 'any', 'inet' or 'inet6' and is set to/) + end + end + end + end end diff --git a/templates/sshd_config.erb b/templates/sshd_config.erb index f5b697c..c8a1b9e 100644 --- a/templates/sshd_config.erb +++ b/templates/sshd_config.erb @@ -17,7 +17,11 @@ Port <%= @sshd_config_port %> #Protocol 2,1 Protocol 2 +<% if @sshd_addressfamily != nil -%> +AddressFamily <%= @sshd_addressfamily %> +<% else -%> #AddressFamily any +<% end -%> <% if @sshd_listen_address.class == Array -%> <% @sshd_listen_address.each do |val| -%> ListenAddress <%= val %>