Add a default rule for dhcpv6 traffic

Via bug https://bugs.launchpad.net/tripleo/+bug/1657108 we need
to zero out the default rules in /etc/sysconfig/ip{6}tables in
the image.
We have done this for ipv4, but when we will do it for ipv6 we
will also need to make sure we add a rule for dhcpv6 traffic
as it is shipped in the iptables rpm. (See
https://bugzilla.redhat.com/show_bug.cgi?id=1169036 for more info)

With this change we correctly get the rule present (aka the first
ACCEPT line. The second line is due to the stock ip6tables rule
I had in my testing):
[root@overcloud-controller-0 ~]# iptables -nvL |grep 546
[root@overcloud-controller-0 ~]# ip6tables -nvL |grep 546
    0     0 ACCEPT     udp      *      *       ::/0 fe80::/64 multiport dports 546 /* 004 accept ipv6 dhcpv6 ipv6 */ state NEW
    0     0 ACCEPT     udp      *      *       ::/0 fe80::/64 udp dpt:546 state NEW

Change-Id: If22080054b2b1fa7acfd101e8c34d2707e8e7864
Partial-Bug: #1657108

diff --git a/manifests/firewall/pre.pp b/manifests/firewall/pre.pp
index 7af7fbc..39120d9 100644 (file)
--- a/manifests/firewall/pre.pp
+++ b/manifests/firewall/pre.pp
@@ -54,4 +54,10 @@ class tripleo::firewall::pre(
     extras => $firewall_settings,
   }
 
+  tripleo::firewall::rule{ '004 accept ipv6 dhcpv6':
+    dport       => '546',
+    proto       => 'udp',
+    state       => ['NEW'],
+    destination => 'fe80::/64',
+  }
 }