lenses/iptables.aug: Support ipset module

[citizenbilly]

Iptables includes a module for integration with ipset.
However, augeas does not appear to support the second argument required for the iptables module: ---match-set.

Example Iptables rule:
-I INPUT -m set --match-set <setname> src -j DROP

Example of adding the rule:

defnode rule \$filter/insert[.='INPUT'][last()+1] "INPUT"
set \$rule/match "set"
set \$rule/ipset_flags "<setname>"
set \$rule/ipset_flags/set "src"
set \$rule/jump "DROP"

Fixes: hercules-team#860

[georgehansper]

The changes here work as expected
Can I suggest that the labels "ipset_flags" and "set" be changed to reflect the intent more closely
For the example given, the resulting augeas tree is

/files/etc/sysconfig/iptables/table[1]/insert = "INPUT"
/files/etc/sysconfig/iptables/table[1]/insert/match = "set"
/files/etc/sysconfig/iptables/table[1]/insert/ipset_flags = "setname"
/files/etc/sysconfig/iptables/table[1]/insert/ipset_flags/set = "src"
/files/etc/sysconfig/iptables/table[1]/insert/jump = "DROP"

I think it would be better to use:

• "ipset" in place of "ipset_flags"
• "flags" in place of "set"

The term "flags" here may seem a little too general, but this is the term used in the ipset man page

The resulting (updated) tree for the input

-A INPUT -m set --match-set setname src,dst -j ACCEPT

/files/etc/sysconfig/iptables/table[1]/append = "INPUT"
/files/etc/sysconfig/iptables/table[1]/append/match = "set"
/files/etc/sysconfig/iptables/table[1]/append/ipset = "setname"
/files/etc/sysconfig/iptables/table[1]/append/ipset/flags[1] = "src"
/files/etc/sysconfig/iptables/table[1]/append/ipset/flags[2] = "dst"
/files/etc/sysconfig/iptables/table[1]/append/jump = "ACCEPT"

Can you please update this pull-request as outlined above?