Fix ip6tables states for kernels older than 2.6.20 (which have states broken).

firewall/manifests/init.pp

@@ -76,6 +76,8 @@ class firewall::common::iptables {
 	ensure => installed,
     }
 
+    $ip6states = versioncmp($kernelversion, "2.6.20")
+
     file { "/etc/sysconfig/iptables":
 	ensure  => present,
 	mode    => 0600,

firewall/templates/ip6tables.erb

@@ -6,7 +6,12 @@
 -A INPUT -i lo -j ACCEPT
 -A INPUT -m ipv6header --header ah -j ACCEPT
 -A INPUT -m ipv6header --header esp -j ACCEPT
+<% if ip6states >= 0 -%>
 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+<% else -%>
+-A INPUT -m tcp -p tcp ! --syn -j ACCEPT
+-A INPUT -m udp -p udp --dport 32768:61000 -j ACCEPT
+<% end -%>
 -A INPUT -p ipv6-icmp -j ACCEPT
 <%
   firewall_rules.each do |rule|