puppet nftables

* [`nftables::rules::out::pxp_agent`](#nftablesrulesoutpxp_agent): manage outgoing pxp-agent

### <a name="nftablesrulesoutpxp_agent"></a>`nftables::rules::out::pxp_agent`

manage outgoing pxp-agent

* **See also**

  * also

    * take a look at nftables::rules::out::puppet, because the PXP agent also connects to a Puppetserver

#### Parameters

The following parameters are available in the `nftables::rules::out::pxp_agent` class:

* [`broker`](#broker)

* [`broker_port`](#broker_port)

##### <a name="broker"></a>`broker`

Data type: `Variant[Stdlib::IP::Address,Array[Stdlib::IP::Address,1]]`

PXP broker IP(s)

##### <a name="broker_port"></a>`broker_port`

Data type: `Stdlib::Port`

PXP broker port

Default value: `8142`

# @summary manage outgoing pxp-agent

#

# @param broker PXP broker IP(s)

# @param broker_port PXP broker port

#

# @see also take a look at nftables::rules::out::puppet, because the PXP agent also connects to a Puppetserver

#

class nftables::rules::out::pxp_agent (

  Variant[Stdlib::IP::Address,Array[Stdlib::IP::Address,1]] $broker,

  Stdlib::Port $broker_port = 8142,

) {

  Array($broker, true).each |$index,$ps| {

    nftables::rule {

      "default_out-pxpagent-${index}":

    }

    if $ps =~ Stdlib::IP::Address::V6 {

      Nftables::Rule["default_out-pxpagent-${index}"] {

        content => "ip6 daddr ${ps} tcp dport ${broker_port} accept",

      }

    } else {

      Nftables::Rule["default_out-pxpagent-${index}"] {

        content => "ip daddr ${ps} tcp dport ${broker_port} accept",

      }

    }

  }

}

      class{'nftables::rules::out::pxp_agent':

        broker => '127.0.0.1',

      }

# frozen_string_literal: true

require 'spec_helper'

describe 'nftables::rules::out::pxp_agent' do

  on_supported_os.each do |os, os_facts|

    context "on #{os}" do

      let(:facts) { os_facts }

      let(:params) do

        { broker: '1.2.3.4' }

      end

      context 'default options' do

        it { is_expected.to compile.with_all_deps }

        it { is_expected.to contain_nftables__rule('default_out-pxpagent-0').with_content('ip daddr 1.2.3.4 tcp dport 8142 accept') }

      end

      context 'with different port' do

        let(:params) do

          super().merge({ broker_port: 8141 })

        end

        it { is_expected.to compile.with_all_deps }

        it { is_expected.to contain_nftables__rule('default_out-pxpagent-0').with_content('ip daddr 1.2.3.4 tcp dport 8141 accept') }

      end

      context 'with ipv6 address' do

        let(:params) do

          { broker: 'fe80::1' }

        end

        it { is_expected.to compile.with_all_deps }

        it { is_expected.to contain_nftables__rule('default_out-pxpagent-0').with_content('ip6 daddr fe80::1 tcp dport 8142 accept') }

      end

      context 'with ipv6 & ipv4 address' do

        let(:params) do

          { broker: ['fe80::1', '1.2.3.4'] }

        end

        it { is_expected.to compile.with_all_deps }

        it { is_expected.to contain_nftables__rule('default_out-pxpagent-0').with_content('ip6 daddr fe80::1 tcp dport 8142 accept') }

        it { is_expected.to contain_nftables__rule('default_out-pxpagent-1').with_content('ip daddr 1.2.3.4 tcp dport 8142 accept') }

        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-pxpagent-0') }

        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-pxpagent-0_header') }

        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-pxpagent-1') }

        it { is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_out-rule-pxpagent-1_header') }

      end

    end

  end

end