commit 1fd3f550bbaa37df212c74f82e3085afc7c35347
Author: Luis Fernández Álvarez <luis.fernandez.alvarez@cern.ch>
Date:   Mon Jul 25 17:29:45 2022 +0200

    Add all families as a valid noflush pattern
    
    nftables has more valid families than the ones currently accepted by the
    module.
    
    This patch adds support for all the families currently supported as per
    the documentation at:
    https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families

diff --git a/manifests/init.pp b/manifests/init.pp
index a25c2c1..6718db7 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -116,7 +116,7 @@ class nftables (
   Variant[Boolean[false], String] $log_limit = '3/minute burst 5 packets',
   Variant[Boolean[false], Pattern[/icmp(v6|x)? type .+|tcp reset/]] $reject_with = 'icmpx type port-unreachable',
   Variant[Boolean[false], Enum['mask']] $firewalld_enable = 'mask',
-  Optional[Array[Pattern[/^(ip|ip6|inet)-[-a-zA-Z0-9_]+$/],1]] $noflush_tables = undef,
+  Optional[Array[Pattern[/^(ip|ip6|inet|arp|bridge|netdev)-[-a-zA-Z0-9_]+$/],1]] $noflush_tables = undef,
   Stdlib::Unixpath $echo,
   Stdlib::Unixpath $configuration_path,
   Stdlib::Unixpath $nft_path,
diff --git a/spec/classes/nftables_spec.rb b/spec/classes/nftables_spec.rb
index 8a067ce..1938f58 100644
--- a/spec/classes/nftables_spec.rb
+++ b/spec/classes/nftables_spec.rb
@@ -247,57 +247,71 @@ describe 'nftables' do
         it { is_expected.to have_nftables__set_resource_count(0) }
       end
 
-      context 'with with noflush_tables parameter' do
-        let(:params) do
-          {
-            noflush_tables: ['inet-f2b-table'],
-          }
-        end
-
-        context 'with no nftables fact' do
-          it { is_expected.to contain_file('/etc/nftables/puppet-preflight.nft').with_content(%r{^flush ruleset$}) }
-        end
+      %w[ip ip6 inet arp bridge netdev].each do |family|
+        context "with noflush_tables parameter set to valid family #{family}" do
+          let(:params) do
+            {
+              noflush_tables: ["#{family}-f2b-table"],
+            }
+          end
 
-        context 'with nftables fact matching' do
-          let(:facts) do
-            super().merge(nftables: { tables: %w[inet-abc inet-f2b-table] })
+          context 'with no nftables fact' do
+            it { is_expected.to contain_file('/etc/nftables/puppet-preflight.nft').with_content(%r{^flush ruleset$}) }
           end
 
-          it {
-            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
-              with_content(%r{^table inet abc \{\}$})
-          }
+          context 'with nftables fact matching' do
+            let(:facts) do
+              super().merge(nftables: { tables: %W[#{family}-abc #{family}-f2b-table] })
+            end
 
-          it {
-            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
-              with_content(%r{^flush table inet abc$})
-          }
-        end
+            it {
+              expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
+                with_content(%r{^table #{family} abc \{\}$})
+            }
 
-        context 'with nftables fact not matching' do
-          let(:facts) do
-            super().merge(nftables: { tables: %w[inet-abc inet-ijk] })
+            it {
+              expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
+                with_content(%r{^flush table #{family} abc$})
+            }
           end
 
-          it {
-            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
-              with_content(%r{^table inet abc \{\}$})
-          }
-
-          it {
-            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
-              with_content(%r{^flush table inet abc$})
-          }
+          context 'with nftables fact not matching' do
+            let(:facts) do
+              super().merge(nftables: { tables: %W[#{family}-abc #{family}-ijk] })
+            end
+
+            it {
+              expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
+                with_content(%r{^table #{family} abc \{\}$})
+            }
+
+            it {
+              expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
+                with_content(%r{^flush table #{family} abc$})
+            }
+
+            it {
+              expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
+                with_content(%r{^table #{family} ijk \{\}$})
+            }
+
+            it {
+              expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
+                with_content(%r{^flush table #{family} ijk$})
+            }
+          end
+        end
+      end
 
-          it {
-            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
-              with_content(%r{^table inet ijk \{\}$})
-          }
+      %w[it ip7 inter arpa brid netdevs].each do |family|
+        context "with noflush_tables parameter set to invalid family #{family}" do
+          let(:params) do
+            {
+              noflush_tables: ["#{family}-f2b-table"],
+            }
+          end
 
-          it {
-            expect(subject).to contain_file('/etc/nftables/puppet-preflight.nft').
-              with_content(%r{^flush table inet ijk$})
-          }
+          it { is_expected.not_to compile }
         end
       end
     end
