puppet nftables

## nftsables::set

Adds a named set to a given table. It allows composing the

set using individual parameters but also takes raw input

via the content and source parameters.

# manage a named set

define nftables::set(

  Enum['ipv4_addr', 'ipv6_addr', 'ether_addr', 'inet_proto', 'inet_service', 'mark']

    $type,

  Enum['present','absent']

    $ensure = 'present',

  Pattern[/^[a-zA-Z0-9_]+$/]

    $setname = $title,

  Pattern[/^\d\d$/]

    $order = '10',

  String

    $table = 'inet-filter',

  Array[Enum['constant', 'dynamic', 'interval', 'timeout'], 0, 4]

    $flags = [],

  Optional[Integer]

    $timeout = undef,

  Optional[Integer]

    $gc_interval = undef,

  Optional[Array[String]]

    $elements = undef,

  Optional[Integer]

    $size = undef,

  Optional[Enum['performance', 'memory']]

    $policy = undef,

  Boolean

    $auto_merge = false,

  Optional[String]

    $content = undef,

  Optional[Variant[String,Array[String,1]]]

    $source = undef,

){

  if $size and $elements {

    if length($elements) > $size {

      fail("Max size of set ${setname} of ${size} is not being respected")

    }

  }

  if $ensure == 'present' {

    concat::fragment{

      "nftables-${table}-set-${setname}":

        order  => $order,

        target => "nftables-${table}",

    }

    if $content {

      Concat::Fragment["nftables-${table}-set-${setname}"]{

        content => "  ${content}",

      }

    } elsif $source {

      Concat::Fragment["nftables-${table}-set-${setname}"]{

        source => $source,

      }

    } else {

      Concat::Fragment["nftables-${table}-set-${setname}"]{

        content => epp('nftables/set.epp',

          {

            'name'        => $setname,

            'type'        => $type,

            'flags'       => $flags,

            'timeout'     => $timeout,

            'gc_interval' => $gc_interval,

            'elements'    => $elements,

            'size'        => $size,

            'policy'      => $policy,

            'auto_merge'  => $auto_merge,

          }

        )

      }

    }

  }

}

require 'spec_helper'

describe 'nftables::set' do

  let(:pre_condition) { 'include nftables' }

  let(:title) { 'my_set' }

  on_supported_os.each do |os, os_facts|

    context "on #{os}" do

      let(:facts) { os_facts }

      describe 'minimum instantiation' do

        let(:params) do

          {

            type: 'ipv4_addr',

          }

        end

        it { is_expected.to compile }

        it {

          is_expected.to contain_concat__fragment('nftables-inet-filter-set-my_set').with(

            target:  'nftables-inet-filter',

            content: %r{^  set my_set \{\n    type ipv4_addr\n  \}$}m,

            order:   '10',

          )

        }

      end

      describe 'max size exceeding the prepopulated elements' do

        let(:params) do

          {

            type: 'ipv6_addr',

            elements: ['2001:1458::/32', '2001:1458:1::/48'],

            size: 1,

          }

        end

        it { is_expected.not_to compile }

      end

      describe 'invalid type' do

        let(:params) do

          {

            type: 'foo',

          }

        end

        it { is_expected.not_to compile }

      end

      describe 'invalid flags' do

        let(:params) do

          {

            type: 'ipv4_addr',

            flags: ['foo'],

          }

        end

        it { is_expected.not_to compile }

      end

      describe 'ipv6 prepopulated' do

        let(:params) do

          {

            type: 'ipv6_addr',

            elements: ['2001:1458::/32', '2001:1458:1::/48'],

          }

        end

        it { is_expected.to compile }

        it {

          is_expected.to contain_concat__fragment('nftables-inet-filter-set-my_set').with(

            target:  'nftables-inet-filter',

            content: %r{^  set my_set \{\n    type ipv6_addr\n    elements = \{ 2001:1458::/32, 2001:1458:1::/48 \}\n  \}$}m,

            order:   '10',

          )

        }

      end

      describe 'using flags and auto-merge' do

        let(:params) do

          {

            type: 'ipv4_addr',

            flags: ['interval', 'timeout'],

            elements: ['192.168.0.1/24'],

            auto_merge: true,

          }

        end

        it { is_expected.to compile }

        it {

          is_expected.to contain_concat__fragment('nftables-inet-filter-set-my_set').with(

            target:  'nftables-inet-filter',

            content: %r{^  set my_set \{\n    type ipv4_addr\n    flags interval, timeout\n    elements = \{ 192.168.0.1/24 \}\n    auto-merge\n  \}$}m,

            order:   '10',

          )

        }

      end

      describe 'using ether_addr as type and custom policy' do

        let(:params) do

          {

            type: 'ether_addr',

            elements: ['aa:bb:cc:dd:ee:ff'],

            policy: 'memory',

          }

        end

        it { is_expected.to compile }

        it {

          is_expected.to contain_concat__fragment('nftables-inet-filter-set-my_set').with(

            target:  'nftables-inet-filter',

            content: %r{^  set my_set \{\n    type ether_addr\n    elements = \{ aa:bb:cc:dd:ee:ff \}\n    policy memory\n  \}$}m,

            order:   '10',

          )

        }

      end

    end

  end

end

<%- | String                  $name,

      String                  $type,

      Array                   $flags,

      Optional[Integer]       $timeout,

      Optional[Integer]       $gc_interval,

      Optional[Array[String]] $elements,

      Optional[Integer]       $size,

      Optional[String]        $policy,

      Boolean                 $auto_merge,

| -%>

  set <%= $name %> {

    type <%= $type %>

    <%- if $flags and length($flags) > 0 { -%>

    flags <%= $flags.join(', ') %>

    <%- } -%>

    <%- if $timeout { -%>

    timeout <%= $timeout %>

    <%- } -%>

    <%- if $gc_interval { -%>

    gc-interval <%= $gc_interval %>

    <%- } -%>

    <%- if $elements and length($elements) > 0 { -%>

    elements = { <%= $elements.join(', ') %> }

    <%- } -%>

    <%- if $size { -%>

    size <%= $size %>

    <%- } -%>

    <%- if $policy { -%>

    policy <%= $policy %>

    <%- } -%>

    <%- if $auto_merge { -%>

    auto-merge

    <%- } -%>

  }