puppet nftables

# @summary allows outbound access for kerberos

class nftables::rules::out::kerberos {

  nftables::rule{

    'default_out-kerberos_udp':

       content =>  'udp dport 88 accept';

    'default_out-kerberos_tcp':

       content =>  'tcp dport 88 accept';

  }

}

# @summary allows outbound access for afs clients

# 7000 - afs3-fileserver

# 7002 - afs3-ptserver

# 7003 - vlserver

#

# @see https://wiki.openafs.org/devel/AFSServicePorts/ AFS Service Ports

#

class nftables::rules::out::openafs_client(

  Array[Integer,1] $ports = [7000, 7002, 7003],

){

  include nftables::rules::out::kerberos

  nftables::rule{'default_out-openafs_client':

    content => "udp dport {${$ports.join(', ')}} accept";

  }

}

class nftables::services::openafs_client inherits nftables {

  if $nftables::out_all {

    fail('All outgoing traffic is allowed, you might want to use only nftables::rules::afs3_callback')

  }

  include nftables::rules::afs3_callback

  include nftables::rules::out::openafs_client

}

require 'spec_helper'

describe 'nftables::rules::out::kerberos' do

  on_supported_os.each do |os, os_facts|

    context "on #{os}" do

      let(:facts) { os_facts }

      context 'default options' do

        it { is_expected.to compile }

        it { is_expected.to contain_nftables__rule('default_out-kerberos_udp').with_content('udp dport 88 accept') }

        it { is_expected.to contain_nftables__rule('default_out-kerberos_tcp').with_content('tcp dport 88 accept') }

      end

    end

  end

end

require 'spec_helper'

describe 'nftables::rules::out::openafs_client' do

  on_supported_os.each do |os, os_facts|

    context "on #{os}" do

      let(:facts) { os_facts }

      context 'default options' do

        it { is_expected.to compile }

        it { is_expected.to contain_nftables__rule('default_out-openafs_client').with_content('udp dport {7000, 7002, 7003} accept') }

      end

      context 'with ports set' do

        let(:params) do

          {

            ports: [7000, 7002],

          }

        end

        it { is_expected.to compile }

        it { is_expected.to contain_nftables__rule('default_out-openafs_client').with_content('udp dport {7000, 7002} accept') }

      end

    end

  end

end

require 'spec_helper'

describe 'nftables::services::openafs_client' do

  on_supported_os.each do |os, os_facts|

    context "on #{os}" do

      let(:facts) { os_facts }

      context 'normal behaviour' do

        it { is_expected.to compile }

        it { is_expected.to contain_class('nftables::rules::afs3_callback') }

        it { is_expected.to contain_class('nftables::rules::out::openafs_client') }

      end

      context 'out_all enabled' do

        let(:pre_condition) { 'class{\'nftables\': out_all => true}' }

        it { is_expected.not_to compile }

      end

    end

  end

end