commit 215aee133455edad234c3f920f3b21ed051ee223
Author: Steve Traylen <steve.traylen@cern.ch>
Date:   Mon Nov 16 13:02:11 2020 +0100

    Add kerberos out and openafs_client out

diff --git a/manifests/rules/out/kerberos.pp b/manifests/rules/out/kerberos.pp
new file mode 100644
index 0000000..2d08c49
--- /dev/null
+++ b/manifests/rules/out/kerberos.pp
@@ -0,0 +1,11 @@
+# @summary allows outbound access for kerberos
+class nftables::rules::out::kerberos {
+
+  nftables::rule{
+    'default_out-kerberos_udp':
+       content =>  'udp dport 88 accept';
+    'default_out-kerberos_tcp':
+       content =>  'tcp dport 88 accept';
+  }
+
+}
diff --git a/manifests/rules/out/openafs_client.pp b/manifests/rules/out/openafs_client.pp
new file mode 100644
index 0000000..97098ea
--- /dev/null
+++ b/manifests/rules/out/openafs_client.pp
@@ -0,0 +1,18 @@
+# @summary allows outbound access for afs clients
+# 7000 - afs3-fileserver
+# 7002 - afs3-ptserver
+# 7003 - vlserver
+#
+# @see https://wiki.openafs.org/devel/AFSServicePorts/ AFS Service Ports
+#
+class nftables::rules::out::openafs_client(
+  Array[Integer,1] $ports = [7000, 7002, 7003],
+){
+
+  include nftables::rules::out::kerberos
+
+  nftables::rule{'default_out-openafs_client':
+    content => "udp dport {${$ports.join(', ')}} accept";
+  }
+
+}
diff --git a/manifests/services/openafs_client.pp b/manifests/services/openafs_client.pp
new file mode 100644
index 0000000..9011817
--- /dev/null
+++ b/manifests/services/openafs_client.pp
@@ -0,0 +1,8 @@
+class nftables::services::openafs_client inherits nftables {
+  if $nftables::out_all {
+    fail('All outgoing traffic is allowed, you might want to use only nftables::rules::afs3_callback')
+  }
+
+  include nftables::rules::afs3_callback
+  include nftables::rules::out::openafs_client
+}
diff --git a/spec/classes/rules/out/kerberos_spec.rb b/spec/classes/rules/out/kerberos_spec.rb
new file mode 100644
index 0000000..f4af49a
--- /dev/null
+++ b/spec/classes/rules/out/kerberos_spec.rb
@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe 'nftables::rules::out::kerberos' do
+  on_supported_os.each do |os, os_facts|
+    context "on #{os}" do
+      let(:facts) { os_facts }
+
+      context 'default options' do
+        it { is_expected.to compile }
+        it { is_expected.to contain_nftables__rule('default_out-kerberos_udp').with_content('udp dport 88 accept') }
+        it { is_expected.to contain_nftables__rule('default_out-kerberos_tcp').with_content('tcp dport 88 accept') }
+      end
+    end
+  end
+end
diff --git a/spec/classes/rules/out/openafs_client_spec.rb b/spec/classes/rules/out/openafs_client_spec.rb
new file mode 100644
index 0000000..f8c8ac6
--- /dev/null
+++ b/spec/classes/rules/out/openafs_client_spec.rb
@@ -0,0 +1,25 @@
+require 'spec_helper'
+
+describe 'nftables::rules::out::openafs_client' do
+  on_supported_os.each do |os, os_facts|
+    context "on #{os}" do
+      let(:facts) { os_facts }
+
+      context 'default options' do
+        it { is_expected.to compile }
+        it { is_expected.to contain_nftables__rule('default_out-openafs_client').with_content('udp dport {7000, 7002, 7003} accept') }
+      end
+
+      context 'with ports set' do
+        let(:params) do
+          {
+            ports: [7000, 7002],
+          }
+        end
+
+        it { is_expected.to compile }
+        it { is_expected.to contain_nftables__rule('default_out-openafs_client').with_content('udp dport {7000, 7002} accept') }
+      end
+    end
+  end
+end
diff --git a/spec/classes/services/openafs_client_spec.rb b/spec/classes/services/openafs_client_spec.rb
new file mode 100644
index 0000000..f2d944f
--- /dev/null
+++ b/spec/classes/services/openafs_client_spec.rb
@@ -0,0 +1,21 @@
+require 'spec_helper'
+
+describe 'nftables::services::openafs_client' do
+  on_supported_os.each do |os, os_facts|
+    context "on #{os}" do
+      let(:facts) { os_facts }
+
+      context 'normal behaviour' do
+        it { is_expected.to compile }
+        it { is_expected.to contain_class('nftables::rules::afs3_callback') }
+        it { is_expected.to contain_class('nftables::rules::out::openafs_client') }
+      end
+
+      context 'out_all enabled' do
+        let(:pre_condition) { 'class{\'nftables\': out_all => true}' }
+
+        it { is_expected.not_to compile }
+      end
+    end
+  end
+end
