commit 248ef9d51e38fe8bd1453ba7cd874736d842cdbd
Author: tr <tr@immerda.ch>
Date:   Wed Oct 28 19:40:33 2020 +0100

    Add basic ip6 nat chains

diff --git a/files/config/puppet-ip6-nat.nft b/files/config/puppet-ip6-nat.nft
new file mode 100644
index 0000000..83a0255
--- /dev/null
+++ b/files/config/puppet-ip6-nat.nft
@@ -0,0 +1,3 @@
+table ip6 nat {
+  include "/etc/nftables/puppet/ip6-nat-chain-*.nft"
+}
diff --git a/manifests/ip_nat.pp b/manifests/ip_nat.pp
index f92e165..022dbc5 100644
--- a/manifests/ip_nat.pp
+++ b/manifests/ip_nat.pp
@@ -4,6 +4,8 @@ class nftables::ip_nat inherits nftables {
   nftables::config{
     'ip-nat':
       source => 'puppet:///modules/nftables/config/puppet-ip-nat.nft';
+    'ip6-nat':
+      source => 'puppet:///modules/nftables/config/puppet-ip6-nat.nft';
   }
 
   nftables::chain{
@@ -14,26 +16,50 @@ class nftables::ip_nat inherits nftables {
       table => 'ip-nat';
   }
 
+  nftables::chain{
+    [
+      'PREROUTING6',
+      'POSTROUTING6',
+    ]:
+      table => 'ip6-nat';
+  }
+
   # ip-nat-chain-PREROUTING
   nftables::rule{
-    default:
-      table   => 'ip-nat';
     'PREROUTING-type':
+      table   => 'ip-nat',
       order   => '01',
       content => 'type nat hook prerouting priority -100';
     'PREROUTING-policy':
+      table   => 'ip-nat',
+      order   => '02',
+      content => 'policy accept';
+    'PREROUTING6-type':
+      table   => 'ip6-nat',
+      order   => '01',
+      content => 'type nat hook prerouting priority -100';
+    'PREROUTING6-policy':
+      table   => 'ip6-nat',
       order   => '02',
       content => 'policy accept';
   }
 
   # ip-nat-chain-POSTROUTING
   nftables::rule{
-    default:
-      table   => 'ip-nat';
     'POSTROUTING-type':
+      table   => 'ip-nat',
       order   => '01',
       content => 'type nat hook postrouting priority 100';
     'POSTROUTING-policy':
+      table   => 'ip-nat',
+      order   => '02',
+      content => 'policy accept';
+    'POSTROUTING6-type':
+      table   => 'ip6-nat',
+      order   => '01',
+      content => 'type nat hook postrouting priority 100';
+    'POSTROUTING6-policy':
+      table   => 'ip6-nat',
       order   => '02',
       content => 'policy accept';
   }
diff --git a/spec/classes/ip_nat_spec.rb b/spec/classes/ip_nat_spec.rb
index 45e1ead..b9e5481 100644
--- a/spec/classes/ip_nat_spec.rb
+++ b/spec/classes/ip_nat_spec.rb
@@ -18,7 +18,16 @@ describe 'nftables' do
         )
       }
 
-      context 'chain prerouting' do
+      it {
+        is_expected.to contain_file('/etc/nftables/puppet/ip6-nat.nft').with(
+          ensure: 'file',
+          owner:  'root',
+          group:  'root',
+          mode:   '0640',
+        )
+      }
+
+      context 'table ip nat chain prerouting' do
         it {
           is_expected.to contain_concat('nftables-ip-nat-chain-PREROUTING').with(
             path:           '/etc/nftables/puppet/ip-nat-chain-PREROUTING.nft',
@@ -58,7 +67,7 @@ describe 'nftables' do
         }
       end
 
-      context 'chain output' do
+      context 'table ip nat chain postrouting' do
         it {
           is_expected.to contain_concat('nftables-ip-nat-chain-POSTROUTING').with(
             path:           '/etc/nftables/puppet/ip-nat-chain-POSTROUTING.nft',
@@ -97,6 +106,86 @@ describe 'nftables' do
           )
         }
       end
+
+      context 'table ip6 nat chain prerouting' do
+        it {
+          is_expected.to contain_concat('nftables-ip6-nat-chain-PREROUTING6').with(
+            path:           '/etc/nftables/puppet/ip6-nat-chain-PREROUTING6.nft',
+            owner:          'root',
+            group:          'root',
+            mode:           '0640',
+            ensure_newline: true,
+          )
+        }
+        it {
+          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-header').with(
+            target:  'nftables-ip6-nat-chain-PREROUTING6',
+            content: %r{^chain PREROUTING6 \{$},
+            order:   '00',
+          )
+        }
+        it {
+          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-rule-type').with(
+            target:  'nftables-ip6-nat-chain-PREROUTING6',
+            content: %r{^  type nat hook prerouting priority -100$},
+            order:   '01',
+          )
+        }
+        it {
+          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-rule-policy').with(
+            target:  'nftables-ip6-nat-chain-PREROUTING6',
+            content: %r{^  policy accept$},
+            order:   '02',
+          )
+        }
+        it {
+          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-PREROUTING6-footer').with(
+            target:  'nftables-ip6-nat-chain-PREROUTING6',
+            content: %r{^\}$},
+            order:   '99',
+          )
+        }
+      end
+
+      context 'table ip nat chain postrouting' do
+        it {
+          is_expected.to contain_concat('nftables-ip6-nat-chain-POSTROUTING6').with(
+            path:           '/etc/nftables/puppet/ip6-nat-chain-POSTROUTING6.nft',
+            owner:          'root',
+            group:          'root',
+            mode:           '0640',
+            ensure_newline: true,
+          )
+        }
+        it {
+          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-header').with(
+            target:  'nftables-ip6-nat-chain-POSTROUTING6',
+            content: %r{^chain POSTROUTING6 \{$},
+            order:   '00',
+          )
+        }
+        it {
+          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-rule-type').with(
+            target:  'nftables-ip6-nat-chain-POSTROUTING6',
+            content: %r{^  type nat hook postrouting priority 100$},
+            order:   '01',
+          )
+        }
+        it {
+          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-rule-policy').with(
+            target:  'nftables-ip6-nat-chain-POSTROUTING6',
+            content: %r{^  policy accept$},
+            order:   '02',
+          )
+        }
+        it {
+          is_expected.to contain_concat__fragment('nftables-ip6-nat-chain-POSTROUTING6-footer').with(
+            target:  'nftables-ip6-nat-chain-POSTROUTING6',
+            content: %r{^\}$},
+            order:   '99',
+          )
+        }
+      end
     end
   end
 end
