puppet nftables

# This class is meant to be useful to ease the migration from the Firewall type

# for simple use cases. The coverage of all the casuistry is rather low so for

# any case not covered by nftables::simplerule please just use nftables::rule.

define nftables::simplerule(

  Enum['present','absent']

    $ensure = 'present',

  Pattern[/^[-a-zA-Z0-9_]+$/]

    $setname = $title,

  Pattern[/^\d\d$/]

    $order = '50',

  String

    $chain  = 'default_in',

  Optional[String]

    $table = 'inet-filter',

  Enum['accept', 'drop']

    $action = 'accept',

  Optional[String]

    $comment = undef,

  Optional[Integer[1, 65535]]

    $dport  = undef,

  Optional[Enum['tcp', 'udp']]

    $proto  = undef,

){

  if $ensure == 'present' {

    nftables::rule{"${chain}-${title}":

      content => epp('nftables/simplerule.epp',

        {

          'action'  => $action,

          'comment' => $comment,

          'dport'   => $dport,

          'proto'   => $proto,

        }

      ),

      order   => $order,

      table   => $table,

    }

  }

}

require 'spec_helper'

describe 'nftables::simplerule' do

  let(:pre_condition) { 'include nftables' }

  let(:title) { 'my_default_rule_name' }

  on_supported_os.each do |os, os_facts|

    context "on #{os}" do

      let(:facts) { os_facts }

      describe 'minimum instantiation' do

        it { is_expected.to compile }

        it {

          is_expected.to contain_nftables__rule('default_in-my_default_rule_name').with(

            content: 'accept',

            order: 50,

          )

        }

      end

      describe 'all parameters provided' do

        let(:title) { 'my_big_rule' }

        let(:params) do

          {

            action: 'accept',

            comment: 'this is my rule',

            dport: 333,

            proto: 'udp',

            chain: 'default_out',

          }

        end

        it { is_expected.to compile }

        it {

          is_expected.to contain_nftables__rule('default_out-my_big_rule').with(

            content: 'udp dport 333 comment "this is my rule" accept',

            order: 50,

          )

        }

      end

    end

  end

end

<%- | String                  $action,

      Optional[String]        $comment,

      Optional[Integer]       $dport,

      Optional[String]        $proto,

| -%>

<%- if $proto and $dport  {

  $_destination = "${proto} dport ${dport}"

} else {

  $_destination = undef

} -%>

<%- if $comment {

  $_comment = "comment \"${comment}\""

} else {

  $_comment = undef

} -%>

<%= strip([$_destination, $_comment, $action].join(' ')) -%>