commit 9e42547bb9e37262485f622fa244d8ac2a3ebaf2
Author: mh <mh@immerda.ch>
Date:   Tue Mar 29 11:04:25 2022 +0200

    split conntrack management into dedicated classes so they get consumeable

diff --git a/manifests/inet_filter.pp b/manifests/inet_filter.pp
index 07616a9..f723091 100644
--- a/manifests/inet_filter.pp
+++ b/manifests/inet_filter.pp
@@ -57,14 +57,7 @@ class nftables::inet_filter inherits nftables {
     }
   }
   if $nftables::in_out_conntrack {
-    nftables::rule {
-      'INPUT-accept_established_related':
-        order   => '05',
-        content => 'ct state established,related accept';
-      'INPUT-drop_invalid':
-        order   => '06',
-        content => 'ct state invalid drop';
-    }
+    include nftables::inet_filter::in_out_conntrack
   }
 
   # inet-filter-chain-OUTPUT
@@ -93,14 +86,7 @@ class nftables::inet_filter inherits nftables {
     }
   }
   if $nftables::in_out_conntrack {
-    nftables::rule {
-      'OUTPUT-accept_established_related':
-        order   => '05',
-        content => 'ct state established,related accept';
-      'OUTPUT-drop_invalid':
-        order   => '06',
-        content => 'ct state invalid drop';
-    }
+    include nftables::inet_filter::in_out_conntrack
   }
 
   # inet-filter-chain-FORWARD
@@ -126,14 +112,7 @@ class nftables::inet_filter inherits nftables {
     }
   }
   if $nftables::fwd_conntrack {
-    nftables::rule {
-      'FORWARD-accept_established_related':
-        order   => '05',
-        content => 'ct state established,related accept';
-      'FORWARD-drop_invalid':
-        order   => '06',
-        content => 'ct state invalid drop';
-    }
+    include nftables::inet_filter::fwd_conntrack
   }
 
   # basic outgoing rules
diff --git a/manifests/inet_filter/fwd_conntrack.pp b/manifests/inet_filter/fwd_conntrack.pp
new file mode 100644
index 0000000..7f534a2
--- /dev/null
+++ b/manifests/inet_filter/fwd_conntrack.pp
@@ -0,0 +1,11 @@
+# @summary enable conntrack for fwd
+class nftables::inet_filter::fwd_conntrack {
+  nftables::rule {
+    'FORWARD-accept_established_related':
+      order   => '05',
+      content => 'ct state established,related accept';
+    'FORWARD-drop_invalid':
+      order   => '06',
+      content => 'ct state invalid drop';
+  }
+}
diff --git a/manifests/inet_filter/in_out_conntrack.pp b/manifests/inet_filter/in_out_conntrack.pp
new file mode 100644
index 0000000..212192c
--- /dev/null
+++ b/manifests/inet_filter/in_out_conntrack.pp
@@ -0,0 +1,17 @@
+# @summary manage input & output conntrack
+class nftables::inet_filter::in_out_conntrack {
+  nftables::rule {
+    'INPUT-accept_established_related':
+      order   => '05',
+      content => 'ct state established,related accept';
+    'INPUT-drop_invalid':
+      order   => '06',
+      content => 'ct state invalid drop';
+    'OUTPUT-accept_established_related':
+      order   => '05',
+      content => 'ct state established,related accept';
+    'OUTPUT-drop_invalid':
+      order   => '06',
+      content => 'ct state invalid drop';
+  }
+}
diff --git a/spec/classes/inet_filter/fwd_conntrack_spec.rb b/spec/classes/inet_filter/fwd_conntrack_spec.rb
new file mode 100644
index 0000000..92a0917
--- /dev/null
+++ b/spec/classes/inet_filter/fwd_conntrack_spec.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'nftables::inet_filter::fwd_conntrack' do
+  on_supported_os.each do |os, _os_facts|
+    context "on #{os}" do
+      it {
+        expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-accept_established_related').with(
+          target: 'nftables-inet-filter-chain-FORWARD',
+          content: %r{^  ct state established,related accept$},
+          order: '05-nftables-inet-filter-chain-FORWARD-rule-accept_established_related-b'
+        )
+      }
+
+      it {
+        expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-drop_invalid').with(
+          target: 'nftables-inet-filter-chain-FORWARD',
+          content: %r{^  ct state invalid drop$},
+          order: '06-nftables-inet-filter-chain-FORWARD-rule-drop_invalid-b'
+        )
+      }
+    end
+  end
+end
diff --git a/spec/classes/inet_filter/in_out_conntrack_spec.rb b/spec/classes/inet_filter/in_out_conntrack_spec.rb
new file mode 100644
index 0000000..d8f6541
--- /dev/null
+++ b/spec/classes/inet_filter/in_out_conntrack_spec.rb
@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'nftables::inet_filter::in_out_conntrack' do
+  let(:pre_condition) { 'Exec{path => "/bin"}' }
+
+  on_supported_os.each do |os, _os_facts|
+    context "on #{os}" do
+      it {
+        expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-accept_established_related').with(
+          target: 'nftables-inet-filter-chain-INPUT',
+          content: %r{^  ct state established,related accept$},
+          order: '05-nftables-inet-filter-chain-INPUT-rule-accept_established_related-b'
+        )
+      }
+
+      it {
+        expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-drop_invalid').with(
+          target: 'nftables-inet-filter-chain-INPUT',
+          content: %r{^  ct state invalid drop$},
+          order: '06-nftables-inet-filter-chain-INPUT-rule-drop_invalid-b'
+        )
+      }
+
+      it {
+        expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-accept_established_related').with(
+          target: 'nftables-inet-filter-chain-OUTPUT',
+          content: %r{^  ct state established,related accept$},
+          order: '05-nftables-inet-filter-chain-OUTPUT-rule-accept_established_related-b'
+        )
+      }
+
+      it {
+        expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-drop_invalid').with(
+          target: 'nftables-inet-filter-chain-OUTPUT',
+          content: %r{^  ct state invalid drop$},
+          order: '06-nftables-inet-filter-chain-OUTPUT-rule-drop_invalid-b'
+        )
+      }
+    end
+  end
+end
diff --git a/spec/classes/inet_filter_spec.rb b/spec/classes/inet_filter_spec.rb
index fd79499..13ab209 100644
--- a/spec/classes/inet_filter_spec.rb
+++ b/spec/classes/inet_filter_spec.rb
@@ -96,22 +96,6 @@ describe 'nftables' do
         }
 
         it {
-          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-accept_established_related').with(
-            target: 'nftables-inet-filter-chain-INPUT',
-            content: %r{^  ct state established,related accept$},
-            order: '05-nftables-inet-filter-chain-INPUT-rule-accept_established_related-b'
-          )
-        }
-
-        it {
-          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-drop_invalid').with(
-            target: 'nftables-inet-filter-chain-INPUT',
-            content: %r{^  ct state invalid drop$},
-            order: '06-nftables-inet-filter-chain-INPUT-rule-drop_invalid-b'
-          )
-        }
-
-        it {
           expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-jump_default_in').with(
             target: 'nftables-inet-filter-chain-INPUT',
             content: %r{^  jump default_in$},
@@ -234,22 +218,6 @@ describe 'nftables' do
         }
 
         it {
-          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-accept_established_related').with(
-            target: 'nftables-inet-filter-chain-OUTPUT',
-            content: %r{^  ct state established,related accept$},
-            order: '05-nftables-inet-filter-chain-OUTPUT-rule-accept_established_related-b'
-          )
-        }
-
-        it {
-          expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-drop_invalid').with(
-            target: 'nftables-inet-filter-chain-OUTPUT',
-            content: %r{^  ct state invalid drop$},
-            order: '06-nftables-inet-filter-chain-OUTPUT-rule-drop_invalid-b'
-          )
-        }
-
-        it {
           expect(subject).to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-jump_default_out').with(
             target: 'nftables-inet-filter-chain-OUTPUT',
             content: %r{^  jump default_out$},
@@ -396,11 +364,7 @@ describe 'nftables' do
         }
 
         it {
-          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-accept_established_related')
-        }
-
-        it {
-          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-drop_invalid')
+          expect(subject).not_to contain_class('nftables::inet_filter::fwd_conntrack')
         }
 
         it {
@@ -685,27 +649,23 @@ describe 'nftables' do
         end
 
         it {
-          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-accept_established_related')
-        }
-
-        it {
-          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-INPUT-rule-drop_invalid')
-        }
-
-        it {
-          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-accept_established_related')
+          expect(subject).not_to contain_class('nftables::inet_filter::in_out_conntrack')
         }
 
         it {
-          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-OUTPUT-rule-drop_invalid')
+          expect(subject).not_to contain_class('nftables::inet_filter::fwd_conntrack')
         }
+      end
 
-        it {
-          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-accept_established_related')
-        }
+      context 'with fwd conntrack rules' do
+        let(:params) do
+          {
+            'fwd_conntrack' => true,
+          }
+        end
 
         it {
-          expect(subject).not_to contain_concat__fragment('nftables-inet-filter-chain-FORWARD-rule-drop_invalid')
+          expect(subject).to contain_class('nftables::inet_filter::fwd_conntrack')
         }
       end
 
