commit a528bf593a7b3671efbadefb13bb3e81130dd29c
Author: Steve Traylen <steve.traylen@cern.ch>
Date:   Wed Jun 26 16:54:29 2024 +0200

    New clobber_default_config paramter
    
    Certain OSes namely Debian and Archlinux provide default rules
    with the OS.
    
    This module has always respected those rules and appended all of
    its own rules to the end of the existing rules.
    
    The new parameter `clobber_default_config` if set `true` (default `false`)
    will drop any existing OS provided rules.
    
    Also related to acceptance tests only on Archlinux where the default
    OS provided configuration requires kernel >= 6.3 we purge the default rules
    if required.

diff --git a/spec/acceptance/default_spec.rb b/spec/acceptance/default_spec.rb
index 61dabe2..a6a65a3 100644
--- a/spec/acceptance/default_spec.rb
+++ b/spec/acceptance/default_spec.rb
@@ -6,10 +6,21 @@ describe 'nftables class' do
   context 'configure default nftables service' do
     it 'works idempotently with no errors' do
       pp = <<-EOS
+
+      # Default ArchLinux rules contain "destroy" that requires kernel >= 6.3
+      # https://gitlab.archlinux.org/archlinux/packaging/packages/nftables/-/commit/f26a7145b2885d298925819782a5302905332dbe
+      # When running on docker this may not be the case.
+      if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
+        $_clobber_default_config = true
+      } else {
+        $_clobber_default_config = undef
+      }
+
       # default mask of firewalld service fails if service is not installed.
       # https://tickets.puppetlabs.com/browse/PUP-10814
       class { 'nftables':
         firewalld_enable => false,
+        clobber_default_config => $_clobber_default_config,
       }
       $config_path = $facts['os']['family'] ? {
         'Archlinux' => '/etc/nftables.conf',
@@ -61,8 +72,14 @@ describe 'nftables class' do
   context 'with bad invalid nft rules' do
     it 'puppet fails but should leave nft service running' do
       pp = <<-EOS
+      if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
+        $_clobber_default_config = true
+      } else {
+        $_clobber_default_config = undef
+      }
       class{'nftables':
         firewalld_enable => false,
+        clobber_default_config => $_clobber_default_config,
       }
       nftables::rule{'default_out-junk':
         content => 'A load of junk',
@@ -103,10 +120,16 @@ describe 'nftables class' do
   context 'with totally empty firewall' do
     it 'no rules validate okay' do
       pp = <<-EOS
+      if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
+        $_clobber_default_config = true
+      } else {
+        $_clobber_default_config = undef
+      }
       class{'nftables':
         firewalld_enable => false,
         inet_filter => false,
         nat => false,
+        clobber_default_config => $_clobber_default_config,
       }
       $config_path = $facts['os']['family'] ? {
         'Archlinux' => '/etc/nftables.conf',
@@ -144,10 +167,16 @@ describe 'nftables class' do
   context 'with custom nat_table_name' do
     it 'no rules validate okay' do
       pp = <<-EOS
+      if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
+        $_clobber_default_config = true
+      } else {
+        $_clobber_default_config = undef
+      }
       class{'nftables':
         firewalld_enable => false,
         nat => true,
         nat_table_name => 'mycustomtablename',
+        clobber_default_config => $_clobber_default_config,
       }
       $config_path = $facts['os']['family'] ? {
         'Archlinux' => '/etc/nftables.conf',
@@ -185,10 +214,16 @@ describe 'nftables class' do
   context 'with only an empty netdev table' do
     it 'rules validate okay' do
       pp = <<-EOS
+      if $facts['os']['family'] == 'Archlinux' and versioncmp($facts['kernelrelease'],'6.3') < 0 {
+        $_clobber_default_config = true
+      } else {
+        $_clobber_default_config = undef
+      }
       class{'nftables':
         firewalld_enable => false,
         inet_filter => false,
         nat => false,
+        clobber_default_config => $_clobber_default_config,
       }
       nftables::config {
         'netdev-filter':
