commit e53053ce3df771f5fcc24f87dd86f5c49db91b46
Author: Steve Traylen <steve.traylen@cern.ch>
Date:   Wed Nov 18 17:01:11 2020 +0100

    Add comments for all the nftable::rules entries
    
    For each nftable::rule this adds an extra concat fragment to
    add a comment containing the name and order number for the rule.
    
    The motivation here is to make the mapping from resulting rules back
    to puppet code more obvious. When adding a new rule it should be more
    obvious to understand what order to choose.
    
    An example resulting table ends up reading as:
    
    ```
    HASH Start of fragment order:00 default_in header
    chain default_in {
    HASH   Start of fragment order:50 rulename:default_in-dhcpv6_client
      ip6 saddr fe80::/10 ip6 daddr fe80::/10 udp sport 547 udp dport 546 accept
    HASH   Start of fragment order:50 rulename:default_in-ssh
      tcp dport {22} accept
    HASH   Start of fragment order:90 rulename:default_in-drop_broadcasts
      meta pkttype broadcast counter drop
    HASH Start of fragment order:99 default_in footer
    }
    
    ```
    
    In addition there is a new test `nftables::rule`. This includes
    a pending test since I would assume setting source and content
    on a rule should be an error however this currently not the case.

diff --git a/spec/classes/dnat4_spec.rb b/spec/classes/dnat4_spec.rb
index 3b385c9..d55173d 100644
--- a/spec/classes/dnat4_spec.rb
+++ b/spec/classes/dnat4_spec.rb
@@ -70,7 +70,7 @@ describe 'nftables' do
           is_expected.to contain_concat__fragment('nftables-inet-filter-chain-default_fwd-rule-jump_ingoing').with(
             target:  'nftables-inet-filter-chain-default_fwd',
             content: %r{^  iifname eth0 oifname eth1 jump ingoing$},
-            order:   '20',
+            order:   '20nftables-inet-filter-chain-default_fwd-rule-jump_ingoingb',
           )
         }
         it {
@@ -92,28 +92,28 @@ describe 'nftables' do
           is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-http').with(
             target:  'nftables-inet-filter-chain-ingoing',
             content: %r{^  ip daddr 192.0.2.2 tcp dport http accept$},
-            order:   '10',
+            order:   '10nftables-inet-filter-chain-ingoing-rule-httpb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-https').with(
             target:  'nftables-inet-filter-chain-ingoing',
             content: %r{^  ip daddr 192.0.2.2 tcp dport https accept$},
-            order:   '10',
+            order:   '10nftables-inet-filter-chain-ingoing-rule-httpsb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-http_alt').with(
             target:  'nftables-inet-filter-chain-ingoing',
             content: %r{^  iifname eth0 ip daddr 192.0.2.2 tcp dport 8000 accept$},
-            order:   '10',
+            order:   '10nftables-inet-filter-chain-ingoing-rule-http_altb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-inet-filter-chain-ingoing-rule-wireguard').with(
             target:  'nftables-inet-filter-chain-ingoing',
             content: %r{^  iifname eth0 ip daddr 192.0.2.3 udp dport 51820 accept$},
-            order:   '10',
+            order:   '10nftables-inet-filter-chain-ingoing-rule-wireguardb',
           )
         }
         it {
@@ -144,42 +144,42 @@ describe 'nftables' do
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-type').with(
             target:  'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  type nat hook prerouting priority -100$},
-            order:   '01',
+            order:   '01nftables-ip-nat-chain-PREROUTING-rule-typeb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-policy').with(
             target:  'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  policy accept$},
-            order:   '02',
+            order:   '02nftables-ip-nat-chain-PREROUTING-rule-policyb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-http').with(
             target:  'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  tcp dport http dnat to 192.0.2.2$},
-            order:   '10',
+            order:   '10nftables-ip-nat-chain-PREROUTING-rule-httpb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-https').with(
             target:  'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  tcp dport https dnat to 192.0.2.2$},
-            order:   '10',
+            order:   '10nftables-ip-nat-chain-PREROUTING-rule-httpsb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-http_alt').with(
             target:  'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  iifname eth0 tcp dport 8080 dnat to 192.0.2.2:8000$},
-            order:   '10',
+            order:   '10nftables-ip-nat-chain-PREROUTING-rule-http_altb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-PREROUTING-rule-wireguard').with(
             target:  'nftables-ip-nat-chain-PREROUTING',
             content: %r{^  iifname eth0 udp dport 51820 dnat to 192.0.2.3$},
-            order:   '10',
+            order:   '10nftables-ip-nat-chain-PREROUTING-rule-wireguardb',
           )
         }
         it {
