commit e53053ce3df771f5fcc24f87dd86f5c49db91b46
Author: Steve Traylen <steve.traylen@cern.ch>
Date:   Wed Nov 18 17:01:11 2020 +0100

    Add comments for all the nftable::rules entries
    
    For each nftable::rule this adds an extra concat fragment to
    add a comment containing the name and order number for the rule.
    
    The motivation here is to make the mapping from resulting rules back
    to puppet code more obvious. When adding a new rule it should be more
    obvious to understand what order to choose.
    
    An example resulting table ends up reading as:
    
    ```
    HASH Start of fragment order:00 default_in header
    chain default_in {
    HASH   Start of fragment order:50 rulename:default_in-dhcpv6_client
      ip6 saddr fe80::/10 ip6 daddr fe80::/10 udp sport 547 udp dport 546 accept
    HASH   Start of fragment order:50 rulename:default_in-ssh
      tcp dport {22} accept
    HASH   Start of fragment order:90 rulename:default_in-drop_broadcasts
      meta pkttype broadcast counter drop
    HASH Start of fragment order:99 default_in footer
    }
    
    ```
    
    In addition there is a new test `nftables::rule`. This includes
    a pending test since I would assume setting source and content
    on a rule should be an error however this currently not the case.

diff --git a/spec/classes/masquerade_spec.rb b/spec/classes/masquerade_spec.rb
index 501c82a..c095cd1 100644
--- a/spec/classes/masquerade_spec.rb
+++ b/spec/classes/masquerade_spec.rb
@@ -54,49 +54,49 @@ describe 'nftables' do
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-type').with(
             target:  'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  type nat hook postrouting priority 100$},
-            order:   '01',
+            order:   '01nftables-ip-nat-chain-POSTROUTING-rule-typeb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-policy').with(
             target:  'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  policy accept$},
-            order:   '02',
+            order:   '02nftables-ip-nat-chain-POSTROUTING-rule-policyb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth0').with(
             target:  'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  oifname eth0 masquerade$},
-            order:   '70',
+            order:   '70nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth0b',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth1_vpn').with(
             target:  'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  oifname eth1 ip saddr 192\.0\.2\.0\/24 masquerade$},
-            order:   '70',
+            order:   '70nftables-ip-nat-chain-POSTROUTING-rule-masquerade_eth1_vpnb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh').with(
             target:  'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  ip saddr 192\.0\.2\.0\/24 ip daddr 198.51.100.2 tcp dport 22 masquerade$},
-            order:   '70',
+            order:   '70nftables-ip-nat-chain-POSTROUTING-rule-masquerade_sshb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh_gitlab').with(
             target:  'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  ip saddr 192\.0\.2\.0\/24 ip daddr 198.51.100.2 tcp dport 22 masquerade$},
-            order:   '70',
+            order:   '70nftables-ip-nat-chain-POSTROUTING-rule-masquerade_ssh_gitlabb',
           )
         }
         it {
           is_expected.to contain_concat__fragment('nftables-ip-nat-chain-POSTROUTING-rule-masquerade_wireguard').with(
             target:  'nftables-ip-nat-chain-POSTROUTING',
             content: %r{^  udp dport 51820 masquerade$},
-            order:   '70',
+            order:   '70nftables-ip-nat-chain-POSTROUTING-rule-masquerade_wireguardb',
           )
         }
         it {
