simplerule: Add support for incoming interface filtering

REFERENCE.md

@@ -2264,6 +2264,7 @@ The following parameters are available in the `nftables::simplerule` defined typ
 * [`sport`](#-nftables--simplerule--sport)
 * [`saddr`](#-nftables--simplerule--saddr)
 * [`counter`](#-nftables--simplerule--counter)
+* [`iifname`](#-nftables--simplerule--iifname)
 
 ##### <a name="-nftables--simplerule--ensure"></a>`ensure`
 
@@ -2378,6 +2379,14 @@ Enable traffic counters for the matched traffic.
 
 Default value: `false`
 
+##### <a name="-nftables--simplerule--iifname"></a>`iifname`
+
+Data type: `Optional[String[1]]`
+
+Optional filter for the incoming interface
+
+Default value: `undef`
+
 ## Data types
 
 ### <a name="Nftables--Addr"></a>`Nftables::Addr`

manifests/simplerule.pp

@@ -52,6 +52,9 @@
 #
 # @param counter
 #   Enable traffic counters for the matched traffic.
+#
+# @param iifname
+#   Optional filter for the incoming interface
 define nftables::simplerule (
   Enum['present','absent'] $ensure = 'present',
   Nftables::SimpleRuleName $rulename = $title,
@@ -67,6 +70,7 @@
   Optional[Nftables::Port] $sport = undef,
   Optional[Nftables::Addr] $saddr = undef,
   Boolean $counter = false,
+  Optional[String[1]] $iifname = undef,
 ) {
   if $dport and !$proto {
     fail('Specifying a transport protocol via $proto is mandatory when passing a $dport')
@@ -89,6 +93,7 @@
           'saddr'    => $saddr,
           'set_type' => $set_type,
           'sport'    => $sport,
+          'iifname'  => $iifname,
         }
       ),
       order   => $order,

spec/acceptance/simple_rule_iifname_spec.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require 'spec_helper_acceptance'
+
+describe 'nftables class' do
+  context 'configure a simple rule with input interface' do
+    it_behaves_like 'an idempotent resource' do
+      let(:manifest) do
+        <<-EOS
+        # default mask of firewalld service fails if service is not installed.
+        # https://tickets.puppetlabs.com/browse/PUP-10814
+        # Disable all default rules and include below explicitly
+        class { 'nftables':
+          firewalld_enable => false,
+          out_ntp          => false,
+          out_http         => false,
+          out_https        => false,
+          out_icmp         => false,
+          in_ssh           => false,
+          in_icmp          => false,
+        }
+        nftables::simplerule { 'dummyrule_in':
+          action  => 'accept',
+          iifname => $facts['networking']['primary'],
+          comment => 'allow some multicast stuff',
+          daddr   => 'ff02::fb',
+        }
+        include nftables::rules::ssh
+        include nftables::rules::out::dns
+        include nftables::rules::out::ssh
+        $config_path = $facts['os']['family'] ? {
+          'Archlinux' => '/etc/nftables.conf',
+          'Debian' => '/etc/nftables.conf',
+          default => '/etc/sysconfig/nftables.conf',
+        }
+        $nft_path = $facts['os']['family'] ? {
+          'Archlinux' => '/usr/bin/nft',
+          default => '/usr/sbin/nft',
+        }
+        # nftables cannot be started in docker so replace service with a validation only.
+        systemd::dropin_file{"zzz_docker_nft.conf":
+          ensure  => present,
+          unit    => "nftables.service",
+          content => [
+            "[Service]",
+            "ExecStart=",
+            "ExecStart=${nft_path} -c -I /etc/nftables/puppet -f ${config_path}",
+            "ExecReload=",
+            "ExecReload=${nft_path} -c -I /etc/nftables/puppet -f ${config_path}",
+            "",
+            ].join("\n"),
+          notify  => Service["nftables"],
+        }
+        EOS
+      end
+    end
+  end
+end

templates/simplerule.epp

@@ -7,6 +7,7 @@
       Optional[Nftables::Addr] $saddr,
       String                   $set_type,
       Optional[Nftables::Port] $sport,
+      Optional[String[1]]      $iifname,
 | -%>
 <%- if $proto {
   $_proto = $proto ? {
@@ -69,4 +70,9 @@
 } else {
   $_counter = undef
 } -%>
-<%= regsubst(strip([$_ip_version_filter, $_src_port, $_dst_port, $_src_hosts, $_dst_hosts, $_counter, $action, $_comment].join(' ')), '\s+', ' ', 'G') -%>
+<%- if $iifname {
+  $_iifname = "iifname \"${iifname}\""
+} else {
+  $_iifname = undef
+} -%>
+<%= regsubst(strip([$_ip_version_filter, $_iifname, $_src_port, $_dst_port, $_src_hosts, $_dst_hosts, $_counter, $action, $_comment].join(' ')), '\s+', ' ', 'G') -%>