fix kernel incompatibilities

Certain kernel modules and thus iptables functionality was introduced at
later releases, so we need to properly reflect that in our default chain
initialization procedure.

`INPUT` chain for `nat` table was introduced with 2.6.36

`ip6table_nat` kernel module for NAT functionality with IPv6 was
introduced with 3.17

This commit implements the required conditional constraints and includes
the rspec tests to validate it.

2 files changed, 26 insertions, 4 deletions

diff --git a/manifests/chain.pp b/manifests/chain.pp
index a01b9b4..10cc9c1 100644
--- a/manifests/chain.pp
+++ b/manifests/chain.pp
@@ -18,12 +18,15 @@
 # @param table Select the target table (filter/raw/mangle/nat)
 #   Default value: 'filter'
 #   Allowed values: (filter|raw|mangle|nat) (see Ferm::Tables type)
+# @param ip_versions Set list of versions of ip we want ot use.
+#   Default value: $ferm::ip_versions
 define ferm::chain (
   Boolean $disable_conntrack,
   Boolean $log_dropped_packets,
-  String[1] $chain                 = $name,
-  Optional[Ferm::Policies] $policy = undef,
-  Ferm::Tables $table              = 'filter',
+  String[1] $chain                     = $name,
+  Optional[Ferm::Policies] $policy     = undef,
+  Ferm::Tables $table                  = 'filter',
+  Array[Enum['ip','ip6']] $ip_versions = $ferm::ip_versions,
 ) {
   # prevent unmanaged files due to new naming schema
   # keep the default "filter" chains in the original location
@@ -74,7 +77,7 @@ define ferm::chain (
     target  => $ferm::configfile,
     content => epp(
       "${module_name}/ferm-table-chain-config-include.epp", {
-        'ip'       => join($ferm::ip_versions, ' '),
+        'ip'       => join($ip_versions, ' '),
         'table'    => $table,
         'chain'    => $chain,
         'filename' => $filename,
diff --git a/manifests/config.pp b/manifests/config.pp
index efabe2b..7dae7a5 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -58,6 +58,9 @@ class ferm::config {
     log_dropped_packets => $ferm::output_log_dropped_packets,
   }
 
+  # some default chains and features depend on support from the kernel
+  $kver = $facts['kernelversion']
+
   # initialize default tables and chains
   ['PREROUTING', 'OUTPUT'].each |$raw_chain| {
     ferm::chain{"raw-${raw_chain}":
@@ -69,12 +72,28 @@ class ferm::config {
     }
   }
   ['PREROUTING', 'INPUT', 'OUTPUT', 'POSTROUTING'].each |$nat_chain| {
+    if versioncmp($kver, '3.17.0') >= 0 {
+      # supports both nat INPUT chain and ip6table_nat
+      $domains = $ferm::ip_versions
+    } elsif versioncmp($kver, '2.6.36') >= 0 {
+      # supports nat INPUT chain, but not ip6table_nat
+      if ('ip6' in $ferm::ip_versions and 'ip' in $ferm::ip_versions) {
+        $domains = ['ip']
+      }
+    } else {
+      # supports neither nat INPUT nor ip6table_nat
+      if $nat_chain == 'INPUT' { next() }
+      if ('ip6' in $ferm::ip_versions and 'ip' in $ferm::ip_versions) {
+        $domains = ['ip']
+      }
+    }
     ferm::chain{"nat-${nat_chain}":
       chain               => $nat_chain,
       policy              => 'ACCEPT',
       disable_conntrack   => true,
       log_dropped_packets => false,
       table               => 'nat',
+      ip_versions         => $domains,
     }
   }
   ['PREROUTING', 'INPUT', 'FORWARD', 'OUTPUT', 'POSTROUTING'].each |$mangle_chain| {