Merge pull request #52 from Sxderp/pr-add-priority

add priority to rich rules

firewalld/files/zone.xml

   Do not edit this file manually, it will be overwritten!
   Modify the salt pillar for firewalld instead
 -->
-{%- macro rich_rule(rule) -%}
-  {%- if 'family' in rule %}
-  <rule family="{{ rule.family }}">
-  {%- else %}
-  <rule>
-  {%- endif %}
+{%- macro rich_rule(rule) %}
+  <rule{% if 'family' in rule %} family="{{ rule.family }}"{% endif %}{% if 'priority' in rule %} priority="{{ rule.priority }}"{% endif %}>
   {%- if 'ipset' in rule %}
     <source ipset="{{ rule.ipset.name }}" />
   {%- endif %}

pillar.example

       # can be used. Special keys "ipsets" and "services", if defined, take precedence.
       # They will be auto-expanded into separate rich rules per value in the list.
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+            - other-ipset
+          priority: 15
+          services:
+            - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/controls/zones_spec.rb

         <zone>
           <short>rich_public</short>
           <description>Example</description>
+          <rule priority="15">
+            <source ipset="other-ipset" />
+            <service name="http" />
+            <accept></accept>
+          </rule>
           <rule>
             <source ipset="fail2ban-ssh" />
             <service name="ssh" />

test/integration/default/files/_mapdata/amazonlinux-1.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/amazonlinux-2.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/arch-base-latest.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/centos-7.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/centos-8.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/debian-10.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/debian-9.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/fedora-31.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/fedora-32.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/fedora-33.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/fedora-34.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/opensuse-15.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/oraclelinux-7.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/oraclelinux-8.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/ubuntu-16.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/ubuntu-18.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets:

test/integration/default/files/_mapdata/ubuntu-20.yaml

     rich_public:
       description: Example
       rich_rules:
+        http-priority:
+          accept: true
+          ipsets:
+          - other-ipset
+          priority: 15
+          services:
+          - http
         ssh-csg:
           accept: true
           ipsets: