Add rules for afs3_callback in and out rules for kerberos and openafs.

[traylenator]

Add the afs callback to the cache manager(7001) which is UDP and always
IPv4 since there OpenAFS does not support IPv6.

include nftables::rules::afs3_callback

For background OpenAFS servers connect to clients on the afs3_callback port and it is the server
initiating the connection. The clients have already connected to server on a completely different ports.

To configure an openafs client in totality

include nftables::services::openafs_client

which will allow both outbound connections clients need and the inbound cache callbacks.

https://wiki.openafs.org/devel/AFSServicePorts/

[traylenator]

Happy to add an nftables::rules::out::afs_client though to be honest it is not something we have real world experience of.

[traylenator]

@nbarrientos and I are happy to do some reviews of other MRs by the way.

[duritong]

Happy to add an nftables::rules::out::afs_client though to be honest it is not something we have real world experience of.

If you have at least an idea, what should be added, it would be nice to have it.

[traylenator]

@duritong I checked with one of the AFS admins who advised those ports. It may well differ for different cells but that's okay.

[traylenator]

While writing the tests for nftables::rules I realised rule title can have a suffix on the end.
What was the idea here?

Should I use -1 and -2 for the kerberos udp and tcp rules.

On a related note I see there is a udp+tcp in one line but it is pretty unreadable.

inet filter input meta l4proto {tcp, udp} @th,16,16 { 88 }

can switch of course.

[duritong]

thank you!

[keachi]

lgtm