puppet nftables

fix datatype for $table

Allow creating a totally empty firewall

By setting `nftables::inet_filter` and `nftables::nat` to `false`
users can now start off from a totally empty firewall and add the
tables, chains and rules they'd like.

The default skeleton for inet-filter, ip-nat and ip6-nat is kept...

Add optional handling of chains

Add newline & more tests

Add rules for Apache ActiveMQ

start declaring the 'global' chain with module resources

the 'global' chain is a vestigial piece of early development on this
module, but it can be useful for creating fast short-circuits like
blocking traffic that match a certain set of IPs.

in the current state we can't inject rules inside the 'global' chain...

add some mail related outgoing rules

Merge pull request #62 from glpatcern/master

Added Samba in rules

Removed unneeded parentheses

Made ctdb rule parameterized

Added Samba in rules

Use Stdlib::Port everywhere in place of Integer

Use Stdlib::Port in place of Integer for ports

Fixes #37

Docs for nftables::set

Prefix custom tables with custom- so they're loaded

Merge pull request #50 from traylenator/moretests

Correct nfs3 invalid udp /tcp matching rule and more tests

Remove a blank separating the doc string and the code

Otherwise the generator of the docs does not do the job :/

Implement intended failure

Encapsulate addr-related exprs in Nftables::Addr

Sort template parameters alphabetically

Allow some other types of verdicts

Recommend using nftables::rule

Remove double spacing

Remove optional modifier on $table

It does not really make sense to pass undef to nftables::rule

Re-document and add example

Implement nftables:;simplerule::daddr

Richer dport

Add nftables::simplerule

Correct layout of ignore chain example

Comment why firewalld_enable parameter is required (#40)

lint_fix results

Enable conntrack in FORWARD

Add NFS-related rules

Signed-off-by: Dan van der Ster <daniel.vanderster@cern.ch>

New parameter noflush_tables to selectivly skip flush

Introduces a new structured fact nftables

```yaml
nftables:
tables:
- inet-filter
- ip-nat
- ip6-nat
- inet-f2b-table
```

By default the nft script will continue to contain `nft flush ruleset`...

Allow sourcing sets from Hiera

Reload rules atomically

Background: The unit file for nftables on CentOS 8 contains:

```
ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf
ExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
ExecStop=/sbin/nft flush ruleset
```...

Merge pull request #16 from cernops/icmp

Move ICMP stuff to separate classes allowing better customisation

Move ICMP stuff to separate classes

Merge pull request #14 from cernops/ct_away

Move conntrack rules from global to INPUT and OUTPUT

Move ct rules from global to INPUT and OUTPUT

Add comments for all the nftable::rules entries

For each nftable::rule this adds an extra concat fragment to
add a comment containing the name and order number for the rule.

The motivation here is to make the mapping from resulting rules back
to puppet code more obvious. When adding a new rule it should be more...

Merge pull request #8 from cernops/ai5973

Allow raw sets and dashes in set names

Add kerberos out and openafs_client out

Allow dashes in set names

Add a parameter to control the fate of discarded packets

Add class nftables::services::dhcpv6_client

Add rules for outgoing and incoming DHCPv6 client traffic

Add support for named sets

Fix rulenames which includes an index

The rulename has a regex pattern `[/^[a-zA-Z0-9_]+-[a-zA-Z0-9_]+(\d+)?$/]`
which allows an index at the end of the rulename (with a delimiter).
This is split later with `$data = split($rulename, '')` but the content...

Fix rule node exporter

Add rule in node_exporter