puppet nftables

make path to `nft` binary configureable

Make sure that the list of interfaces is mocked

If 'networking' is not removed from the facts, the values declared in
`default_module_facts.yml` win (the fact set contains two keys:
`:networking` and `'networking'`)

This test has always been wrong as the interfaces were never been...

rubocop:auto_correct results

support a different table name for 'nat'
- Some applications (such as libvirt) still use iptables to inject firewall
rules
- iptables will refuse to update tables that were initially created with nft
- This commit allows defining the name of the 'nat' table in order to avoid...

Add rules for QEMU/libvirt guests

Fix rulename spec in spec

Add newline & more tests

Add rules for Apache ActiveMQ

Merge pull request #73 from Koumbit/global_chain_not_hardcoded

start declaring the 'global' chain with module resources

add some mail related outgoing rules

Added to tests

switch naming to puppetserver

Correct NFS udp and tcp port matching

There was a missing `th` from rule which from the examples in the man
page is meant to be there.

Cannot find the docs for what `th` does.

Remove duplicate flush on reload

When nftables was reloaded a flush was being done both in the systemd
reload call and in the nft script itself.

Merge pull request #29 from keachi/fwd_conntrack

Enable conntrack in FORWARD

Merge pull request #32 from dvanders/ceph_nfs

Add Ceph and NFS rules

Test ceph rules

Signed-off-by: Dan van der Ster <daniel.vanderster@cern.ch>

Merge pull request #28 from traylenator/simplify

Do not test nftables::rules repeatadly

Do not test nftables::rules repeatadly

Rather than testing the contents of nftable::rules just test
that nftables::rules instance is correct.

The existing test for the define nftables::rules is enough.

Motivation here is to make changes to nftables::rules easier to handle...

Allow disabling default NAT tables and chains

Set a customisable rate limit to the logging rules

Make masking Service['firewalld'] configurable

Correct bad merge

There was a bad merge between

• https://github.com/duritong/puppet-nftables/pull/13
• https://github.com/duritong/puppet-nftables/pull/14

correct tests.

Merge pull request #14 from cernops/ct_away

Move conntrack rules from global to INPUT and OUTPUT

Move ct rules from global to INPUT and OUTPUT

Add comments for all the nftable::rules entries

For each nftable::rule this adds an extra concat fragment to
add a comment containing the name and order number for the rule.

The motivation here is to make the mapping from resulting rules back
to puppet code more obvious. When adding a new rule it should be more...

Add kerberos out and openafs_client out

Add a parameter to control the fate of discarded packets

Add class nftables::services::dhcpv6_client

Allow customising the log prefix

Fix rulenames which includes an index

The rulename has a regex pattern `[/^[a-zA-Z0-9_]+-[a-zA-Z0-9_]+(\d+)?$/]`
which allows an index at the end of the rulename (with a delimiter).
This is split later with `$data = split($rulename, '')` but the content...

Add class bridges

Allow traffic from any bridge to itself by default

fix offenses

Styling to make tests green

Test masquerade default proto

Extract the dnat spec tests

Create a special ingoing chain for all ingoing fwd rules

Linting

Add spec tests for ip nat prerouting

Add spec tests for ip nat chain policies

Rename to snake cases

Rename spec filter to inet-filter

Refactoring

Spec tests for default rules

Add spec tests for filter chains

Add spec tests it should compile