New parameter noflush_tables to selectivly skip flush
Introduces a new structured fact nftables
```yamlnftables: tables: - inet-filter - ip-nat - ip6-nat - inet-f2b-table```
By default the nft script will continue to contain `nft flush ruleset`...
Merge pull request #30 from traylenator/slc
Scientific Linux 8 will never exist
As per
https://listserv.fnal.gov/scripts/wa.exe?A2=ind1904&L=SCIENTIFIC-LINUX-ANNOUNCE&P=78
Merge pull request #28 from traylenator/simplify
Do not test nftables::rules repeatadly
Merge pull request #22 from cernops/log_limit
Set a customisable rate limit to the logging rules
Merge pull request #26 from cernops/hiera_sets
Allow sourcing sets from Hiera
Merge pull request #27 from traylenator/reference
Refresh REFERENCE
Rather than testing the contents of nftable::rules just testthat nftables::rules instance is correct.
The existing test for the define nftables::rules is enough.
Motivation here is to make changes to nftables::rules easier to handle...
Merge pull request #25 from cernops/no_nat
Allow disabling default NAT tables and chains
Merge pull request #10 from traylenator/reload
Reload rules atomically and verify rules before deploy
Reload rules atomically
Background: The unit file for nftables on CentOS 8 contains:
```ExecStart=/sbin/nft -f /etc/sysconfig/nftables.confExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'ExecStop=/sbin/nft flush ruleset```...
Merge pull request #16 from cernops/icmp
Move ICMP stuff to separate classes allowing better customisation
Merge pull request #20 from cernops/firewalld_mask
Make masking Service['firewalld'] optional
Make masking Service['firewalld'] configurable
Move ICMP stuff to separate classes
Merge pull request #15 from traylenator/fixtests
Correct bad merge
There was a bad merge between
correct tests.
Merge pull request #13 from traylenator/comment
Add comments for all the nftable::rules entries
Merge pull request #14 from cernops/ct_away
Move conntrack rules from global to INPUT and OUTPUT
Merge pull request #6 from traylenator/afs
Add rules for afs3_callback in and out rules for kerberos and openafs.
Move ct rules from global to INPUT and OUTPUT
Switch $order$fragmenta/b to $order-$fragment-a/b
For each nftable::rule this adds an extra concat fragment toadd a comment containing the name and order number for the rule.
The motivation here is to make the mapping from resulting rules backto puppet code more obvious. When adding a new rule it should be more...
Merge pull request #12 from cernops/log_format
Allow tables to add comments to $log_prefix
Merge pull request #8 from cernops/ai5973
Allow raw sets and dashes in set names
lint fix
Add kerberos out and openafs_client out
Add rules for afs3_callback
In particular the afs callback to the cache manager(7001) which is UDP and alwaysIPv4 since there OpenAFS does not support IPv6.
https://wiki.openafs.org/devel/AFSServicePorts/
Merge pull request #7 from cernops/reject_with
Add a parameter to control the fate of discarded traffic
Allow dashes in set names
Relax nftables::set::type making it optional
This is needed in case nftables::set is passed raw configuration viasource or content.
Add a parameter to control the fate of discarded packets
Merge pull request #4 from cernops/dhcp6
Add classes encapsulating rules for DHCPv6 client traffic (in/out)
Add class nftables::services::dhcpv6_client
Merge pull request #5 from cernops/custom_log_prefix
Allow customising the log prefix
Add rules for outgoing and incoming DHCPv6 client traffic
Merge pull request #3 from cernops/ai5973
Add support for named sets
Use concat for table conf generation
This way other components of the module will be able to add extra stuffto the table definitions like sets.
Fix rulenames which includes an index
The rulename has a regex pattern `[/^[a-zA-Z0-9_]+-[a-zA-Z0-9_]+(\d+)?$/]`which allows an index at the end of the rulename (with a delimiter).This is split later with `$data = split($rulename, '')` but the content...
Allow to specify prometheus source addresses
Fix rule node exporter
Manage rule in dns
Add rule in node_exporter
Include table ip6 nat
Add basic ip6 nat chains
Fix the regex for bridge names
Replace dashes with underlines
Docker daemon bridges contains dashes, replace them with underlines tofit the naming concept.
migrate create_resource to the generic loop over hash approach
create_resource is notorious for not providing exact line/file infowhen something fails. Since in puppet you can now loop over hashesand you have the splat assignment operator. This means you get much...
Allow ICMPv6 Router Advertisment packets
Add class bridges
Allow traffic from any bridge to itself by default
Move filter rules to inet_filter class
Allow to inject custom rules
Git ignore .ruby-version
Switch back to Ruby 2.5
```can't modify frozen String: "true" ```[Ticket IAC-1146](https://tickets.puppetlabs.com/browse/IAC-1146)
fix offenses
Merge pull request #1 from traylenator/all
New parameter out_all, default false
In order to allow all outbound traffic a parameter isadded to enable a simple `allow` entry on the out chain.
Default is false so backwards compatible.
If true all the other out_bound rules (ntp, ...) will be disabled...
Merge branch 'pdk' into 'master'
Add a PDK configuration and run PDK convert
See merge request immerda/puppet-modules/nftables!1
Only test with Ruby 2.7 and Puppet 6
Styling to make tests green
Add travis ci configuration
Do PDK convert
Allow index numbers
Fix rule puppet out
Add http and https
add license file
Use enum instead of pattern for proto
Add a rule to create snat
Test masquerade default proto
Add a define for masquerading
Extract the dnat spec tests
Linting
Add rules for OSPF
Add a define for ipv4 dnat
Create a special ingoing chain for all ingoing fwd rules
Add mld-listener-done to the list of allowed icmpv6 types
Rename file filter to inet-filter
Stop and mask firewalld service
add new rules
Add spec tests for a DNAT
Add spec tests for ip nat prerouting
Add spec tests for router functionality
Add spec tests for ip nat chain policies
add a few more rules
Split init class
Use default
Fix nat hooks
Rename to snake cases
Adapt readme to the refactoring
Rewrite ip-nat to concat
Add spec tests for ip-nat
Rename spec filter to inet-filter
