puppet nftables

modulesync 8.0.1

Run default destroying acceptance tests at end

The spec test destroy_spec was purging default nftables configurations
before other existing tests had a chance to run.

Run the default destroying tests as the final test.

New clobber_default_config paramter

Certain OSes namely Debian and Archlinux provide default rules
with the OS.

This module has always respected those rules and appended all of
its own rules to the end of the existing rules.

The new parameter `clobber_default_config` if set `true` (default `false`)...

Accept on Debian 11 nftables::set will fail

On Debian 11 adding an nftables set triggers a bug:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063690

move the `nftables::set` tests out to their own test which makes sense
anyway and mark as pending for Debian 11.

Drop EOL CentOS 8 support

Merge pull request #242 from voxpupuli/systemd_update

update puppet-systemd upper bound to 8.0.0

modulesync 7.5.0

Merge pull request #238 from voxpupuli/modulesync

modulesync 7.3.0

Merge pull request #235 from voxpupuli/ospf

rules::llmnr: Allow interface filtering

Merge pull request #234 from voxpupuli/ospf

rules::ospf3 & rules::out::ospf3: Allow filtering on outgoing interfaces

rules::out::ospf3: Allow filtering on outgoing interfaces

rules::mdns: Allow interface filtering

[blacksmith] Bump version to 3.7.2-rc0

Release 3.7.1

rules::icmp: Allow ICMP packets with extensions

out::icmp: simplify filtering/fix ICMP bug

out::icmp: reformat code

Merge pull request #229 from voxpupuli/rel370

Release 3.7.0

Merge pull request #228 from voxpupuli/foo

simplerule: Allow multiple oifname/iifname

[blacksmith] Bump version to 3.6.1-rc0

Release 3.6.0

Make "dropping invalid packets" configureable

It doesn't make sense to explicitly drop those pakets when the default
policy is already `DROP`. Also some applications, like ceph, are known
to send packets that might be marked as invalid.

simplerule: Add support for outgoing interface filtering

rules::out:dns: refactor for better readability

simplerule: Add support for incoming interface filtering

Regenerate REFERENCE.md

Merge pull request #219 from Tamerz/document-set-param

Document what the 'auto_merge' set parameter does.

Merge pull request #218 from voxpupuli/modulesync

modulesync 7.1.0

[blacksmith] Bump version to 3.5.1-rc0

Release 3.5.0

Support input interface specification to dns server

Useful when you want to allow docker/podman containers
access to a hosts dns stub resolver.

```puppet
class{'nftables::rules::dns':
iifname => ['docker0'],
}
```

Merge pull request #214 from traylenator/podman

Additional rules for podman root containers

Example how to redirect one port to another

Add example how to redirect traffic from one port to another.

[blacksmith] Bump version to 3.4.1-rc0

Release 3.4.0

allow puppet/systemd v6

Add Debian 12 support

add ftp helper

This adds ability to enable a connection tracker helper and provides typical ftp rules

Co-authored-by: Vadym Chepkov <vchepkov@gmail.com>
Co-authored-by: Yury Bushmelev <jay4mail@gmail.com>

spec update to confirm that port ranges work

Merge pull request #209 from vchepkov/rejects

provide an option to disable logging rejected packets

[blacksmith] Bump version to 3.3.1-rc0

Release 3.3.0

Merge pull request #203 from voxpupuli/wsd

Add nftables rules for ws-discovery

Add nftables rules for ws-discovery

Add rule for incoming SSDP

init.pp: disable check_unsafe_interpolations

Merge branch 'master' into master

Merge pull request #200 from bastelfreak/rel320

Release 3.2.0

Merge pull request #199 from bastelfreak/omcast

Add rule for outgoing multicast DNS

Merge pull request #198 from bastelfreak/mlds

Add rule for multicast listener requests (MLDv2)