commit 50a5be8b049446b849e36eff8ff93b5da815d566
Author: Tim Meusel <tim@bastelfreak.de>
Date:   Sat Aug 26 01:04:01 2023 +0200

    Add rule for incoming SSDP

diff --git a/REFERENCE.md b/REFERENCE.md
index d6c4505..0aed781 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -69,6 +69,7 @@ and Manager Daemons (MGR).
 * [`nftables::rules::out::pxp_agent`](#nftables--rules--out--pxp_agent): manage outgoing pxp-agent
 * [`nftables::rules::out::smtp`](#nftables--rules--out--smtp): allow outgoing smtp
 * [`nftables::rules::out::smtp_client`](#nftables--rules--out--smtp_client): allow outgoing smtp client
+* [`nftables::rules::out::ssdp`](#nftables--rules--out--ssdp): allow outgoing SSDP
 * [`nftables::rules::out::ssh`](#nftables--rules--out--ssh): manage out ssh
 * [`nftables::rules::out::ssh::remove`](#nftables--rules--out--ssh--remove): disable outgoing ssh
 * [`nftables::rules::out::tor`](#nftables--rules--out--tor): manage out tor
@@ -82,6 +83,7 @@ and Manager Daemons (MGR).
 * [`nftables::rules::smtp_submission`](#nftables--rules--smtp_submission): manage in smtp submission
 * [`nftables::rules::smtps`](#nftables--rules--smtps): manage in smtps
 * [`nftables::rules::spotify`](#nftables--rules--spotify): allow incoming spotify
+* [`nftables::rules::ssdp`](#nftables--rules--ssdp): allow incoming SSDP
 * [`nftables::rules::ssh`](#nftables--rules--ssh): manage in ssh
 * [`nftables::rules::tor`](#nftables--rules--tor): manage in tor
 * [`nftables::rules::wireguard`](#nftables--rules--wireguard): manage in wireguard
@@ -1085,6 +1087,36 @@ allow outgoing smtp
 
 allow outgoing smtp client
 
+### <a name="nftables--rules--out--ssdp"></a>`nftables::rules::out::ssdp`
+
+allow outgoing SSDP
+
+* **See also**
+  * https://datatracker.ietf.org/doc/html/draft-cai-ssdp-v1-03
+
+#### Parameters
+
+The following parameters are available in the `nftables::rules::out::ssdp` class:
+
+* [`ipv4`](#-nftables--rules--out--ssdp--ipv4)
+* [`ipv6`](#-nftables--rules--out--ssdp--ipv6)
+
+##### <a name="-nftables--rules--out--ssdp--ipv4"></a>`ipv4`
+
+Data type: `Boolean`
+
+Allow SSDP over IPv4
+
+Default value: `true`
+
+##### <a name="-nftables--rules--out--ssdp--ipv6"></a>`ipv6`
+
+Data type: `Boolean`
+
+Allow SSDP over IPv6
+
+Default value: `true`
+
 ### <a name="nftables--rules--out--ssh"></a>`nftables::rules::out::ssh`
 
 manage out ssh
@@ -1277,6 +1309,36 @@ manage in smtps
 
 allow incoming spotify
 
+### <a name="nftables--rules--ssdp"></a>`nftables::rules::ssdp`
+
+allow incoming SSDP
+
+* **See also**
+  * https://datatracker.ietf.org/doc/html/draft-cai-ssdp-v1-03
+
+#### Parameters
+
+The following parameters are available in the `nftables::rules::ssdp` class:
+
+* [`ipv4`](#-nftables--rules--ssdp--ipv4)
+* [`ipv6`](#-nftables--rules--ssdp--ipv6)
+
+##### <a name="-nftables--rules--ssdp--ipv4"></a>`ipv4`
+
+Data type: `Boolean`
+
+Allow SSDP over IPv4
+
+Default value: `true`
+
+##### <a name="-nftables--rules--ssdp--ipv6"></a>`ipv6`
+
+Data type: `Boolean`
+
+Allow SSDP over IPv6
+
+Default value: `true`
+
 ### <a name="nftables--rules--ssh"></a>`nftables::rules::ssh`
 
 manage in ssh
diff --git a/manifests/rules/out/ssdp.pp b/manifests/rules/out/ssdp.pp
new file mode 100644
index 0000000..6f23f1a
--- /dev/null
+++ b/manifests/rules/out/ssdp.pp
@@ -0,0 +1,23 @@
+#
+# @summary allow outgoing SSDP
+#
+# @param ipv4 Allow SSDP over IPv4
+# @param ipv6 Allow SSDP over IPv6
+#
+# @see https://datatracker.ietf.org/doc/html/draft-cai-ssdp-v1-03
+#
+class nftables::rules::out::ssdp (
+  Boolean $ipv4 = true,
+  Boolean $ipv6 = true,
+) {
+  if $ipv4 {
+    nftables::rule { 'default_out-ssdp_v4':
+      content => 'ip daddr 239.255.255.250 udp dport 1900 accept comment "allow outgoing SSDP"',
+    }
+  }
+  if $ipv6 {
+    nftables::rule { 'default_out-ssdp_v6':
+      content => 'ip6 daddr {ff02::c, ff05::c} udp dport 1900 accept comment "allow outgoing SSDP"',
+    }
+  }
+}
diff --git a/manifests/rules/ssdp.pp b/manifests/rules/ssdp.pp
new file mode 100644
index 0000000..a9faa13
--- /dev/null
+++ b/manifests/rules/ssdp.pp
@@ -0,0 +1,23 @@
+#
+# @summary allow incoming SSDP
+#
+# @param ipv4 Allow SSDP over IPv4
+# @param ipv6 Allow SSDP over IPv6
+#
+# @see https://datatracker.ietf.org/doc/html/draft-cai-ssdp-v1-03
+#
+class nftables::rules::ssdp (
+  Boolean $ipv4 = true,
+  Boolean $ipv6 = true,
+) {
+  if $ipv4 {
+    nftables::rule { 'default_in-ssdp_v4':
+      content => 'ip daddr 239.255.255.250 udp dport 1900 accept comment "accept SSDP"',
+    }
+  }
+  if $ipv6 {
+    nftables::rule { 'default_in-ssdp_v6':
+      content => 'ip6 daddr {ff02::c, ff05::c} udp dport 1900 accept comment "accept SSDP"',
+    }
+  }
+}
diff --git a/spec/acceptance/all_rules_spec.rb b/spec/acceptance/all_rules_spec.rb
index 28448db..578b0ff 100644
--- a/spec/acceptance/all_rules_spec.rb
+++ b/spec/acceptance/all_rules_spec.rb
@@ -87,11 +87,13 @@ describe 'nftables class' do
       include nftables::rules::multicast
       include nftables::rules::spotify
       include nftables::rules::llmnr
+      include nftables::rules::ssdp
       include nftables::rules::mdns
       include nftables::rules::igmp
       include nftables::rules::out::igmp
       include nftables::rules::out::mldv2
       include nftables::rules::out::mdns
+      include nftables::rules::out::ssdp
       include nftables::services::dhcpv6_client
       include nftables::services::openafs_client
       nftables::set{'my_test_set':
