Rewrite this to make it clear the roles and profiles pattern would be
the better idea.
Merge pull request #294 from apenney/rolesandprofiles

WIP: Rewrite this to make it clear the roles and profiles pattern would be
(#21166) Add support the the iptables recent module.
Make rsource, rdest, reap and rttl known_booleans and remove munging.
Add unit and acceptance tests for the recent iptables module
Some documentation fixups and newvalues to make tests pass
Merge pull request #296 from hunner/ticket/21166-add_support_for_iptables-recent

(MODULES-31) add support for iptables recent
(MODULES-16) Correct src_range dst_range ordering

I wasn't able to reproduce the bug in testing, but several people were
able to and the proposed fix is a correct assumption.
Update the 'recent' module example with a more complete one linked to from the iptables man page.
Merge pull request #293 from hunner/range_fix

(MODULES-16) Correct src_range dst_range ordering
Merge pull request #297 from hunner/recent_docs

Update the 'recent' module example with a more complete one linked to from the iptables man page
Add --random support as per #141 comment
Merge pull request #298 from hunner/add_random

Add --random support as per #141 comment
(MODULES-48) Parse negated rules

This adds tests mentioned in #141 and MODULES-48 to make sure that they
are covered by #267

Closes #141
Merge pull request #299 from hunner/negation_support

(MODULES-48) Parse negated rules
(MODULES-451) Match extension protocol for multiport

The `-m (tcp|udp)` match extension flag before multiport `--sport` and
`--dport` flags is considered optional, but may be present on some
rules. This patches the provides recognition of those rules.
Merge pull request #300 from hunner/fix_multiport

(MODULES-451) Match extension protocol for multiport
Fix #300 for match extension protocol

So... #300 fixed matching `-m (tcp|udp)` at the beginning of `-m
multiport` or `--dport` or `--sport` rules, but broke actual *creation*
of those rules because `-m (tcp|udp)` was used as an iptables argument,
which it is not.

This change removes the problematic argument from `@resource_map` and
instead just substitutes `-m (tcp|udp)` out of any existing rules before
matching. The `-m tcp` match extension arguments are optional anyway,
and not needed for iptables functionality and don't change the semantics
at all.
Merge pull request #302 from hunner/fix_match_extension

Fix #300 for match extension protocol
Fix for #286 for pre-existing rules at the start of a chain

In #286 we fixed rule offset detection for existing managed and
unmanaged rules, but in the case where the first rule in a chain was
unmanaged, managed rules were still being inserted under it.

This patch changes it so that if the first rule detected for offset is
unmanaged, then we should insert before that for more consistent
behavior.