puppet nftables

Révision 30462da1

Reload rules atomically

Background: The unit file for nftables on CentOS 8 contains:

```
ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf
ExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
ExecStop=/sbin/nft flush ruleset
```

As things stood on config modication `systemctl stop nftables ; systemctl start nftables` was being
called resulting in:

```
nft flush ruleset
nft -f /etc/sysconfig/nftables.conf
```

as distinct commands so a non-atomic flush and load of ruleset.

With this change it is now.

```
/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
```

There is subsequently a redundant extra 'flush ruleset' in there to be followed
up in a seperate patch as I have desire to make that tunable.

To verify what happens when broken rules have been applied, e.g

```puppet
nftables::rule{'default_in-junk':
content => 'junk',
}
```

This results in puppet run of

```
Error: /Stage[main]/Nftables/Service[nftables]: Failed to call refresh: Systemd restart for nftables failed!
journalctl log for nftables:
```

and the existing rules are left live, previously the flush from the stop was occuring.

The reload attempt would only happen once however leaving a time bomb at reboot.
To resvole this the configuration is modified to force a reconfig and reload every puppet run.

# puppet-preflight.nft is only used by puppet for validating new configs

# puppet.nft is real configuration that the nftables services uses.

# To process either the -I flag must be specified.

# nft -c -I /etc/nftables/puppet -f /etc/nftables/puppet.nft

# nft -c -I /etc/nftables/puppet-preflight -f /etc/nftables/puppet-preflight.nft

# drop any existing nftables ruleset

flush ruleset

include "/etc/nftables/puppet/custom-*.nft"

include "/etc/nftables/puppet/inet-filter.nft"

include "/etc/nftables/puppet/ip-nat.nft"

include "/etc/nftables/puppet/ip6-nat.nft"

include "custom-*.nft"

include "inet-filter.nft"

include "ip-nat.nft"

include "ip6-nat.nft"

Formats disponibles : Unified diff