puppet nftables

Révision 30462da1

Reload rules atomically

Background: The unit file for nftables on CentOS 8 contains:

```
ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf
ExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
ExecStop=/sbin/nft flush ruleset
```

As things stood on config modication `systemctl stop nftables ; systemctl start nftables` was being
called resulting in:

```
nft flush ruleset
nft -f /etc/sysconfig/nftables.conf
```

as distinct commands so a non-atomic flush and load of ruleset.

With this change it is now.

```
/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
```

There is subsequently a redundant extra 'flush ruleset' in there to be followed
up in a seperate patch as I have desire to make that tunable.

To verify what happens when broken rules have been applied, e.g

```puppet
nftables::rule{'default_in-junk':
content => 'junk',
}
```

This results in puppet run of

```
Error: /Stage[main]/Nftables/Service[nftables]: Failed to call refresh: Systemd restart for nftables failed!
journalctl log for nftables:
```

and the existing rules are left live, previously the flush from the stop was occuring.

The reload attempt would only happen once however leaving a time bomb at reboot.
To resvole this the configuration is modified to force a reconfig and reload every puppet run.

  concat{

    $concat_name:

      path           => "/etc/nftables/puppet/${table}-chain-${chain}.nft",

      path           => "/etc/nftables/puppet-preflight/${table}-chain-${chain}.nft",

      owner          => root,

      group          => root,

      mode           => '0640',

      ensure_newline => true,

      require        => Package['nftables'],

      notify         => Service['nftables'],

  }

  } ~> Exec['nft validate'] -> file{

    "/etc/nftables/puppet/${table}-chain-${chain}.nft":

    ensure => file,

    source => "/etc/nftables/puppet-preflight/${table}-chain-${chain}.nft",

    owner  => root,

    group  => root,

    mode   => '0640',

  } ~> Service['nftables']

  concat::fragment{

    default:

Formats disponibles : Unified diff