puppet nftables

Révision 30462da1

Reload rules atomically

Background: The unit file for nftables on CentOS 8 contains:

```
ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf
ExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
ExecStop=/sbin/nft flush ruleset
```

As things stood on config modication `systemctl stop nftables ; systemctl start nftables` was being
called resulting in:

```
nft flush ruleset
nft -f /etc/sysconfig/nftables.conf
```

as distinct commands so a non-atomic flush and load of ruleset.

With this change it is now.

```
/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
```

There is subsequently a redundant extra 'flush ruleset' in there to be followed
up in a seperate patch as I have desire to make that tunable.

To verify what happens when broken rules have been applied, e.g

```puppet
nftables::rule{'default_in-junk':
content => 'junk',
}
```

This results in puppet run of

```
Error: /Stage[main]/Nftables/Service[nftables]: Failed to call refresh: Systemd restart for nftables failed!
journalctl log for nftables:
```

and the existing rules are left live, previously the flush from the stop was occuring.

The reload attempt would only happen once however leaving a time bomb at reboot.
To resvole this the configuration is modified to force a reconfig and reload every puppet run.

      owner => 'root',

      group => 'root',

      mode  => '0640';

    '/etc/nftables/puppet-preflight':

      ensure  => directory,

      mode    => '0750',

      purge   => true,

      force   => true,

      recurse => true;

    '/etc/nftables/puppet-preflight.nft':

      ensure => file,

      source => 'puppet:///modules/nftables/config/puppet.nft';

  } ~> exec{

    'nft validate':

      refreshonly => true,

      command     => '/usr/sbin/nft -I /etc/nftables/puppet-preflight -c -f /etc/nftables/puppet-preflight.nft || ( /usr/bin/echo "#CONFIG BROKEN" >> /etc/nftables/puppet-preflight.nft && /bin/false)';

  } -> file{

    default:

      owner => 'root',

      group => 'root',

      mode  => '0640';

    '/etc/nftables/puppet.nft':

      ensure => file,

      source => 'puppet:///modules/nftables/config/puppet.nft';

      force   => true,

      recurse => true;

  } ~> service{'nftables':

    ensure => running,

    enable => true,

    ensure     => running,

    enable     => true,

    hasrestart => true,

    restart    => '/usr/bin/systemctl reload nftables',

  }

  systemd::dropin_file{'puppet_nft.conf':

    ensure => present,

    unit   => 'nftables.service',

    source => 'puppet:///modules/nftables/systemd/puppet_nft.conf',

    notify => Service['nftables'],

  }

  service{'firewalld':

Formats disponibles : Unified diff