puppet nftables

Révision 30462da1

Reload rules atomically

Background: The unit file for nftables on CentOS 8 contains:

```
ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf
ExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
ExecStop=/sbin/nft flush ruleset
```

As things stood on config modication `systemctl stop nftables ; systemctl start nftables` was being
called resulting in:

```
nft flush ruleset
nft -f /etc/sysconfig/nftables.conf
```

as distinct commands so a non-atomic flush and load of ruleset.

With this change it is now.

```
/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
```

There is subsequently a redundant extra 'flush ruleset' in there to be followed
up in a seperate patch as I have desire to make that tunable.

To verify what happens when broken rules have been applied, e.g

```puppet
nftables::rule{'default_in-junk':
content => 'junk',
}
```

This results in puppet run of

```
Error: /Stage[main]/Nftables/Service[nftables]: Failed to call refresh: Systemd restart for nftables failed!
journalctl log for nftables:
```

and the existing rules are left live, previously the flush from the stop was occuring.

The reload attempt would only happen once however leaving a time bomb at reboot.
To resvole this the configuration is modified to force a reconfig and reload every puppet run.

        it {

          is_expected.to contain_concat('nftables-inet-filter-chain-default_fwd').with(

            path:           '/etc/nftables/puppet/inet-filter-chain-default_fwd.nft',

            path:           '/etc/nftables/puppet-preflight/inet-filter-chain-default_fwd.nft',

            owner:          'root',

            group:          'root',

            mode:           '0640',

        it {

          is_expected.to contain_concat('nftables-ip-nat-chain-PREROUTING').with(

            path:           '/etc/nftables/puppet/ip-nat-chain-PREROUTING.nft',

            path:           '/etc/nftables/puppet-preflight/ip-nat-chain-PREROUTING.nft',

            owner:          'root',

            group:          'root',

            mode:           '0640',

Formats disponibles : Unified diff