puppet nftables

Révision 30462da1

Reload rules atomically

Background: The unit file for nftables on CentOS 8 contains:

```
ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf
ExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
ExecStop=/sbin/nft flush ruleset
```

As things stood on config modication `systemctl stop nftables ; systemctl start nftables` was being
called resulting in:

```
nft flush ruleset
nft -f /etc/sysconfig/nftables.conf
```

as distinct commands so a non-atomic flush and load of ruleset.

With this change it is now.

```
/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
```

There is subsequently a redundant extra 'flush ruleset' in there to be followed
up in a seperate patch as I have desire to make that tunable.

To verify what happens when broken rules have been applied, e.g

```puppet
nftables::rule{'default_in-junk':
content => 'junk',
}
```

This results in puppet run of

```
Error: /Stage[main]/Nftables/Service[nftables]: Failed to call refresh: Systemd restart for nftables failed!
journalctl log for nftables:
```

and the existing rules are left live, previously the flush from the stop was occuring.

The reload attempt would only happen once however leaving a time bomb at reboot.
To resvole this the configuration is modified to force a reconfig and reload every puppet run.

      }

      it {

        is_expected.to contain_file('/etc/nftables/puppet-preflight.nft').with(

          ensure: 'file',

          owner:  'root',

          group:  'root',

          mode:   '0640',

          source: 'puppet:///modules/nftables/config/puppet.nft',

        )

      }

      it {

        is_expected.to contain_file('/etc/nftables/puppet-preflight').with(

          ensure:  'directory',

          owner:   'root',

          group:   'root',

          mode:    '0750',

          purge:   true,

          force:   true,

          recurse: true,

        )

      }

      it {

        is_expected.to contain_exec('nft validate').with(

          refreshonly: true,

          command: %r{^/usr/sbin/nft -I /etc/nftables/puppet-preflight -c -f /etc/nftables/puppet-preflight.nft.*},

        )

      }

      it {

        is_expected.to contain_service('nftables').with(

          ensure: 'running',

          enable: true,

          hasrestart: true,

          restart: %r{/usr/bin/systemctl reload nft.*},

        )

      }

Formats disponibles : Unified diff