Reload rules atomically and verify rules before deploy #10
Conversation
|
I'm not very proud of that |
|
Still thinking about this so draft for now. |
|
Yeah, this is generally an issue with Puppet, since Puppet forgets that it wasn't able to reload the firewall the run before and since nothing changes in the next run there is no need to re-run the reload it will never be done. We also have this issue in the shorewall module and what we did there, was to periodically run a Also I would not like to reload the tables on each run. But since nft supports a check run: I would suggest to trigger a nft check on any change before trying to restart the nftables service OR when the current running version does not match the current running version. The latter could be done through concat putting things down into a temporary file (e.g. |
|
But I also like your idea, as it would change the file, so we would ensure to try to update it again... |
Just to be clear this will not reload every time, only when the config is changed or broken as that always triggers a change. Thanks for the other comments, will digest. |
|
Adding the intermediate file to do a validation test before service. I will add the #CONFIG BROKEN in that file so we do still get the multiple attempts every puppet run. |
traylenator
changed the title
|
So now.
The result is okay. , if I add some rubbish config: and 2nd puppet run is exactly the same till fixed. The particular awkward ones are the It's all a bit convoluted. The only real advantage of the 3rd commit over the 2nd commit is it covers the reboot case with broken rules. I'm sure there's a brilliant idea in there somewhere. For info when using relative includes it is relative to the directory |
|
Excellent, this looks great! |
|
One more commit I think. It does not fail but loads a completely wrong rule set. |
Yeah, this could be confusing (if not even dangerous), but if we can have a workaround: even better. |
Background: The unit file for nftables on CentOS 8 contains:
```
ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf
ExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
ExecStop=/sbin/nft flush ruleset
```
As things stood on config modication `systemctl stop nftables ; systemctl start nftables` was being
called resulting in:
```
nft flush ruleset
nft -f /etc/sysconfig/nftables.conf
```
as distinct commands so a non-atomic flush and load of ruleset.
With this change it is now.
```
/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
```
There is subsequently a redundant extra 'flush ruleset' in there to be followed
up in a seperate patch as I have desire to make that tunable.
To verify what happens when broken rules have been applied, e.g
```puppet
nftables::rule{'default_in-junk':
content => 'junk',
}
```
This results in puppet run of
```
Error: /Stage[main]/Nftables/Service[nftables]: Failed to call refresh: Systemd restart for nftables failed!
journalctl log for nftables:
```
and the existing rules are left live, previously the flush from the stop was occuring.
The reload attempt would only happen once however leaving a time bomb at reboot.
To resvole this the configuration is modified to force a reconfig and reload every puppet run.
now fails hard. and there are comments in the file about that you need to run: to get the desired result All rebased. This migrates better on puppet6 than on puppet5 as the |
|
great stuff! |
7395300 Merge pull request voxpupuli#25 from cernops/no_nat 82d1065 Allow disabling default NAT tables and chains bd54947 Merge pull request voxpupuli#10 from traylenator/reload 30462da Reload rules atomically git-subtree-dir: code git-subtree-split: 7395300
Background: The unit file for nftables on CentOS 8 contains:
As things stood on config modification
systemctl stop nftables ; systemctl start nftableswas beingcalled resulting in:
as distinct commands so a non-atomic flush and load of ruleset.
With this change it is now.
Also added is validation of the ruleset by puppet prior to updating the real configuration.
Configuration is deployed to
/etc/nftables/puppet-preflight/and/etc/nftables/puppet-preflight.nftThis is validate with
nft -cand if and only if the configuration is valid in the nft sense the configurationwill be copied to the live location
/etc/nftables/puppet/and/etc/nftables/puppet.nftbefore the serviceis reloaded.