search

voxpupuli / puppet-firewalld

Puppet module for managing firewalld
Apache License 2.0
40 stars 77 forks source link

firewalld_zone doesn't autorequire consumed firewalld_ipset elements #362

Closed jcpunk closed 7 months ago

jcpunk commented 10 months ago

Affected Puppet, Ruby, OS and module versions/distributions

How to reproduce (e.g Puppet code you use)

firewalld::zones:
  00_internal:
    target: ACCEPT
    sources:
      - "ipset:internal_ipv4"
    icmp_blocks:
      - router-advertisement
      - router-solicitation
firewalld::ipsets:
  internal_ipv4:
    ensure: present
    type: "hash:net"
    family: inet
    entries:
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16

What are you seeing

The IPSet may be applied after the zone is defined causing firewalld to crash

What behaviour did you expect instead

Autorequires to correctly setup the ordering

Output log

Info: /Stage[main]/Firewalld/Augeas[firewalld::zone_drifting]: Scheduling refresh of Service[firewalld]
Info: /Stage[main]/Firewalld/Augeas[firewalld::zone_drifting]: Scheduling refresh of Class[Firewalld::Reload]
Notice: /Stage[main]/Firewalld/Service[firewalld]: Triggered 'refresh' from 1 event
Notice: /Stage[main]/Firewalld/Firewalld_zone[00_internal]/ensure: created
Error: /Stage[main]/Firewalld/Firewalld_zone[00_internal]: Could not evaluate: Execution of '/usr/bin/firewall-cmd --reload' returned 13:

Any additional information you'd like to impart