This PR will enable using nested arrays for parameter 'set'.
It's required (e.g.) when grouping networks in Hiera.
Allow ipset_sync script to work with ipset 7.8 and newer, by ignoring the variables when checking the configuration
This patch makes ipset_sync ignore the
initval parameters. Without it, the module wants to recreate the ipset on every Puppet run. I made diff ignore whitespace as well to reduce sed space tricks required.
I tried to add bucketsize as an actual settable option to the module, which may be nice, but unfortunately stops working on older kernels, and because the module sorts the parameters in $opt_string, it also does not match the order
ipset save provides.
Diff result on my recent system before this patch:
create vallumd hash:ip family inet maxelem 65536 timeout 3600
The current ipset service unit sets
Before=network-pre.target as it is needed before the network to help ensure that the firewall is up and running before anyone might actually try to connect. It has no setting
DefaultDependencies which means it takes the defaults, one of which is
There are some cases where this can cause a dependency cycle with other units that want to start early in the boot process between
sysinit.target (for example, cloud-init). This results in one of the offending units being removed and risks startup continuing without ipsets being configured, potentially leaving a firewall open and a host at risk.
The ipset service can safely be run before
sysinit.target by setting
DefaultDependencies=no with a couple of additional dependencies to handle some of the other implied settings that are removed as a result.
Thank you for contributing to this project!
Replace this comment with a description of your pull request.
Replace this comment with the list of issues or n/a.