fix: reload on resetting to defaults

.sanity-ansible-ignore-2.12.txt

@@ -2,3 +2,4 @@ plugins/modules/firewall_lib.py validate-modules:missing-gplv3-license
 plugins/modules/firewall_lib_facts.py validate-modules:missing-gplv3-license
 plugins/modules/firewall_lib.py validate-modules:missing-examples
 roles/firewall/files/get_files_checksums.sh shebang!skip
+files/test_ping.sh shebang!skip

.sanity-ansible-ignore-2.13.txt

@@ -2,3 +2,4 @@ plugins/modules/firewall_lib.py validate-modules:missing-gplv3-license
 plugins/modules/firewall_lib_facts.py validate-modules:missing-gplv3-license
 plugins/modules/firewall_lib.py validate-modules:missing-examples
 roles/firewall/files/get_files_checksums.sh shebang!skip
+files/test_ping.sh shebang!skip

.sanity-ansible-ignore-2.14.txt

@@ -2,3 +2,4 @@ plugins/modules/firewall_lib.py validate-modules:missing-gplv3-license
 plugins/modules/firewall_lib_facts.py validate-modules:missing-gplv3-license
 plugins/modules/firewall_lib.py validate-modules:missing-examples
 roles/firewall/files/get_files_checksums.sh shebang!skip
+files/test_ping.sh shebang!skip

.sanity-ansible-ignore-2.15.txt

@@ -2,3 +2,4 @@ plugins/modules/firewall_lib.py validate-modules:missing-gplv3-license
 plugins/modules/firewall_lib_facts.py validate-modules:missing-gplv3-license
 plugins/modules/firewall_lib.py validate-modules:missing-examples
 roles/firewall/files/get_files_checksums.sh shebang!skip
+files/test_ping.sh shebang!skip

.sanity-ansible-ignore-2.9.txt

@@ -2,3 +2,4 @@ plugins/modules/firewall_lib.py validate-modules:missing-gplv3-license
 plugins/modules/firewall_lib_facts.py validate-modules:missing-gplv3-license
 plugins/modules/firewall_lib.py validate-modules:missing-examples
 roles/firewall/files/get_files_checksums.sh shebang!skip
+files/test_ping.sh shebang!skip

files/get_files_checksums.sh

@@ -33,7 +33,7 @@ if [ "${remove:-false}" = true ]; then
     find "$firewall_conf_root" -name \*.xml -exec rm -f {} \;
     rm -f "$firewall_conf_root/firewalld.conf"
     if [ -s "$listfile" ] ; then
-        systemctl restart "$firewall_service"
+        systemctl reload "$firewall_service"
     fi
 fi
 

tests/files/test_ping.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# Author - Brennan Paciorek <[email protected]>
+# Description - Benchmark firewalld downtime while reloading and while restarting
+# by measuring how many packets are dropped while firewalld is restarting/reloading
+
+cat > /tmp/Containerfile << EOF
+FROM quay.io/centos/centos:stream8
+RUN dnf -y install systemd
+RUN dnf -y install firewalld nc
+EXPOSE 31337
+CMD /usr/lib/systemd/systemd 
+EOF
+
+trap "rm -f /tmp/Containerfile" EXIT
+
+# Initial container setup #
+{
+  podman network create --subnet 172.16.1.0/24 --gateway 172.16.1.1 --interface-name podmanbr0 podmanbr0
+  trap "podman network rm podmanbr0" EXIT
+  imageid=$(podman build -q /tmp)
+  podman run -d --privileged --net podmanbr0 --ip 172.16.1.2 --name test-firewalld --rm "$imageid" /usr/lib/systemd/systemd || exit 1
+  trap "podman stop test-firewalld" EXIT
+  sleep 5 # Wait reasonable amount of time for container to start services
+
+  # Firewall rule setup #
+  podman exec test-firewalld firewall-cmd --permanent --add-icmp-block "echo-request"
+  # firewall-cmd reload waits for dbus response, systemctl will not
+  podman exec test-firewalld firewall-cmd --reload
+} > /dev/null 2>/dev/null
+# The following ping should have 100% packet loss
+ping -c 500 -i 0.01 172.16.1.2 1>/tmp/ping0 2>/dev/null
+trap "rm -f /tmp/ping0" EXIT
+
+# Begin downtime comparision #
+ping -c 500 -i 0.01 172.16.1.2 1>/tmp/ping1 2>/dev/null &
+pid=$!
+trap "rm -f /tmp/ping1" EXIT
+podman exec test-firewalld systemctl restart firewalld.service
+wait $pid
+
+ping -c 500 -i 0.01 172.16.1.2 1>/tmp/ping2 2>/dev/null &
+pid=$!
+trap "rm -f /tmp/ping2" EXIT
+podman exec test-firewalld systemctl reload firewalld.service
+wait $pid
+
+# Print Results
+tail -2 /tmp/ping0 | head -1 | awk '{print $4}'
+tail -2 /tmp/ping1 | head -1 | awk '{print $4}'
+tail -2 /tmp/ping2 | head -1 | awk '{print $4}'
+

tests/tests_reload_on_reset.yml

@@ -0,0 +1,25 @@
+---
+- name: Setup a vm with podman on it
+  hosts: all
+  tasks:
+    - name: Install podman
+      package:
+        name: podman
+        state: present
+
+    - name: Run test
+      script:
+        cmd: files/test_ping.sh
+        executable: /bin/bash
+      register: test_results
+
+    - name: Process test results
+      vars:
+        coherence_check: "{{ test_results.stdout_lines[0] }}"
+        restart_check: "{{ test_results.stdout_lines[1] }}"
+        reload_check: "{{ test_results.stdout_lines[2] }}"
+      fail:
+        msg: Either coherence check or benchmark failed
+      when: >-
+        coherence_check | int != 0
+        or restart_check | int < reload_check | int