meta-google: nftables: Make rule loading atomic
This ensures that all of the rules are processed and unexpected packets
are not allowed or blocked by the kernel at any time.
Change-Id: Ia7bb1d7f604f8ed1bd9759a23e370d20cb0c690d
Signed-off-by: William A. Kennington III <wak@google.com>
diff --git a/meta-google/recipes-google/nftables/files/nft-configure.sh b/meta-google/recipes-google/nftables/files/nft-configure.sh
index 05bb23d..8c8e058 100644
--- a/meta-google/recipes-google/nftables/files/nft-configure.sh
+++ b/meta-google/recipes-google/nftables/files/nft-configure.sh
@@ -8,10 +8,14 @@
done
let i+=1
done
-rc=0
-nft flush ruleset || rc=$?
+
+rules=""
+trap 'rm -f -- "$rules"' TERM INT EXIT ERR
+rules="$(mktemp)" || exit
+echo 'flush ruleset' >"$rules"
for key in $(printf "%s\n" "${!basemap[@]}" | sort -r); do
- echo "Executing ${basemap[$key]}" >&2
- nft -f "${basemap[$key]}" || rc=$?
+ echo "Loading ${basemap[$key]}" >&2
+ echo '' >>"$rules"
+ cat "${basemap[$key]}" >>"$rules"
done
-exit $rc
+nft -f "$rules" || exit