[PATCH proxmox-firewall v2 12/12] fix #5759: firewall: restore from dumped config before network-pre

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

proxmox-firewall depends on pve-cluster, pve-cluster depends on
corosync, which itself depends on network-online. This creates a
boot-time window where the network is up on the PVE host without it
having any firewall protection.

To address this, add a simple oneshot service depending on
network-pre [0] that applies the last remembered rules to bridge the
gap until the configured firewall daemon takes over.

[0] https://systemd.io/NETWORK_ONLINE/

Link: https://bugzilla.proxmox.com/show_bug.cgi?id=5759
Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
Reviewed-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
Tested-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
 debian/proxmox-firewall-pre-network.service | 16 ++++++++++++++++
 debian/rules                                |  2 +-
 2 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 debian/proxmox-firewall-pre-network.service

diff --git a/debian/proxmox-firewall-pre-network.service b/debian/proxmox-firewall-pre-network.service
new file mode 100644
index 0000000..83c686f
--- /dev/null
+++ b/debian/proxmox-firewall-pre-network.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Proxmox VE Pre-Network NFT Firewall
+Wants=network-pre.target
+Before=network-pre.target shutdown.target
+Conflicts=shutdown.target
+DefaultDependencies=no
+After=local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/proxmox/proxmox-firewall restore
+RemainAfterExit=true
+Environment=PVE_LOG=info
+
+[Install]
+WantedBy=sysinit.target
diff --git a/debian/rules b/debian/rules
index 0dc4e0f..99a6797 100755
--- a/debian/rules
+++ b/debian/rules
@@ -28,4 +28,4 @@ override_dh_auto_configure:
 
 override_dh_installsystemd:
 	dh_installsystemd proxmox-firewall.service
-
+	dh_installsystemd --no-start --name proxmox-firewall-pre-network proxmox-firewall-pre-network.service
-- 
2.47.3