[PATCH pve-manager v2 01/12] network interface pinning: write new firewall config to local dir

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

Preparatory step for restoring firewall rules before pve-cluster is up.

The boot-time restore recompiles the ruleset from the firewall config
dumped to local disk. Interface name pinnings only take effect on the
next boot, so a host.fw dumped before a pinning change still carries the
old interface names, and recompiling from it would produce rules
matching interfaces that no longer exist.

pve-network-interface-pinning already writes the updated config to
host.fw.new. Also write it to the local dump directory so the boot-time
restore prefers it over the stale host.fw; the local copy is removed
again in pve-firewall-commit once the pinning has been committed.

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
Reviewed-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
Tested-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
 PVE/CLI/pve_network_interface_pinning.pm | 6 +++++-
 bin/pve-firewall-commit                  | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/PVE/CLI/pve_network_interface_pinning.pm b/PVE/CLI/pve_network_interface_pinning.pm
index 9dff181d..758b2107 100644
--- a/PVE/CLI/pve_network_interface_pinning.pm
+++ b/PVE/CLI/pve_network_interface_pinning.pm
@@ -22,6 +22,8 @@ use base qw(PVE::CLIHandler);
 
 my $PVEETH_LOCK = "/run/lock/proxmox-network-interface-pinning.lck";
 
+my $local_dump_dir = "/var/lib/pve/firewall";
+
 sub setup_environment {
     PVE::RPCEnvironment->setup_default_cli_env();
 }
@@ -120,7 +122,7 @@ my sub update_host_fw_config {
     my ($mapping) = @_;
 
     my $local_node = PVE::INotify::nodename();
-    print "Updating /etc/pve/nodes/$local_node/host.fw.new\n";
+    print "Updating /etc/pve/nodes/$local_node/host.fw.new and $local_dump_dir/host.fw.new\n";
 
     my $code = sub {
         my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
@@ -143,6 +145,8 @@ my sub update_host_fw_config {
         }
 
         PVE::Firewall::save_hostfw_conf($host_conf, "/etc/pve/nodes/$local_node/host.fw.new");
+        make_path($local_dump_dir, { mode => 0700 });
+        PVE::Firewall::save_hostfw_conf($host_conf, "$local_dump_dir/host.fw.new");
     };
 
     PVE::Firewall::run_locked($code);
diff --git a/bin/pve-firewall-commit b/bin/pve-firewall-commit
index 3d208f67..cbb71f58 100644
--- a/bin/pve-firewall-commit
+++ b/bin/pve-firewall-commit
@@ -23,5 +23,6 @@ if (-e $new_fw_config_file) {
     rename($new_fw_config_file, $current_fw_config_file)
         or die "failed to commit new local node firewall config '$new_fw_config_file' - $!\n";
 }
+unlink "/var/lib/pve/firewall/host.fw.new";
 
 exit 0;
-- 
2.47.3