[PATCH firewall/proxmox-firewall 0/2] fix bridge-nf-call settings during upgrades and handover

[Stefan Hanreich <s.hanreich@proxmox.com>]

pve-firewall needs net.bridge.bridge-nf-call-ip{,6}tables set to 1, so
that bridged guest traffic passes through iptables and conntrack. It
sets them at runtime, while 10-pve.conf sets them to 0. Whenever the
sysctl.d configuration is re-applied, e.g. when systemd-sysctl is
restarted during a package upgrade, they drop back to 0 until the next
update round of pve-firewall, up to 10 seconds later. Conntrack misses
the bridged traffic in between, so packets of established connections
get dropped as invalid afterwards.

The pve-firewall patch writes a drop-in to /run/sysctl.d while the
iptables based firewall is active, so re-applying the configuration
keeps the values at 1.

The proxmox-firewall patch fixes a related issue when switching to the
nftables based firewall at runtime. It does not need the sysctls, but
nothing reset them either, so the host and cluster forward rules also
applied to bridged guest traffic until the next re-apply. It now
re-applies the configured values once when it takes over, which keeps
any override by the admin.


pve-firewall:

Stefan Hanreich (1):
  fix #8268: firewall: keep bridge-nf-call sysctls set on upgrade

 debian/control      |  4 ++--
 src/PVE/Firewall.pm | 34 +++++++++++++++++++++++++++++++++-
 2 files changed, 35 insertions(+), 3 deletions(-)


proxmox-firewall:

Stefan Hanreich (1):
  service: re-apply bridge sysctls when taking over from pve-firewall

 proxmox-firewall/src/bin/proxmox-firewall.rs | 35 ++++++++++++++++++++
 1 file changed, 35 insertions(+)


Summary over all repositories:
  3 files changed, 70 insertions(+), 3 deletions(-)

-- 
Generated by murpp 0.12.0