[PATCH pve-firewall v2 1/2] fix #8268: firewall: keep bridge-nf-call sysctls set on upgrade

[Stefan Hanreich <s.hanreich@proxmox.com>]

Restarting systemd-sysctl, as done on some package upgrades, or
loading br_netfilter re-applies the sysctl.d configuration. This
resets bridge-nf-call-ip{,6}tables to the 0 from 10-pve.conf until
the next update round enables them again. Bridged traffic bypasses
conntrack in that window, so conntrack loses track of established
connections and drops their packets as invalid afterwards.

Write a drop-in to /run/sysctl.d while the iptables based firewall is
active, so re-applying the configuration keeps the values. Only remove
it once the firewall is disabled or switched to nftables, not on
daemon shutdown, as the daemon itself may be restarted during the same
upgrade.

The nftables based proxmox-firewall does not need the drop-in. It
filters bridged guest traffic in a bridge table, which has its own
conntrack support, so it does not need br_netfilter. Remove the
drop-in before handing over to proxmox-firewall, so a re-apply after
the takeover cannot pick up its values.

The new code uses PVE::File directly, including file_exists, which is
available since libpve-common-perl 9.1.8, so raise the dependency
accordingly.

Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=8268
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 debian/control      |  4 ++--
 src/PVE/Firewall.pm | 34 +++++++++++++++++++++++++++++++++-
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/debian/control b/debian/control
index 7fbbe33..1128d8e 100644
--- a/debian/control
+++ b/debian/control
@@ -9,7 +9,7 @@ Build-Depends: debhelper-compat (= 13),
                libnetfilter-log-dev,
                libpve-access-control,
                libpve-cluster-perl,
-               libpve-common-perl (>= 7.3-2),
+               libpve-common-perl (>= 9.1.8),
                proxmox-firewall-data (>= 0.1),
                pve-cluster (>= 6.0-4),
                pve-doc-generator (>= 5.3-3),
@@ -24,7 +24,7 @@ Depends: conntrack,
          iptables,
          libpve-access-control,
          libpve-cluster-perl,
-         libpve-common-perl (>= 9.0.2),
+         libpve-common-perl (>= 9.1.8),
          libpve-network-perl (>= 1.6.8~),
          libpve-rs-perl (>= 0.8.13),
          proxmox-firewall-data (>= 0.1),
diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index dd5d92c..082e916 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -17,6 +17,7 @@ use Storable qw(dclone);
 use PVE::Cluster;
 use PVE::Corosync;
 use PVE::Exception qw(raise raise_param_exc);
+use PVE::File;
 use PVE::INotify;
 use PVE::JSONSchema qw(register_standard_option get_standard_option);
 use PVE::Network;
@@ -2110,8 +2111,34 @@ sub rules_audit_permissions {
 
 # core functions
 
+my $bridge_sysctl_dropin_dir = "/run/sysctl.d";
+# must sort after 10-pve.conf, and must not reuse a name from another sysctl.d directory, which
+# would mask that file
+my $bridge_sysctl_dropin = "$bridge_sysctl_dropin_dir/90-pve-firewall-bridge.conf";
+
+my sub write_bridge_sysctl_dropin {
+    return if PVE::File::file_exists($bridge_sysctl_dropin);
+
+    eval {
+        File::Path::make_path($bridge_sysctl_dropin_dir);
+        PVE::File::file_set_contents(
+            $bridge_sysctl_dropin,
+            "net.bridge.bridge-nf-call-iptables = 1\nnet.bridge.bridge-nf-call-ip6tables = 1\n",
+        );
+    };
+    warn "failed to write '$bridge_sysctl_dropin' - $@" if $@;
+}
+
+my sub remove_bridge_sysctl_dropin {
+    if (!unlink($bridge_sysctl_dropin)) {
+        warn "failed to unlink '$bridge_sysctl_dropin' - $!\n" if !$!{ENOENT};
+    }
+}
+
 sub enable_bridge_firewall {
 
+    write_bridge_sysctl_dropin();
+
     PVE::ProcFSTools::write_proc_entry("/proc/sys/net/bridge/bridge-nf-call-iptables", "1");
     PVE::ProcFSTools::write_proc_entry("/proc/sys/net/bridge/bridge-nf-call-ip6tables", "1");
 
@@ -5573,10 +5600,15 @@ my sub is_enabled_and_not_nftables {
     $host_conf = load_hostfw_conf($cluster_conf) if !defined($host_conf);
 
     my $is_nftables = get_nftables_option($cluster_conf, $host_conf);
+    my $enabled_and_not_nftables = $cluster_conf->{options}->{enable} && !$is_nftables;
+
+    # remove the drop-in before handing over, as proxmox-firewall re-applies the bridge sysctls
+    # once it takes over
+    remove_bridge_sysctl_dropin() if !$enabled_and_not_nftables;
 
     update_force_nftables_disable_flag($cluster_conf->{options}->{enable}, $is_nftables);
 
-    return $cluster_conf->{options}->{enable} && !$is_nftables;
+    return $enabled_and_not_nftables;
 }
 
 sub init {
-- 
2.47.3