From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 442EF1FF16F for ; Fri, 15 Nov 2024 13:10:21 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id A5879122C5; Fri, 15 Nov 2024 13:10:18 +0100 (CET) From: Stefan Hanreich To: pve-devel@lists.proxmox.com Date: Fri, 15 Nov 2024 13:09:33 +0100 Message-Id: <20241115120937.169342-6-s.hanreich@proxmox.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241115120937.169342-1-s.hanreich@proxmox.com> References: <20241115120937.169342-1-s.hanreich@proxmox.com> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.240 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Subject: [pve-devel] [PATCH pve-firewall v4 5/9] nftables: make is_nftables check flag file instead of config X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Cc: Wolfgang Bumiller Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" is_nftables is used in the VM and CT network startup scripts to determine whether the nftables firewall is enabled or not. This causes issues on container and VM startup when loading the SDN config, since it requires the RPCEnvironment which is not initialized yet. Therefore change this check to look for the existence of the flag file instead. It also avoids parsing the entire cluster and host firewall configuration on VM / CT startup, which means increased performance. While we're at it, make all methods related to the configuration parsing private, in order to avoid accidental usage of the expensive methods. Signed-off-by: Stefan Hanreich Reviewed-by: Wolfgang Bumiller --- src/PVE/Firewall.pm | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 7642bf6..bfaa33a 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -4727,7 +4727,14 @@ sub remove_pvefw_chains_ebtables { ebtables_restore_cmdlist(get_ebtables_cmdlist({})); } +# This is checked in proxmox-firewall to avoid log-spam due to failing to parse the config +my $FORCE_NFT_DISABLE_FLAG_FILE = "/run/proxmox-nftables-firewall-force-disable"; + sub is_nftables { + return !-e $FORCE_NFT_DISABLE_FLAG_FILE; +} + +my sub get_nftables_option { my ($cluster_conf, $host_conf) = @_; if (!-x "/usr/libexec/proxmox/proxmox-firewall") { @@ -4743,9 +4750,6 @@ sub is_nftables { my sub update_force_nftables_disable_flag { my ($cluster_firewall_enabled, $is_nftables) = @_; - # This is checked in proxmox-firewall to avoid log-spam due to failing to parse the config - my $FORCE_NFT_DISABLE_FLAG_FILE = "/run/proxmox-nftables-firewall-force-disable"; - if (!($cluster_firewall_enabled && $is_nftables)) { if (! -e $FORCE_NFT_DISABLE_FLAG_FILE) { open(my $_fh, '>', $FORCE_NFT_DISABLE_FLAG_FILE) @@ -4757,13 +4761,13 @@ my sub update_force_nftables_disable_flag { } } -sub is_enabled_and_not_nftables { +my sub is_enabled_and_not_nftables { my ($cluster_conf, $host_conf) = @_; $cluster_conf = load_clusterfw_conf() if !defined($cluster_conf); $host_conf = load_hostfw_conf($cluster_conf) if !defined($host_conf); - my $is_nftables = is_nftables($cluster_conf, $host_conf); + my $is_nftables = get_nftables_option($cluster_conf, $host_conf); update_force_nftables_disable_flag($cluster_conf->{options}->{enable}, $is_nftables); -- 2.39.5 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel