[PATCH proxmox-firewall 10/13] fix #5759: firewall: do not clear rules on system shutdown

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

The assumption until now was that the firewall rules should always be
cleared when receiving SIGTERM. This is correct when SIGTERM is received
as the result of `systemctl stop`, should however not be handled the
same way in case of a system shutdown.

Because of the way the proxmox-firewall service is ordered, it comes
down before the network. Clearing the rules in that case creates a
window where the network is up without firewall protection.

Check the operational state of the system when receiving a stop signal
and only clear the nftables rules if the system is not currently
shutting down.

Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=5759
Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 Cargo.toml                                   |  1 +
 proxmox-firewall/Cargo.toml                  |  1 +
 proxmox-firewall/src/bin/proxmox-firewall.rs | 12 +++++++++++-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index 1dd2784..5f2fa1c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -33,6 +33,7 @@ proxmox-network-api = "1"
 proxmox-network-types = "1"
 proxmox-serde = "1"
 proxmox-sys = "1"
+proxmox-systemd = "1.0.1"
 proxmox-ve-config = "0.10"
 
 # workspace crates
diff --git a/proxmox-firewall/Cargo.toml b/proxmox-firewall/Cargo.toml
index 6ad7e79..fa7fd34 100644
--- a/proxmox-firewall/Cargo.toml
+++ b/proxmox-firewall/Cargo.toml
@@ -22,6 +22,7 @@ proxmox-log.workspace = true
 proxmox-network-types.workspace = true
 proxmox-network-api = { workspace = true, features = [ "impl" ] }
 proxmox-nftables = { workspace = true, features = [ "config-ext" ] }
+proxmox-systemd.workspace = true
 proxmox-ve-config.workspace = true
 
 [dev-dependencies]
diff --git a/proxmox-firewall/src/bin/proxmox-firewall.rs b/proxmox-firewall/src/bin/proxmox-firewall.rs
index e8ed477..27fd67d 100644
--- a/proxmox-firewall/src/bin/proxmox-firewall.rs
+++ b/proxmox-firewall/src/bin/proxmox-firewall.rs
@@ -10,6 +10,7 @@ use proxmox_firewall::firewall::Firewall;
 use proxmox_log as log;
 use proxmox_log::{LevelFilter, Logger};
 use proxmox_nftables::{NftClient, client::NftError};
+use proxmox_systemd::systemctl;
 use proxmox_ve_config::firewall::host::Config as HostConfig;
 
 const HELP: &str = r#"
@@ -115,7 +116,16 @@ fn run_firewall() -> Result<(), Error> {
         std::thread::sleep(Duration::from_secs(5));
     }
 
-    remove_firewall().with_context(|| "Could not remove firewall rules")
+    match systemctl::is_system_running() {
+        // Got SIGTERM as the result of a shutdown, do not remove rules.
+        Ok(systemctl::SystemState::Stopping) => {
+            log::info!("system is stopping, not removing firewall rules");
+            Ok(())
+        }
+        Err(e) => bail!("{e}"),
+        // System is not stopping, firewall was shut down explicitly, remove rules.
+        _ => remove_firewall().with_context(|| "could not remove firewall rules"),
+    }
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-- 
2.47.3