From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 8C9061FF0E3 for ; Tue, 21 Jul 2026 15:54:28 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 6ED0921522; Tue, 21 Jul 2026 15:54:12 +0200 (CEST) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH pve-manager 01/13] network interface pinning: write new firewall config to local dir Date: Tue, 21 Jul 2026 15:53:55 +0200 Message-ID: <20260721135407.372150-2-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721135407.372150-1-a.bied-charreton@proxmox.com> References: <20260721135407.372150-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 2 DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 1.274 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Message-ID-Hash: KLQFH4SQKAHYMBCTWM6XZRWQ5VBLFJHY X-Message-ID-Hash: KLQFH4SQKAHYMBCTWM6XZRWQ5VBLFJHY X-MailFrom: abied-charreton@jett.proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Preparatory step for restoring firewall rules before pve-cluster is up. The boot-time restore recompiles the ruleset from the firewall config dumped to local disk. Interface name pinnings only take effect on the next boot, so a host.fw dumped before a pinning change still carries the old interface names, and recompiling from it would produce rules matching interfaces that no longer exist. pve-network-interface-pinning already writes the updated config to host.fw.new. Also write it to the local dump directory so the boot-time restore prefers it over the stale host.fw; the local copy is removed again in pve-firewall-commit once the pinning has been committed. Signed-off-by: Arthur Bied-Charreton --- PVE/CLI/pve_network_interface_pinning.pm | 6 +++++- bin/pve-firewall-commit | 1 + 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/PVE/CLI/pve_network_interface_pinning.pm b/PVE/CLI/pve_network_interface_pinning.pm index 9dff181d..758b2107 100644 --- a/PVE/CLI/pve_network_interface_pinning.pm +++ b/PVE/CLI/pve_network_interface_pinning.pm @@ -22,6 +22,8 @@ use base qw(PVE::CLIHandler); my $PVEETH_LOCK = "/run/lock/proxmox-network-interface-pinning.lck"; +my $local_dump_dir = "/var/lib/pve/firewall"; + sub setup_environment { PVE::RPCEnvironment->setup_default_cli_env(); } @@ -120,7 +122,7 @@ my sub update_host_fw_config { my ($mapping) = @_; my $local_node = PVE::INotify::nodename(); - print "Updating /etc/pve/nodes/$local_node/host.fw.new\n"; + print "Updating /etc/pve/nodes/$local_node/host.fw.new and $local_dump_dir/host.fw.new\n"; my $code = sub { my $cluster_conf = PVE::Firewall::load_clusterfw_conf(); @@ -143,6 +145,8 @@ my sub update_host_fw_config { } PVE::Firewall::save_hostfw_conf($host_conf, "/etc/pve/nodes/$local_node/host.fw.new"); + make_path($local_dump_dir, { mode => 0700 }); + PVE::Firewall::save_hostfw_conf($host_conf, "$local_dump_dir/host.fw.new"); }; PVE::Firewall::run_locked($code); diff --git a/bin/pve-firewall-commit b/bin/pve-firewall-commit index 3d208f67..cbb71f58 100644 --- a/bin/pve-firewall-commit +++ b/bin/pve-firewall-commit @@ -23,5 +23,6 @@ if (-e $new_fw_config_file) { rename($new_fw_config_file, $current_fw_config_file) or die "failed to commit new local node firewall config '$new_fw_config_file' - $!\n"; } +unlink "/var/lib/pve/firewall/host.fw.new"; exit 0; -- 2.47.3