[PATCH pve-firewall 04/13] firewall: dump configs locally after applying

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

... and remove them when pve-firewall is disabled in the config.

The firewall config lives on pmxcfs, which is only available once
pve-cluster is up, i.e. well after the network. To be able to restore
rules before that, dump the config files needed to recompile the ruleset
(cluster.fw, host.fw and the SDN config as sdn.json) to a local
directory after every successful apply. The guest configs are not
dumped, since pve-guests does not start until the actual firewall daemon
is running.

The last dumped content is cached per file, so the daemon only writes
when something changed since the last dump.

Ownership of the dumps is keyed on the nftables option in the host
config. When the firewall is disabled, the dumps are only removed if
nftables is disabled - otherwise that responsibility is on
proxmox-firewall.

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 debian/dirs                     |  1 +
 src/PVE/Firewall.pm             | 79 +++++++++++++++++++++++++++++----
 src/PVE/Service/pve_firewall.pm |  5 ++-
 3 files changed, 76 insertions(+), 9 deletions(-)

diff --git a/debian/dirs b/debian/dirs
index c9e3b54..e472f56 100644
--- a/debian/dirs
+++ b/debian/dirs
@@ -1 +1,2 @@
 /var/lib/pve-firewall
+/var/lib/pve/firewall
diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 6270771..ada8c1d 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -8,6 +8,7 @@ use Encode;
 use File::Basename;
 use File::Path;
 use IO::File;
+use JSON;
 use Net::IP;
 use POSIX;
 use Socket qw(AF_INET AF_INET6 inet_ntop inet_pton);
@@ -16,6 +17,7 @@ use Storable qw(dclone);
 use PVE::Cluster;
 use PVE::Corosync;
 use PVE::Exception qw(raise raise_param_exc);
+use PVE::File;
 use PVE::INotify;
 use PVE::JSONSchema qw(register_standard_option get_standard_option);
 use PVE::Network;
@@ -31,6 +33,8 @@ my $pvefw_conf_dir = "/etc/pve/firewall";
 my $clusterfw_conf_filename = "$pvefw_conf_dir/cluster.fw";
 my $vnetfw_conf_dir = "/etc/pve/sdn/firewall";
 
+my $dump_dir = '/var/lib/pve/firewall';
+
 # dynamically include PVE::QemuServer and PVE::LXC
 # to avoid dependency problems
 my $have_qemu_server;
@@ -4084,7 +4088,7 @@ sub load_sdn_conf {
     return $sdn_config // $empty_sdn_config;
 }
 
-sub save_clusterfw_conf {
+sub serialize_clusterfw_conf {
     my ($cluster_conf) = @_;
 
     my $raw = '';
@@ -4119,11 +4123,21 @@ sub save_clusterfw_conf {
         }
     }
 
+    return $raw;
+}
+
+sub save_clusterfw_conf {
+    my ($cluster_conf, $filename) = @_;
+
+    $filename = $clusterfw_conf_filename if !defined($filename);
+
+    my $raw = serialize_clusterfw_conf($cluster_conf);
+
     if ($raw) {
         mkdir $pvefw_conf_dir;
-        PVE::Tools::file_set_contents($clusterfw_conf_filename, $raw);
+        PVE::Tools::file_set_contents($filename, $raw);
     } else {
-        unlink $clusterfw_conf_filename;
+        unlink($filename);
     }
 }
 
@@ -4147,11 +4161,8 @@ sub load_hostfw_conf {
     return generic_fw_config_parser($filename, $cluster_conf, $empty_conf, 'host');
 }
 
-sub save_hostfw_conf {
-    my ($hostfw_conf, $filename) = @_;
-
-    $filename = $hostfw_conf_filename if !defined($filename);
-
+sub serialize_hostfw_conf {
+    my ($hostfw_conf) = @_;
     my $raw = '';
 
     my $options = $hostfw_conf->{options};
@@ -4164,6 +4175,16 @@ sub save_hostfw_conf {
         $raw .= "\n";
     }
 
+    return $raw;
+}
+
+sub save_hostfw_conf {
+    my ($hostfw_conf, $filename) = @_;
+
+    $filename = $hostfw_conf_filename if !defined($filename);
+
+    my $raw = serialize_hostfw_conf($hostfw_conf);
+
     if ($raw) {
         PVE::Tools::file_set_contents($filename, $raw);
     } else {
@@ -5234,6 +5255,14 @@ sub remove_pvefw_chains {
 
 }
 
+sub delete_dumps {
+
+    unlink "$dump_dir/cluster.fw";
+    unlink "$dump_dir/host.fw";
+    unlink "$dump_dir/sdn.json";
+
+}
+
 sub remove_pvefw_chains_iptables {
     my ($iptablescmd, $table) = @_;
 
@@ -5332,21 +5361,55 @@ sub init {
     # load required modules here
 }
 
+my $dump_cache = {};
+
+sub dump_if_changed {
+    my ($f, $data) = @_;
+    if (-f $f && defined($dump_cache->{$f}) && $dump_cache->{$f} eq $data) {
+        syslog('info', "no changes to $f since last dump\n");
+        return;
+    }
+    PVE::File::file_set_contents($f, $data);
+    $dump_cache->{$f} = $data;
+    syslog('info', "dumped $f\n");
+}
+
 sub update {
     my $code = sub {
+        my $cfw_dump_path = "$dump_dir/cluster.fw";
+        my $hfw_dump_path = "$dump_dir/host.fw";
+        my $sdn_dump_path = "$dump_dir/sdn.json";
 
         my $cluster_conf = load_clusterfw_conf();
         my $hostfw_conf = load_hostfw_conf($cluster_conf);
 
         if (!is_enabled_and_not_nftables($cluster_conf, $hostfw_conf)) {
             PVE::Firewall::remove_pvefw_chains();
+            $dump_cache = {};
+            # Disabled in config: drop stale dumps so the pre-network restore does not resurrect a
+            # disabled ruleset. Leave them in nftables mode, since in that case proxmox-firewall
+            # owns the dump directory.
+            delete_dumps() if !$cluster_conf->{options}->{enable};
             return;
         }
 
+        # compile() rewrites rule actions in-place. Snapshot the untouched configs now for the
+        # post-apply boot-time dump.
+        my ($cfw_dump, $hfw_dump) = (dclone($cluster_conf), dclone($hostfw_conf));
+
         my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) =
             compile($cluster_conf, $hostfw_conf);
 
         apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset, $rulesetv6, $ebtables_ruleset);
+
+        eval {
+            mkdir($dump_dir);
+            chmod(0700, $dump_dir);
+            dump_if_changed($cfw_dump_path, serialize_clusterfw_conf($cfw_dump));
+            dump_if_changed($hfw_dump_path, serialize_hostfw_conf($hfw_dump));
+            dump_if_changed($sdn_dump_path, JSON->new->utf8->canonical->encode($cfw_dump->{sdn}));
+        };
+        syslog('err', "could not persist firewall configs at $dump_dir: $@\n") if $@;
     };
 
     run_locked($code);
diff --git a/src/PVE/Service/pve_firewall.pm b/src/PVE/Service/pve_firewall.pm
index 95901a5..9c64442 100755
--- a/src/PVE/Service/pve_firewall.pm
+++ b/src/PVE/Service/pve_firewall.pm
@@ -51,7 +51,10 @@ sub shutdown {
 
     syslog('info', "clear PVE-generated firewall rules");
 
-    eval { PVE::Firewall::remove_pvefw_chains(); };
+    eval {
+        PVE::Firewall::remove_pvefw_chains();
+        PVE::Firewall::delete_dumps();
+    };
     warn $@ if $@;
 
     $self->exit_daemon(0);
-- 
2.47.3