From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id AB49B1FF0E3 for ; Tue, 21 Jul 2026 15:54:10 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id EF73421447; Tue, 21 Jul 2026 15:54:09 +0200 (CEST) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH pve-firewall 04/13] firewall: dump configs locally after applying Date: Tue, 21 Jul 2026 15:53:58 +0200 Message-ID: <20260721135407.372150-5-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721135407.372150-1-a.bied-charreton@proxmox.com> References: <20260721135407.372150-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 2 DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 1.274 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Message-ID-Hash: IBUZQZAXUPJ2FVU6S2LUZWNC5JABTLWQ X-Message-ID-Hash: IBUZQZAXUPJ2FVU6S2LUZWNC5JABTLWQ X-MailFrom: abied-charreton@jett.proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: ... and remove them when pve-firewall is disabled in the config. The firewall config lives on pmxcfs, which is only available once pve-cluster is up, i.e. well after the network. To be able to restore rules before that, dump the config files needed to recompile the ruleset (cluster.fw, host.fw and the SDN config as sdn.json) to a local directory after every successful apply. The guest configs are not dumped, since pve-guests does not start until the actual firewall daemon is running. The last dumped content is cached per file, so the daemon only writes when something changed since the last dump. Ownership of the dumps is keyed on the nftables option in the host config. When the firewall is disabled, the dumps are only removed if nftables is disabled - otherwise that responsibility is on proxmox-firewall. Signed-off-by: Arthur Bied-Charreton --- debian/dirs | 1 + src/PVE/Firewall.pm | 79 +++++++++++++++++++++++++++++---- src/PVE/Service/pve_firewall.pm | 5 ++- 3 files changed, 76 insertions(+), 9 deletions(-) diff --git a/debian/dirs b/debian/dirs index c9e3b54..e472f56 100644 --- a/debian/dirs +++ b/debian/dirs @@ -1 +1,2 @@ /var/lib/pve-firewall +/var/lib/pve/firewall diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 6270771..ada8c1d 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -8,6 +8,7 @@ use Encode; use File::Basename; use File::Path; use IO::File; +use JSON; use Net::IP; use POSIX; use Socket qw(AF_INET AF_INET6 inet_ntop inet_pton); @@ -16,6 +17,7 @@ use Storable qw(dclone); use PVE::Cluster; use PVE::Corosync; use PVE::Exception qw(raise raise_param_exc); +use PVE::File; use PVE::INotify; use PVE::JSONSchema qw(register_standard_option get_standard_option); use PVE::Network; @@ -31,6 +33,8 @@ my $pvefw_conf_dir = "/etc/pve/firewall"; my $clusterfw_conf_filename = "$pvefw_conf_dir/cluster.fw"; my $vnetfw_conf_dir = "/etc/pve/sdn/firewall"; +my $dump_dir = '/var/lib/pve/firewall'; + # dynamically include PVE::QemuServer and PVE::LXC # to avoid dependency problems my $have_qemu_server; @@ -4084,7 +4088,7 @@ sub load_sdn_conf { return $sdn_config // $empty_sdn_config; } -sub save_clusterfw_conf { +sub serialize_clusterfw_conf { my ($cluster_conf) = @_; my $raw = ''; @@ -4119,11 +4123,21 @@ sub save_clusterfw_conf { } } + return $raw; +} + +sub save_clusterfw_conf { + my ($cluster_conf, $filename) = @_; + + $filename = $clusterfw_conf_filename if !defined($filename); + + my $raw = serialize_clusterfw_conf($cluster_conf); + if ($raw) { mkdir $pvefw_conf_dir; - PVE::Tools::file_set_contents($clusterfw_conf_filename, $raw); + PVE::Tools::file_set_contents($filename, $raw); } else { - unlink $clusterfw_conf_filename; + unlink($filename); } } @@ -4147,11 +4161,8 @@ sub load_hostfw_conf { return generic_fw_config_parser($filename, $cluster_conf, $empty_conf, 'host'); } -sub save_hostfw_conf { - my ($hostfw_conf, $filename) = @_; - - $filename = $hostfw_conf_filename if !defined($filename); - +sub serialize_hostfw_conf { + my ($hostfw_conf) = @_; my $raw = ''; my $options = $hostfw_conf->{options}; @@ -4164,6 +4175,16 @@ sub save_hostfw_conf { $raw .= "\n"; } + return $raw; +} + +sub save_hostfw_conf { + my ($hostfw_conf, $filename) = @_; + + $filename = $hostfw_conf_filename if !defined($filename); + + my $raw = serialize_hostfw_conf($hostfw_conf); + if ($raw) { PVE::Tools::file_set_contents($filename, $raw); } else { @@ -5234,6 +5255,14 @@ sub remove_pvefw_chains { } +sub delete_dumps { + + unlink "$dump_dir/cluster.fw"; + unlink "$dump_dir/host.fw"; + unlink "$dump_dir/sdn.json"; + +} + sub remove_pvefw_chains_iptables { my ($iptablescmd, $table) = @_; @@ -5332,21 +5361,55 @@ sub init { # load required modules here } +my $dump_cache = {}; + +sub dump_if_changed { + my ($f, $data) = @_; + if (-f $f && defined($dump_cache->{$f}) && $dump_cache->{$f} eq $data) { + syslog('info', "no changes to $f since last dump\n"); + return; + } + PVE::File::file_set_contents($f, $data); + $dump_cache->{$f} = $data; + syslog('info', "dumped $f\n"); +} + sub update { my $code = sub { + my $cfw_dump_path = "$dump_dir/cluster.fw"; + my $hfw_dump_path = "$dump_dir/host.fw"; + my $sdn_dump_path = "$dump_dir/sdn.json"; my $cluster_conf = load_clusterfw_conf(); my $hostfw_conf = load_hostfw_conf($cluster_conf); if (!is_enabled_and_not_nftables($cluster_conf, $hostfw_conf)) { PVE::Firewall::remove_pvefw_chains(); + $dump_cache = {}; + # Disabled in config: drop stale dumps so the pre-network restore does not resurrect a + # disabled ruleset. Leave them in nftables mode, since in that case proxmox-firewall + # owns the dump directory. + delete_dumps() if !$cluster_conf->{options}->{enable}; return; } + # compile() rewrites rule actions in-place. Snapshot the untouched configs now for the + # post-apply boot-time dump. + my ($cfw_dump, $hfw_dump) = (dclone($cluster_conf), dclone($hostfw_conf)); + my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = compile($cluster_conf, $hostfw_conf); apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset, $rulesetv6, $ebtables_ruleset); + + eval { + mkdir($dump_dir); + chmod(0700, $dump_dir); + dump_if_changed($cfw_dump_path, serialize_clusterfw_conf($cfw_dump)); + dump_if_changed($hfw_dump_path, serialize_hostfw_conf($hfw_dump)); + dump_if_changed($sdn_dump_path, JSON->new->utf8->canonical->encode($cfw_dump->{sdn})); + }; + syslog('err', "could not persist firewall configs at $dump_dir: $@\n") if $@; }; run_locked($code); diff --git a/src/PVE/Service/pve_firewall.pm b/src/PVE/Service/pve_firewall.pm index 95901a5..9c64442 100755 --- a/src/PVE/Service/pve_firewall.pm +++ b/src/PVE/Service/pve_firewall.pm @@ -51,7 +51,10 @@ sub shutdown { syslog('info', "clear PVE-generated firewall rules"); - eval { PVE::Firewall::remove_pvefw_chains(); }; + eval { + PVE::Firewall::remove_pvefw_chains(); + PVE::Firewall::delete_dumps(); + }; warn $@ if $@; $self->exit_daemon(0); -- 2.47.3