[PATCH pve-firewall 06/13] firewall: add restore command

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

Add a 'restore' command that recompiles and applies the firewall from
the config dumped to /var/lib/pve/firewall, to bridge the boot window
before pmxcfs (and thus the real config) is available.

It reuses update() with a local flag: configs are loaded from the local
dumps instead of pmxcfs and nothing is dumped back. A missing or
unreadable SDN dump is treated as empty, and rules referencing an
unavailable IPSet are skipped, so a partial dump still restores the rest
on a best-effort basis.

For the cluster and host config, a user-provided .override or a .new
written by the pve-network-interface-pinning take precedence over the
plain dump when present (.override -> .new -> plain).

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/Firewall.pm             | 33 ++++++++++++++++++++++++++++-----
 src/PVE/Service/pve_firewall.pm | 18 ++++++++++++++++++
 src/pve-firewall                | 10 +++++++---
 3 files changed, 53 insertions(+), 8 deletions(-)

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index ada8c1d..76dbec1 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -4050,11 +4050,11 @@ sub lock_clusterfw_conf {
 }
 
 sub load_clusterfw_conf {
-    my ($filename) = @_;
+    my ($filename, $sdn_conf) = @_;
 
     $filename = $clusterfw_conf_filename if !defined($filename);
 
-    my $sdn_conf = load_sdn_conf();
+    $sdn_conf //= load_sdn_conf();
 
     my $empty_conf = {
         rules => [],
@@ -5374,14 +5374,32 @@ sub dump_if_changed {
     syslog('info', "dumped $f\n");
 }
 
+my sub get_local_config_dump_path {
+    my ($filename) = @_;
+    for my $p (qw(.override .new)) {
+        my $f = $filename . $p;
+        return $f if -f $f;
+    }
+    return $filename;
+}
+
 sub update {
+    my ($local) = @_;
+
     my $code = sub {
         my $cfw_dump_path = "$dump_dir/cluster.fw";
         my $hfw_dump_path = "$dump_dir/host.fw";
         my $sdn_dump_path = "$dump_dir/sdn.json";
 
-        my $cluster_conf = load_clusterfw_conf();
-        my $hostfw_conf = load_hostfw_conf($cluster_conf);
+        my $cfw_conf_path = $local ? get_local_config_dump_path($cfw_dump_path) : undef;
+        my $hfw_conf_path = $local ? get_local_config_dump_path($hfw_dump_path) : undef;
+        my $sdn_conf = undef;
+        $sdn_conf = eval { decode_json(PVE::File::file_get_contents($sdn_dump_path)) }
+            if $local;
+        $sdn_conf = undef if $local && (!ref($sdn_conf) || ref($sdn_conf->{ipset}) ne 'HASH');
+
+        my $cluster_conf = load_clusterfw_conf($cfw_conf_path, $sdn_conf);
+        my $hostfw_conf = load_hostfw_conf($cluster_conf, $hfw_conf_path);
 
         if (!is_enabled_and_not_nftables($cluster_conf, $hostfw_conf)) {
             PVE::Firewall::remove_pvefw_chains();
@@ -5389,10 +5407,13 @@ sub update {
             # Disabled in config: drop stale dumps so the pre-network restore does not resurrect a
             # disabled ruleset. Leave them in nftables mode, since in that case proxmox-firewall
             # owns the dump directory.
-            delete_dumps() if !$cluster_conf->{options}->{enable};
+            delete_dumps() if !$local && !$cluster_conf->{options}->{enable};
+            syslog('info', "iptables firewall is not enabled, not restoring rules\n") if $local;
             return;
         }
 
+        syslog('info', "restoring last remembered ruleset from $dump_dir\n") if $local;
+
         # compile() rewrites rule actions in-place. Snapshot the untouched configs now for the
         # post-apply boot-time dump.
         my ($cfw_dump, $hfw_dump) = (dclone($cluster_conf), dclone($hostfw_conf));
@@ -5402,6 +5423,8 @@ sub update {
 
         apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset, $rulesetv6, $ebtables_ruleset);
 
+        return if $local;
+
         eval {
             mkdir($dump_dir);
             chmod(0700, $dump_dir);
diff --git a/src/PVE/Service/pve_firewall.pm b/src/PVE/Service/pve_firewall.pm
index 2fe68cc..8cba523 100755
--- a/src/PVE/Service/pve_firewall.pm
+++ b/src/PVE/Service/pve_firewall.pm
@@ -10,6 +10,7 @@ use PVE::CLIHandler;
 use PVE::Cluster qw(cfs_read_file);
 use PVE::Corosync;
 use PVE::Daemon;
+use PVE::File;
 use PVE::INotify;
 use PVE::ProcFSTools;
 use PVE::RPCEnvironment;
@@ -487,6 +488,22 @@ __PACKAGE__->register_method({
     },
 });
 
+__PACKAGE__->register_method({
+    name => 'restore',
+    path => 'restore',
+    method => 'GET',
+    description => 'Attempt to restore the last remembered ruleset',
+    parameters => {
+        additionalProperties => 0,
+        properties => {},
+    },
+    returns => { type => 'null' },
+    code => sub {
+        PVE::Firewall::update(1);
+        return undef;
+    },
+});
+
 our $cmddef = {
     start => [__PACKAGE__, 'start', []],
     restart => [__PACKAGE__, 'restart', []],
@@ -494,6 +511,7 @@ our $cmddef = {
     compile => [__PACKAGE__, 'compile', []],
     simulate => [__PACKAGE__, 'simulate', []],
     localnet => [__PACKAGE__, 'localnet', []],
+    restore => [__PACKAGE__, 'restore', []],
     status => [
         __PACKAGE__,
         'status',
diff --git a/src/pve-firewall b/src/pve-firewall
index 5b62430..6343adc 100755
--- a/src/pve-firewall
+++ b/src/pve-firewall
@@ -14,12 +14,16 @@ $SIG{'__WARN__'} = sub {
     $@ = $err;
 };
 
+my $is_restore = ($ARGV[0] // '') eq 'restore';
+
 my $prepare = sub {
     my $rpcenv = PVE::RPCEnvironment->init('cli');
 
-    $rpcenv->init_request();
-    $rpcenv->set_language($ENV{LANG});
-    $rpcenv->set_user('root@pam');
+
+    # 'restore' runs at pre-network, before pmxcfs is up, and needs no ACL
+    $rpcenv->init_request() if !$is_restore;
+    $rpcenv->set_language($ENV{LANG}) if !$is_restore;
+    $rpcenv->set_user('root@pam') if !$is_restore;
 };
 
 PVE::Service::pve_firewall->run_cli_handler(prepare => $prepare);
-- 
2.47.3