[PATCH pve-firewall 07/13] fix #5759: firewall: restore from dumped config before network-pre

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

Since pve-firewall depends on pve-cluster for its config, pve-cluster
depends on corosync, which itself depends on network-online. This
creates a window at boot where the network is up with no protection.

To address this, add a simple oneshot service depending on
network-pre [0] that applies the last remembered rules to bridge the gap
until the configured firewall daemon takes over.

[0] https://systemd.io/NETWORK_ONLINE/

Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=5759
Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 debian/pve-firewall-pre-network.service | 16 ++++++++++++++++
 debian/rules                            |  1 +
 2 files changed, 17 insertions(+)
 create mode 100644 debian/pve-firewall-pre-network.service

diff --git a/debian/pve-firewall-pre-network.service b/debian/pve-firewall-pre-network.service
new file mode 100644
index 0000000..e1127e4
--- /dev/null
+++ b/debian/pve-firewall-pre-network.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Proxmox VE Pre-Network iptables Firewall
+Wants=network-pre.target
+Before=network-pre.target shutdown.target
+Conflicts=shutdown.target
+DefaultDependencies=no
+After=local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/pve-firewall restore
+RemainAfterExit=true
+Environment=PVE_LOG=info
+
+[Install]
+WantedBy=sysinit.target
diff --git a/debian/rules b/debian/rules
index 9bd53bc..170a90d 100755
--- a/debian/rules
+++ b/debian/rules
@@ -8,6 +8,7 @@
 
 override_dh_installsystemd:
 	dh_installsystemd --name pvefw-logger pvefw-logger.service
+	dh_installsystemd --no-start --name pve-firewall-pre-network pve-firewall-pre-network.service
 	dh_installsystemd --name pve-firewall --no-stop-on-upgrade --no-restart-after-upgrade pve-firewall.service
 
 override_dh_installinit:
-- 
2.47.3