[PATCH pve-firewall v2 04/12] fix #5759: firewall: do not remove chains when host is shutting down

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

The assumption until now was that the firewall rules should always be
cleared when the daemon is shutting down. This is correct when the
shutdown happens as the result of `systemctl stop`, should however not
be handled the same way in case of a system shutdown.

Because of the way pve-firewall is ordered, it comes down before the
network does. Clearing the rules in the host shutdown case creates a
window where the network is up without firewall protection.

When shutting down, check the operational state of the system and only
remove the chains if the system is _not_ currently shutting down.

Link: https://bugzilla.proxmox.com/show_bug.cgi?id=5759
Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
Reviewed-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
Tested-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
 src/PVE/Service/pve_firewall.pm | 40 +++++++++++++++++++++++++++------
 1 file changed, 33 insertions(+), 7 deletions(-)

diff --git a/src/PVE/Service/pve_firewall.pm b/src/PVE/Service/pve_firewall.pm
index f9fa1dd..b39fea7 100755
--- a/src/PVE/Service/pve_firewall.pm
+++ b/src/PVE/Service/pve_firewall.pm
@@ -41,6 +41,29 @@ my $updatetime = 10;
 
 my $initial_memory_usage;
 
+=head3 is_host_shutdown()
+
+Query C<systemctl is-system-running>, returning C<1> if the system's running state is C<stopping>,
+C<0> otherwise.
+
+Note that C<1> is also returned if the running state of the system could not be determined, in order
+to fail closed.
+
+=cut
+
+sub is_host_shutdown {
+    my $state = undef;
+
+    PVE::Tools::run_command(
+        ['systemctl', 'is-system-running'],
+        outfunc => sub { $state = PVE::Tools::trim(shift) },
+        noerr => 1,
+    );
+
+    return 1 if !defined($state) || $state eq '';
+    return $state eq 'stopping';
+}
+
 sub shutdown {
     my ($self) = @_;
 
@@ -49,13 +72,16 @@ sub shutdown {
     # wait for children
     1 while (waitpid(-1, POSIX::WNOHANG()) > 0);
 
-    syslog('info', "clear PVE-generated firewall rules");
-
-    eval {
-        PVE::Firewall::remove_pvefw_chains();
-        PVE::Firewall::delete_dumps_if_owned();
-    };
-    warn $@ if $@;
+    if (is_host_shutdown()) {
+        syslog('info', "system is stopping, not removing firewall rules\n");
+    } else {
+        syslog('info', "clear PVE-generated firewall rules");
+        eval {
+            PVE::Firewall::remove_pvefw_chains();
+            PVE::Firewall::delete_dumps_if_owned();
+        };
+        warn $@ if $@;
+    }
 
     $self->exit_daemon(0);
 }
-- 
2.47.3