split compile from apply

And renamed compile_and_start into apply_ruleset.

diff --git a/PVE/Firewall.pm b/PVE/Firewall.pm
index 47862f19a004f041c08e59dae1462e4a1a12ab0e..2de83345d49e6d8ccd246a12d37a0b0a17eced4b 100644 (file)
--- a/PVE/Firewall.pm
+++ b/PVE/Firewall.pm
@@ -702,10 +702,10 @@ sub print_sig_rule {
     return "-A $chain -j LOG --log-prefix \"PVESIG:$sig\" -p tcp -s \"127.128.129.130\" --dport 1\n";
 }
 
-sub compile_and_start {
-    my ($verbose) = @_;
+sub apply_ruleset {
+    my ($ruleset, $verbose) = @_;
 
-    my $ruleset = compile();
+    enable_bridge_firewall();
 
     my $cmdlist = "*filter\n"; # we pass this to iptables-restore;
 

diff --git a/pvefw b/pvefw
index 4370678570dca59386ded0a90828d28148d8428b..1c346b555e7e4e6019452593844508b0145cfefd 100755 (executable)
--- a/pvefw
+++ b/pvefw
@@ -82,8 +82,8 @@ __PACKAGE__->register_method ({
        my ($param) = @_;
 
        my $code = sub {
-           PVE::Firewall::enable_bridge_firewall();
-           PVE::Firewall::compile_and_start($param->{verbose});
+           my $ruleset = PVE::Firewall::compile();
+           PVE::Firewall::apply_ruleset($ruleset, $param->{verbose});
        };
 
        PVE::Firewall::run_locked($code);