bump version to 5.0.6

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 77cbaf46598ff7eff0842a0484ef90239e4a58b0..5dca91ff633f44b6c983424c2c7bd37414a8fd11 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1408,6 +1408,12 @@ our $host_option_properties = {
        default => 0,
        optional => 1
     },
+    nftables => {
+       description => "Enable nftables based firewall (tech preview)",
+       type => 'boolean',
+       default => 0,
+       optional => 1,
+    },
 };
 
 our $vm_option_properties = {
@@ -2929,7 +2935,7 @@ sub parse_hostfw_option {
 
     my $loglevels = "emerg|alert|crit|err|warning|notice|info|debug|nolog";
 
-    if ($line =~ m/^(enable|nosmurfs|tcpflags|ndp|log_nf_conntrack|nf_conntrack_allow_invalid|protection_synflood):\s*(0|1)\s*$/i) {
+    if ($line =~ m/^(enable|nosmurfs|tcpflags|ndp|log_nf_conntrack|nf_conntrack_allow_invalid|protection_synflood|nftables):\s*(0|1)\s*$/i) {
        $opt = lc($1);
        $value = int($2);
     } elsif ($line =~ m/^(log_level_in|log_level_out|tcp_flags_log_level|smurf_log_level):\s*(($loglevels)\s*)?$/i) {
@@ -3360,7 +3366,7 @@ my $format_aliases = sub {
     my $raw = '';
 
     $raw .= "[ALIASES]\n\n";
-    foreach my $k (keys %$aliases) {
+    foreach my $k (sort keys %$aliases) {
        my $e = $aliases->{$k};
        $raw .= "$e->{name} $e->{cidr}";
        $raw .= " # " . encode('utf8', $e->{comment})
@@ -4673,28 +4679,54 @@ sub remove_pvefw_chains_ebtables {
     ebtables_restore_cmdlist(get_ebtables_cmdlist({}));
 }
 
-sub init {
-    my $cluster_conf = load_clusterfw_conf();
-    my $cluster_options = $cluster_conf->{options};
-    my $enable = $cluster_options->{enable};
+sub is_nftables {
+    my ($cluster_conf, $host_conf) = @_;
+
+    if (!-x "/usr/libexec/proxmox/proxmox-firewall") {
+       return 0;
+    }
+
+    $cluster_conf = load_clusterfw_conf() if !defined($cluster_conf);
+    $host_conf = load_hostfw_conf($cluster_conf) if !defined($host_conf);
+
+    return $host_conf->{options}->{nftables};
+}
+
+sub is_enabled_and_not_nftables {
+    my ($cluster_conf, $host_conf) = @_;
+
+    $cluster_conf = load_clusterfw_conf() if !defined($cluster_conf);
+    $host_conf = load_hostfw_conf($cluster_conf) if !defined($host_conf);
+
+    return $cluster_conf->{options}->{enable} && !is_nftables($cluster_conf, $host_conf);
+}
 
-    return if !$enable;
+sub init {
+    return if !is_enabled_and_not_nftables();
 
     # load required modules here
 }
 
+# This is checked in proxmox-firewall to avoid log-spam due to failing to parse the config
+my $FORCE_NFT_DISABLE_FLAG_FILE = "/run/proxmox-nftables-firewall-force-disable";
+
 sub update {
     my $code = sub {
 
        my $cluster_conf = load_clusterfw_conf();
-       my $cluster_options = $cluster_conf->{options};
+       my $hostfw_conf = load_hostfw_conf($cluster_conf);
 
-       if (!$cluster_options->{enable}) {
+       if (!is_enabled_and_not_nftables($cluster_conf, $hostfw_conf)) {
+           unlink($FORCE_NFT_DISABLE_FLAG_FILE)
+               or $!{ENOENT} or warn "failed to unlink flag file '$FORCE_NFT_DISABLE_FLAG_FILE' - $!\n";
            PVE::Firewall::remove_pvefw_chains();
            return;
        }
+       if (! -e $FORCE_NFT_DISABLE_FLAG_FILE) {
+           open(my $_fh, '>', $FORCE_NFT_DISABLE_FLAG_FILE)
+               or warn "failed to create flag file '$FORCE_NFT_DISABLE_FLAG_FILE' – $!\n";
+       }
 
-       my $hostfw_conf = load_hostfw_conf($cluster_conf);
 
        my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = compile($cluster_conf, $hostfw_conf);