do not set persistent state if firewall is disabled

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 8c8e50ae569eb1e384be78d3eecd3801d6e6494f..d5d4950b6aaa4be45c796d37c084dc599452976c 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1503,7 +1503,7 @@ sub generate_nfqueue {
                $action .= " --queue-num $1";
            }
        }
-       $action .= " --queue-bypass";
+       $action .= " --queue-bypass" if $feature_ipset_nomatch; #need kernel 3.10
     }else{
        $action = "ACCEPT";
     }
@@ -2483,12 +2483,16 @@ sub save_hostfw_conf {
 }
 
 sub compile {
+    my ($cluster_conf, $hostfw_conf) = @_;
+
+    $cluster_conf = load_clusterfw_conf() if !$cluster_conf;
+    $hostfw_conf = load_hostfw_conf() if !$hostfw_conf;
+
     my $vmdata = read_local_vm_config();
     my $vmfw_configs = read_vm_firewall_configs($vmdata);
 
     my $routing_table = read_proc_net_route();
 
-    my $cluster_conf = load_clusterfw_conf();
 
     my $ipset_ruleset = {};
     generate_ipset_chains($ipset_ruleset, $cluster_conf);
@@ -2500,7 +2504,6 @@ sub compile {
 
     ruleset_create_chain($ruleset, "PVEFW-FORWARD");
 
-    my $hostfw_conf = load_hostfw_conf();
     my $hostfw_options = $hostfw_conf->{options} || {};
 
     generate_std_chains($ruleset, $hostfw_options);
@@ -2596,7 +2599,7 @@ sub compile {
     ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j DROP");
     ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j DROP");
 
-    return wantarray ? ($ruleset, $hostfw_conf, $ipset_ruleset) : $ruleset;
+    return ($ruleset, $ipset_ruleset);
 }
 
 sub get_ruleset_status {
@@ -2868,9 +2871,25 @@ sub update {
     my ($start, $verbose) = @_;
 
     my $code = sub {
+
+       my $cluster_conf = load_clusterfw_conf();
+       my $cluster_options = $cluster_conf->{options};
+
+       my $enable = $cluster_options->{enable};
+
        my $status = read_pvefw_status();
 
-       my ($ruleset, $hostfw_conf, $ipset_ruleset) = compile();
+       die "Firewall is disabled - cannot start\n" if !$enable && $start;
+
+       if (!$enable) {
+           PVE::Firewall::remove_pvefw_chains();
+           print "Firewall disabled\n" if $verbose;
+           return;
+       }
+
+       my $hostfw_conf = load_hostfw_conf();
+
+       my ($ruleset, $ipset_ruleset) = compile($cluster_conf, $hostfw_conf);
 
        if ($start || $status eq 'active') {