verify_rule: correctly set ipversion for aliases

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index fcbac368459a664f3960c0df30e902306a915d90..f4b199bdb7281f8ab894cdfd26b194f295e8a2bc 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -37,6 +37,10 @@ eval {
     $have_pve_manager = 1;
 };
 
+my $pve_fw_status_dir = "/var/lib/pve-firewall";
+
+mkdir $pve_fw_status_dir; # make sure this exists
+
 my $security_group_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+';
 my $ipset_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+';
 our $ip_alias_pattern = '[A-Za-z][A-Za-z0-9\-\_]+';
@@ -1213,6 +1217,16 @@ sub verify_rule {
        $errors->{$param} = $msg if !$errors->{$param};
     };
 
+    my $ipversion;
+    my $set_ip_version = sub {
+       my $vers = shift;
+       if ($vers) {
+           die "detected mixed ipv4/ipv6 adresses in rule\n"
+               if $ipversion && ($vers != $ipversion);
+           $ipversion = $vers;
+       }
+    };
+
     my $check_ipset_or_alias_property = sub {
        my ($name, $expected_ipversion) = @_;
 
@@ -1233,8 +1247,7 @@ sub verify_rule {
                my $e = $fw_conf->{aliases}->{$alias} if $fw_conf;
                $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf;
 
-               die "detected mixed ipv4/ipv6 adresses in rule\n"
-                   if $expected_ipversion && ($expected_ipversion != $e->{ipversion});
+               &$set_ip_version($e->{ipversion});
            }
        }
     };
@@ -1281,16 +1294,6 @@ sub verify_rule {
        }
     }
 
-    my $ipversion;
-    my $set_ip_version = sub {
-       my $vers = shift;
-       if ($vers) {
-           die "detected mixed ipv4/ipv6 adresses in rule\n"
-               if $ipversion && ($vers != $ipversion);
-           $ipversion = $vers;
-       }
-    };
-
     if ($rule->{proto}) {
        eval { pve_fw_verify_protocol_spec($rule->{proto}); };
        &$add_error('proto', $@) if $@;
@@ -3427,11 +3430,24 @@ sub apply_ruleset {
        }
     }
 
+    my $tmpfile = "$pve_fw_status_dir/ipsetcmdlist1";
+    PVE::Tools::file_set_contents($tmpfile, $ipset_create_cmdlist || '');
+
     ipset_restore_cmdlist($ipset_create_cmdlist);
 
+    $tmpfile = "$pve_fw_status_dir/ip4cmdlist";
+    PVE::Tools::file_set_contents($tmpfile, $cmdlist || '');
+
     iptables_restore_cmdlist($cmdlist);
+
+    $tmpfile = "$pve_fw_status_dir/ip6cmdlist";
+    PVE::Tools::file_set_contents($tmpfile, $cmdlistv6 || '');
+
     ip6tables_restore_cmdlist($cmdlistv6);
 
+    $tmpfile = "$pve_fw_status_dir/ipsetcmdlist2";
+    PVE::Tools::file_set_contents($tmpfile, $ipset_delete_cmdlist || '');
+
     ipset_restore_cmdlist($ipset_delete_cmdlist) if $ipset_delete_cmdlist;
 
     # test: re-read status and check if everything is up to date