save restore commands into files (debug help)

To make it easier to debug restore errors.

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index fcbac368459a664f3960c0df30e902306a915d90..1fbd40314e3aa73f787840d0a68b305ba7221f40 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -37,6 +37,10 @@ eval {
     $have_pve_manager = 1;
 };
 
     $have_pve_manager = 1;
 };
 

+my $pve_fw_status_dir = "/var/lib/pve-firewall";
+
+mkdir $pve_fw_status_dir; # make sure this exists
+

 my $security_group_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+';
 my $ipset_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+';
 our $ip_alias_pattern = '[A-Za-z][A-Za-z0-9\-\_]+';
 my $security_group_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+';
 my $ipset_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+';
 our $ip_alias_pattern = '[A-Za-z][A-Za-z0-9\-\_]+';


@@ -3427,11 +3431,24 @@ sub apply_ruleset {
        }
     }
 
        }
     }
 

+    my $tmpfile = "$pve_fw_status_dir/ipsetcmdlist1";
+    PVE::Tools::file_set_contents($tmpfile, $ipset_create_cmdlist || '');
+

     ipset_restore_cmdlist($ipset_create_cmdlist);
 
     ipset_restore_cmdlist($ipset_create_cmdlist);
 

+    $tmpfile = "$pve_fw_status_dir/ip4cmdlist";
+    PVE::Tools::file_set_contents($tmpfile, $cmdlist || '');
+

     iptables_restore_cmdlist($cmdlist);
     iptables_restore_cmdlist($cmdlist);

+
+    $tmpfile = "$pve_fw_status_dir/ip6cmdlist";
+    PVE::Tools::file_set_contents($tmpfile, $cmdlistv6 || '');
+

     ip6tables_restore_cmdlist($cmdlistv6);
 
     ip6tables_restore_cmdlist($cmdlistv6);
 

+    $tmpfile = "$pve_fw_status_dir/ipsetcmdlist2";
+    PVE::Tools::file_set_contents($tmpfile, $ipset_delete_cmdlist || '');
+

     ipset_restore_cmdlist($ipset_delete_cmdlist) if $ipset_delete_cmdlist;
 
     # test: re-read status and check if everything is up to date
     ipset_restore_cmdlist($ipset_delete_cmdlist) if $ipset_delete_cmdlist;
 
     # test: re-read status and check if everything is up to date

diff --git a/src/pve-firewall b/src/pve-firewall
index e7a2337c4c9da59c19c4eda999b369303ef62a8c..f2ccd307369ebfa4dcfa08d7b389813b3cef4b92 100755 (executable)
--- a/src/pve-firewall
+++ b/src/pve-firewall
@@ -49,6 +49,8 @@ my $commandline = [$0, @ARGV];
 
 $0 = "pve-firewall";
 
 
 $0 = "pve-firewall";
 

+mkdir "/var/lib/pve-firewall";
+

 sub restart_server {
     my ($waittime) = @_;
 
 sub restart_server {
     my ($waittime) = @_;