remove ipsets when firewall disabled

And improve status output

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index f4f4377b64e3a9f67ca9b24bf2386bfeb510abdb..22cae5a8c7ee50eafe1073f063339837353d1199 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -2971,8 +2971,9 @@ sub get_ruleset_cmdlist {
     }
 
     foreach my $h (qw(INPUT OUTPUT FORWARD)) {
     }
 
     foreach my $h (qw(INPUT OUTPUT FORWARD)) {

-       if (!$hooks->{$h}) {
-           $cmdlist .= "-A $h -j PVEFW-$h\n";
+       my $chain = "PVEFW-$h";
+       if ($ruleset->{$chain} && !$hooks->{$h}) {
+           $cmdlist .= "-A $h -j $chain\n";

        }
     }
 
        }
     }
 


@@ -3172,6 +3173,17 @@ sub remove_pvefw_chains {
     $cmdlist .= "COMMIT\n";
 
     iptables_restore_cmdlist($cmdlist);
     $cmdlist .= "COMMIT\n";
 
     iptables_restore_cmdlist($cmdlist);

+
+    my $ipset_chains = ipset_get_chains();
+
+    $cmdlist = "";
+ 
+    foreach my $chain (keys %$ipset_chains) {
+       $cmdlist .= "flush $chain\n";
+       $cmdlist .= "destroy $chain\n";
+    }
+
+    ipset_restore_cmdlist($cmdlist) if $cmdlist; 

 }
 
 sub init {
 }
 
 sub init {


@@ -3190,11 +3202,7 @@ sub update {
        my $cluster_conf = load_clusterfw_conf();
        my $cluster_options = $cluster_conf->{options};
 
        my $cluster_conf = load_clusterfw_conf();
        my $cluster_options = $cluster_conf->{options};
 

-       my $enable = $cluster_options->{enable};
-
-       die "Firewall is disabled - cannot start\n" if !$enable;
-
-       if (!$enable) {
+       if (!$cluster_options->{enable}) {

            PVE::Firewall::remove_pvefw_chains();
            return;
        }
            PVE::Firewall::remove_pvefw_chains();
            return;
        }

diff --git a/src/pve-firewall b/src/pve-firewall
index d401b993ea5dd2d6b0d637cc339efa2f6650e8a2..befee4482aca03d7c82804a9c132fdf491b507c6 100755 (executable)
--- a/src/pve-firewall
+++ b/src/pve-firewall
@@ -311,7 +311,11 @@ __PACKAGE__->register_method ({
        properties => {
            status => {
                type => 'string',
        properties => {
            status => {
                type => 'string',

-               enum => ['unknown', 'stopped', 'active'],
+               enum => ['unknown', 'stopped', 'running'],
+           },
+           enable => {
+               description => "Firewall is enabled (in 'cluster.fw')",
+               type => 'boolean',

            },
            changes => {
                description => "Set when there are pending changes.",
            },
            changes => {
                description => "Set when there are pending changes.",


@@ -330,17 +334,21 @@ __PACKAGE__->register_method ({
            my $pid = int(PVE::Tools::file_read_firstline($pve_firewall_pidfile) || 0);
            my $running = PVE::ProcFSTools::check_process_running($pid);
 
            my $pid = int(PVE::Tools::file_read_firstline($pve_firewall_pidfile) || 0);
            my $running = PVE::ProcFSTools::check_process_running($pid);
 

-           my $status = $running ? 'active' : 'stopped';
+           my $status = $running ? 'running' : 'stopped';

 
            my $res = { status => $status };
 
            my $res = { status => $status };

-           if ($status eq 'active') {
+
+           my $verbose = 1; # show syntax errors 
+           my $cluster_conf = PVE::Firewall::load_clusterfw_conf(undef, $verbose); 
+           $res->{enable} = $cluster_conf->{options}->{enable} ? 1 : 0;
+
+           if ($status eq 'running') {

                
                

-               my $verbose = 1; # show syntax errors 
-               my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile(undef, undef, undef, $verbose);
+               my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile($cluster_conf, undef, undef, $verbose);

 
                $verbose = 0; # do not show iptables details
                my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset, $verbose);
 
                $verbose = 0; # do not show iptables details
                my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset, $verbose);

-               my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset, $verbose);
+               my ($test, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset, $verbose);

              
                $res->{changes} = ($ipset_changes || $ruleset_changes) ? 1 : 0;
            }
              
                $res->{changes} = ($ipset_changes || $ruleset_changes) ? 1 : 0;
            }


@@ -371,15 +379,21 @@ __PACKAGE__->register_method ({
 
            my $verbose = 1;
 
 
            my $verbose = 1;
 

-           my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile(undef, undef, undef, $verbose);
+           my $cluster_conf = PVE::Firewall::load_clusterfw_conf(undef, $verbose); 
+           my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile($cluster_conf, undef, undef, $verbose);

 
            my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset, $verbose);
            my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset, $verbose);
 
            my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset, $verbose);
            my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset, $verbose);

+

            if ($ipset_changes || $ruleset_changes) {
                print "detected changes\n";
            } else {
                print "no changes\n";
            }
            if ($ipset_changes || $ruleset_changes) {
                print "detected changes\n";
            } else {
                print "no changes\n";
            }

+           if (!$cluster_conf->{options}->{enable}) {
+               print "firewall disabled\n";
+           }
+

        };
 
        PVE::Firewall::run_locked($code);
        };
 
        PVE::Firewall::run_locked($code);


@@ -542,10 +556,12 @@ my $cmddef = {
     localnet => [ __PACKAGE__, 'localnet', []],
     status => [ __PACKAGE__, 'status', [], undef, sub {
        my $res = shift;
     localnet => [ __PACKAGE__, 'localnet', []],
     status => [ __PACKAGE__, 'status', [], undef, sub {
        my $res = shift;

+       my $status = ($res->{enable} ? "enabled" : "disabled") . '/' . $res->{status};
+       

        if ($res->{changes}) {
        if ($res->{changes}) {

-           print "Status: $res->{status} (pending changes)\n";
+           print "Status: $status (pending changes)\n";

        } else {
        } else {

-           print "Status: $res->{status}\n";
+           print "Status: $status\n";

        }
     }],
  };
        }
     }],
  };