MitchDrage opened a new pull request, #14621: URL: https://github.com/apache/cloudstack/pull/14621
### Description This PR fixes the virtual router's nftables restore at boot. `rules.nftables` was saved with `nft list ruleset`, which includes the iptables-nft tables. nft can't load those, so the whole restore failed and the IPv6 firewall and ACLs were missing after a reboot from the router's shell. - New `CsHelper.save_nftables` saves every table except the iptables ones (`filter`, `nat`, `mangle`, `raw`, `security`) and ebtables' `broute`. The router's iptables rules are already saved in `rules.v4` and `rules.v6` and restored with iptables-restore. - `configure.py` uses it in place of `nft list ruleset`. - `save_iptables` and `save_nftables` now share a small `write_lines` helper. - On routers with no nftables-only tables the file is empty, and the restore runs without error. The iptables table names are fixed, so I chose to exclude those over naming the tables to keep. The set of nftables tables can grow, and #14620 adds one, for example. Fixes: #14619 ### Types of changes - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] New feature (non-breaking change which adds functionality) - [x] Bug fix (non-breaking change which fixes an issue) - [ ] Enhancement (improves an existing feature and functionality) - [ ] Cleanup (Code refactoring and cleanup, that may add test cases) - [ ] Build/CI - [ ] Test (unit or integration test code) ### Feature/Enhancement Scale or Bug Severity #### Bug Severity - [ ] BLOCKER - [ ] Critical - [ ] Major - [x] Minor - [ ] Trivial ### Screenshots (if appropriate): ### How Has This Been Tested? - Unit tests in `TestCsHelper`: iptables tables and `broute` are left out, the IPv6 firewall, IPv4 routed firewall and other tables are kept, a router with only iptables tables gets an empty file, and `save_iptables` still writes the `iptables-save` output unchanged. - A lab running the 4.20 router scripts (Debian 12, nftables 1.0.6). Each run applied the rules, flushed the ruleset and ran the restore block from `postinit.sh`, as a boot would: | Router | Before this PR | With this PR | |---|---|---| | Isolated, IPv6 firewall | Restore fails, IPv6 firewall missing, blocked source gets through | IPv6 firewall restored identically, blocked source still blocked | | VPC, IPv6 ACL | Restore fails, ACL missing, blocked source gets through | ACL restored, blocked source still blocked | | Routed mode, IPv4 firewall | Restores fine (run on `main`) | Restores fine | | Isolated, no IPv6 | Restore fails, nothing lost (also seen on production 4.22.1.1 routers) | Empty file, restore succeeds | IPv4 iptables rules were identical before and after the boot in every run. #### How did you try to break this feature and the system with this change? - Ran it on a router with no nftables-only tables, to check an empty file restores cleanly. - Ran it in routed mode, where the IPv4 firewall is an nftables table, to check it's still saved. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
