Rest refactor - #4
Merged
Merged
Conversation
Two related fixes for toggling firewall/NAT rules over REST v2:
1. FIELD_EMPTY_NOT_ALLOWED on rule toggle. pfSense's webConfigurator
stores content-less config elements (<statetype></statetype>), which
the REST API surfaces as "". A PATCH re-validates the whole rule, so
toggling a rule whose statetype is empty fails even though only
`disabled` changed. _set_rule_disabled now backfills the empty field
with pfSense's own default ("keep state"), which is a no-op for the
rule's behaviour. Driven by a per-endpoint _RULE_REQUIRED_DEFAULTS
table. Verified on 26.07 / RESTAPI 2.10.2.
2. New option "Reset matching states when a rule switch is toggled"
(rule_switch_kill_states, default off). When set, enabling or
disabling any rule switch also flushes the state-table entries for
the hosts/networks that rule matches, so existing connections stop
riding the old ruleset without a global `pfctl -F states`.
kill_states_for_rule() resolves the rule's source/destination to
concrete IPv4 networks (literal CIDR/host, or alias names expanded
via /firewall/aliases, following nested aliases), turns each into a
firewall/state value prefix (host -> "ip:", octet-aligned CIDR ->
leading octets), and issues DELETE /firewall/states with a
{source,destination}__startswith filter. REST-only, best effort:
`any`, `(self)`, interface macros, negated aliases, non
octet-aligned networks and IPv6 are skipped rather than shelling out
to pfctl. A single DELETE clears every currently-matching state
(no per-call cap); it can't stop a busy host reopening connections,
which is expected. The toggle never fails if the kill errors.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
🎉 Thank you for contributing to SkyRadar Fusion! Your Pull Request has been received. Our automated tests (Hassfest, Ruff, etc.) will run shortly. If anything fails, don't worry—just check the logs and update your branch! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.