Add rich rules support

[gsanchietti]

The need arose to allow advanced firewall configurations using firewalld 'rich rules', which enable more granular control, improved security flexibility, and support for complex network policies in NethServer 8 environments, like port forwarding inside NethVoice Proxy module.

Proposed solution

• Integrate rich rules management into the ns8-core firewall module

• Allow creation, listing, modification, and removal of rich rules

• Continue managing only traditional/simple rules, but this limits advanced scenarios and could require complex manual configurations

• Provide external scripts or modules to manage rich rules, but integrated support is more maintainable

See also

#7725

[gsanchietti]

Testing image: core:3.16.0-dev.1

Test case 1: clean machine, add rich rules

1. Install a clean machine

curl https://raw.githubusercontent.com/NethServer/ns8-core/main/core/install.sh > install.sh 
bash install.sh ghcr.io/nethserver/core:3.16.0-dev.1

3. Add rich rules:

api-cli  run node/1/add-rich-rules --data '{"rich_rules":  ["rule family=ipv4 forward-port port=5060 protocol=udp to-port=5060", "rule family=ipv6 forward-port port=5060 protocol=udp to-port=5060 to-addr=2001:db8::1","rule family=ipv4 forward-port port=5060 protocol=udp to-port=5060 source address=1.2.3.4" ] }'

3. Verify rich rules are listed, execute: firewall-cmd --list-rich-rules

Test case 2: clean machine, remove rich rules

1. After test case 1
2. Remove the rich rules:

api-cli  run node/1/remove-rich-rules --data '{"rich_rules":  ["rule family=ipv4 forward-port port=5060 protocol=udp to-port=5060", "rule family=ipv6 forward-port port=5060 protocol=udp to-port=5060 to-addr=2001:db8::1","rule family=ipv4 forward-port port=5060 protocol=udp to-port=5060 source address=1.2.3.4" ] }'

3. Verify rich rules are not listed, execute: firewall-cmd --list-rich-rules

Test case 3: updated machine, add rich rules

1. Upgrade an existing machine

api-cli run update-core --data '{"core_url":"ghcr.io/nethserver/core:3.16.0-dev.1","nodes":[1], "force": true}'

2. Repeat steps 2 and 3 from test case 1

Test case 3: updated machine, remove rich rules

1. After test case 3
2. Repeat steps 2 and 3 from test case 2