feat: add rich rules

[gsanchietti]

This pull request adds support for managing firewall rich rules at the node level.

This feature is required for NethVoice Proxy.
Fixes NethServer/dev#7725
Fixes NethServer/dev#7776

Firewall rich rule management:

• Added add_rich_rules and remove_rich_rules functions to agent/__init__.py to enable adding and removing arrays of rich rules on a node using firewall-cmd.
• Introduced new node actions: add-rich-rules and remove-rich-rules, each with a Python script to apply or remove rich rules and reload the firewall configuration. [1] [2]
• Added JSON schema validation files for both actions to validate input structure for rich rules. [1] [2]

Permission and role updates:

• Updated add-node/50update and node/install-finalize.sh scripts to grant add-rich-rules and remove-rich-rules permissions to relevant roles (fwadm, portsadm, tunadm). [1] [2] [3] [4]

Usage example

Add rules:

import agent

# Add two rich rules (example: forward and allow)
rules_to_add = [
    "rule family=ipv4 forward-port port=5060 protocol=udp to-port=5060",
    "rule family=ipv4 source address=203.0.113.5 accept"
]
success = agent.add_rich_rules(rules_to_add)

Remove rules:

import agent

# Remove them later
rules_to_remove = = [
    "rule family=ipv4 forward-port port=5060 protocol=udp to-port=5060",
    "rule family=ipv4 source address=203.0.113.5 accept"
]
success = agent.remove_rich_rules(rules_to_remove)

Update an existing machine

api-cli run update-core --data '{"core_url":"ghcr.io/nethserver/core:port_forward","nodes":[1]}'

Install a new machine

curl https://raw.githubusercontent.com/NethServer/ns8-core/main/core/install.sh > install.sh 
bash install.sh ghcr.io/nethserver/core:port_forward

[Copilot]

Pull request overview

This PR adds support for managing firewall rich rules at the node level, enabling applications like NethVoice Proxy to configure advanced firewall rules programmatically. The implementation introduces two new node actions (add-rich-rules and remove-rich-rules) with corresponding Python helper functions in the agent module.

Key changes:

• New node actions with JSON schema validation for adding and removing firewall rich rules using firewall-cmd
• Agent module functions add_rich_rules() and remove_rich_rules() for programmatic access
• Permission grants for fwadm and portsadm roles (incomplete - missing tunadm grants)

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
core/imageroot/var/lib/nethserver/node/actions/add-rich-rules/50add	Python script to add rich rules and reload firewall configuration
core/imageroot/var/lib/nethserver/node/actions/add-rich-rules/validate-input.json	JSON schema validation for add-rich-rules input
core/imageroot/var/lib/nethserver/node/actions/remove-rich-rules/50remove	Python script to remove rich rules and reload firewall configuration
core/imageroot/var/lib/nethserver/node/actions/remove-rich-rules/validate-input.json	JSON schema validation for remove-rich-rules input
core/imageroot/usr/local/agent/pypkg/agent/__init__.py	Added add_rich_rules() and remove_rich_rules() helper functions
core/imageroot/var/lib/nethserver/cluster/actions/add-node/50update	Grants permissions for new actions when adding nodes (incomplete role coverage)
core/imageroot/var/lib/nethserver/node/install-finalize.sh	Grants permissions for new actions during node initialization (incomplete role coverage)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.