firewall.py complete revamp

[Salamandar]

The problem

dumb code

Solution

• rewrite the firewall.yml config:
  • Remove the differentiation between ipv4 and ipv6
  • Remove the "Both" parameter for tcp/udp (just call it twice! most of the time it's tcp only anyways)
  • Closing a port does NOT remove it from the list -> users can close a port, while apps at remove time should remove it.
  • Opening a port can be passed a comment that will be shown on the web UI, and on UPnP config.
• Write the config only when necessary
• Apply (reload) only when necessary
• Fix UPnP discovery (open a specific UDP port for this purpose)
• Use nftables via regen_conf

Left to do

• test !

• adapt the webadmin -> see Adapt webadmin to the new firewall API yunohost-admin#606
• Manage the migration between iptables and nftables -> nothing to do : iptables already use the kernel nf_tables so nftables pick it up automatically
• Change the fail2ban configuration to use nftables -> Tested, validated.
• Fix translations
• Update doc (also now manifest takes a upnp value, and yunohost firewall is-open <port>)
• Run post_iptable_rules hook on nftables reload/start
• Check that apps calling directly iptables work (Actually in bookworm the iptables command is already in a compat mode with nftables)
  • hotspot
  • vpnclient
  • wireguard
• Patch apps calling yunohost firewall allow/disallow -> Maybe actually keep it for a while ?

How to test

uuuuuuuh how to what now ?