From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <f.gruenbichler@proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by lists.proxmox.com (Postfix) with ESMTPS id 07B846C46A
for <pve-devel@lists.proxmox.com>; Fri, 6 Aug 2021 14:06:45 +0200 (CEST)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id EF40FD746
for <pve-devel@lists.proxmox.com>; Fri, 6 Aug 2021 14:06:44 +0200 (CEST)
Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com
[94.136.29.106])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by firstgate.proxmox.com (Proxmox) with ESMTPS id 37633D739
for <pve-devel@lists.proxmox.com>; Fri, 6 Aug 2021 14:06:44 +0200 (CEST)
Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1])
by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 0194342EFC
for <pve-devel@lists.proxmox.com>; Fri, 6 Aug 2021 14:06:44 +0200 (CEST)
Date: Fri, 06 Aug 2021 14:06:37 +0200
From: Fabian =?iso-8859-1?q?Gr=FCnbichler?= <f.gruenbichler@proxmox.com>
To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
References: <20210805105903.765052-1-l.stechauner@proxmox.com>
In-Reply-To: <20210805105903.765052-1-l.stechauner@proxmox.com>
MIME-Version: 1.0
User-Agent: astroid/0.15.0 (https://github.com/astroidmail/astroid)
Message-Id: <1628251520.kcdfunhkdm.astroid@nora.none>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-SPAM-LEVEL: Spam detection results: 0
AWL 0.437 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more
information. [firewall.pm, gitlab.com, proxmox.com]
Subject: [pve-devel] applied: [PATCH firewall] fix #2721: remove reject tcp
43 from default drop and reject actions
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Fri, 06 Aug 2021 12:06:45 -0000
thanks!
On August 5, 2021 12:59 pm, Lorenz Stechauner wrote:
> first, '43' is a typo, it should say '113' (if it really is like
> legacy shorewall [0]). this tcp port corresponds to the ident or
> authentication service protocol.
>=20
> second, nowdays this reject is not included in shorewall anymore.
> furthermore it would make no sense to reject specifically this
> one port.
>=20
> [0] https://gitlab.com/shorewall/code/-/blob/4.6.13/Shorewall/action.Drop=
#L66
> https://gitlab.com/shorewall/code/-/blob/4.6.13/Shorewall/Macros/macr=
o.Auth
>=20
> Signed-off-by: Lorenz Stechauner <l.stechauner@proxmox.com>
> ---
> src/PVE/Firewall.pm | 2 --
> 1 file changed, 2 deletions(-)
>=20
> diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
> index fc5c077..edc5336 100644
> --- a/src/PVE/Firewall.pm
> +++ b/src/PVE/Firewall.pm
> @@ -592,7 +592,6 @@ $pve_std_chains_conf->{4} =3D {
> # same as shorewall 'Drop', which is equal to DROP,
> # but REJECT/DROP some packages to reduce logging,
> # and ACCEPT critical ICMP types
> - { action =3D> 'PVEFW-reject', proto =3D> 'tcp', dport =3D> '43' }, # R=
EJECT 'auth'
> # we are not interested in BROADCAST/MULTICAST/ANYCAST
> { action =3D> 'PVEFW-DropBroadcast' },
> # ACCEPT critical ICMP types
> @@ -615,7 +614,6 @@ $pve_std_chains_conf->{4} =3D {
> # same as shorewall 'Reject', which is equal to Reject,
> # but REJECT/DROP some packages to reduce logging,
> # and ACCEPT critical ICMP types
> - { action =3D> 'PVEFW-reject', proto =3D> 'tcp', dport =3D> '43' }, # R=
EJECT 'auth'
> # we are not interested in BROADCAST/MULTICAST/ANYCAST
> { action =3D> 'PVEFW-DropBroadcast' },
> # ACCEPT critical ICMP types
> --=20
> 2.30.2
>=20
>=20
>=20
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>=20
>=20
>=20