[pve-devel] [PATCH proxmox-firewall] firewall: apply `nt_conntrack_allow_invalid` option to guest table

[Hannes Laimer <h.laimer@proxmox.com>]

So it behaves the same way the 'old' firewall did. Since currently
ct state invalid are always dropped on the guest table, regardless
of the option. The host behaviour is not changed as it would
require `forward` to match the 'old' behaviour.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
based on what @Stefan suggested in response to [1]. This matches what the
old fw did with this option on vms.

[1] https://lore.proxmox.com/pve-devel/918ffc4c-c371-4d43-8c2c-849e618273b6@proxmox.com/T/#t

 .../resources/proxmox-firewall.nft            |  4 +++-
 proxmox-firewall/src/firewall.rs              | 10 ++++++++
 .../integration_tests__firewall.snap          | 23 +++++++++++++++++++
 3 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/proxmox-firewall/resources/proxmox-firewall.nft b/proxmox-firewall/resources/proxmox-firewall.nft
index f42255c..f823a60 100644
--- a/proxmox-firewall/resources/proxmox-firewall.nft
+++ b/proxmox-firewall/resources/proxmox-firewall.nft
@@ -325,8 +325,10 @@ table bridge proxmox-firewall-guests {
         iifname vmap @vm-map-out
     }
 
+    chain invalid-conntrack { }
+
     chain pre-vm-in {
-        meta protocol != arp ct state vmap { established : accept, related : accept, invalid : drop }
+        meta protocol != arp ct state vmap { established : accept, related : accept, invalid : jump invalid-conntrack }
         meta protocol arp accept
     }
 
diff --git a/proxmox-firewall/src/firewall.rs b/proxmox-firewall/src/firewall.rs
index 941aa20..4ced6a8 100644
--- a/proxmox-firewall/src/firewall.rs
+++ b/proxmox-firewall/src/firewall.rs
@@ -92,6 +92,10 @@ impl Firewall {
         ChainPart::new(table, format!("group-{name}-{dir}"))
     }
 
+    fn guest_invalid_conntrack_chain() -> ChainPart {
+        ChainPart::new(Self::guest_table(), format!("invalid-conntrack"))
+    }
+
     fn host_conntrack_chain() -> ChainPart {
         ChainPart::new(Self::host_table(), "ct-in".to_string())
     }
@@ -126,6 +130,7 @@ impl Firewall {
             Add::chain(Self::host_chain(Direction::Out)),
             Flush::chain(Self::host_chain(Direction::Out)),
             Flush::chain(Self::host_option_chain(Direction::Out)),
+            Flush::chain(Self::guest_invalid_conntrack_chain()),
             Flush::map(Self::guest_vmap(Direction::In)),
             Flush::map(Self::guest_vmap(Direction::Out)),
             Flush::chain(Self::host_conntrack_chain()),
@@ -398,6 +403,11 @@ impl Firewall {
                 chain_in,
                 Statement::jump("block-conntrack-invalid"),
             )));
+
+            commands.push(Add::rule(AddRule::from_statement(
+                Self::guest_invalid_conntrack_chain(),
+                Statement::make_drop(),
+            )));
         }
 
         if let Some(value) = self.config.host().nf_conntrack_max() {
diff --git a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
index 40d4405..155b999 100644
--- a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
+++ b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
@@ -76,6 +76,15 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
         }
       }
     },
+    {
+      "flush": {
+        "chain": {
+          "family": "bridge",
+          "table": "proxmox-firewall-guests",
+          "name": "invalid-conntrack"
+        }
+      }
+    },
     {
       "flush": {
         "map": {
@@ -1927,6 +1936,20 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
         }
       }
     },
+    {
+      "add": {
+        "rule": {
+          "family": "bridge",
+          "table": "proxmox-firewall-guests",
+          "chain": "invalid-conntrack",
+          "expr": [
+            {
+              "drop": null
+            }
+          ]
+        }
+      }
+    },
     {
       "add": {
         "rule": {
-- 
2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel