From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 70ADB9A0A4 for ; Tue, 16 May 2023 11:09:34 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 5A7FC1BC7F for ; Tue, 16 May 2023 11:09:34 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Tue, 16 May 2023 11:09:33 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id A123644BDB for ; Tue, 16 May 2023 11:09:33 +0200 (CEST) From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= To: pve-devel@lists.proxmox.com Date: Tue, 16 May 2023 11:09:24 +0200 Message-Id: <20230516090924.1944193-2-f.gruenbichler@proxmox.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20230516090924.1944193-1-f.gruenbichler@proxmox.com> References: <20230516090924.1944193-1-f.gruenbichler@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.074 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pve-devel] [PATCH firewall 2/2] fix #4730: add safeguards to prevent ICMP type misuse X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2023 09:09:34 -0000 without this additional conditions, it's possible to break the firewall by setting an ICMP-type value as dport for non-ICMP protocols, e.g. 'any' for 'tcp'. by rejecting the invalid rule/parameter, the rest of the ruleset is still applied properly, and the error messages are a lot more informative as well. Signed-off-by: Fabian Grünbichler --- Notes: without this patch, it's possible to set such a rule over the GUI and the pve-firewall just logs: status update error: iptables_restore_cmdlist: Try `iptables-restore -h' or 'iptables-restore --help' for more information. and is no longer able to setup any rule (change). with this patch, any existing broken config will trigger the following: /etc/pve/nodes//host.fw (line 7) - errors in rule parameters: IN REJECT -source 10.0.1.0/24 -dest 10.0.1.2 -p tcp -dport any -log nolog dport: invalid port 'any' and creating such a broken rule in the first place is no longer possible over the API, and *only* adding this rule is skipped. src/PVE/Firewall.pm | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 5fa264a..8e40872 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -1100,6 +1100,9 @@ sub parse_address_list { return $ipversion; } +# $dport must only be set to 1 if the parsed parameter is dport and the +# protocol is one of the ICMP variants - ICMP type values used to be stored in +# the dport parameter. sub parse_port_name_number_or_range { my ($str, $dport) = @_; @@ -1749,7 +1752,7 @@ sub verify_rule { } if ($rule->{dport}) { - eval { parse_port_name_number_or_range($rule->{dport}, 1); }; + eval { parse_port_name_number_or_range($rule->{dport}, $is_icmp); }; &$add_error('dport', $@) if $@; my $proto = $rule->{proto}; &$add_error('proto', "missing property - 'dport' requires this property") @@ -2146,7 +2149,7 @@ sub ipt_rule_to_cmds { push @match, "-p $proto"; my $is_icmp = $proto_is_icmp->($proto); - my $multidport = defined($rule->{dport}) && parse_port_name_number_or_range($rule->{dport}, 1); + my $multidport = defined($rule->{dport}) && parse_port_name_number_or_range($rule->{dport}, $is_icmp); my $multisport = defined($rule->{sport}) && parse_port_name_number_or_range($rule->{sport}, 0); my $add_dport = sub { -- 2.30.2