[pve-devel] [PATCH proxmox-firewall 1/3] cargo: bump dependencies of proxmox-ve-config

[pve-devel] [PATCH proxmox-firewall 1/3] cargo: bump dependencies of proxmox-ve-config

[Stefan Hanreich]

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 proxmox-ve-config/Cargo.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/proxmox-ve-config/Cargo.toml b/proxmox-ve-config/Cargo.toml
index cc689c8..b0f3434 100644
--- a/proxmox-ve-config/Cargo.toml
+++ b/proxmox-ve-config/Cargo.toml
@@ -20,6 +20,6 @@ serde_json = "1"
 serde_plain = "1"
 serde_with = "2.3.3"
 
-proxmox-schema = "3.1.0"
-proxmox-sys = "0.5.3"
+proxmox-schema = "3.1.1"
+proxmox-sys = "0.5.8"
 proxmox-sortable-macro = "0.1.3"
-- 
2.39.2


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH proxmox-firewall 2/3] conntrack: arp: move handling to guest chains

[Stefan Hanreich]

In order to make sure we are only affecting VM traffic and no host
interfaces that are bridged, move the rules into a chain that gets
executed inside the guest chain, rather than setting the rules
globally.

Since ether type matches on the respective Ethernet header, it
doesn't work for packets with VLAN header. Matching via meta protocol
ensures that VLAN encapsulated ARP packets are matched as well.
Otherwise ARP traffic inside VLANs gets dropped, due to them having
conntrack state invalid.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 .../resources/proxmox-firewall.nft            | 16 ++++-
 proxmox-firewall/src/firewall.rs              | 11 +++-
 .../integration_tests__firewall.snap          | 64 +++++++++++++++++++
 3 files changed, 87 insertions(+), 4 deletions(-)

diff --git a/proxmox-firewall/resources/proxmox-firewall.nft b/proxmox-firewall/resources/proxmox-firewall.nft
index 537ba88..968fb93 100644
--- a/proxmox-firewall/resources/proxmox-firewall.nft
+++ b/proxmox-firewall/resources/proxmox-firewall.nft
@@ -33,7 +33,9 @@ add chain bridge proxmox-firewall-guests block-ndp-out
 add chain bridge proxmox-firewall-guests allow-ra-out
 add chain bridge proxmox-firewall-guests block-ra-out
 add chain bridge proxmox-firewall-guests do-reject
+add chain bridge proxmox-firewall-guests pre-vm-out
 add chain bridge proxmox-firewall-guests vm-out {type filter hook prerouting priority 0; policy accept;}
+add chain bridge proxmox-firewall-guests pre-vm-in
 add chain bridge proxmox-firewall-guests vm-in {type filter hook postrouting priority 0; policy accept;}
 
 flush chain inet proxmox-firewall do-reject
@@ -64,7 +66,9 @@ flush chain bridge proxmox-firewall-guests block-ndp-out
 flush chain bridge proxmox-firewall-guests allow-ra-out
 flush chain bridge proxmox-firewall-guests block-ra-out
 flush chain bridge proxmox-firewall-guests do-reject
+flush chain bridge proxmox-firewall-guests pre-vm-out
 flush chain bridge proxmox-firewall-guests vm-out
+flush chain bridge proxmox-firewall-guests pre-vm-in
 flush chain bridge proxmox-firewall-guests vm-in
 
 table inet proxmox-firewall {
@@ -295,16 +299,22 @@ table bridge proxmox-firewall-guests {
         drop
     }
 
+    chain pre-vm-out {
+        meta protocol != arp ct state vmap { established : accept, related : accept, invalid : drop }
+    }
+
     chain vm-out {
         type filter hook prerouting priority 0; policy accept;
-        ether type != arp ct state vmap { established : accept, related : accept, invalid : drop }
         iifname vmap @vm-map-out
     }
 
+    chain pre-vm-in {
+        meta protocol != arp ct state vmap { established : accept, related : accept, invalid : drop }
+        meta protocol arp accept
+    }
+
     chain vm-in {
         type filter hook postrouting priority 0; policy accept;
-        ether type != arp ct state vmap { established : accept, related : accept, invalid : drop }
-        ether type arp accept
         oifname vmap @vm-map-in
     }
 }
diff --git a/proxmox-firewall/src/firewall.rs b/proxmox-firewall/src/firewall.rs
index 4c85ea2..4ea81df 100644
--- a/proxmox-firewall/src/firewall.rs
+++ b/proxmox-firewall/src/firewall.rs
@@ -758,7 +758,16 @@ impl Firewall {
 
         let chain = Self::guest_chain(direction, vmid);
 
-        commands.append(&mut vec![Add::chain(chain.clone()), Flush::chain(chain)]);
+        let pre_chain = match direction {
+            Direction::In => "pre-vm-in",
+            Direction::Out => "pre-vm-out",
+        };
+
+        commands.append(&mut vec![
+            Add::chain(chain.clone()),
+            Flush::chain(chain.clone()),
+            Add::rule(AddRule::from_statement(chain, Statement::jump(pre_chain))),
+        ]);
 
         Ok(())
     }
diff --git a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
index 669bad9..e1953e0 100644
--- a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
+++ b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
@@ -2543,6 +2543,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
         }
       }
     },
+    {
+      "add": {
+        "rule": {
+          "family": "bridge",
+          "table": "proxmox-firewall-guests",
+          "chain": "guest-100-in",
+          "expr": [
+            {
+              "jump": {
+                "target": "pre-vm-in"
+              }
+            }
+          ]
+        }
+      }
+    },
     {
       "add": {
         "chain": {
@@ -2561,6 +2577,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
         }
       }
     },
+    {
+      "add": {
+        "rule": {
+          "family": "bridge",
+          "table": "proxmox-firewall-guests",
+          "chain": "guest-100-out",
+          "expr": [
+            {
+              "jump": {
+                "target": "pre-vm-out"
+              }
+            }
+          ]
+        }
+      }
+    },
     {
       "add": {
         "set": {
@@ -3362,6 +3394,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
         }
       }
     },
+    {
+      "add": {
+        "rule": {
+          "family": "bridge",
+          "table": "proxmox-firewall-guests",
+          "chain": "guest-101-in",
+          "expr": [
+            {
+              "jump": {
+                "target": "pre-vm-in"
+              }
+            }
+          ]
+        }
+      }
+    },
     {
       "add": {
         "chain": {
@@ -3380,6 +3428,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
         }
       }
     },
+    {
+      "add": {
+        "rule": {
+          "family": "bridge",
+          "table": "proxmox-firewall-guests",
+          "chain": "guest-101-out",
+          "expr": [
+            {
+              "jump": {
+                "target": "pre-vm-out"
+              }
+            }
+          ]
+        }
+      }
+    },
     {
       "add": {
         "set": {
-- 
2.39.2


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH proxmox-firewall 3/3] guest: match arp packets via meta

[Stefan Hanreich]

When matching via ether type, VLAN packets are not matched. This can
cause ARP packets encapsulated in VLAN frames to be dropped.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 proxmox-firewall/src/firewall.rs                       |  2 +-
 .../tests/snapshots/integration_tests__firewall.snap   | 10 ++++------
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/proxmox-firewall/src/firewall.rs b/proxmox-firewall/src/firewall.rs
index 4ea81df..941aa20 100644
--- a/proxmox-firewall/src/firewall.rs
+++ b/proxmox-firewall/src/firewall.rs
@@ -538,7 +538,7 @@ impl Firewall {
 
         // we allow outgoing ARP, except if blocked by the MAC filter above
         let arp_rule = vec![
-            Match::new_eq(Payload::field("ether", "type"), Expression::from("arp")).into(),
+            Match::new_eq(Meta::new("protocol"), Expression::from("arp")).into(),
             Statement::make_accept(),
         ];
 
diff --git a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
index e1953e0..40d4405 100644
--- a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
+++ b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
@@ -2961,9 +2961,8 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
               "match": {
                 "op": "==",
                 "left": {
-                  "payload": {
-                    "protocol": "ether",
-                    "field": "type"
+                  "meta": {
+                    "key": "protocol"
                   }
                 },
                 "right": "arp"
@@ -3623,9 +3622,8 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
               "match": {
                 "op": "==",
                 "left": {
-                  "payload": {
-                    "protocol": "ether",
-                    "field": "type"
+                  "meta": {
+                    "key": "protocol"
                   }
                 },
                 "right": "arp"
-- 
2.39.2


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] applied: [PATCH proxmox-firewall 1/3] cargo: bump dependencies of proxmox-ve-config

[Thomas Lamprecht]

Am 03/07/2024 um 11:17 schrieb Stefan Hanreich:
> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
>  proxmox-ve-config/Cargo.toml | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
>

applied series with some merge conflict in the context addressed for the
second patch and updated the dependencies to the newer versions that got
released since you sent this patch, plus also bumped proxmox-sys for the
proxmox-firewall sub-crate.

thanks!


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel