From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id A68DE1FF2AD for ; Wed, 3 Jul 2024 11:17:03 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id F419F49F1; Wed, 3 Jul 2024 11:17:18 +0200 (CEST) From: Stefan Hanreich To: pve-devel@lists.proxmox.com Date: Wed, 3 Jul 2024 11:17:11 +0200 Message-Id: <20240703091712.99197-2-s.hanreich@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240703091712.99197-1-s.hanreich@proxmox.com> References: <20240703091712.99197-1-s.hanreich@proxmox.com> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.254 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [firewall.rs] Subject: [pve-devel] [PATCH proxmox-firewall 2/3] conntrack: arp: move handling to guest chains X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" In order to make sure we are only affecting VM traffic and no host interfaces that are bridged, move the rules into a chain that gets executed inside the guest chain, rather than setting the rules globally. Since ether type matches on the respective Ethernet header, it doesn't work for packets with VLAN header. Matching via meta protocol ensures that VLAN encapsulated ARP packets are matched as well. Otherwise ARP traffic inside VLANs gets dropped, due to them having conntrack state invalid. Signed-off-by: Stefan Hanreich --- .../resources/proxmox-firewall.nft | 16 ++++- proxmox-firewall/src/firewall.rs | 11 +++- .../integration_tests__firewall.snap | 64 +++++++++++++++++++ 3 files changed, 87 insertions(+), 4 deletions(-) diff --git a/proxmox-firewall/resources/proxmox-firewall.nft b/proxmox-firewall/resources/proxmox-firewall.nft index 537ba88..968fb93 100644 --- a/proxmox-firewall/resources/proxmox-firewall.nft +++ b/proxmox-firewall/resources/proxmox-firewall.nft @@ -33,7 +33,9 @@ add chain bridge proxmox-firewall-guests block-ndp-out add chain bridge proxmox-firewall-guests allow-ra-out add chain bridge proxmox-firewall-guests block-ra-out add chain bridge proxmox-firewall-guests do-reject +add chain bridge proxmox-firewall-guests pre-vm-out add chain bridge proxmox-firewall-guests vm-out {type filter hook prerouting priority 0; policy accept;} +add chain bridge proxmox-firewall-guests pre-vm-in add chain bridge proxmox-firewall-guests vm-in {type filter hook postrouting priority 0; policy accept;} flush chain inet proxmox-firewall do-reject @@ -64,7 +66,9 @@ flush chain bridge proxmox-firewall-guests block-ndp-out flush chain bridge proxmox-firewall-guests allow-ra-out flush chain bridge proxmox-firewall-guests block-ra-out flush chain bridge proxmox-firewall-guests do-reject +flush chain bridge proxmox-firewall-guests pre-vm-out flush chain bridge proxmox-firewall-guests vm-out +flush chain bridge proxmox-firewall-guests pre-vm-in flush chain bridge proxmox-firewall-guests vm-in table inet proxmox-firewall { @@ -295,16 +299,22 @@ table bridge proxmox-firewall-guests { drop } + chain pre-vm-out { + meta protocol != arp ct state vmap { established : accept, related : accept, invalid : drop } + } + chain vm-out { type filter hook prerouting priority 0; policy accept; - ether type != arp ct state vmap { established : accept, related : accept, invalid : drop } iifname vmap @vm-map-out } + chain pre-vm-in { + meta protocol != arp ct state vmap { established : accept, related : accept, invalid : drop } + meta protocol arp accept + } + chain vm-in { type filter hook postrouting priority 0; policy accept; - ether type != arp ct state vmap { established : accept, related : accept, invalid : drop } - ether type arp accept oifname vmap @vm-map-in } } diff --git a/proxmox-firewall/src/firewall.rs b/proxmox-firewall/src/firewall.rs index 4c85ea2..4ea81df 100644 --- a/proxmox-firewall/src/firewall.rs +++ b/proxmox-firewall/src/firewall.rs @@ -758,7 +758,16 @@ impl Firewall { let chain = Self::guest_chain(direction, vmid); - commands.append(&mut vec![Add::chain(chain.clone()), Flush::chain(chain)]); + let pre_chain = match direction { + Direction::In => "pre-vm-in", + Direction::Out => "pre-vm-out", + }; + + commands.append(&mut vec![ + Add::chain(chain.clone()), + Flush::chain(chain.clone()), + Add::rule(AddRule::from_statement(chain, Statement::jump(pre_chain))), + ]); Ok(()) } diff --git a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap index 669bad9..e1953e0 100644 --- a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap +++ b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap @@ -2543,6 +2543,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")" } } }, + { + "add": { + "rule": { + "family": "bridge", + "table": "proxmox-firewall-guests", + "chain": "guest-100-in", + "expr": [ + { + "jump": { + "target": "pre-vm-in" + } + } + ] + } + } + }, { "add": { "chain": { @@ -2561,6 +2577,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")" } } }, + { + "add": { + "rule": { + "family": "bridge", + "table": "proxmox-firewall-guests", + "chain": "guest-100-out", + "expr": [ + { + "jump": { + "target": "pre-vm-out" + } + } + ] + } + } + }, { "add": { "set": { @@ -3362,6 +3394,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")" } } }, + { + "add": { + "rule": { + "family": "bridge", + "table": "proxmox-firewall-guests", + "chain": "guest-101-in", + "expr": [ + { + "jump": { + "target": "pre-vm-in" + } + } + ] + } + } + }, { "add": { "chain": { @@ -3380,6 +3428,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")" } } }, + { + "add": { + "rule": { + "family": "bridge", + "table": "proxmox-firewall-guests", + "chain": "guest-101-out", + "expr": [ + { + "jump": { + "target": "pre-vm-out" + } + } + ] + } + } + }, { "add": { "set": { -- 2.39.2 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel