From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <pve-devel-bounces@lists.proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9])
by lore.proxmox.com (Postfix) with ESMTPS id BEED61FF163
for <inbox@lore.proxmox.com>; Thu, 10 Oct 2024 17:59:30 +0200 (CEST)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id 4FB851E744;
Thu, 10 Oct 2024 17:57:32 +0200 (CEST)
From: Stefan Hanreich <s.hanreich@proxmox.com>
To: pve-devel@lists.proxmox.com
Date: Thu, 10 Oct 2024 17:56:33 +0200
Message-Id: <20241010155650.255698-1-s.hanreich@proxmox.com>
X-Mailer: git-send-email 2.39.5
MIME-Version: 1.0
X-SPAM-LEVEL: Spam detection results: 0
AWL -0.257 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
DMARC_MISSING 0.1 Missing DMARC policy
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery
methods
RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_NONE 0.001 SPF: sender does not publish an SPF Record
Subject: [pve-devel] [PATCH docs/firewall/manager/network/proxmox{-ve-rs,
-firewall} v2 00/17] add forward chain firewalling for hosts and
vnets
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
Reply-To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: pve-devel-bounces@lists.proxmox.com
Sender: "pve-devel" <pve-devel-bounces@lists.proxmox.com>
## Introduction
This patch series introduces a new direction for firewall rules: forward.
Additionally this patch series introduces defining firewall rules on a vnet
level.
## Use Cases
For hosts:
* hosts utilizing NAT can define firewall rules for NATed traffic
* hosts utilizing EVPN zones can define rules for exit node traffic
* hosts acting as gateway can firewall the traffic that passes through them
For vnets:
* can create firewall rules globally without having to attach/update security
groups to every newly created VM
This patch series is particularly useful when combined with my other current RFC
'autogenerate ipsets for sdn objects'. It enables users to quickly define rules
like:
on the host level:
* only SNAT HTTP traffic from hosts in this vnet to a specific host
* restricting traffic routed from hosts in one vnet to another vnet
on the vnet level:
* only allow DHCP/DNS traffic inside a bridge to the gateway
Not only does this streamline creating firewall rules, it also enables users to
create firewall rules that haven't been possible before and needed to rely on
external firewall appliances.
Since forwarded traffic goes *both* ways, you generally have to create two rules
in case of bi-directional traffic. It might make sense to simplify this in the
future by adding an additional option to the firewall config scheme that
specifies that rules in the other direction should also get automatically
generated.
## Usage
For creating forward rules on the cluster/host level, you simply create a new
rule with the new 'forward' direction. It uses the existing configuration files.
For creating them on a vnet level, there are new firewall configuration files
located under '/etc/pve/sdn/firewall/<vnet>.fw'. It utilizes the same
configuration format as the existing firewall configuration files. You can only
define rules with direction 'forward' on a vnet-level.
Changes from RFC to v2:
* Fixed several bugs
* SDN Firewall folder does not automatically created (thanks @Gabriel)
* Firewall flushes the bridge table if no guest firewall is active, even
though VNet-level rules exist
* VNet-level firewall now matches on both input and output interface
* Introduced log option for VNet firewall
* Improved style of perl code (thanks @Thomas)
* promox-firewall now verifies the directions of rules
* added some additional tests to verify this behavior
* added documentation
proxmox-ve-rs:
Stefan Hanreich (4):
firewall: add forward direction
firewall: add bridge firewall config parser
config: firewall: add tests for interface and directions
host: add struct representing bridge names
proxmox-ve-config/Cargo.toml | 1 +
proxmox-ve-config/src/firewall/bridge.rs | 64 +++++++++++++++++++
proxmox-ve-config/src/firewall/cluster.rs | 11 ++++
proxmox-ve-config/src/firewall/common.rs | 11 ++++
proxmox-ve-config/src/firewall/guest.rs | 66 ++++++++++++++++++++
proxmox-ve-config/src/firewall/host.rs | 12 +++-
proxmox-ve-config/src/firewall/mod.rs | 1 +
proxmox-ve-config/src/firewall/types/rule.rs | 10 ++-
proxmox-ve-config/src/host/mod.rs | 1 +
proxmox-ve-config/src/host/types.rs | 46 ++++++++++++++
10 files changed, 220 insertions(+), 3 deletions(-)
create mode 100644 proxmox-ve-config/src/firewall/bridge.rs
create mode 100644 proxmox-ve-config/src/host/types.rs
proxmox-firewall:
Stefan Hanreich (5):
nftables: derive additional traits for nftables types
sdn: add support for loading vnet-level firewall config
sdn: create forward firewall rules
use std::mem::take over drain()
cargo: make proxmox-ve-config a workspace dependency
Cargo.toml | 3 +
proxmox-firewall/Cargo.toml | 2 +-
.../resources/proxmox-firewall.nft | 54 ++++++++
proxmox-firewall/src/config.rs | 88 ++++++++++++-
proxmox-firewall/src/firewall.rs | 122 +++++++++++++++++-
proxmox-firewall/src/rule.rs | 7 +-
proxmox-firewall/tests/integration_tests.rs | 12 ++
.../integration_tests__firewall.snap | 86 ++++++++++++
proxmox-nftables/Cargo.toml | 2 +-
proxmox-nftables/src/expression.rs | 8 ++
proxmox-nftables/src/types.rs | 14 +-
11 files changed, 383 insertions(+), 15 deletions(-)
pve-firewall:
Stefan Hanreich (2):
sdn: add vnet firewall configuration
api: add vnet endpoints
src/PVE/API2/Firewall/Makefile | 1 +
src/PVE/API2/Firewall/Rules.pm | 84 +++++++++++++++++
src/PVE/API2/Firewall/Vnet.pm | 168 +++++++++++++++++++++++++++++++++
src/PVE/Firewall.pm | 132 ++++++++++++++++++++++++--
src/PVE/Firewall/Helpers.pm | 12 +++
5 files changed, 391 insertions(+), 6 deletions(-)
create mode 100644 src/PVE/API2/Firewall/Vnet.pm
pve-manager:
Stefan Hanreich (4):
firewall: add forward direction to rule panel
firewall: add vnet to firewall options component
firewall: make base_url dynamically configurable in options component
sdn: add firewall panel
www/manager6/Makefile | 2 +
www/manager6/dc/Config.js | 9 ++++
www/manager6/dc/SecurityGroups.js | 1 +
www/manager6/grid/FirewallOptions.js | 74 +++++++++++++++++++++-----
www/manager6/grid/FirewallRules.js | 32 ++++++++++--
www/manager6/lxc/Config.js | 1 +
www/manager6/node/Config.js | 1 +
www/manager6/qemu/Config.js | 1 +
www/manager6/sdn/FirewallPanel.js | 48 +++++++++++++++++
www/manager6/sdn/FirewallVnetView.js | 77 ++++++++++++++++++++++++++++
10 files changed, 228 insertions(+), 18 deletions(-)
create mode 100644 www/manager6/sdn/FirewallPanel.js
create mode 100644 www/manager6/sdn/FirewallVnetView.js
pve-network:
Stefan Hanreich (1):
firewall: add endpoints for vnet-level firewall
src/PVE/API2/Network/SDN/Vnets.pm | 6 ++++++
1 file changed, 6 insertions(+)
pve-docs:
Stefan Hanreich (1):
firewall: add documentation for forward direction
Makefile | 1 +
gen-pve-firewall-vnet-opts.pl | 12 ++++++++
pve-firewall-vnet-opts.adoc | 8 ++++++
pve-firewall.adoc | 53 ++++++++++++++++++++++++++++++++---
4 files changed, 70 insertions(+), 4 deletions(-)
create mode 100755 gen-pve-firewall-vnet-opts.pl
create mode 100644 pve-firewall-vnet-opts.adoc
Summary over all repositories:
41 files changed, 1298 insertions(+), 46 deletions(-)
--
Generated by git-murpp 0.6.0
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel