From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 135FE1FF16F for ; Fri, 15 Nov 2024 16:30:21 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 3773518B54; Fri, 15 Nov 2024 16:30:24 +0100 (CET) From: Hannes Laimer To: pve-devel@lists.proxmox.com Date: Fri, 15 Nov 2024 16:30:16 +0100 Message-Id: <20241115153016.118024-1-h.laimer@proxmox.com> X-Mailer: git-send-email 2.39.5 MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.022 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [proxmox.com, firewall.rs] Subject: [pve-devel] [PATCH proxmox-firewall] firewall: apply `nt_conntrack_allow_invalid` option to guest table X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" So it behaves the same way the 'old' firewall did. Since currently ct state invalid are always dropped on the guest table, regardless of the option. The host behaviour is not changed as it would require `forward` to match the 'old' behaviour. Signed-off-by: Hannes Laimer --- based on what @Stefan suggested in response to [1]. This matches what the old fw did with this option on vms. [1] https://lore.proxmox.com/pve-devel/918ffc4c-c371-4d43-8c2c-849e618273b6@proxmox.com/T/#t .../resources/proxmox-firewall.nft | 4 +++- proxmox-firewall/src/firewall.rs | 10 ++++++++ .../integration_tests__firewall.snap | 23 +++++++++++++++++++ 3 files changed, 36 insertions(+), 1 deletion(-) diff --git a/proxmox-firewall/resources/proxmox-firewall.nft b/proxmox-firewall/resources/proxmox-firewall.nft index f42255c..f823a60 100644 --- a/proxmox-firewall/resources/proxmox-firewall.nft +++ b/proxmox-firewall/resources/proxmox-firewall.nft @@ -325,8 +325,10 @@ table bridge proxmox-firewall-guests { iifname vmap @vm-map-out } + chain invalid-conntrack { } + chain pre-vm-in { - meta protocol != arp ct state vmap { established : accept, related : accept, invalid : drop } + meta protocol != arp ct state vmap { established : accept, related : accept, invalid : jump invalid-conntrack } meta protocol arp accept } diff --git a/proxmox-firewall/src/firewall.rs b/proxmox-firewall/src/firewall.rs index 941aa20..4ced6a8 100644 --- a/proxmox-firewall/src/firewall.rs +++ b/proxmox-firewall/src/firewall.rs @@ -92,6 +92,10 @@ impl Firewall { ChainPart::new(table, format!("group-{name}-{dir}")) } + fn guest_invalid_conntrack_chain() -> ChainPart { + ChainPart::new(Self::guest_table(), format!("invalid-conntrack")) + } + fn host_conntrack_chain() -> ChainPart { ChainPart::new(Self::host_table(), "ct-in".to_string()) } @@ -126,6 +130,7 @@ impl Firewall { Add::chain(Self::host_chain(Direction::Out)), Flush::chain(Self::host_chain(Direction::Out)), Flush::chain(Self::host_option_chain(Direction::Out)), + Flush::chain(Self::guest_invalid_conntrack_chain()), Flush::map(Self::guest_vmap(Direction::In)), Flush::map(Self::guest_vmap(Direction::Out)), Flush::chain(Self::host_conntrack_chain()), @@ -398,6 +403,11 @@ impl Firewall { chain_in, Statement::jump("block-conntrack-invalid"), ))); + + commands.push(Add::rule(AddRule::from_statement( + Self::guest_invalid_conntrack_chain(), + Statement::make_drop(), + ))); } if let Some(value) = self.config.host().nf_conntrack_max() { diff --git a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap index 40d4405..155b999 100644 --- a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap +++ b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap @@ -76,6 +76,15 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")" } } }, + { + "flush": { + "chain": { + "family": "bridge", + "table": "proxmox-firewall-guests", + "name": "invalid-conntrack" + } + } + }, { "flush": { "map": { @@ -1927,6 +1936,20 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")" } } }, + { + "add": { + "rule": { + "family": "bridge", + "table": "proxmox-firewall-guests", + "chain": "invalid-conntrack", + "expr": [ + { + "drop": null + } + ] + } + } + }, { "add": { "rule": { -- 2.39.5 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel