From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <pve-devel-bounces@lists.proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
by lore.proxmox.com (Postfix) with ESMTPS id 135FE1FF16F
for <inbox@lore.proxmox.com>; Fri, 15 Nov 2024 16:30:21 +0100 (CET)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id 3773518B54;
Fri, 15 Nov 2024 16:30:24 +0100 (CET)
From: Hannes Laimer <h.laimer@proxmox.com>
To: pve-devel@lists.proxmox.com
Date: Fri, 15 Nov 2024 16:30:16 +0100
Message-Id: <20241115153016.118024-1-h.laimer@proxmox.com>
X-Mailer: git-send-email 2.39.5
MIME-Version: 1.0
X-SPAM-LEVEL: Spam detection results: 0
AWL 0.022 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
DMARC_MISSING 0.1 Missing DMARC policy
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more
information. [proxmox.com, firewall.rs]
Subject: [pve-devel] [PATCH proxmox-firewall] firewall: apply
`nt_conntrack_allow_invalid` option to guest table
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
Reply-To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: pve-devel-bounces@lists.proxmox.com
Sender: "pve-devel" <pve-devel-bounces@lists.proxmox.com>
So it behaves the same way the 'old' firewall did. Since currently
ct state invalid are always dropped on the guest table, regardless
of the option. The host behaviour is not changed as it would
require `forward` to match the 'old' behaviour.
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
based on what @Stefan suggested in response to [1]. This matches what the
old fw did with this option on vms.
[1] https://lore.proxmox.com/pve-devel/918ffc4c-c371-4d43-8c2c-849e618273b6@proxmox.com/T/#t
.../resources/proxmox-firewall.nft | 4 +++-
proxmox-firewall/src/firewall.rs | 10 ++++++++
.../integration_tests__firewall.snap | 23 +++++++++++++++++++
3 files changed, 36 insertions(+), 1 deletion(-)
diff --git a/proxmox-firewall/resources/proxmox-firewall.nft b/proxmox-firewall/resources/proxmox-firewall.nft
index f42255c..f823a60 100644
--- a/proxmox-firewall/resources/proxmox-firewall.nft
+++ b/proxmox-firewall/resources/proxmox-firewall.nft
@@ -325,8 +325,10 @@ table bridge proxmox-firewall-guests {
iifname vmap @vm-map-out
}
+ chain invalid-conntrack { }
+
chain pre-vm-in {
- meta protocol != arp ct state vmap { established : accept, related : accept, invalid : drop }
+ meta protocol != arp ct state vmap { established : accept, related : accept, invalid : jump invalid-conntrack }
meta protocol arp accept
}
diff --git a/proxmox-firewall/src/firewall.rs b/proxmox-firewall/src/firewall.rs
index 941aa20..4ced6a8 100644
--- a/proxmox-firewall/src/firewall.rs
+++ b/proxmox-firewall/src/firewall.rs
@@ -92,6 +92,10 @@ impl Firewall {
ChainPart::new(table, format!("group-{name}-{dir}"))
}
+ fn guest_invalid_conntrack_chain() -> ChainPart {
+ ChainPart::new(Self::guest_table(), format!("invalid-conntrack"))
+ }
+
fn host_conntrack_chain() -> ChainPart {
ChainPart::new(Self::host_table(), "ct-in".to_string())
}
@@ -126,6 +130,7 @@ impl Firewall {
Add::chain(Self::host_chain(Direction::Out)),
Flush::chain(Self::host_chain(Direction::Out)),
Flush::chain(Self::host_option_chain(Direction::Out)),
+ Flush::chain(Self::guest_invalid_conntrack_chain()),
Flush::map(Self::guest_vmap(Direction::In)),
Flush::map(Self::guest_vmap(Direction::Out)),
Flush::chain(Self::host_conntrack_chain()),
@@ -398,6 +403,11 @@ impl Firewall {
chain_in,
Statement::jump("block-conntrack-invalid"),
)));
+
+ commands.push(Add::rule(AddRule::from_statement(
+ Self::guest_invalid_conntrack_chain(),
+ Statement::make_drop(),
+ )));
}
if let Some(value) = self.config.host().nf_conntrack_max() {
diff --git a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
index 40d4405..155b999 100644
--- a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
+++ b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
@@ -76,6 +76,15 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
}
}
},
+ {
+ "flush": {
+ "chain": {
+ "family": "bridge",
+ "table": "proxmox-firewall-guests",
+ "name": "invalid-conntrack"
+ }
+ }
+ },
{
"flush": {
"map": {
@@ -1927,6 +1936,20 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
}
}
},
+ {
+ "add": {
+ "rule": {
+ "family": "bridge",
+ "table": "proxmox-firewall-guests",
+ "chain": "invalid-conntrack",
+ "expr": [
+ {
+ "drop": null
+ }
+ ]
+ }
+ }
+ },
{
"add": {
"rule": {
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel