From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 7E44C1FF165 for ; Thu, 25 Sep 2025 16:30:51 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id E5FA223E4F; Thu, 25 Sep 2025 16:31:22 +0200 (CEST) From: Stefan Hanreich To: pve-devel@lists.proxmox.com Date: Thu, 25 Sep 2025 16:31:18 +0200 Message-ID: <20250925143119.330179-1-s.hanreich@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.183 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Subject: [pve-devel] [PATCH proxmox-firewall 1/1] firewall: merge management ipset with local_network X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" To override the local_network, which is used in the management ipset, pve-firewall used a specific alias on datacenter-level 'local_network'. If an ipset called 'management' exists on the datacenter-level then those entries would additionally get added to the management ipset. proxmox-firewall had a different behavior where the alias was ignored and the management ipset was completely overridden if a custom ipset was defined in the datacenter-level configuration. This could potentially lead to users locking themselves out of their PVE instance if they create a new ipset called 'management' and the firewall daemon recreated the ruleset while there still weren't any entries in the ipset. This commit make proxmox-firewall behave like pve-firewall with regards to management ipset creation. Signed-off-by: Stefan Hanreich --- Luckily no reports of this have popped up yet, but found this while working on the proxmox-firewall in general. proxmox-firewall/src/firewall.rs | 49 ++++++++++++------- proxmox-firewall/tests/input/cluster.fw | 1 + .../integration_tests__firewall.snap | 12 +++++ 3 files changed, 45 insertions(+), 17 deletions(-) diff --git a/proxmox-firewall/src/firewall.rs b/proxmox-firewall/src/firewall.rs index 30bc642..690520d 100644 --- a/proxmox-firewall/src/firewall.rs +++ b/proxmox-firewall/src/firewall.rs @@ -190,28 +190,41 @@ impl Firewall { ] } - fn create_management_ipset(&self, commands: &mut Commands) -> Result<(), Error> { - if self.config.cluster().ipsets().get("management").is_none() { - log::trace!("auto-generating management ipset"); - - let management_ips = HostConfig::management_ips()?; + fn create_management_ipset( + &self, + commands: &mut Commands, + table: &TablePart, + ) -> Result<(), Error> { + let mut management_ipset = Ipset::new(IpsetName::new(IpsetScope::Datacenter, "management")); - let mut ipset = Ipset::new(IpsetName::new(IpsetScope::Datacenter, "management")); - ipset.reserve(management_ips.len()); + if let Some(config_ipset) = self.config.cluster().ipsets().get("management") { + log::trace!("adding custom entries from management ipset"); - let entries = management_ips.into_iter().map(IpsetEntry::from); + for entry in config_ipset.iter() { + management_ipset.push(entry.clone()); + } + } - ipset.extend(entries); + if let Some(local_network_alias) = self.config.cluster().alias("local_network") { + log::trace!("using local_network alias for determining management ips"); - let env = NftObjectEnv { - table: &Self::cluster_table(), - firewall_config: &self.config, - vmid: None, - }; + management_ipset.push(IpsetEntry::from(*local_network_alias.address())); + } else { + log::trace!("using network configuration for determining management ips"); - commands.append(&mut ipset.to_nft_objects(&env)?); + for management_ip in HostConfig::management_ips()? { + management_ipset.push(IpsetEntry::from(management_ip)); + } } + let env = NftObjectEnv { + table, + firewall_config: &self.config, + vmid: None, + }; + + commands.append(&mut management_ipset.to_nft_objects(&env)?); + Ok(()) } @@ -248,7 +261,7 @@ impl Firewall { if self.config.host().is_enabled() { log::info!("creating cluster / host configuration"); - self.create_management_ipset(&mut commands)?; + self.create_management_ipset(&mut commands, &cluster_host_table)?; self.create_ipsets( &mut commands, @@ -315,6 +328,8 @@ impl Firewall { if !(enabled_guests.is_empty() && enabled_bridges.is_empty()) { log::info!("creating guest configuration"); + self.create_management_ipset(&mut commands, &guest_table)?; + self.create_ipsets( &mut commands, self.config.cluster().ipsets(), @@ -776,7 +791,7 @@ impl Firewall { }; for (name, ipset) in ipsets { - if ipset.ipfilter().is_some() { + if ipset.ipfilter().is_some() || ipset.name().name() == "management" { continue; } diff --git a/proxmox-firewall/tests/input/cluster.fw b/proxmox-firewall/tests/input/cluster.fw index 376d2f1..4f50cc1 100644 --- a/proxmox-firewall/tests/input/cluster.fw +++ b/proxmox-firewall/tests/input/cluster.fw @@ -7,6 +7,7 @@ enable: 1 network1 172.16.100.0/24 network2 172.16.200.0/24 +local_network 198.51.100.100/32 [IPSET network1] diff --git a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap index 1a19ea7..127d634 100644 --- a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap +++ b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap @@ -1600,6 +1600,12 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")" "addr": "127.0.0.1", "len": 8 } + }, + { + "prefix": { + "addr": "198.51.100.100", + "len": 32 + } } ] } @@ -3907,6 +3913,12 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")" "addr": "127.0.0.1", "len": 8 } + }, + { + "prefix": { + "addr": "198.51.100.100", + "len": 32 + } } ] } -- 2.47.3 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel