ipfilter: include configured container IPs by default

diff --git a/src/PVE/API2/Firewall/VM.pm b/src/PVE/API2/Firewall/VM.pm
index 192737a4c06c027a2f14b8bc7c4df537115eb36a..4fdf3da9a19d9172ee82c05163e2e6fbbe41a3a1 100644 (file)
--- a/src/PVE/API2/Firewall/VM.pm
+++ b/src/PVE/API2/Firewall/VM.pm
@@ -43,7 +43,8 @@ my $option_properties = {
           "This is equivalent to adding an empty ipfilter-net<id> ipset " .
           "for every interface. Such ipsets implicitly contain sane default " .
           "restrictions such as restricting IPv6 link local addresses to " .
-          "the one derived from the interface's MAC address.",
+          "the one derived from the interface's MAC address. For containers " .
+          "the configured IP addresses will be implicitly added.",
        type => 'boolean',
        optional => 1,
     },

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 73ae6f7011c8f66bab4619c34d7b1fb752f9a191..7dbe13de472b81de6944ca0db5e23980c23ac623 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -3357,7 +3357,8 @@ sub compile_ipsets {
            # is no 'ipfilter-netX' ipset defiend gets an implicit empty default
            # ipset.
            # The reason is that ipfilter ipsets are always filled with standard
-           # IPv6 link-local filters.
+           # IPv6 link-local filters, as well as the IP addresses configured
+           # for the container.
            my $ipsets = $vmfw_conf->{ipset};
            my $implicit_sets = {};
 
@@ -3373,10 +3374,16 @@ sub compile_ipsets {
 
                my $macaddr = $net->{hwaddr};
                my $linklocal = mac_to_linklocal($macaddr);
-               $device_ips->{$netid} = [
+               my $set = $device_ips->{$netid} = [
                    { cidr => $linklocal },
                    { cidr => 'fe80::/10', nomatch => 1 }
                ];
+               if ($net->{ip} =~ m!^($IPV4RE)(?:/\d+)?$!) {
+                   push @$set, { cidr => $1 };
+               }
+               if ($net->{ip6} =~ m!^($IPV6RE)(?:/\d+)?$!) {
+                   push @$set, { cidr => $1 };
+               }
            }
 
            generate_ipset_chains($ipset_ruleset, $cluster_conf, $vmfw_conf, $device_ips, $ipsets);