implement nosmurfs option for hiost firewall

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 2d834b7c88b965070b05f766ce2e3c2bbbf425c8..6d715c20f6348fd7fe745b1cff1f27824e34b0a8 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1125,6 +1125,14 @@ sub enable_host_firewall {
 
     my $loglevel = get_option_log_level($options, "log_level_in");
 
+    if (!(defined($options->{nosmurfs}) && $options->{nosmurfs} == 0)) {
+       ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs");
+    }
+
+    if ($options->{tcpflags}) {
+       ruleset_addrule($ruleset, $chain, "-p tcp -j PVEFW-tcpflags");
+    }
+
     ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID -j DROP");
     ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT");
     ruleset_addrule($ruleset, $chain, "-i lo -j ACCEPT");
@@ -1175,8 +1183,7 @@ sub enable_host_firewall {
 
 sub generate_group_rules {
     my ($ruleset, $groups_conf, $group) = @_;
-
-    die "no such security group '$group'\n" if !$groups_conf->{$group};
+    die "no such security group '$group'\n" if !$groups_conf->{rules}->{$group};
 
     my $rules = $groups_conf->{rules}->{$group};