use IO::File;
use Net::IP;
use PVE::Tools qw(run_command lock_file);
+use Encode;
# dynamically include PVE::QemuServer and PVE::OpenVZ
# to avoid dependency problems
}
if (!(defined($options->{dhcp}) && $options->{dhcp} == 0)) {
- ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 67:68 -j ACCEPT");
+ if ($direction eq 'OUT') {
+ ruleset_addrule($ruleset, $chain, "-p udp -m udp --sport 68 --dport 67 -j PVEFW-SET-ACCEPT-MARK");
+ } else {
+ ruleset_addrule($ruleset, $chain, "-p udp -m udp --sport 67 --dport 68 -j ACCEPT");
+ }
}
if ($options->{tcpflags}) {
my $loglevel = get_option_log_level($options, "log_level_in");
+ if (!(defined($options->{nosmurfs}) && $options->{nosmurfs} == 0)) {
+ ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs");
+ }
+
+ if ($options->{tcpflags}) {
+ ruleset_addrule($ruleset, $chain, "-p tcp -j PVEFW-tcpflags");
+ }
+
ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID -j DROP");
ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT");
ruleset_addrule($ruleset, $chain, "-i lo -j ACCEPT");
sub generate_group_rules {
my ($ruleset, $groups_conf, $group) = @_;
-
- die "no such security group '$group'\n" if !$groups_conf->{$group};
+ die "no such security group '$group'\n" if !$groups_conf->{rules}->{$group};
my $rules = $groups_conf->{rules}->{$group};
my ($type, $action, $iface, $source, $dest, $proto, $dport, $sport);
# we can add single line comments to the end of the rule
- my $comment = $1 if $line =~ s/#\s*(.*?)\s*$//;
+ my $comment = decode('utf8', $1) if $line =~ s/#\s*(.*?)\s*$//;
# we can disable a rule when prefixed with '|'
my $disable = 1 if $line =~ s/^\|//;