Remove redundant logging of packets passing the tap chain.

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 2108567f73e5d17f813e2dcc954df2cf7a172312..abcc1e858ebb34d87f262e90a45f40d971c4f987 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -23,7 +23,6 @@ use PVE::SafeSyslog;
 use PVE::Tools qw($IPV4RE $IPV6RE);
 use PVE::Tools qw(run_command lock_file dir_glob_foreach);
 
-my $hostfw_conf_filename = "/etc/pve/local/host.fw";
 my $pvefw_conf_dir = "/etc/pve/firewall";
 my $clusterfw_conf_filename = "$pvefw_conf_dir/cluster.fw";
 
@@ -127,6 +126,7 @@ eval  {
 };
 
 my $nodename = PVE::INotify::nodename();
+my $hostfw_conf_filename = "/etc/pve/nodes/$nodename/host.fw";
 
 my $pve_fw_lock_filename = "/var/lock/pvefw.lck";
 
@@ -666,14 +666,10 @@ $pve_std_chains_conf->{6} = {
        #{ action => 'DROP', dest => '224.0.0.0/4' },
     ],
     'PVEFW-reject' => [
-       # same as shorewall 'reject'
-       #{ action => 'DROP', dsttype => 'BROADCAST' },
-       #{ action => 'DROP', source => '224.0.0.0/4' },
        { action => 'DROP', proto => 'icmpv6' },
        { match => '-p tcp', target => '-j REJECT --reject-with tcp-reset' },
-       #"-p udp -j REJECT --reject-with icmp-port-unreachable",
-       #"-p icmp -j REJECT --reject-with icmp-host-unreachable",
-       #"-j REJECT --reject-with icmp-host-prohibited",
+       { match => '-p udp', target => '-j REJECT --reject-with icmp6-port-unreachable' },
+       { target => '-j REJECT --reject-with icmp6-adm-prohibited' },
     ],
     'PVEFW-Drop' => [
        # same as shorewall 'Drop', which is equal to DROP,
@@ -2391,10 +2387,10 @@ sub generate_tap_rules_direction {
     # plug the tap chain to bridge chain
     if ($direction eq 'IN') {
        ruleset_addrule($ruleset, "PVEFW-FWBR-IN",
-                       "-m physdev --physdev-is-bridged --physdev-out $iface", "-j $tapchain", $loglevel, 'FWBR-IN: ', $vmid);
+                       "-m physdev --physdev-is-bridged --physdev-out $iface", "-j $tapchain");
     } else {
        ruleset_addrule($ruleset, "PVEFW-FWBR-OUT",
-                       "-m physdev --physdev-is-bridged --physdev-in $iface", "-j $tapchain", $loglevel, 'FWBR-OUT: ', $vmid);
+                       "-m physdev --physdev-is-bridged --physdev-in $iface", "-j $tapchain");
     }
 }
 
@@ -3786,7 +3782,12 @@ sub compile_ebtables_filter {
                        push(@$arpfilter, $ip);
                    }
                }
-               push(@$arpfilter, $net->{ip}) if $net->{ip} && $vmfw_conf->{options}->{ipfilter};
+               if (my $ip = $net->{ip} && $vmfw_conf->{options}->{ipfilter}) {
+                   # ebtables changes this to a .0/MASK network but we just
+                   # want the address here, no network - see #2193
+                   $ip =~ s|/(\d+)$||;
+                   push @$arpfilter, $ip;
+               }
                generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter);
            }
        };