fix #4204: automatically update usages of group when it is renamed

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 92ea33d6ca8e6ffd84dbba7adbba7227a0496a17..e6d68020a1e94528a841fc043a855122c818bc30 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -494,6 +494,10 @@ my $pve_fw_macros = {
        { action => 'PARAM', proto => '41' },
        { action => 'PARAM', proto => 'udp', dport => '5072,8374' },
     ],
+    'SPICEproxy' => [
+       "Proxmox VE SPICE display proxy traffic",
+       { action => 'PARAM', proto => 'tcp', dport => '3128' },
+    ],
     'Squid' => [
        "Squid web proxy traffic",
        { action => 'PARAM', proto => 'tcp', dport => '3128' },
@@ -592,7 +596,6 @@ $pve_std_chains_conf->{4} = {
        # same as shorewall 'Drop', which is equal to DROP,
        # but REJECT/DROP some packages to reduce logging,
        # and ACCEPT critical ICMP types
-       { action => 'PVEFW-reject',  proto => 'tcp', dport => '43' }, # REJECT 'auth'
        # we are not interested in BROADCAST/MULTICAST/ANYCAST
        { action => 'PVEFW-DropBroadcast' },
        # ACCEPT critical ICMP types
@@ -615,7 +618,6 @@ $pve_std_chains_conf->{4} = {
        # same as shorewall 'Reject', which is equal to Reject,
        # but REJECT/DROP some packages to reduce logging,
        # and ACCEPT critical ICMP types
-       { action => 'PVEFW-reject',  proto => 'tcp', dport => '43' }, # REJECT 'auth'
        # we are not interested in BROADCAST/MULTICAST/ANYCAST
        { action => 'PVEFW-DropBroadcast' },
        # ACCEPT critical ICMP types
@@ -1359,7 +1361,7 @@ our $vm_option_properties = {
     macfilter => {
        description => "Enable/disable MAC address filter.",
        type => 'boolean',
-       default => 0,
+       default => 1,
        optional => 1,
     },
     dhcp => {
@@ -1449,11 +1451,13 @@ my $rule_properties = {
        description => "Restrict packet source address. $addr_list_descr",
        type => 'string', format => 'pve-fw-addr-spec',
        optional => 1,
+       maxLength => 512,
     },
     dest => {
        description => "Restrict packet destination address. $addr_list_descr",
        type => 'string', format => 'pve-fw-addr-spec',
        optional => 1,
+       maxLength => 512,
     },
     proto => {
        description => "IP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as defined in '/etc/protocols'.",
@@ -1816,11 +1820,9 @@ sub rules_audit_permissions {
 }
 
 # core functions
-my $bridge_firewall_enabled = 0;
 
 sub enable_bridge_firewall {
 
-    return if $bridge_firewall_enabled; # only once
 
     PVE::ProcFSTools::write_proc_entry("/proc/sys/net/bridge/bridge-nf-call-iptables", "1");
     PVE::ProcFSTools::write_proc_entry("/proc/sys/net/bridge/bridge-nf-call-ip6tables", "1");
@@ -1828,7 +1830,6 @@ sub enable_bridge_firewall {
     # make sure syncookies are enabled (which is default on newer 3.X kernels anyways)
     PVE::ProcFSTools::write_proc_entry("/proc/sys/net/ipv4/tcp_syncookies", "1");
 
-    $bridge_firewall_enabled = 1;
 }
 
 sub iptables_restore_cmdlist {
@@ -1950,6 +1951,8 @@ sub ipset_get_chains {
        return if $line =~ m/^\s*$/;
        if ($line =~ m/^(?:\S+)\s(PVEFW-\S+)\s(?:\S+).*/) {
            my $chain = $1;
+           # ignore initval from ipset v7.7+, won't set that yet so it'd mess up change detection
+           $line =~ s/\binitval 0x[0-9a-f]+//;
            $line =~ s/\s+$//; # delete trailing white space
            push @{$chains->{$chain}}, $line;
        } else {
@@ -1972,10 +1975,18 @@ sub ebtables_get_chains {
 
     my $res = {};
     my $chains = {};
+    my $table;
     my $parser = sub {
        my $line = shift;
        return if $line =~ m/^#/;
        return if $line =~ m/^\s*$/;
+       if ($line =~ m/^\*(\S+)$/) {
+           $table = $1;
+           return;
+       }
+
+       return if $table ne "filter";
+
        if ($line =~ m/^:(\S+)\s(ACCEPT|DROP|RETURN)$/) {
            # Make sure we know chains exist even if they're empty.
            $chains->{$1} //= [];
@@ -3157,13 +3168,13 @@ sub read_local_vm_config {
                }
            }
         } elsif ($d->{type} eq 'lxc') {
-            if ($have_lxc) {
-                my $cfspath = PVE::LXC::Config->cfs_config_path($vmid);
-                if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
-                    $lxc->{$vmid} = $conf;
-                }
-            }
-        }
+           if ($have_lxc) {
+               my $cfspath = PVE::LXC::Config->cfs_config_path($vmid);
+               if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
+                   $lxc->{$vmid} = $conf;
+               }
+           }
+       }
     }
 
     return $vmdata;
@@ -3486,9 +3497,13 @@ sub generate_ipset_chains {
                $hashsize = round_powerof2($hashsize);
            }
 
+           my $bucketsize = 12; # lower than the default of 14, faster but slightly more memory use
+
            my $family = $ipversion == "6" ? "inet6" : "inet";
 
-           $ipset_ruleset->{$name} = ["create $name hash:net family $family hashsize $hashsize maxelem $hashsize"];
+           $ipset_ruleset->{$name} = [
+               "create $name hash:net family $family hashsize $hashsize maxelem $hashsize bucketsize $bucketsize"
+           ];
 
            foreach my $cidr (sort keys %$data) {
                my $entry = $data->{$cidr};
@@ -3609,10 +3624,12 @@ sub save_clusterfw_conf {
     }
 }
 
-sub lock_hostfw_conf {
-    my ($timeout, $code, @param) = @_;
+sub lock_hostfw_conf : prototype($$$@) {
+    my ($node, $timeout, $code, @param) = @_;
+
+    $node = $nodename if !defined($node);
 
-    my $res = PVE::Cluster::cfs_lock_firewall("host-$nodename", $timeout, $code, @param);
+    my $res = PVE::Cluster::cfs_lock_firewall("host-$node", $timeout, $code, @param);
     die $@ if $@;
 
     return $res;
@@ -3628,7 +3645,9 @@ sub load_hostfw_conf {
 }
 
 sub save_hostfw_conf {
-    my ($hostfw_conf) = @_;
+    my ($hostfw_conf, $filename) = @_;
+
+    $filename = $hostfw_conf_filename if !defined($filename);
 
     my $raw = '';
 
@@ -3643,9 +3662,9 @@ sub save_hostfw_conf {
     }
 
     if ($raw) {
-       PVE::Tools::file_set_contents($hostfw_conf_filename, $raw);
+       PVE::Tools::file_set_contents($filename, $raw);
     } else {
-       unlink $hostfw_conf_filename;
+       unlink $filename;
     }
 }
 
@@ -3961,7 +3980,7 @@ sub compile_ebtables_filter {
        eval {
            my $conf = $vmdata->{qemu}->{$vmid};
            my $vmfw_conf = $vmfw_configs->{$vmid};
-           return if !$vmfw_conf;
+           return if !$vmfw_conf || !$vmfw_conf->{options}->{enable};
            my $ipsets = $vmfw_conf->{ipset};
 
            foreach my $netid (sort keys %$conf) {
@@ -4037,7 +4056,7 @@ sub generate_tap_layer2filter {
     ruleset_create_chain($ruleset, $tapchain);
 
     if (defined($macaddr) && !(defined($options->{macfilter}) && $options->{macfilter} == 0)) {
-           ruleset_addrule($ruleset, $tapchain, "-s ! $macaddr", '-j DROP');
+       ruleset_addrule($ruleset, $tapchain, "-s ! $macaddr", '-j DROP');
     }
 
     if (@$arpfilter){