fix #2721: remove reject tcp 43 from default drop and reject actions

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index e01fea50e49a0511c37050b7feaff00ced95a52f..edc5336c726ce7805025dfcda86d9a0050304aa8 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -213,7 +213,7 @@ my $pve_fw_macros = {
        { action => 'PARAM', proto => 'udp', dport => '6881' },
     ],
     'Ceph' => [
-        "Ceph Storage Cluster traffic (Ceph Monitors, OSD & MDS Deamons)",
+        "Ceph Storage Cluster traffic (Ceph Monitors, OSD & MDS Daemons)",
        # Legacy port for protocol v1
         { action => 'PARAM', proto => 'tcp', dport => '6789' },
        # New port for protocol v2
@@ -276,7 +276,7 @@ my $pve_fw_macros = {
        { action => 'PARAM', proto => 'tcp', dport => '9418' },
     ],
     'HKP' => [
-       "OpenPGP HTTP keyserver protocol traffic",
+       "OpenPGP HTTP key server protocol traffic",
        { action => 'PARAM', proto => 'tcp', dport => '11371' },
     ],
     'HTTP' => [
@@ -592,7 +592,6 @@ $pve_std_chains_conf->{4} = {
        # same as shorewall 'Drop', which is equal to DROP,
        # but REJECT/DROP some packages to reduce logging,
        # and ACCEPT critical ICMP types
-       { action => 'PVEFW-reject',  proto => 'tcp', dport => '43' }, # REJECT 'auth'
        # we are not interested in BROADCAST/MULTICAST/ANYCAST
        { action => 'PVEFW-DropBroadcast' },
        # ACCEPT critical ICMP types
@@ -615,7 +614,6 @@ $pve_std_chains_conf->{4} = {
        # same as shorewall 'Reject', which is equal to Reject,
        # but REJECT/DROP some packages to reduce logging,
        # and ACCEPT critical ICMP types
-       { action => 'PVEFW-reject',  proto => 'tcp', dport => '43' }, # REJECT 'auth'
        # we are not interested in BROADCAST/MULTICAST/ANYCAST
        { action => 'PVEFW-DropBroadcast' },
        # ACCEPT critical ICMP types
@@ -636,7 +634,7 @@ $pve_std_chains_conf->{4} = {
     ],
     'PVEFW-tcpflags' => [
        # same as shorewall tcpflags action.
-       # Packets arriving on this interface are checked for som illegal combinations of TCP flags
+       # Packets arriving on this interface are checked for some illegal combinations of TCP flags
        { match => '-p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG', target => '-g PVEFW-logflags' },
        { match => '-p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE', target => '-g PVEFW-logflags' },
        { match => '-p tcp -m tcp --tcp-flags SYN,RST SYN,RST', target => '-g PVEFW-logflags' },
@@ -729,7 +727,7 @@ $pve_std_chains_conf->{6} = {
     ],
     'PVEFW-tcpflags' => [
        # same as shorewall tcpflags action.
-       # Packets arriving on this interface are checked for som illegal combinations of TCP flags
+       # Packets arriving on this interface are checked for some illegal combinations of TCP flags
        { match => '-p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG', target => '-g PVEFW-logflags' },
        { match => '-p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE', target => '-g PVEFW-logflags' },
        { match => '-p tcp -m tcp --tcp-flags SYN,RST SYN,RST', target => '-g PVEFW-logflags' },
@@ -1256,7 +1254,7 @@ our $cluster_option_properties = {
                type => 'integer',
                minimum => 0,
                optional => 1,
-               description => 'Inital burst of packages which will get logged',
+               description => 'Initial burst of packages which will always get logged before the rate is applied',
                default => 5,
            },
        },
@@ -1449,11 +1447,13 @@ my $rule_properties = {
        description => "Restrict packet source address. $addr_list_descr",
        type => 'string', format => 'pve-fw-addr-spec',
        optional => 1,
+       maxLength => 512,
     },
     dest => {
        description => "Restrict packet destination address. $addr_list_descr",
        type => 'string', format => 'pve-fw-addr-spec',
        optional => 1,
+       maxLength => 512,
     },
     proto => {
        description => "IP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as defined in '/etc/protocols'.",
@@ -1609,7 +1609,7 @@ sub verify_rule {
     my $set_ip_version = sub {
        my $vers = shift;
        if ($vers) {
-           die "detected mixed ipv4/ipv6 adresses in rule\n"
+           die "detected mixed ipv4/ipv6 addresses in rule\n"
                if $ipversion && ($vers != $ipversion);
            $ipversion = $vers;
        }
@@ -1816,11 +1816,9 @@ sub rules_audit_permissions {
 }
 
 # core functions
-my $bridge_firewall_enabled = 0;
 
 sub enable_bridge_firewall {
 
-    return if $bridge_firewall_enabled; # only once
 
     PVE::ProcFSTools::write_proc_entry("/proc/sys/net/bridge/bridge-nf-call-iptables", "1");
     PVE::ProcFSTools::write_proc_entry("/proc/sys/net/bridge/bridge-nf-call-ip6tables", "1");
@@ -1828,7 +1826,6 @@ sub enable_bridge_firewall {
     # make sure syncookies are enabled (which is default on newer 3.X kernels anyways)
     PVE::ProcFSTools::write_proc_entry("/proc/sys/net/ipv4/tcp_syncookies", "1");
 
-    $bridge_firewall_enabled = 1;
 }
 
 sub iptables_restore_cmdlist {
@@ -1999,7 +1996,7 @@ sub ebtables_get_chains {
     return $res;
 }
 
-# substitude action of rule according to action hash
+# substitute action of rule according to action hash
 sub rule_substitude_action {
     my ($rule, $actions) = @_;
 
@@ -2747,33 +2744,33 @@ sub parse_fw_rule {
 
        last if $rule->{type} eq 'group';
 
-       if ($line =~ s/^-p (\S+)\s*//) {
+       if ($line =~ s/^(?:-p|--?proto) (\S+)\s*//) {
            $rule->{proto} = $1;
            next;
        }
 
-       if ($line =~ s/^-dport (\S+)\s*//) {
+       if ($line =~ s/^--?dport (\S+)\s*//) {
            $rule->{dport} = $1;
            next;
        }
 
-       if ($line =~ s/^-sport (\S+)\s*//) {
+       if ($line =~ s/^--?sport (\S+)\s*//) {
            $rule->{sport} = $1;
            next;
        }
-       if ($line =~ s/^-source (\S+)\s*//) {
+       if ($line =~ s/^--?source (\S+)\s*//) {
            $rule->{source} = $1;
            next;
        }
-       if ($line =~ s/^-dest (\S+)\s*//) {
+       if ($line =~ s/^--?dest (\S+)\s*//) {
            $rule->{dest} = $1;
            next;
        }
-       if ($line =~ s/^-log (emerg|alert|crit|err|warning|notice|info|debug|nolog)\s*//) {
+       if ($line =~ s/^--?log (emerg|alert|crit|err|warning|notice|info|debug|nolog)\s*//) {
            $rule->{log} = $1;
            next;
        }
-       if ($line =~ s/^-icmp-type (\S+)\s*//) {
+       if ($line =~ s/^--?icmp-type (\S+)\s*//) {
            $rule->{'icmp-type'} = $1;
            next;
        }
@@ -3857,7 +3854,7 @@ sub compile_ipsets {
            return if !$vmfw_conf;
 
            # When the 'ipfilter' option is enabled every device for which there
-           # is no 'ipfilter-netX' ipset defiend gets an implicit empty default
+           # is no 'ipfilter-netX' ipset defined gets an implicit empty default
            # ipset.
            # The reason is that ipfilter ipsets are always filled with standard
            # IPv6 link-local filters.
@@ -3896,7 +3893,7 @@ sub compile_ipsets {
            return if !$vmfw_conf;
 
            # When the 'ipfilter' option is enabled every device for which there
-           # is no 'ipfilter-netX' ipset defiend gets an implicit empty default
+           # is no 'ipfilter-netX' ipset defined gets an implicit empty default
            # ipset.
            # The reason is that ipfilter ipsets are always filled with standard
            # IPv6 link-local filters, as well as the IP addresses configured