eliminate unused nbdport in pve_std_chains_conf

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 634ff90c8ab7f216af72a3e4b0f9590cf4c220ce..f009e58ec93f16a60c5c049bf8454d5031536855 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -20,6 +20,7 @@ use IO::File;
 use Net::IP;
 use PVE::Tools qw(run_command lock_file dir_glob_foreach);
 use Encode;
+use Storable qw(dclone);
 
 my $hostfw_conf_filename = "/etc/pve/local/host.fw";
 my $pvefw_conf_dir = "/etc/pve/firewall";
@@ -548,7 +549,8 @@ my $FWACCEPTMARK_ON  = "0x80000000/0x80000000";
 my $FWACCEPTMARK_OFF = "0x00000000/0x80000000";
 
 my $pve_std_chains = {};
-$pve_std_chains->{4} = {
+my $pve_std_chains_conf = {};
+$pve_std_chains_conf->{4} = {
     'PVEFW-SET-ACCEPT-MARK' => [
        { target => "-j MARK --set-mark $FWACCEPTMARK_ON" },
     ],
@@ -584,10 +586,10 @@ $pve_std_chains->{4} = {
        # Drop packets with INVALID state
        { action => 'DROP', match => '-m conntrack --ctstate INVALID', },
        # Drop Microsoft SMB noise
-       { action => 'DROP', proto => 'udp', dport => '135,445', nbdport => 2 },
-       { action => 'DROP', proto => 'udp', dport => '137:139'},
+       { action => 'DROP', proto => 'udp', dport => '135,445' },
+       { action => 'DROP', proto => 'udp', dport => '137:139' },
        { action => 'DROP', proto => 'udp', dport => '1024:65535', sport => 137 },
-       { action => 'DROP', proto => 'tcp', dport => '135,139,445', nbdport => 3 },
+       { action => 'DROP', proto => 'tcp', dport => '135,139,445' },
        { action => 'DROP', proto => 'udp', dport => 1900 }, # UPnP
        # Drop new/NotSyn traffic so that it doesn't get logged
        { action => 'DROP', match => '-p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN' },
@@ -607,10 +609,10 @@ $pve_std_chains->{4} = {
        # Drop packets with INVALID state
        { action => 'DROP', match => '-m conntrack --ctstate INVALID', },
        # Drop Microsoft SMB noise
-       { action => 'PVEFW-reject', proto => 'udp', dport => '135,445', nbdport => 2 },
+       { action => 'PVEFW-reject', proto => 'udp', dport => '135,445' },
        { action => 'PVEFW-reject', proto => 'udp', dport => '137:139'},
        { action => 'PVEFW-reject', proto => 'udp', dport => '1024:65535', sport => 137 },
-       { action => 'PVEFW-reject', proto => 'tcp', dport => '135,139,445', nbdport => 3 },
+       { action => 'PVEFW-reject', proto => 'tcp', dport => '135,139,445' },
        { action => 'DROP', proto => 'udp', dport => 1900 }, # UPnP
        # Drop new/NotSyn traffic so that it doesn't get logged
        { action => 'DROP', match => '-p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN' },
@@ -641,7 +643,7 @@ $pve_std_chains->{4} = {
     ],
 };
 
-$pve_std_chains->{6} = {
+$pve_std_chains_conf->{6} = {
     'PVEFW-SET-ACCEPT-MARK' => [
        { target => "-j MARK --set-mark $FWACCEPTMARK_ON" },
     ],
@@ -680,10 +682,10 @@ $pve_std_chains->{6} = {
        # Drop packets with INVALID state
        { action => 'DROP', match => '-m conntrack --ctstate INVALID', },
        # Drop Microsoft SMB noise
-       { action => 'DROP', proto => 'udp', dport => '135,445', nbdport => 2 },
+       { action => 'DROP', proto => 'udp', dport => '135,445' },
        { action => 'DROP', proto => 'udp', dport => '137:139'},
        { action => 'DROP', proto => 'udp', dport => '1024:65535', sport => 137 },
-       { action => 'DROP', proto => 'tcp', dport => '135,139,445', nbdport => 3 },
+       { action => 'DROP', proto => 'tcp', dport => '135,139,445' },
        { action => 'DROP', proto => 'udp', dport => 1900 }, # UPnP
        # Drop new/NotSyn traffic so that it doesn't get logged
        { action => 'DROP', match => '-p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN' },
@@ -704,10 +706,10 @@ $pve_std_chains->{6} = {
        # Drop packets with INVALID state
        { action => 'DROP', match => '-m conntrack --ctstate INVALID', },
        # Drop Microsoft SMB noise
-       { action => 'PVEFW-reject', proto => 'udp', dport => '135,445', nbdport => 2 },
-       { action => 'PVEFW-reject', proto => 'udp', dport => '137:139'},
+       { action => 'PVEFW-reject', proto => 'udp', dport => '135,445' },
+       { action => 'PVEFW-reject', proto => 'udp', dport => '137:139' },
        { action => 'PVEFW-reject', proto => 'udp', dport => '1024:65535', sport => 137 },
-       { action => 'PVEFW-reject', proto => 'tcp', dport => '135,139,445', nbdport => 3 },
+       { action => 'PVEFW-reject', proto => 'tcp', dport => '135,139,445' },
        { action => 'DROP', proto => 'udp', dport => 1900 }, # UPnP
        # Drop new/NotSyn traffic so that it doesn't get logged
        { action => 'DROP', match => '-p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN' },
@@ -3354,6 +3356,9 @@ sub compile {
 
     my $vmfw_configs;
 
+    # fixme: once we read standard chains from config this needs to be put in test/standard cases below
+    $pve_std_chains = dclone($pve_std_chains_conf);
+
     if ($vmdata) { # test mode
        my $testdir = $vmdata->{testdir} || die "no test directory specified";
        my $filename = "$testdir/cluster.fw";