X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=246e7af88a32e437789cbfc9e45a8a3db2a2cbd5;hp=be9cc5a81eb1662e27c245aaa3f034a9830f698d;hb=93be433387be21e7a26495065da3a32bb79b334a;hpb=dba740a9c766f1584f06b87747069740fb333fcd diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index be9cc5a..246e7af 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -99,7 +99,7 @@ my $nodename = PVE::INotify::nodename(); my $pve_fw_lock_filename = "/var/lock/pvefw.lck"; -my $default_log_level = 'info'; +my $default_log_level = 'nolog'; # avoid logs by default my $log_level_hash = { debug => 7, @@ -157,9 +157,8 @@ my $pve_fw_macros = { { action => 'PARAM', proto => 'tcp', dport => '6277' }, ], 'DHCPfwd' => [ - "Forwarded DHCP traffic (bidirectional)", + "Forwarded DHCP traffic", { action => 'PARAM', proto => 'udp', dport => '67:68', sport => '67:68' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '67:68', sport => '67:68' }, ], 'DNS' => [ "Domain Name System traffic (upd and tcp)", @@ -186,9 +185,8 @@ my $pve_fw_macros = { { action => 'PARAM', proto => 'udp', dport => '1080' }, ], 'GRE' => [ - "Generic Routing Encapsulation tunneling protocol (bidirectional)", + "Generic Routing Encapsulation tunneling protocol", { action => 'PARAM', proto => '47' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '47' }, ], 'Git' => [ "Git distributed revision control traffic", @@ -223,32 +221,24 @@ my $pve_fw_macros = { { action => 'PARAM', proto => 'tcp', dport => '993' }, ], 'IPIP' => [ - "IPIP capsulation traffic (bidirectional)", + "IPIP capsulation traffic", { action => 'PARAM', proto => '94' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '94' }, ], 'IPsec' => [ - "IPsec traffic (bidirectional)", + "IPsec traffic", { action => 'PARAM', proto => 'udp', dport => '500', sport => '500' }, { action => 'PARAM', proto => '50' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '500', sport => '500' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '50' }, ], 'IPsecah' => [ - "IPsec authentication (AH) traffic (bidirectional)", + "IPsec authentication (AH) traffic", { action => 'PARAM', proto => 'udp', dport => '500', sport => '500' }, { action => 'PARAM', proto => '51' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '500', sport => '500' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '51' }, ], 'IPsecnat' => [ - "IPsec traffic and Nat-Traversal (bidirectional)", + "IPsec traffic and Nat-Traversal", { action => 'PARAM', proto => 'udp', dport => '500' }, { action => 'PARAM', proto => 'udp', dport => '4500' }, { action => 'PARAM', proto => '50' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '500' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '4500' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '50' }, ], 'IRC' => [ "Internet Relay Chat traffic", @@ -261,7 +251,6 @@ my $pve_fw_macros = { 'L2TP' => [ "Layer 2 Tunneling Protocol traffic", { action => 'PARAM', proto => 'udp', dport => '1701' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '1701' }, ], 'LDAP' => [ "Lightweight Directory Access Protocol traffic", @@ -305,11 +294,6 @@ my $pve_fw_macros = { "Network Time Protocol (ntpd)", { action => 'PARAM', proto => 'udp', dport => '123' }, ], - 'NTPbi' => [ - "Bi-directional NTP (for NTP peers)", - { action => 'PARAM', proto => 'udp', dport => '123' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '123' }, - ], 'OSPF' => [ "OSPF multicast traffic", { action => 'PARAM', proto => '89' }, @@ -334,7 +318,6 @@ my $pve_fw_macros = { 'PPtP' => [ "Point-to-Point Tunneling Protocol", { action => 'PARAM', proto => '47' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '47' }, { action => 'PARAM', proto => 'tcp', dport => '1723' }, ], 'Ping' => [ @@ -353,10 +336,9 @@ my $pve_fw_macros = { "Microsoft Remote Desktop Protocol traffic", { action => 'PARAM', proto => 'tcp', dport => '3389' }, ], - 'RIPbi' => [ + 'RIP' => [ "Routing Information Protocol (bidirectional)", { action => 'PARAM', proto => 'udp', dport => '520' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '520' }, ], 'RNDC' => [ "BIND remote management protocol", @@ -385,17 +367,6 @@ my $pve_fw_macros = { { action => 'PARAM', proto => 'udp', dport => '1024:65535', sport => '137' }, { action => 'PARAM', proto => 'tcp', dport => '135,139,445' }, ], - 'SMBBI' => [ - "Microsoft SMB traffic (bidirectional)", - { action => 'PARAM', proto => 'udp', dport => '135,445' }, - { action => 'PARAM', proto => 'udp', dport => '137:139' }, - { action => 'PARAM', proto => 'udp', dport => '1024:65535', sport => '137' }, - { action => 'PARAM', proto => 'tcp', dport => '135,139,445' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '135,445' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '137:139' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '1024:65535', sport => '137' }, - { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'tcp', dport => '135,139,445' }, - ], 'SMBswat' => [ "Samba Web Administration Tool", { action => 'PARAM', proto => 'tcp', dport => '901' }, @@ -467,8 +438,8 @@ my $pve_fw_macros = { { action => 'PARAM', proto => 'icmp', dport => 'echo-request' }, ], 'VNC' => [ - "VNC traffic for VNC display's 0 - 9", - { action => 'PARAM', proto => 'tcp', dport => '5900:5909' }, + "VNC traffic for VNC display's 0 - 99", + { action => 'PARAM', proto => 'tcp', dport => '5900:5999' }, ], 'VNCL' => [ "VNC traffic from Vncservers to Vncviewers in listen mode", @@ -716,6 +687,55 @@ sub get_etc_protocols { return $etc_protocols; } +my $ipv4_mask_hash_clusternet = { + '255.255.0.0' => 16, + '255.255.128.0' => 17, + '255.255.192.0' => 18, + '255.255.224.0' => 19, + '255.255.240.0' => 20, + '255.255.248.0' => 21, + '255.255.252.0' => 22, + '255.255.254.0' => 23, + '255.255.255.0' => 24, + '255.255.255.128' => 25, + '255.255.255.192' => 26, + '255.255.255.224' => 27, + '255.255.255.240' => 28, + '255.255.255.248' => 29, + '255.255.255.252' => 30, +}; + +my $cluster_network; + +sub get_cluster_network { + + return $cluster_network if defined($cluster_network); + + eval { + my $nodename = PVE::INotify::nodename(); + + my $ip = PVE::Cluster::remote_node_ip($nodename); + + my $testip = Net::IP->new($ip); + + my $routes = PVE::ProcFSTools::read_proc_net_route(); + foreach my $entry (@$routes) { + my $mask = $ipv4_mask_hash_clusternet->{$entry->{mask}}; + next if !defined($mask); + return if $mask eq '0.0.0.0'; + my $cidr = "$entry->{dest}/$mask"; + my $testnet = Net::IP->new($cidr); + if ($testnet->overlaps($testip)) { + $cluster_network = $cidr; + return; + } + } + }; + warn $@ if $@; + + return $cluster_network; +} + sub parse_address_list { my ($str) = @_; @@ -1455,7 +1475,7 @@ sub ruleset_chain_add_input_filters { } sub ruleset_create_vm_chain { - my ($ruleset, $chain, $options, $host_options, $macaddr, $direction) = @_; + my ($ruleset, $chain, $options, $macaddr, $direction) = @_; ruleset_create_chain($ruleset, $chain); my $accept = generate_nfqueue($options); @@ -1563,19 +1583,18 @@ sub ruleset_generate_vm_ipsrules { } sub generate_venet_rules_direction { - my ($ruleset, $cluster_conf, $hostfw_conf, $vmfw_conf, $vmid, $ip, $direction) = @_; + my ($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, $direction) = @_; my $lc_direction = lc($direction); my $rules = $vmfw_conf->{rules}; my $options = $vmfw_conf->{options}; - my $hostfw_options = $vmfw_conf->{options}; my $loglevel = get_option_log_level($options, "log_level_${lc_direction}"); my $chain = "venet0-$vmid-$direction"; - ruleset_create_vm_chain($ruleset, $chain, $options, $hostfw_options, undef, $direction); + ruleset_create_vm_chain($ruleset, $chain, $options, undef, $direction); ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $chain, 'venet', $direction); @@ -1606,19 +1625,18 @@ sub generate_venet_rules_direction { } sub generate_tap_rules_direction { - my ($ruleset, $cluster_conf, $hostfw_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, $direction) = @_; + my ($ruleset, $cluster_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, $direction) = @_; my $lc_direction = lc($direction); my $rules = $vmfw_conf->{rules}; my $options = $vmfw_conf->{options}; - my $hostfw_options = $hostfw_conf->{options}; my $loglevel = get_option_log_level($options, "log_level_${lc_direction}"); my $tapchain = "$iface-$direction"; - ruleset_create_vm_chain($ruleset, $tapchain, $options, $hostfw_options, $macaddr, $direction); + ruleset_create_vm_chain($ruleset, $tapchain, $options, $macaddr, $direction); ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $tapchain, $netid, $direction, $options); @@ -1666,6 +1684,15 @@ sub enable_host_firewall { ruleset_chain_add_conn_filters($ruleset, $chain, 'ACCEPT'); ruleset_chain_add_input_filters($ruleset, $chain, $options, $cluster_conf, $loglevel); + my $clusternet = get_cluster_network(); + + if ($clusternet) { + ruleset_addrule($ruleset, $chain, "-s $clusternet -p tcp --dport 8006 -j ACCEPT"); # PVE API + ruleset_addrule($ruleset, $chain, "-s $clusternet -p tcp --dport 5900:5999 -j ACCEPT"); # PVE VNC Console + ruleset_addrule($ruleset, $chain, "-s $clusternet -p tcp --dport 3128 -j ACCEPT"); # SPICE Proxy + ruleset_addrule($ruleset, $chain, "-s $clusternet -p tcp --dport 22 -j ACCEPT"); # SSH + } + ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW --dport 5404:5405 -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 9000 -j ACCEPT"); #corosync @@ -2636,9 +2663,9 @@ sub compile { my $iface = "tap${vmid}i$1"; my $macaddr = $net->{macaddr}; - generate_tap_rules_direction($ruleset, $cluster_conf, $hostfw_conf, $iface, $netid, $macaddr, + generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, 'IN'); - generate_tap_rules_direction($ruleset, $cluster_conf, $hostfw_conf, $iface, $netid, $macaddr, + generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, 'OUT'); } } @@ -2664,8 +2691,8 @@ sub compile { push @{$cluster_conf->{ipset}->{venet0}}, $venet0ipset; } - generate_venet_rules_direction($ruleset, $cluster_conf, $hostfw_conf, $vmfw_conf, $vmid, $ip, 'IN'); - generate_venet_rules_direction($ruleset, $cluster_conf, $hostfw_conf, $vmfw_conf, $vmid, $ip, 'OUT'); + generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'IN'); + generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'OUT'); } if ($conf->{netif} && $conf->{netif}->{value}) { @@ -2675,9 +2702,9 @@ sub compile { my $macaddr = $d->{mac}; my $iface = $d->{host_ifname}; - generate_tap_rules_direction($ruleset, $cluster_conf, $hostfw_conf, $iface, $netid, $macaddr, + generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, 'IN'); - generate_tap_rules_direction($ruleset, $cluster_conf, $hostfw_conf, $iface, $netid, $macaddr, + generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, 'OUT'); } } @@ -2959,6 +2986,16 @@ sub remove_pvefw_chains { iptables_restore_cmdlist($cmdlist); } +sub init { + my $cluster_conf = load_clusterfw_conf(); + my $cluster_options = $cluster_conf->{options}; + my $enable = $cluster_options->{enable}; + + return if !$enable; + + # load required modules here +} + sub update { my ($verbose) = @_; @@ -2987,5 +3024,4 @@ sub update { run_locked($code); } - 1;