X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=d5d4950b6aaa4be45c796d37c084dc599452976c;hp=ca57a2437e8b8f87c36224a1416c23d0c7bbddea;hb=b22130d3fd198a3d5ad9113f87c4ae3cf68c0303;hpb=5d38d64fa42881c571db1566cfcb350a3da31269

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index ca57a24..d5d4950 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -792,6 +792,7 @@ sub copy_opject_with_digest {
     my $res = {};
     foreach my $k (sort keys %$object) {
 	my $v = $object->{$k};
+	next if !defined($v);
 	$res->{$k} = $v;
 	$sha->add($k, ':', $v, "\n");
     }
@@ -813,6 +814,7 @@ sub copy_list_with_digest {
 	my $data = {};
 	foreach my $k (sort keys %$entry) {
 	    my $v = $entry->{$k};
+	    next if !defined($v);
 	    $data->{$k} = $v;
 	    $sha->add($k, ':', $v, "\n");
 	}
@@ -1501,7 +1503,7 @@ sub generate_nfqueue {
 		$action .= " --queue-num $1";
 	    }
 	}
-	$action .= " --queue-bypass";
+	$action .= " --queue-bypass" if $feature_ipset_nomatch; #need kernel 3.10
     }else{
 	$action = "ACCEPT";
     }
@@ -1630,6 +1632,7 @@ sub enable_host_firewall {
     # fixme: allow security groups
 
     my $options = $hostfw_conf->{options};
+    my $cluster_options = $cluster_conf->{options};
     my $rules = $hostfw_conf->{rules};
 
     # host inbound firewall
@@ -1662,7 +1665,7 @@ sub enable_host_firewall {
     }
 
     # implement input policy
-    my $policy = $options->{policy_in} || 'DROP'; # allow nothing by default
+    my $policy = $cluster_options->{policy_in} || 'DROP'; # allow nothing by default
     ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action);
 
     # host outbound firewall
@@ -1687,7 +1690,7 @@ sub enable_host_firewall {
     }
 
     # implement output policy
-    $policy = $options->{policy_out} || 'ACCEPT'; # allow everything by default
+    $policy = $cluster_options->{policy_out} || 'ACCEPT'; # allow everything by default
     ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action);
 
     ruleset_addrule($ruleset, "PVEFW-OUTPUT", "-j PVEFW-HOST-OUT");
@@ -1848,16 +1851,13 @@ sub parse_hostfw_option {
 
     my $loglevels = "emerg|alert|crit|err|warning|notice|info|debug|nolog";
 
-    if ($line =~ m/^(enable|dhcp|nosmurfs|tcpflags|allow_bridge_route|optimize):\s*(0|1)\s*$/i) {
+    if ($line =~ m/^(enable|nosmurfs|tcpflags|allow_bridge_route|optimize):\s*(0|1)\s*$/i) {
 	$opt = lc($1);
 	$value = int($2);
     } elsif ($line =~ m/^(log_level_in|log_level_out|tcp_flags_log_level|smurf_log_level):\s*(($loglevels)\s*)?$/i) {
 	$opt = lc($1);
 	$value = $2 ? lc($3) : '';
-    } elsif ($line =~ m/^(policy_(in|out)):\s*(ACCEPT|DROP|REJECT)\s*$/i) {
-	$opt = lc($1);
-	$value = uc($3);
-    } elsif ($line =~ m/^(nf_conntrack_max):\s*(\d+)\s*$/i) {
+    } elsif ($line =~ m/^(nf_conntrack_max|nf_conntrack_tcp_timeout_established):\s*(\d+)\s*$/i) {
 	$opt = lc($1);
 	$value = int($2);
     } else {
@@ -1876,6 +1876,9 @@ sub parse_clusterfw_option {
     if ($line =~ m/^(enable):\s*(0|1)\s*$/i) {
 	$opt = lc($1);
 	$value = int($2);
+    } elsif ($line =~ m/^(policy_(in|out)):\s*(ACCEPT|DROP|REJECT)\s*$/i) {
+	$opt = lc($1);
+	$value = uc($3);
     } else {
 	chomp $line;
 	die "can't parse option '$line'\n"
@@ -2480,12 +2483,16 @@ sub save_hostfw_conf {
 }
 
 sub compile {
+    my ($cluster_conf, $hostfw_conf) = @_;
+
+    $cluster_conf = load_clusterfw_conf() if !$cluster_conf;
+    $hostfw_conf = load_hostfw_conf() if !$hostfw_conf;
+
     my $vmdata = read_local_vm_config();
     my $vmfw_configs = read_vm_firewall_configs($vmdata);
 
     my $routing_table = read_proc_net_route();
 
-    my $cluster_conf = load_clusterfw_conf();
 
     my $ipset_ruleset = {};
     generate_ipset_chains($ipset_ruleset, $cluster_conf);
@@ -2497,7 +2504,6 @@ sub compile {
 
     ruleset_create_chain($ruleset, "PVEFW-FORWARD");
 
-    my $hostfw_conf = load_hostfw_conf();
     my $hostfw_options = $hostfw_conf->{options} || {};
 
     generate_std_chains($ruleset, $hostfw_options);
@@ -2593,7 +2599,7 @@ sub compile {
     ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j DROP");
     ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j DROP");
 
-    return wantarray ? ($ruleset, $hostfw_conf, $ipset_ruleset) : $ruleset;
+    return ($ruleset, $ipset_ruleset);
 }
 
 sub get_ruleset_status {
@@ -2762,6 +2768,8 @@ sub apply_ruleset {
 
     update_nf_conntrack_max($hostfw_conf);
 
+    update_nf_conntrack_tcp_timeout_established($hostfw_conf);
+
     my ($ipset_create_cmdlist, $ipset_delete_cmdlist, $ipset_changes) =
 	get_ipset_cmdlist($ipset_ruleset, undef, $verbose);
 
@@ -2826,6 +2834,16 @@ sub update_nf_conntrack_max {
     }
 }
 
+sub update_nf_conntrack_tcp_timeout_established {
+    my ($hostfw_conf) = @_;
+
+    my $options = $hostfw_conf->{options} || {};
+
+    my $value = defined($options->{nf_conntrack_tcp_timeout_established}) ? $options->{nf_conntrack_tcp_timeout_established} : 432000;
+
+    PVE::ProcFSTools::write_proc_entry("/proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established", $value);
+}
+
 sub remove_pvefw_chains {
 
     my ($chash, $hooks) = iptables_get_chains();
@@ -2853,9 +2871,25 @@ sub update {
     my ($start, $verbose) = @_;
 
     my $code = sub {
+
+	my $cluster_conf = load_clusterfw_conf();
+	my $cluster_options = $cluster_conf->{options};
+
+	my $enable = $cluster_options->{enable};
+
 	my $status = read_pvefw_status();
 
-	my ($ruleset, $hostfw_conf, $ipset_ruleset) = compile();
+	die "Firewall is disabled - cannot start\n" if !$enable && $start;
+
+	if (!$enable) {
+	    PVE::Firewall::remove_pvefw_chains();
+	    print "Firewall disabled\n" if $verbose;
+	    return;
+	}
+
+	my $hostfw_conf = load_hostfw_conf();
+
+	my ($ruleset, $ipset_ruleset) = compile($cluster_conf, $hostfw_conf);
 
 	if ($start || $status eq 'active') {