X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=f294d365545facc005c3a6195ba699eaf4674bce;hp=39f79d4ac19d7d6c654c3bee3552358e69b77dce;hb=e17d3eec6b9bd7427a67ceb0ca21dd4fc6d6f54e;hpb=6c27f4f30b789ba4e80ba5e58c313fc81ccfb930

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 39f79d4..f294d36 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1242,6 +1242,18 @@ our $host_option_properties = {
 	type => 'boolean',
 	optional => 1,
     },
+    nf_conntrack_allow_invalid => {
+	description => "Allow invalid packets on connection tracking.",
+	type => 'boolean',
+	default => 0,
+	optional => 1,
+    },
+    log_nf_conntrack => {
+	description => "Enable logging of conntrack information.",
+	type => 'boolean',
+	default => 0,
+	optional => 1
+    },
 };
 
 our $vm_option_properties = {
@@ -1357,6 +1369,9 @@ my $rule_properties = {
 	minimum => 0,
 	optional => 1,
     },
+    log => get_standard_option('pve-fw-loglevel', {
+	description => "Log level for firewall rule.",
+    }),
     sport => {
 	description => "Restrict TCP/UDP source port. $port_descr",
 	type => 'string', format => 'pve-fw-sport-spec',
@@ -2002,8 +2017,10 @@ sub ipt_rule_to_cmds {
     }
 
     my @iptcmds;
-    if (defined $rule->{log} && $rule->{log}) {
-	my $logaction = get_log_rule_base($chain, $vmid, $rule->{logmsg}, $rule->{log});
+    my $log = $rule->{log};
+    if (defined($log) && $log ne 'nolog') {
+	my $loglevel = $log_level_hash->{$log};
+	my $logaction = get_log_rule_base($chain, $vmid, $rule->{logmsg}, $loglevel);
 	push @iptcmds, "-A $chain $matchstr $logaction";
     }
     push @iptcmds, "-A $chain $matchstr $targetstr";
@@ -2011,7 +2028,7 @@ sub ipt_rule_to_cmds {
 }
 
 sub ruleset_generate_rule {
-    my ($ruleset, $chain, $ipversion, $rule, $cluster_conf, $fw_conf) = @_;
+    my ($ruleset, $chain, $ipversion, $rule, $cluster_conf, $fw_conf, $vmid) = @_;
 
     my $rules;
 
@@ -2024,7 +2041,7 @@ sub ruleset_generate_rule {
     # update all or nothing
     my @ipt_rule_cmds;
     foreach my $r (@$rules) {
-	push @ipt_rule_cmds, ipt_rule_to_cmds($r, $chain, $ipversion, $cluster_conf, $fw_conf);
+	push @ipt_rule_cmds, ipt_rule_to_cmds($r, $chain, $ipversion, $cluster_conf, $fw_conf, $vmid);
     }
     foreach my $c (@ipt_rule_cmds) {
 	ruleset_add_ipt_cmd($ruleset, $chain, $c);
@@ -2058,17 +2075,18 @@ sub ruleset_add_ipt_cmd {
 }
 
 sub ruleset_addrule {
-   my ($ruleset, $chain, $match, $action, $log, $logmsg, $vmid) = @_;
+    my ($ruleset, $chain, $match, $action, $log, $logmsg, $vmid) = @_;
 
-   die "no such chain '$chain'\n" if !$ruleset->{$chain};
+    die "no such chain '$chain'\n" if !$ruleset->{$chain};
 
-   if (defined($log) && $log) {
-	my $logaction = get_log_rule_base($chain, $vmid, $logmsg, $log);
+    if ($log) {
+	my $loglevel = $log_level_hash->{$log};
+	my $logaction = get_log_rule_base($chain, $vmid, $logmsg, $loglevel);
 	push @{$ruleset->{$chain}}, "-A $chain $match $logaction";
-   }
-   # for stable ebtables digests avoid double-spaces to match ebtables-save output
-   $match .= ' ' if length($match);
-   push @{$ruleset->{$chain}}, "-A $chain ${match}$action";
+    }
+    # for stable ebtables digests avoid double-spaces to match ebtables-save output
+    $match .= ' ' if length($match);
+    push @{$ruleset->{$chain}}, "-A $chain ${match}$action";
 }
 
 sub ruleset_insertrule {
@@ -2088,7 +2106,7 @@ sub get_log_rule_base {
     # Note: we use special format for prefix to pass further
     # info to log daemon (VMID, LOGLEVEL and CHAIN)
 
-    return "-j NFLOG --nflog-prefix \":$vmid:$loglevel:$chain: $msg\"";
+    return "-m limit --limit 1/sec -j NFLOG --nflog-prefix \":$vmid:$loglevel:$chain: $msg\"";
 }
 
 sub ruleset_add_chain_policy {
@@ -2108,7 +2126,7 @@ sub ruleset_add_chain_policy {
     } elsif ($policy eq 'REJECT') {
 	ruleset_addrule($ruleset, $chain, "", "-j PVEFW-Reject");
 
-	ruleset_addrule($ruleset, $chain, "", "-g PVEFW-reject", $loglevel, "policy $policy:", $vmid);
+	ruleset_addrule($ruleset, $chain, "", "-g PVEFW-reject", $loglevel, "policy $policy: ", $vmid);
     } else {
 	# should not happen
 	die "internal error: unknown policy '$policy'";
@@ -2128,9 +2146,11 @@ sub ruleset_chain_add_ndp {
 }
 
 sub ruleset_chain_add_conn_filters {
-    my ($ruleset, $chain, $accept) = @_;
+    my ($ruleset, $chain, $allow_invalid, $accept) = @_;
 
-    ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID", "-j DROP");
+    if (!$allow_invalid) {
+	ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID", "-j DROP");
+    }
     ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED", "-j $accept");
 }
 
@@ -2140,7 +2160,7 @@ sub ruleset_chain_add_input_filters {
     if ($cluster_conf->{ipset}->{blacklist}){
 	if (!ruleset_chain_exist($ruleset, "PVEFW-blacklist")) {
 	    ruleset_create_chain($ruleset, "PVEFW-blacklist");
-	    ruleset_addrule($ruleset, "PVEFW-blacklist", "", "-j DROP", $loglevel, "DROP: ");
+	    ruleset_addrule($ruleset, "PVEFW-blacklist", "", "-j DROP", $loglevel, "DROP: ", 0);
 	}
 	my $ipset_chain = compute_ipset_chain_name(0, 'blacklist', $ipversion);
 	ruleset_addrule($ruleset, $chain, "-m set --match-set ${ipset_chain} src", "-j PVEFW-blacklist");
@@ -2226,7 +2246,7 @@ sub ruleset_add_group_rule {
 }
 
 sub ruleset_generate_vm_rules {
-    my ($ruleset, $rules, $cluster_conf, $vmfw_conf, $chain, $netid, $direction, $options, $ipversion) = @_;
+    my ($ruleset, $rules, $cluster_conf, $vmfw_conf, $chain, $netid, $direction, $options, $ipversion, $vmid) = @_;
 
     my $lc_direction = lc($direction);
 
@@ -2243,12 +2263,13 @@ sub ruleset_generate_vm_rules {
 	} else {
 	    next if $rule->{type} ne $lc_direction;
 	    eval {
+		$rule->{logmsg} = "$rule->{action}: ";
 		if ($direction eq 'OUT') {
 		    rule_substitude_action($rule, { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" });
-		    ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, $cluster_conf, $vmfw_conf);
+		    ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, $cluster_conf, $vmfw_conf, $vmid);
 		} else {
 		    rule_substitude_action($rule, { ACCEPT => $in_accept , REJECT => "PVEFW-reject" });
-		    ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, $cluster_conf, $vmfw_conf);
+		    ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, $cluster_conf, $vmfw_conf, $vmid);
 		}
 	    };
 	    warn $@ if $@;
@@ -2309,7 +2330,7 @@ sub generate_tap_rules_direction {
     ruleset_create_vm_chain($ruleset, $tapchain, $ipversion, $options, $macaddr, $ipfilter_ipset, $direction);
 
     if ($options->{enable}) {
-	ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $vmfw_conf, $tapchain, $netid, $direction, $options, $ipversion);
+	ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $vmfw_conf, $tapchain, $netid, $direction, $options, $ipversion, $vmid);
 
 	ruleset_generate_vm_ipsrules($ruleset, $options, $direction, $iface);
 
@@ -2333,10 +2354,10 @@ sub generate_tap_rules_direction {
     # plug the tap chain to bridge chain
     if ($direction eq 'IN') {
 	ruleset_addrule($ruleset, "PVEFW-FWBR-IN",
-			"-m physdev --physdev-is-bridged --physdev-out $iface", "-j $tapchain");
+			"-m physdev --physdev-is-bridged --physdev-out $iface", "-j $tapchain", $loglevel, 'FWBR-IN: ', $vmid);
     } else {
 	ruleset_addrule($ruleset, "PVEFW-FWBR-OUT",
-			"-m physdev --physdev-is-bridged --physdev-in $iface", "-j $tapchain");
+			"-m physdev --physdev-is-bridged --physdev-in $iface", "-j $tapchain", $loglevel, 'FWBR-OUT: ', $vmid);
     }
 }
 
@@ -2356,7 +2377,7 @@ sub enable_host_firewall {
 
     ruleset_addrule($ruleset, $chain, "-i lo", "-j ACCEPT");
 
-    ruleset_chain_add_conn_filters($ruleset, $chain, 'ACCEPT');
+    ruleset_chain_add_conn_filters($ruleset, $chain, 0, 'ACCEPT');
     ruleset_chain_add_ndp($ruleset, $chain, $ipversion, $options, 'IN', '-j RETURN');
     ruleset_chain_add_input_filters($ruleset, $chain, $ipversion, $options, $cluster_conf, $loglevel);
 
@@ -2377,7 +2398,7 @@ sub enable_host_firewall {
 		ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'IN', $accept_action, $ipversion);
 	    } elsif ($rule->{type} eq 'in') {
 		rule_substitude_action($rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" });
-		ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, $cluster_conf, $hostfw_conf);
+		ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, $cluster_conf, $hostfw_conf, 0);
 	    }
 	};
 	warn $@ if $@;
@@ -2414,7 +2435,7 @@ sub enable_host_firewall {
 
     ruleset_addrule($ruleset, $chain, "-o lo", "-j ACCEPT");
 
-    ruleset_chain_add_conn_filters($ruleset, $chain, 'ACCEPT');
+    ruleset_chain_add_conn_filters($ruleset, $chain, 0, 'ACCEPT');
 
     # we use RETURN because we may want to check other thigs later
     $accept_action = 'RETURN';
@@ -2429,11 +2450,12 @@ sub enable_host_firewall {
 
 	$rule->{iface_out} = $rule->{iface} if $rule->{iface};
 	eval {
+	    $rule->{logmsg} = "$rule->{action}: ";
 	    if ($rule->{type} eq 'group') {
 		ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'OUT', $accept_action, $ipversion);
 	    } elsif ($rule->{type} eq 'out') {
 		rule_substitude_action($rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" });
-		ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, $cluster_conf, $hostfw_conf);
+		ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, $cluster_conf, $hostfw_conf, 0);
 	    }
 	};
 	warn $@ if $@;
@@ -2572,6 +2594,10 @@ sub parse_fw_rule {
 	    $rule->{dest} = $1;
 	    next;
 	}
+	if ($line =~ s/^-log (emerg|alert|crit|err|warning|notice|info|debug|nolog)\s*//) {
+	    $rule->{log} = $1;
+	    next;
+	}
 
 	last;
     }
@@ -2638,7 +2664,7 @@ sub parse_hostfw_option {
 
     my $loglevels = "emerg|alert|crit|err|warning|notice|info|debug|nolog";
 
-    if ($line =~ m/^(enable|nosmurfs|tcpflags|ndp|log_nf_conntrack):\s*(0|1)\s*$/i) {
+    if ($line =~ m/^(enable|nosmurfs|tcpflags|ndp|log_nf_conntrack|nf_conntrack_allow_invalid):\s*(0|1)\s*$/i) {
 	$opt = lc($1);
 	$value = int($2);
     } elsif ($line =~ m/^(log_level_in|log_level_out|tcp_flags_log_level|smurf_log_level):\s*(($loglevels)\s*)?$/i) {
@@ -3024,6 +3050,7 @@ my $format_rules = sub {
 		$raw .= " -p $rule->{proto}" if $rule->{proto};
 		$raw .= " -dport $rule->{dport}" if $rule->{dport};
 		$raw .= " -sport $rule->{sport}" if $rule->{sport};
+		$raw .= " -log $rule->{log}" if $rule->{log};
 	    }
 
 	    $raw .= " # " . encode('utf8', $rule->{comment})
@@ -3182,9 +3209,7 @@ sub get_option_log_level {
 
     return undef if $v eq '' || $v eq 'nolog';
 
-    $v = $log_level_hash->{$v} if defined($log_level_hash->{$v});
-
-    return $v if ($v >= 0) && ($v <= 7);
+    return $v if defined($log_level_hash->{$v});
 
     warn "unknown log level ($k = '$v')\n";
 
@@ -3217,7 +3242,7 @@ sub generate_std_chains {
 	ruleset_create_chain($ruleset, $chain);
 	foreach my $rule (@{$std_chains->{$chain}}) {
 	    if (ref($rule)) {
-		ruleset_generate_rule($ruleset, $chain, $ipversion, $rule);
+		ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, 0);
 	    } else {
 		die "rule $rule as string - should not happen";
 	    }
@@ -3461,7 +3486,8 @@ sub compile_iptables_filter {
     # fixme: what log level should we use here?
     my $loglevel = get_option_log_level($hostfw_options, "log_level_out");
 
-    ruleset_chain_add_conn_filters($ruleset, "PVEFW-FORWARD", "ACCEPT");
+    my $conn_allow_invalid = $hostfw_options->{nf_conntrack_allow_invalid} // 0;
+    ruleset_chain_add_conn_filters($ruleset, "PVEFW-FORWARD", $conn_allow_invalid, "ACCEPT");
 
     ruleset_create_chain($ruleset, "PVEFW-FWBR-IN");
     ruleset_chain_add_input_filters($ruleset, "PVEFW-FWBR-IN", $ipversion, $hostfw_options, $cluster_conf, $loglevel);
@@ -3678,6 +3704,7 @@ sub compile_ebtables_filter {
 	    my $conf = $vmdata->{qemu}->{$vmid};
 	    my $vmfw_conf = $vmfw_configs->{$vmid};
 	    return if !$vmfw_conf;
+	    my $ipsets = $vmfw_conf->{ipset};
 
 	    foreach my $netid (sort keys %$conf) {
 		next if $netid !~ m/^net(\d+)$/;
@@ -3685,9 +3712,15 @@ sub compile_ebtables_filter {
 		next if !$net->{firewall};
 		my $iface = "tap${vmid}i$1";
 		my $macaddr = $net->{macaddr};
-
-		generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid);
-
+		my $arpfilter = [];
+		if (defined(my $ipset = $ipsets->{"ipfilter-$netid"})) {
+		    foreach my $ipaddr (@$ipset) {
+			my($ip, $version) = parse_ip_or_cidr($ipaddr->{cidr});
+			next if !$ip || ($version && $version != 4);
+			push(@$arpfilter, $ip);
+		    }
+		}
+		generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter);
 	    }
 	};
 	warn $@ if $@; # just to be sure - should not happen
@@ -3700,6 +3733,7 @@ sub compile_ebtables_filter {
 
 	    my $vmfw_conf = $vmfw_configs->{$vmid};
 	    return if !$vmfw_conf || !$vmfw_conf->{options}->{enable};
+	    my $ipsets = $vmfw_conf->{ipset};
 
 	    foreach my $netid (sort keys %$conf) {
 		next if $netid !~ m/^net(\d+)$/;
@@ -3707,7 +3741,16 @@ sub compile_ebtables_filter {
 		next if !$net->{firewall};
 		my $iface = "veth${vmid}i$1";
 		my $macaddr = $net->{hwaddr};
-		generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid);
+		my $arpfilter = [];
+		if (defined(my $ipset = $ipsets->{"ipfilter-$netid"})) {
+		    foreach my $ipaddr (@$ipset) {
+			my($ip, $version) = parse_ip_or_cidr($ipaddr->{cidr});
+			next if !$ip || ($version && $version != 4);
+			push(@$arpfilter, $ip);
+		    }
+		}
+		push(@$arpfilter, $net->{ip}) if $net->{ip} && $vmfw_conf->{options}->{ipfilter};
+		generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter);
 	    }
 	};
 	warn $@ if $@; # just to be sure - should not happen
@@ -3717,7 +3760,7 @@ sub compile_ebtables_filter {
 }
 
 sub generate_tap_layer2filter {
-    my ($ruleset, $iface, $macaddr, $vmfw_conf, $vmid) = @_;
+    my ($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter) = @_;
     my $options = $vmfw_conf->{options};
 
     my $tapchain = $iface."-OUT";
@@ -3732,15 +3775,30 @@ sub generate_tap_layer2filter {
 	    ruleset_addrule($ruleset, $tapchain, "-s ! $macaddr", '-j DROP');
     }
 
+    if (@$arpfilter){
+	my $arpchain = $tapchain."-ARP";
+	ruleset_addrule($ruleset, $tapchain, "-p ARP", "-j $arpchain");
+	ruleset_create_chain($ruleset, $arpchain);
+
+	foreach my $ip (@{$arpfilter}) {
+	    ruleset_addrule($ruleset, $arpchain, "-p ARP --arp-ip-src $ip", '-j RETURN');
+	}
+	ruleset_addrule($ruleset, $arpchain, '', '-j DROP');
+    }
+
     if (defined($options->{layer2_protocols})){
+	my $protochain = $tapchain."-PROTO";
+	ruleset_addrule($ruleset, $tapchain, '', "-j $protochain");
+	ruleset_create_chain($ruleset, $protochain);
+
 	foreach my $proto (split(/,/, $options->{layer2_protocols})) {
-	    ruleset_addrule($ruleset, $tapchain, "-p $proto", '-j ACCEPT');
+	    ruleset_addrule($ruleset, $protochain, "-p $proto", '-j RETURN');
 	}
-	ruleset_addrule($ruleset, $tapchain, '', "-j DROP");
-    } else {
-	ruleset_addrule($ruleset, $tapchain, '', '-j ACCEPT');
+	ruleset_addrule($ruleset, $protochain, '', '-j DROP');
     }
 
+    ruleset_addrule($ruleset, $tapchain, '', '-j ACCEPT');
+
     ruleset_addrule($ruleset, 'PVEFW-FWBR-OUT', "-i $iface", "-j $tapchain");
 }