X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=ff50d048af9bfe220d08de4589ba5c2ba5c00fc1;hp=3acd906741cdb2db9314ecd509857c27369b1cf4;hb=5176619e3d01585761e34a350c4e15c8029c408f;hpb=1f3485a0aeeed9d8dd982e39ab30ef21aa37f988 diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 3acd906..ff50d04 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -4,9 +4,12 @@ use warnings; use strict; use Data::Dumper; use Digest::SHA; +use PVE::INotify; +use PVE::Cluster; use PVE::ProcFSTools; use PVE::Tools; use PVE::QemuServer; +use PVE::OpenVZ; # dependeny problem?! use File::Basename; use File::Path; use IO::File; @@ -15,6 +18,8 @@ use PVE::Tools qw(run_command lock_file); use Data::Dumper; +my $nodename = PVE::INotify::nodename(); + my $pve_fw_lock_filename = "/var/lock/pvefw.lck"; my $pve_fw_status_filename = "/var/lib/pve-firewall/pvefw.status"; @@ -658,6 +663,11 @@ sub iptables_get_chains { return 1 if $name =~ m/^PVEFW-\S+$/; return 1 if $name =~ m/^tap\d+i\d+-(:?IN|OUT)$/; + + return 1 if $name =~ m/^veth\d+.\d+-(:?IN|OUT)$/; # fixme: dev name is configurable + + return 1 if $name =~ m/^venet0-\d+-(:?IN|OUT)$/; + return 1 if $name =~ m/^vmbr\d+-(:?FW|IN|OUT)$/; return 1 if $name =~ m/^GROUP-(:?[^\s\-]+)-(:?IN|OUT)$/; @@ -821,24 +831,30 @@ sub ruleset_insertrule { } sub generate_bridge_chains { - my ($ruleset, $bridge) = @_; + my ($ruleset, $hostfw_conf, $bridge) = @_; - if (!ruleset_chain_exist($ruleset, "PVEFW-FORWARD")){ - ruleset_create_chain($ruleset, "PVEFW-FORWARD"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"); - } + my $options = $hostfw_conf->{options} || {}; + + # fixme: what log level should we use here? + my $loglevel = get_option_log_level($options, "log_level_out"); if (!ruleset_chain_exist($ruleset, "$bridge-FW")) { ruleset_create_chain($ruleset, "$bridge-FW"); ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -m physdev --physdev-is-bridged -j $bridge-FW"); ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -m physdev --physdev-is-bridged -j $bridge-FW"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -j DROP"); # disable interbridge routing - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -j DROP"); # disable interbridge routing + # disable interbridge routing + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -j PVEFW-Drop"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -j PVEFW-Drop"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -j LOG --log-prefix \"PVEFW-FORWARD-dropped \" --log-level $loglevel"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -j LOG --log-prefix \"PVEFW-FORWARD-dropped \" --log-level $loglevel"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -j DROP"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -j DROP"); } if (!ruleset_chain_exist($ruleset, "$bridge-OUT")) { ruleset_create_chain($ruleset, "$bridge-OUT"); ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-bridged --physdev-is-in -j $bridge-OUT"); + ruleset_addrule($ruleset, "PVEFW-INPUT", "-i $bridge -m physdev --physdev-is-bridged --physdev-is-in -j $bridge-OUT"); } if (!ruleset_chain_exist($ruleset, "$bridge-IN")) { @@ -850,39 +866,67 @@ sub generate_bridge_chains { } } -sub generate_tap_rules_direction { - my ($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, $direction) = @_; +sub ruleset_add_chain_policy { + my ($ruleset, $chain, $policy, $loglevel, $accept_action) = @_; - my $lc_direction = lc($direction); + if ($policy eq 'ACCEPT') { - my $rules = $vmfw_conf->{rules}; + ruleset_generate_rule($ruleset, $chain, { action => 'ACCEPT' }, + { ACCEPT => $accept_action}); - my $options = $vmfw_conf->{options}; - my $loglevel = get_option_log_level($options, "log_level_${lc_direction}"); + } elsif ($policy eq 'DROP') { - my $tapchain = "$iface-$direction"; + ruleset_addrule($ruleset, $chain, "-j PVEFW-Drop"); - ruleset_create_chain($ruleset, $tapchain); + ruleset_addrule($ruleset, $chain, "-j LOG --log-prefix \"$chain-dropped: \" --log-level $loglevel") + if defined($loglevel); + + ruleset_addrule($ruleset, $chain, "-j DROP"); + } elsif ($policy eq 'REJECT') { + ruleset_addrule($ruleset, $chain, "-j PVEFW-Reject"); + + ruleset_addrule($ruleset, $chain, "-j LOG --log-prefix \"$chain-reject: \" --log-level $loglevel") + if defined($loglevel); + + ruleset_addrule($ruleset, $chain, "-g PVEFW-reject"); + } else { + # should not happen + die "internal error: unknown policy '$policy'"; + } +} + +sub ruleset_create_vm_chain { + my ($ruleset, $chain, $options, $macaddr, $direction) = @_; + + ruleset_create_chain($ruleset, $chain); if (!(defined($options->{nosmurfs}) && $options->{nosmurfs} == 0)) { - ruleset_addrule($ruleset, $tapchain, "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs"); + ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs"); } if (!(defined($options->{dhcp}) && $options->{dhcp} == 0)) { - ruleset_addrule($ruleset, $tapchain, "-p udp -m udp --dport 67:68 -j ACCEPT"); + ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 67:68 -j ACCEPT"); } if ($options->{tcpflags}) { - ruleset_addrule($ruleset, $tapchain, "-p tcp -j PVEFW-tcpflags"); + ruleset_addrule($ruleset, $chain, "-p tcp -j PVEFW-tcpflags"); } - ruleset_addrule($ruleset, $tapchain, "-m conntrack --ctstate INVALID -j DROP"); - ruleset_addrule($ruleset, $tapchain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"); + ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID -j DROP"); + ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"); - if ($direction eq 'OUT' && defined($macaddr) && - !(defined($options->{macfilter}) && $options->{macfilter} == 0)) { - ruleset_addrule($ruleset, $tapchain, "-m mac ! --mac-source $macaddr -j DROP"); + if ($direction eq 'OUT') { + if (defined($macaddr) && !(defined($options->{macfilter}) && $options->{macfilter} == 0)) { + ruleset_addrule($ruleset, $chain, "-m mac ! --mac-source $macaddr -j DROP"); + } + ruleset_addrule($ruleset, $chain, "-j MARK --set-mark 0"); # clear mark } +} + +sub ruleset_generate_vm_rules { + my ($ruleset, $rules, $groups_conf, $chain, $netid, $direction) = @_; + + my $lc_direction = lc($direction); foreach my $rule (@$rules) { next if $rule->{iface} && $rule->{iface} ne $netid; @@ -892,65 +936,86 @@ sub generate_tap_rules_direction { if(!ruleset_chain_exist($ruleset, $group_chain)){ generate_group_rules($ruleset, $groups_conf, $rule->{action}); } - ruleset_addrule($ruleset, $tapchain, "-j $group_chain"); - ruleset_addrule($ruleset, $tapchain, "-m mark --mark 1 -j RETURN") + ruleset_addrule($ruleset, $chain, "-j $group_chain"); + ruleset_addrule($ruleset, $chain, "-m mark --mark 1 -j RETURN") if $direction eq 'OUT'; } else { next if $rule->{type} ne $lc_direction; if ($direction eq 'OUT') { - ruleset_generate_rule($ruleset, $tapchain, $rule, + ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }); } else { - ruleset_generate_rule($ruleset, $tapchain, $rule, { REJECT => "PVEFW-reject" }); + ruleset_generate_rule($ruleset, $chain, $rule, { REJECT => "PVEFW-reject" }); } } } +} + +sub generate_venet_rules_direction { + my ($ruleset, $groups_conf, $vmfw_conf, $vmid, $ip, $direction) = @_; + + parse_address_list($ip); # make sure we have a valid $ip list + + my $lc_direction = lc($direction); + + my $rules = $vmfw_conf->{rules}; + + my $options = $vmfw_conf->{options}; + my $loglevel = get_option_log_level($options, "log_level_${lc_direction}"); + + my $chain = "venet0-$vmid-$direction"; + + ruleset_create_vm_chain($ruleset, $chain, $options, undef, $direction); + + ruleset_generate_vm_rules($ruleset, $rules, $groups_conf, $chain, 'venet', $direction); # implement policy my $policy; if ($direction eq 'OUT') { - $policy = $options->{'policy-out'} || 'ACCEPT'; # allow everything by default + $policy = $options->{policy_out} || 'ACCEPT'; # allow everything by default } else { - $policy = $options->{'policy-in'} || 'DROP'; # allow everything by default + $policy = $options->{policy_in} || 'DROP'; # allow nothing by default } - if ($policy eq 'ACCEPT') { - if ($direction eq 'OUT') { - ruleset_addrule($ruleset, $tapchain, "-g PVEFW-SET-ACCEPT-MARK"); - } else { - ruleset_addrule($ruleset, $tapchain, "-j ACCEPT"); - } - } elsif ($policy eq 'DROP') { + my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : "ACCEPT"; + ruleset_add_chain_policy($ruleset, $chain, $policy, $loglevel, $accept_action); - ruleset_addrule($ruleset, $tapchain, "-j PVEFW-Drop"); - ruleset_addrule($ruleset, $tapchain, "-j LOG --log-prefix \"$tapchain-dropped: \" --log-level $loglevel") - if defined($loglevel); +} - ruleset_addrule($ruleset, $tapchain, "-j DROP"); - } elsif ($policy eq 'REJECT') { - ruleset_addrule($ruleset, $tapchain, "-j PVEFW-Reject"); +sub generate_tap_rules_direction { + my ($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, $direction) = @_; - ruleset_addrule($ruleset, $tapchain, "-j LOG --log-prefix \"$tapchain-reject: \" --log-level $loglevel") - if defined($loglevel); + my $lc_direction = lc($direction); + + my $rules = $vmfw_conf->{rules}; - ruleset_addrule($ruleset, $tapchain, "-g PVEFW-reject"); + my $options = $vmfw_conf->{options}; + my $loglevel = get_option_log_level($options, "log_level_${lc_direction}"); + + my $tapchain = "$iface-$direction"; + + ruleset_create_vm_chain($ruleset, $tapchain, $options, $macaddr, $direction); + + ruleset_generate_vm_rules($ruleset, $rules, $groups_conf, $tapchain, $netid, $direction); + + # implement policy + my $policy; + + if ($direction eq 'OUT') { + $policy = $options->{policy_out} || 'ACCEPT'; # allow everything by default } else { - # should not happen - die "internal error: unknown policy '$policy'"; + $policy = $options->{policy_in} || 'DROP'; # allow nothing by default } + my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : "ACCEPT"; + ruleset_add_chain_policy($ruleset, $tapchain, $policy, $loglevel, $accept_action); + # plug the tap chain to bridge chain my $physdevdirection = $direction eq 'IN' ? "out" : "in"; my $rule = "-m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain"; ruleset_insertrule($ruleset, "$bridge-$direction", $rule); - - if ($direction eq 'OUT'){ - # add tap->host rules - my $rule = "-m physdev --physdev-$physdevdirection $iface -j $tapchain"; - ruleset_addrule($ruleset, "PVEFW-INPUT", $rule); - } } sub enable_host_firewall { @@ -974,16 +1039,17 @@ sub enable_host_firewall { ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW -m multiport --dports 5404,5405 -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 9000 -j ACCEPT"); #corosync + # we use RETURN because we need to check also tap rules + my $accept_action = 'RETURN'; + foreach my $rule (@$rules) { next if $rule->{type} ne 'in'; - # we use RETURN because we need to check also tap rules - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => 'RETURN', REJECT => "PVEFW-reject" }); + ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }); } - ruleset_addrule($ruleset, $chain, "-j LOG --log-prefix \"kvmhost-IN dropped: \" --log-level $loglevel") - if defined($loglevel); - - ruleset_addrule($ruleset, $chain, "-j DROP"); + # implement input policy + my $policy = $options->{policy_in} || 'DROP'; # allow nothing by default + ruleset_add_chain_policy($ruleset, $chain, $policy, $loglevel, $accept_action); # host outbound firewall $chain = "PVEFW-HOST-OUT"; @@ -998,16 +1064,17 @@ sub enable_host_firewall { ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW -m multiport --dports 5404,5405 -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 9000 -j ACCEPT"); #corosync + # we use RETURN because we may want to check other thigs later + $accept_action = 'RETURN'; + foreach my $rule (@$rules) { next if $rule->{type} ne 'out'; - # we use RETURN because we need to check also tap rules - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => 'RETURN', REJECT => "PVEFW-reject" }); + ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }); } - ruleset_addrule($ruleset, $chain, "-j LOG --log-prefix \"kvmhost-OUT dropped: \" --log-level $loglevel") - if defined($loglevel); - - ruleset_addrule($ruleset, $chain, "-j DROP"); + # implement output policy + $policy = $options->{policy_out} || 'ACCEPT'; # allow everything by default + ruleset_add_chain_policy($ruleset, $chain, $policy, $loglevel, $accept_action); ruleset_addrule($ruleset, "PVEFW-OUTPUT", "-j PVEFW-HOST-OUT"); ruleset_addrule($ruleset, "PVEFW-INPUT", "-j PVEFW-HOST-IN"); @@ -1105,8 +1172,6 @@ sub parse_fw_rule { if ($need_iface) { $iface = undef if $iface && $iface eq '-'; - die "unknown interface '$iface'\n" - if defined($iface) && !$valid_netdev_names->{$iface}; } $proto = undef if $proto && $proto eq '-'; @@ -1202,7 +1267,7 @@ sub parse_vmfw_option { } elsif ($line =~ m/^(log_level_in|log_level_out):\s*(($loglevels)\s*)?$/i) { $opt = lc($1); $value = $2 ? lc($3) : ''; - } elsif ($line =~ m/^(policy-(in|out)):\s*(ACCEPT|DROP|REJECT)\s*$/i) { + } elsif ($line =~ m/^(policy_(in|out)):\s*(ACCEPT|DROP|REJECT)\s*$/i) { $opt = lc($1); $value = uc($3); } else { @@ -1226,9 +1291,12 @@ sub parse_hostfw_option { } elsif ($line =~ m/^(log_level_in|log_level_out|tcp_flags_log_level|smurf_log_level):\s*(($loglevels)\s*)?$/i) { $opt = lc($1); $value = $2 ? lc($3) : ''; - } elsif ($line =~ m/^(policy-(in|out)):\s*(ACCEPT|DROP|REJECT)\s*$/i) { + } elsif ($line =~ m/^(policy_(in|out)):\s*(ACCEPT|DROP|REJECT)\s*$/i) { $opt = lc($1); $value = uc($3); + } elsif ($line =~ m/^(nf_conntrack_max):\s*(\d+)\s*$/i) { + $opt = lc($1); + $value = int($2); } else { chomp $line; die "can't parse option '$line'\n" @@ -1386,35 +1454,48 @@ sub run_locked { sub read_local_vm_config { my $openvz = {}; - my $qemu = {}; - my $list = PVE::QemuServer::config_list(); + my $vmdata = { openvz => $openvz, qemu => $qemu }; - foreach my $vmid (keys %$list) { - my $cfspath = PVE::QemuServer::cfs_config_path($vmid); - if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { - $qemu->{$vmid} = $conf; + my $vmlist = PVE::Cluster::get_vmlist(); + return $vmdata if !$vmlist || !$vmlist->{ids}; + my $ids = $vmlist->{ids}; + + foreach my $vmid (keys %$ids) { + next if !$vmid; # skip VE0 + my $d = $ids->{$vmid}; + next if !$d->{node} || $d->{node} ne $nodename; + next if !$d->{type}; + if ($d->{type} eq 'openvz') { + my $cfspath = PVE::OpenVZ::cfs_config_path($vmid); + if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { + $openvz->{$vmid} = $conf; + } + } elsif ($d->{type} eq 'qemu') { + my $cfspath = PVE::QemuServer::cfs_config_path($vmid); + if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { + $qemu->{$vmid} = $conf; + } } } - - my $vmdata = { openvz => $openvz, qemu => $qemu }; - + return $vmdata; }; -sub read_vm_firewall_rules { +sub read_vm_firewall_configs { my ($vmdata) = @_; - my $rules = {}; + my $vmfw_configs = {}; + foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) { my $filename = "/etc/pve/firewall/$vmid.fw"; my $fh = IO::File->new($filename, O_RDONLY); next if !$fh; - $rules->{$vmid} = parse_vm_fw_rules($filename, $fh); + $vmfw_configs->{$vmid} = parse_vm_fw_rules($filename, $fh); } - return $rules; + return $vmfw_configs; } sub get_option_log_level { @@ -1442,7 +1523,7 @@ sub generate_std_chains { # same as shorewall smurflog. if (defined($loglevel)) { $pve_std_chains-> {'PVEFW-smurflog'} = [ - "-j LOG --log-prefix \"smurfs-dropped\" --log-level $loglevel", + "-j LOG --log-prefix \"smurfs-dropped: \" --log-level $loglevel", "-j DROP", ]; } else { @@ -1453,7 +1534,7 @@ sub generate_std_chains { $loglevel = get_option_log_level($options, 'tcp_flags_log_level'); if (defined($loglevel)) { $pve_std_chains-> {'PVEFW-logflags'} = [ - "-j LOG --log-prefix \"logflags-dropped:\" --log-level $loglevel --log-ip-options", + "-j LOG --log-prefix \"logflags-dropped: \" --log-level $loglevel --log-ip-options", "-j DROP", ]; } else { @@ -1498,7 +1579,7 @@ sub read_pvefw_status { sub compile { my $vmdata = read_local_vm_config(); - my $rules = read_vm_firewall_rules($vmdata); + my $vmfw_configs = read_vm_firewall_configs($vmdata); my $groups_conf = {}; my $filename = "/etc/pve/firewall/groups.fw"; @@ -1506,16 +1587,16 @@ sub compile { $groups_conf = parse_group_fw_rules($filename, $fh); } - #print Dumper($rules); - my $ruleset = {}; ruleset_create_chain($ruleset, "PVEFW-INPUT"); ruleset_create_chain($ruleset, "PVEFW-OUTPUT"); + ruleset_create_chain($ruleset, "PVEFW-FORWARD"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"); my $hostfw_options = {}; - my $hostfw_conf; + my $hostfw_conf = {}; $filename = "/etc/pve/local/host.fw"; if (my $fh = IO::File->new($filename, O_RDONLY)) { @@ -1525,15 +1606,14 @@ sub compile { generate_std_chains($ruleset, $hostfw_options); - my $hostfw_enable = $hostfw_conf && - !(defined($hostfw_options->{enable}) && ($hostfw_options->{enable} == 0)); + my $hostfw_enable = !(defined($hostfw_options->{enable}) && ($hostfw_options->{enable} == 0)); enable_host_firewall($ruleset, $hostfw_conf, $groups_conf) if $hostfw_enable; # generate firewall rules for QEMU VMs foreach my $vmid (keys %{$vmdata->{qemu}}) { my $conf = $vmdata->{qemu}->{$vmid}; - my $vmfw_conf = $rules->{$vmid}; + my $vmfw_conf = $vmfw_configs->{$vmid}; next if !$vmfw_conf; next if defined($vmfw_conf->{options}->{enable}) && ($vmfw_conf->{options}->{enable} == 0); @@ -1548,7 +1628,7 @@ sub compile { $bridge .= "v$net->{tag}" if $net->{tag}; - generate_bridge_chains($ruleset, $bridge); + generate_bridge_chains($ruleset, $hostfw_conf, $bridge); my $macaddr = $net->{macaddr}; generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'IN'); @@ -1556,7 +1636,38 @@ sub compile { } } - return $ruleset; + # generate firewall rules for OpenVZ containers + foreach my $vmid (keys %{$vmdata->{openvz}}) { + my $conf = $vmdata->{openvz}->{$vmid}; + + my $vmfw_conf = $vmfw_configs->{$vmid}; + next if !$vmfw_conf; + next if defined($vmfw_conf->{options}->{enable}) && ($vmfw_conf->{options}->{enable} == 0); + + if ($conf->{ip_address} && $conf->{ip_address}->{value}) { + my $ip = $conf->{ip_address}->{value}; + generate_venet_rules_direction($ruleset, $groups_conf, $vmfw_conf, $vmid, $ip, 'IN'); + generate_venet_rules_direction($ruleset, $groups_conf, $vmfw_conf, $vmid, $ip, 'OUT'); + } + + if ($conf->{netif} && $conf->{netif}->{value}) { + my $netif = PVE::OpenVZ::parse_netif($conf->{netif}->{value}); + foreach my $netid (keys %$netif) { + my $d = $netif->{$netid}; + my $bridge = $d->{bridge}; + if (!$bridge) { + warn "no bridge device for CT $vmid iface '$netid'\n"; + next; # fixme? + } + my $macaddr = $d->{host_mac}; + my $iface = $d->{host_ifname}; + generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'IN'); + generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'OUT'); + } + } + } + + return wantarray ? ($ruleset, $hostfw_conf) : $ruleset; } sub get_ruleset_status { @@ -1707,13 +1818,39 @@ sub apply_ruleset { die "unable to apply firewall changes\n" if $errors; } +sub update_nf_conntrack_max { + my ($hostfw_conf) = @_; + + my $max = 65536; # reasonable default + + my $options = $hostfw_conf->{options} || {}; + + if (defined($options->{nf_conntrack_max}) && ($options->{nf_conntrack_max} > $max)) { + $max = $options->{nf_conntrack_max}; + $max = int(($max+ 8191)/8192)*8192; # round to multiples of 8192 + } + + my $filename_nf_conntrack_max = "/proc/sys/net/nf_conntrack_max"; + my $filename_hashsize = "/sys/module/nf_conntrack/parameters/hashsize"; + + my $current = int(PVE::Tools::file_read_firstline($filename_nf_conntrack_max) || $max); + + if ($current != $max) { + my $hashsize = int($max/4); + PVE::ProcFSTools::write_proc_entry($filename_hashsize, $hashsize); + PVE::ProcFSTools::write_proc_entry($filename_nf_conntrack_max, $max); + } +} + sub update { my ($start, $verbose) = @_; my $code = sub { my $status = read_pvefw_status(); - my $ruleset = PVE::Firewall::compile(); + my ($ruleset, $hostfw_conf) = PVE::Firewall::compile(); + + update_nf_conntrack_max($hostfw_conf); if ($start || $status eq 'active') {