implement nosmurfs option for hiost firewall

diff --git a/example/100.fw b/example/100.fw
index 94f178d8b6d5ed6f43fec257f507ea63d98efc6e..a9179310dad6eb21b8a4493d7e205c80d58f34b4 100644 (file)
--- a/example/100.fw
+++ b/example/100.fw
@@ -19,8 +19,8 @@ log_level_in: info
 # disable log for outgoing connections
 log_level_out: nolog
 
 # disable log for outgoing connections
 log_level_out: nolog
 

-# filter SMURFS
-nosmurfs: 1
+# disable SMURFS filter
+nosmurfs: 0

 
 # filter illegal combinations of TCP flags
 tcpflags: 1
 
 # filter illegal combinations of TCP flags
 tcpflags: 1

diff --git a/example/host.fw b/example/host.fw
index e38b2a58b24fec3e55a9da53b1d4caa010fd2f96..663d2d7f05b5d0506cfaa449a3036fd5b078b565 100644 (file)
--- a/example/host.fw
+++ b/example/host.fw
@@ -20,6 +20,9 @@ nf_conntrack_max: 196608
 # you need to enable that explicitly
 allow_bridge_route: 1
 
 # you need to enable that explicitly
 allow_bridge_route: 1
 

+# disable SMURFS filter
+nosmurfs: 0
+

 # filter illegal combinations of TCP flags
 tcpflags: 1
 
 # filter illegal combinations of TCP flags
 tcpflags: 1
 

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index a929b54ac755b1d0c356c46282867a7c7d2dc3af..6d715c20f6348fd7fe745b1cff1f27824e34b0a8 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1125,6 +1125,10 @@ sub enable_host_firewall {
 
     my $loglevel = get_option_log_level($options, "log_level_in");
 
 
     my $loglevel = get_option_log_level($options, "log_level_in");
 

+    if (!(defined($options->{nosmurfs}) && $options->{nosmurfs} == 0)) {
+       ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs");
+    }
+

     if ($options->{tcpflags}) {
        ruleset_addrule($ruleset, $chain, "-p tcp -j PVEFW-tcpflags");
     }
     if ($options->{tcpflags}) {
        ruleset_addrule($ruleset, $chain, "-p tcp -j PVEFW-tcpflags");
     }