Wolfgang Bumiller [Mon, 17 Jul 2023 08:40:17 +0000 (10:40 +0200)]
bump version to 5.0.3
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Leo Nunner [Tue, 11 Jul 2023 09:41:15 +0000 (11:41 +0200)]
parser: fix scoped alias resolution
We tried to resolve aliases in some places where the cluster
configuration didn't get set. It's probably better to handle these cases
directly in the function at hand, instead of at every place where this
issues might arise.
This seemingly fixes the issues reported on pve-user and the forum:
* https://forum.proxmox.com/threads/pve-8-pve-firewall-status-no-such-alias.130202/
* https://forum.proxmox.com/threads/ipset-not-working-for-accepting-cluster-traffic.129599/
Signed-off-by: Leo Nunner <l.nunner@proxmox.com>
Thomas Lamprecht [Wed, 21 Jun 2023 17:17:27 +0000 (19:17 +0200)]
bump version to 5.0.2
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Leo Nunner [Tue, 13 Jun 2023 12:06:33 +0000 (14:06 +0200)]
fix #4556: api: return scoped IPSets and aliases
Introduce a new 'scope' field in the return values for the /ref
endpoints. Also add the 'ref' field in the VM endpoint, since it has
been missing up until now.
Signed-off-by: Leo Nunner <l.nunner@proxmox.com>
Leo Nunner [Tue, 13 Jun 2023 12:06:32 +0000 (14:06 +0200)]
api: fix scoping for ipset endpoint
in the cluster class, we save the cluster config into the 'fw_conf'
variable, and not into 'cluster_conf', which in turns is set to 'undef'
instead.
Signed-off-by: Leo Nunner <l.nunner@proxmox.com>
Wolfgang Bumiller [Wed, 7 Jun 2023 14:06:17 +0000 (16:06 +0200)]
bump version to 5.0.1
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Wolfgang Bumiller [Wed, 7 Jun 2023 13:55:35 +0000 (15:55 +0200)]
change vm/ prefix to guest/ prefix
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Wolfgang Bumiller [Wed, 7 Jun 2023 12:30:05 +0000 (14:30 +0200)]
d/control: add missing anyevent dependency
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Leo Nunner [Wed, 7 Jun 2023 10:17:49 +0000 (12:17 +0200)]
fix #4556: introduce 'dc' and 'vm' prefix for aliases
since they had the same issue as IPSets, detailed in #4556. The format
works the same as for IPSets:
dc/alias
Looks for the alias on the Datacenter level.
vm/alias
Looks for the alias on the VM level.
alias
Uses the previous method of scoping, where it first looks at the
VM level and then at the Datacenter level.
Signed-off-by: Leo Nunner <l.nunner@proxmox.com>
Leo Nunner [Wed, 7 Jun 2023 10:17:48 +0000 (12:17 +0200)]
fix #4556: introduce 'dc' and 'vm' prefix for IPSets
to differentiate whether they should be taken from the datacenter config
or from the local config. The parser now accepts IPSets in the following
format:
+dc/ipset
Looks for the IPSet on the Datacenter level.
+vm/ipset
Looks for the IPSet on the VM level.
+ipset
Uses the previous method of scoping, where it first looks at the
VM level and then at the Datacenter level.
Signed-off-by: Leo Nunner <l.nunner@proxmox.com>
Thomas Lamprecht [Mon, 22 May 2023 12:48:12 +0000 (14:48 +0200)]
bump version to 5.0.0
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 May 2023 12:48:09 +0000 (14:48 +0200)]
d/control: raise standards version compliance to 4.6.2
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 May 2023 12:47:51 +0000 (14:47 +0200)]
d/control: define compat level via build-depends and raise to 13
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 May 2023 12:46:45 +0000 (14:46 +0200)]
buildsys: add sbuild convenience target
and only call lintian for the dsc target, as otherwise sbuild already
takes care of that (avoid duplicate work)
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 May 2023 12:46:36 +0000 (14:46 +0200)]
buildsys: derive upload dist automatically
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 May 2023 12:45:19 +0000 (14:45 +0200)]
buildsys: use full DEB_VERSION and correct DEB_HOST_ARCH
The DEB_BUILD_ARCH is the one from the build host, the DEB_HOST_ARCH
is the one the package is build for, so the latter is the correct one
here.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 May 2023 12:42:06 +0000 (14:42 +0200)]
buildsys: cleanup and expand clean target
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 May 2023 12:40:55 +0000 (14:40 +0200)]
add basic gitignore file
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 May 2023 12:39:36 +0000 (14:39 +0200)]
d/control: do not depend on obsolete lsb-base
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 May 2023 12:39:25 +0000 (14:39 +0200)]
makefile: convert to use simple parenthesis
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 22 May 2023 12:24:20 +0000 (14:24 +0200)]
buildsys: rework doc-gen cleanup and makefile inclusion
The NOVIEW variable is useless now anyway, and the cleanup-docgen
target is a bit dangerous (removes _all_ *.adoc files) and it's just
a single line, so avoid complexity.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 16 May 2023 09:18:09 +0000 (11:18 +0200)]
bump version to 4.3-2
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Fabian Grünbichler [Tue, 16 May 2023 09:09:24 +0000 (11:09 +0200)]
fix #4730: add safeguards to prevent ICMP type misuse
without this additional conditions, it's possible to break the firewall by
setting an ICMP-type value as dport for non-ICMP protocols, e.g. 'any' for
'tcp'.
by rejecting the invalid rule/parameter, the rest of the ruleset is still
applied properly, and the error messages are a lot more informative as well.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Tue, 16 May 2023 09:09:23 +0000 (11:09 +0200)]
icmp: factor out check for relevant protocols
this were not entirely consistent and sometimes the checks were repeated.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Thomas Lamprecht [Wed, 26 Apr 2023 10:24:28 +0000 (12:24 +0200)]
d/changelog: fixup released
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 11 Apr 2023 14:23:40 +0000 (16:23 +0200)]
fix variables declared in conditional statement
as that can trigger hard to reproduce/debug bugs; as with such
statements the variable won't be necessarily undef if the post-if
evaluates to false, but rather will hold the (now bogus) value from
the last time it evaluated to true.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 17 Mar 2023 14:30:49 +0000 (15:30 +0100)]
d/changelog: fix typo
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 17 Mar 2023 14:28:37 +0000 (15:28 +0100)]
bump version to 4.3-1
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Alexandre Derumier [Thu, 9 Mar 2023 15:34:16 +0000 (16:34 +0100)]
Fix #4550 : host options: add nf_conntrack_helpers
kernel 6.1 have removed auto helpers loading.
This was deprecaded since multiple years.
We simply need to add rules in PREROUTING to load theses helpers.
supported protocols :
- amanda
- ftp
- irc (ipv4 only)
- netbios-ns (ipv4 only)
- pptp (ipv4 only)
- sane
- sip
- snmp (ipv4 only)
- tftp
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Wolfgang Bumiller [Fri, 27 Jan 2023 09:51:37 +0000 (10:51 +0100)]
d/control: depend on pve-common 7.3-2 for new dump-log variant
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Christian Ebner [Thu, 19 Jan 2023 10:25:04 +0000 (11:25 +0100)]
api: Add optional parameters `since` and `until` for timestamp filter
The optional unix epoch timestamps parameters `since` and `until` are introduced
in order to filter firewall logs files. If one of these flags is set, also
rotated logfiles are included. This is handled in the `dump_fw_logfile` helper
function. Filtering is now performed based on a callback function passed to
`dump_fw_logfile`.
This patch depends on the corresponding patch in the pve-common repository.
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
[w.bumiller@proxmox.com: fixup 'continue' -> 'next']
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Stefan Hrdlicka [Tue, 13 Dec 2022 15:14:19 +0000 (16:14 +0100)]
cleanup: don't capture "/xx" of CIDR
Signed-off-by: Stefan Hrdlicka <s.hrdlicka@proxmox.com>
Stefan Hrdlicka [Tue, 13 Dec 2022 15:14:18 +0000 (16:14 +0100)]
allow non zero ip address host bits to be entered
They can already be set directly via the cluster.fw file. Net::IP is just a
bit more picky with what it allows:
For example:
error: 192.168.1.155/24
correct: 192.168.1.0/24
This cleans the entered IP and removes the non zero host bits.
Signed-off-by: Stefan Hrdlicka <s.hrdlicka@proxmox.com>
Thomas Lamprecht [Thu, 17 Nov 2022 18:53:09 +0000 (19:53 +0100)]
bump version to 4.2-7
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Leo Nunner [Mon, 24 Oct 2022 10:02:01 +0000 (12:02 +0200)]
fix #4268: add 'force' parameter to delete IPSet with members
Currently, trying to delete a non-empty IPSet will throw an error.
Manually deleting all members of the set might be a time-consuming
process, which the force parameter allows to bypass.
Signed-off-by: Leo Nunner <l.nunner@proxmox.com>
Thomas Lamprecht [Wed, 16 Nov 2022 16:03:12 +0000 (17:03 +0100)]
helpers: move over missing lock_vmfw_conf
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 16 Nov 2022 16:02:54 +0000 (17:02 +0100)]
helpers: re-introduce original call site for backward compat
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Alexandre Derumier [Wed, 29 Jun 2022 09:08:29 +0000 (11:08 +0200)]
move clone_vmfw_conf && remove_vmfw_conf to a Helpers
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Wolfgang Bumiller [Tue, 4 Oct 2022 11:18:05 +0000 (13:18 +0200)]
whitespace fixup
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Leo Nunner [Wed, 28 Sep 2022 09:11:44 +0000 (11:11 +0200)]
fix #4204: automatically update usages of group when it is renamed
When renaming a group, the usages didn't get updated automatically. To
get around problems with atomicity, the old rule is first cloned with the
new name, the usages are updated and only when updating has finished, the
old rule is deleted.
The subroutines that lock/update host configs had to be changed so that
it's possible to lock any config, not just the one of the current host.
Signed-off-by: Leo Nunner <l.nunner@proxmox.com>
Thomas Lamprecht [Mon, 12 Sep 2022 15:22:39 +0000 (17:22 +0200)]
macros: s/SPICE/SPICEproxy/
while I'm still a bit on the edge about the usefulness of this macro,
it should better convey for what it is, as SPICE itself doesn't
really have a direct port (in PVE that is), but all runs through our
spiceproxy, so name the macro that way.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Oguz Bektas [Wed, 29 Jun 2022 11:07:08 +0000 (13:07 +0200)]
fix #4018: add firewall macro for SPICE
uses port 3128 (same as squid)
although it's enabled by default for the "management" ipset, it doesn't
hurt to add it in there.
Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
Thomas Lamprecht [Mon, 29 Aug 2022 07:43:59 +0000 (09:43 +0200)]
bump version to 4.2-6
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Fabian Grünbichler [Wed, 27 Jul 2022 13:07:52 +0000 (15:07 +0200)]
fix #4175: ignore non-filter ebtables tables
we only ever add rules to the filter table, without this we'd add all
rules from other tables (which might have been manually filled by the
admin) to the filter table as well - adding another copy on every
iteration of the firewall update cycle!
note that ebtables-restore seems to flush tables contained in its input,
but leave those alone which are not referenced at all.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Mira Limbeck [Wed, 24 Aug 2022 12:24:30 +0000 (14:24 +0200)]
fix invalid vmfw config being interpreted as enabled
MAC filter was enabled as long as the VM firewall config existed even
with an invalid config.
With this change the check now matches the one for CTs.
Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
Thomas Lamprecht [Thu, 25 Aug 2022 13:56:29 +0000 (15:56 +0200)]
daemon: code cleanup/shortify
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Thu, 25 Aug 2022 13:51:11 +0000 (15:51 +0200)]
whitespace/indentation/line-length cleanup
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Sun, 15 May 2022 06:47:03 +0000 (08:47 +0200)]
config defaults: macfilter defaults to on
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Thu, 4 Nov 2021 15:37:17 +0000 (16:37 +0100)]
bump version to 4.2-5
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 29 Oct 2021 16:13:20 +0000 (18:13 +0200)]
fix #3677: follow up: actually handle bucket size and ignore initval
The former is simply new and we can control it, so do so instead of
ignoring it, if it seems worth while we can also expose that as
option or do some fancier auto calculation, maybe depending on ipset
size.
The u32 `initval` is a bit different, its not a config in the exact
traditional sense but would allow to recreate an bit to bit
indentical save/restore - but we do not really do that and we cannot
pre-calculate that our self (or at least I'd rather like to avoid
doing that from perl).. So, ignore it actively for now to avoid
false-postivie detection in pending changes.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Mark Yardley [Mon, 18 Oct 2021 20:21:32 +0000 (21:21 +0100)]
fix #3677 ipset_get_chains fixed to work with new ipset output
Signed-off-by: Mark Yardley <mgit@fragmentedpackets.net>
Thomas Lamprecht [Tue, 12 Oct 2021 08:39:12 +0000 (10:39 +0200)]
bump version to 4.2-4
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 10 Sep 2021 11:00:11 +0000 (13:00 +0200)]
bump version to 4.2-3
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Lorenz Stechauner [Thu, 5 Aug 2021 10:59:03 +0000 (12:59 +0200)]
fix #2721: remove reject tcp 43 from default drop and reject actions
first, '43' is a typo, it should say '113' (if it really is like
legacy shorewall [0]). this tcp port corresponds to the ident or
authentication service protocol.
second, nowdays this reject is not included in shorewall anymore.
furthermore it would make no sense to reject specifically this
one port.
[0] https://gitlab.com/shorewall/code/-/blob/4.6.13/Shorewall/action.Drop#L66
https://gitlab.com/shorewall/code/-/blob/4.6.13/Shorewall/Macros/macro.Auth
Signed-off-by: Lorenz Stechauner <l.stechauner@proxmox.com>
Thomas Lamprecht [Mon, 21 Jun 2021 09:31:47 +0000 (11:31 +0200)]
bump version to 4.2-2
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Stoiko Ivanov [Wed, 26 May 2021 14:51:59 +0000 (16:51 +0200)]
set sysctls on every apply
setting the sysctls needed on every run should not be too costly
(the original implementation used a `system` invocation, which was
far more expensive), and reduce the chances for side-effects.
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Thomas Lamprecht [Mon, 24 May 2021 09:39:09 +0000 (11:39 +0200)]
buildsys: change upload/repo dist to bullseye
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 24 May 2021 09:15:50 +0000 (11:15 +0200)]
d/rules: cleanup systemd overrides
both, `override_dh_systemd_enable` and `override_dh_systemd_start`
are ignored with current compat level 12, and will become an error in
level >= 13, so drop them and use `override_dh_installsystemd` for
both of the previous uses.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 12 May 2021 18:23:15 +0000 (20:23 +0200)]
bump version to 4.2-1
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 12 May 2021 18:24:23 +0000 (20:24 +0200)]
debian: run wrap-and-sort -abt
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 12 May 2021 18:23:07 +0000 (20:23 +0200)]
install pvefw-logger.service in multi-user.target
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 12 May 2021 18:04:52 +0000 (20:04 +0200)]
d/control: bump debhelper compat to >= 12
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 12 May 2021 17:58:46 +0000 (19:58 +0200)]
fw logger: cosmetic fixes
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Aaron Lauterer [Thu, 22 Apr 2021 12:30:09 +0000 (14:30 +0200)]
fix #967: source: dest: limit length
iptables-restore has a buffer limit of 1024 for paramters [0].
If users end up adding a long list of IPs in the source or dest field
they might reach this limit. The result is that the rule will not be
applied and pve-firewall will show some error in the syslog which will
be "hidden" for most users.
Enforcing a smaller limit ourselves should help to avoid any such
situation. 512 characters should help to not run into any problems that
stem from differences in what counts as character. If people need longer
lists, using IP sets are the better approach anyway.
[0] http://git.netfilter.org/iptables/tree/iptables/xshared.c?h=v1.8.7#n469
Signed-off-by: Aaron Lauterer <a.lauterer@proxmox.com>
Mira Limbeck [Mon, 22 Feb 2021 12:00:18 +0000 (13:00 +0100)]
fix #2358: allow --<opt> in firewall rule config files
The docs mention --<opt> as valid syntax for firewall rules, but the
code that parses the .fw files only accepts -<opt>. To make it
consistent with the docs and the API, also accept --<opt>.
In addition allow 'proto' as option, not only '-p'.
Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
Thomas Lamprecht [Fri, 18 Sep 2020 14:51:40 +0000 (16:51 +0200)]
bump version to 4.1-3
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 18 Sep 2020 14:39:08 +0000 (16:39 +0200)]
improve log burst property description
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 18 Sep 2020 14:37:06 +0000 (16:37 +0200)]
various typo fixes
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Mira Limbeck [Fri, 29 May 2020 12:22:04 +0000 (14:22 +0200)]
introduce new icmp-type parameter
Currently icmp types are handled via 'dport'. This is not documented
anywhere except for a single line of comment in the code. To untangle
the icmp-type handling from the dport handling a new 'icmp-type'
parameter is introduced.
The valid 'icmp-type' values are limited to the names
(icmp[v6]_type_names hash in the code, same as ip[6]tables provides).
Type[/Code] values are not supported.
Support for ipv6-icmp is added to icmp-type parameter handling. This makes it
possible to specify icmpv6 types via the GUI.
Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
Stoiko Ivanov [Tue, 2 Jun 2020 08:06:17 +0000 (10:06 +0200)]
fix #2773: ebtables: keep policy of custom chains
currently all ebtalbes chains are created with a hardcoded policy of ACCEPT.
This patch changes the functionality to store the configured policy of a
chain while reading the 'ebtables-save' output and uses this policy when
creating the command list.
This is only relevant for ebtablers chains not generated by pve-firewall (the
ones having an action of 'ignore' in the status-hash).
Reported on the pve-user list:
https://pve.proxmox.com/pipermail/pve-user/2020-May/171731.html
Minimally tested with the example from the thread.
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Thomas Lamprecht [Wed, 6 May 2020 15:41:46 +0000 (17:41 +0200)]
bump version to 4.1-2
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 6 May 2020 15:40:33 +0000 (17:40 +0200)]
Revert "rules: verify referenced security group exists"
This could never work, we do not have the groups parsed at this
point..
This reverts commit
312ae5161f80d7cd600d9a182eb0b70492489a05.
Thomas Lamprecht [Mon, 4 May 2020 13:02:01 +0000 (15:02 +0200)]
bump version to 4.1-1
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 4 May 2020 12:13:23 +0000 (14:13 +0200)]
add dport: factor out ICMP-type validity checking
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 4 May 2020 12:13:02 +0000 (14:13 +0200)]
icmp: allow to specify the echo-reply (0) type as integer
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 4 May 2020 12:12:13 +0000 (14:12 +0200)]
fix typo: s/ICPM/ICMP/
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 4 May 2020 12:10:53 +0000 (14:10 +0200)]
test/simulator: add very basic ICMP type functionallity
For now without integer to full-name, and vice versa, mapping of
ICMP types.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 4 May 2020 12:09:53 +0000 (14:09 +0200)]
fwtester: reduce extra empty lines a bit
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 4 May 2020 11:52:44 +0000 (13:52 +0200)]
test/README: whitespace fixes and slight rewording
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Mira Limbeck [Wed, 29 Apr 2020 13:45:24 +0000 (15:45 +0200)]
fix wrong icmpv6 types
This removes icmpv6-type 'any' as it is not supported by ip6tables. Also
introduced new icmpv6 types 'beyond-scope', 'failed-policy' and
'reject-route'. These values were taken from 'ip6tables -p icmpv6 -h'.
Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
Mira Limbeck [Wed, 29 Apr 2020 13:45:23 +0000 (15:45 +0200)]
fix iptables-restore failing if icmp-type value > 255
This has to be done in both icmp and icmpv6 cases. Currently if
'ipv6-icmp' is set via the GUI ('icmpv6' is not available there) there
is no icmp-type handling. As this is meant to fix the iptables-restore
failure if an icmp-type > 255 is specified, no ipv6-icmp handling is
introduced.
These error messages are not logged as warnings are ignored. To get
these messages you have to run pve-firewall compile and look at the
output.
Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
Thomas Lamprecht [Sat, 2 May 2020 16:57:04 +0000 (18:57 +0200)]
d/control: bump pve-cluster dependency for new lock methods
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Fabian Grünbichler [Wed, 29 Apr 2020 08:52:56 +0000 (10:52 +0200)]
rules: verify referenced security group exists
while this was already handled properly (as empty rules), adding this as
error makes it much more visible (in the GUI as well).
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Wed, 29 Apr 2020 08:52:55 +0000 (10:52 +0200)]
configs: warn about duplicate ipset entries
instead of silently dropping them when writing the config out.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Wed, 29 Apr 2020 08:52:54 +0000 (10:52 +0200)]
api/ipsets: parse_cidr before checking for duplicates
for example, the config parser drops a trailing /32 for IPv4, so we
should do the same here. otherwise we can have one entry for $IP and
one for $IP/32 with different properties until the next R-M-W cycle
drops one of them again.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Wed, 29 Apr 2020 08:52:53 +0000 (10:52 +0200)]
clone_vmfw_conf: lock new config
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Wed, 29 Apr 2020 08:52:52 +0000 (10:52 +0200)]
api: lock configs
wherever we have a r-m-w cycle.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Wed, 29 Apr 2020 08:52:50 +0000 (10:52 +0200)]
api: add locking helpers
for ipset, rules and alias API generation modules.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Wed, 29 Apr 2020 08:52:49 +0000 (10:52 +0200)]
configs: add locking helpers
to allow some level of safe concurrent config modification, instead of
the current free for all.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Mira Limbeck [Thu, 30 Apr 2020 10:26:41 +0000 (12:26 +0200)]
fix #2686: don't add arp-ip-src filter for dhcp
When the IPFilter setting is enabled and the container has DHCP
configured on an interface no 'arp-ip-src' filter should be added as we
don't have an IP address.
Previously '--arp-ip-src dhcp' was passed to ebtables which led to an error.
Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
Christian Ebner [Tue, 28 Jan 2020 16:57:26 +0000 (17:57 +0100)]
logging: Add missing logmsg for inbound rules
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
Thomas Lamprecht [Mon, 27 Jan 2020 18:25:53 +0000 (19:25 +0100)]
bump version to 4.0-10
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Christian Ebner [Tue, 21 Jan 2020 09:24:30 +0000 (10:24 +0100)]
macros: add macro for Proxmox Mail Gateway web interface
Macro to allow access to the PMG web interface when hosted on PVE.
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
Thomas Lamprecht [Thu, 9 Jan 2020 12:03:52 +0000 (13:03 +0100)]
fwtester: sort and group module usage
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Thu, 9 Jan 2020 11:55:13 +0000 (12:55 +0100)]
api node: always pass cluster conf to node FW parser
As else the parsing may lead to "false positive" errors, as cluster
wide aliases and other definitions are seemingly missing.
Reproducer:
* add *cluster* alias
* add+enable *host* rule using that alias
* enable FW on DC and node level
* go to Node -> FW -> Options
* check journal/syslog for error like:
> pveproxy[
1339680]: /etc/pve/nodes/dev6/host.fw (line 3) - errors in rule parameters: IN ACCEPT -source test123 -p tcp -sport 22 -log nolog
> pveproxy[
1339680]: source: no such alias 'test123'
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 13 Dec 2019 11:07:16 +0000 (12:07 +0100)]
grammar fix: s/does not exists/does not exist/g
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 3 Dec 2019 07:12:23 +0000 (08:12 +0100)]
bump version to 4.0-9
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Christian Ebner [Mon, 2 Dec 2019 15:55:57 +0000 (16:55 +0100)]
rules: allow connections on port range 60000:60050 in management network for migration
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
Wolfgang Bumiller [Mon, 18 Nov 2019 12:51:46 +0000 (13:51 +0100)]
bump version to 4.0-8
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Alexandre Derumier [Tue, 12 Nov 2019 12:59:04 +0000 (13:59 +0100)]
add synflood protection
Currently, a virtio-net + vhost-net can handle between 200-300 kpps for each vm (with 1core/queue=1).
That mean than a vm can easily overloaded with a simple synflood (hping3 --flood -p 80 -S targetip).
Also the conntrack of the host can be saturated easily.
This patch introduce a new option, enable rate limiting of syn/s by src ip (protection_synflood:1).
rate limit can be set with : protection_synflood_rate (default 200 syn/s)
with an extra burst: protection_synflood_rate (default 1000).
It's also possible to reduce conntrack syn timeout: nf_conntrack_tcp_timeout_syn_recv (default 60).
with default values, a src ip can take around (60 * 200 = 12000 conntrack entries).
The iptables rules are done in raw table, before reaching the conntrack.
This protection works fine for non-spoofed src ip.
For spoofed src ip, the only way could be to implement SYNPROXY,
but this only works for routed/nat setup. (The host need to be able to reply
with the src ip the vm)
Some good information about synflood protections
https://2014.rmll.info/slides/356/day_1-1400-Jesper_Brouer-DDoS_protection_using_Netfilter_iptables.pdf
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>