pve-firewall.git
3 years agoallow numeric icmp types
Wolfgang Bumiller [Tue, 16 Feb 2016 10:20:37 +0000 (11:20 +0100)]
allow numeric icmp types

3 years agoip6tables accepts both spellings of the word neighbor
Wolfgang Bumiller [Tue, 16 Feb 2016 10:20:36 +0000 (11:20 +0100)]
ip6tables accepts both spellings of the word neighbor

3 years agoadd DHCPv6 macro
Wolfgang Bumiller [Tue, 16 Feb 2016 10:20:35 +0000 (11:20 +0100)]
add DHCPv6 macro

3 years agoipv6 neighbor discovery and solicitation macros
Wolfgang Bumiller [Tue, 16 Feb 2016 10:20:34 +0000 (11:20 +0100)]
ipv6 neighbor discovery and solicitation macros

4 years agobump version to 1.0-21
Dietmar Maurer [Wed, 18 Mar 2015 05:11:45 +0000 (06:11 +0100)]
bump version to 1.0-21

4 years agoallow admins to delete security groups
Dietmar Maurer [Wed, 18 Mar 2015 05:08:53 +0000 (06:08 +0100)]
allow admins to delete security groups

4 years agoalways use local_network alias if specified by user
Dietmar Maurer [Mon, 16 Mar 2015 05:30:43 +0000 (06:30 +0100)]
always use local_network alias if specified by user

4 years agobump version to 1.0-20
Dietmar Maurer [Sun, 15 Mar 2015 09:21:31 +0000 (10:21 +0100)]
bump version to 1.0-20

4 years agocorrectly emit ipv6 rules for host firewall
Dietmar Maurer [Sun, 15 Mar 2015 09:11:00 +0000 (10:11 +0100)]
correctly emit ipv6 rules for host firewall

4 years agobump version to 1.0-19
Dietmar Maurer [Mon, 2 Mar 2015 05:29:30 +0000 (06:29 +0100)]
bump version to 1.0-19

4 years agoimplement permission for Alias class.
Dietmar Maurer [Mon, 2 Mar 2015 05:27:19 +0000 (06:27 +0100)]
implement permission for Alias class.

4 years agobump version to 1.0-18
Dietmar Maurer [Mon, 9 Feb 2015 08:32:53 +0000 (09:32 +0100)]
bump version to 1.0-18

4 years agofix alias lookup
Dietmar Maurer [Mon, 9 Feb 2015 08:31:18 +0000 (09:31 +0100)]
fix alias lookup

4 years agobump version to 1.0-17
Dietmar Maurer [Thu, 15 Jan 2015 05:55:38 +0000 (06:55 +0100)]
bump version to 1.0-17

4 years agoadd preinst script
Dietmar Maurer [Thu, 15 Jan 2015 05:53:45 +0000 (06:53 +0100)]
add preinst script

Older versions of the pve-firewall daemon do not restart
with HUP, so we need to do a stop/start.

4 years agofix call to register_restart_command (set $use_hup to true)
Dietmar Maurer [Thu, 15 Jan 2015 05:44:58 +0000 (06:44 +0100)]
fix call to register_restart_command (set $use_hup to true)

4 years agoremove class paramenter from register_XXX_command
Dietmar Maurer [Wed, 31 Dec 2014 16:40:51 +0000 (17:40 +0100)]
remove class paramenter from register_XXX_command

4 years agosimplify code (error log is done inside Daemon.pm)
Dietmar Maurer [Wed, 31 Dec 2014 16:18:53 +0000 (17:18 +0100)]
simplify code (error log is done inside Daemon.pm)

4 years agoimprove logging
Dietmar Maurer [Wed, 31 Dec 2014 11:34:17 +0000 (12:34 +0100)]
improve logging

4 years agofix arguments for register_restart_command
Dietmar Maurer [Thu, 18 Dec 2014 12:48:24 +0000 (13:48 +0100)]
fix arguments for register_restart_command

4 years agobump version to 1.0-16
Dietmar Maurer [Thu, 18 Dec 2014 08:45:18 +0000 (09:45 +0100)]
bump version to 1.0-16

4 years agouse Daemon class from pve-common
Dietmar Maurer [Tue, 16 Dec 2014 11:15:43 +0000 (12:15 +0100)]
use Daemon class from pve-common

4 years agobump version to 1.0-15
Dietmar Maurer [Fri, 12 Dec 2014 05:33:58 +0000 (06:33 +0100)]
bump version to 1.0-15

4 years agofirewall update : load cluster conf for host rules
Alexandre Derumier [Thu, 11 Dec 2014 13:25:42 +0000 (14:25 +0100)]
firewall update : load cluster conf for host rules

Currently we can't use ipsets defined in cluster in host rules

host.fw
----------
[OPTIONS]

log_level_in: debug
enable: 1
tcp_flags_log_level: debug
log_level_out: debug
tcpflags: 1
smurf_log_level: debug

[RULES]

IN ACCEPT -source +whitelist

in sub update {
my $hostfw_conf = load_hostfw_conf();
}

$VAR1 = {
          'options' => {
                         'enable' => 1,
                         'log_level_in' => 'debug',
                         'tcp_flags_log_level' => 'debug',
                         'log_level_out' => 'debug',
                         'tcpflags' => 1,
                         'smurf_log_level' => 'debug'
                       },
          'ipset' => {},
          'rules' => [
                       {
                         'source' => '+whitelist',
                         'enable' => 1,
                         'errors' => {
                                       'source' => 'no such ipset \'whitelist\''
                                     },
                         'action' => 'ACCEPT',
                         'type' => 'in'
                       }
                     ]
        };

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
4 years agobump version to 1.0-14
Dietmar Maurer [Fri, 5 Dec 2014 12:42:07 +0000 (13:42 +0100)]
bump version to 1.0-14

4 years agodo not use ipset list chains
Dietmar Maurer [Sat, 29 Nov 2014 07:40:46 +0000 (08:40 +0100)]
do not use ipset list chains

Instead, we directly use -v4 and -v6 names inside iptables rules.

So we can safely remove the preinst script.

4 years agobump version to 1.0-13
Dietmar Maurer [Fri, 28 Nov 2014 11:46:25 +0000 (12:46 +0100)]
bump version to 1.0-13

4 years agofix ipset remove order
Dietmar Maurer [Fri, 28 Nov 2014 11:43:31 +0000 (12:43 +0100)]
fix ipset remove order

4 years agoadd debian/dirs file to install /var/lib/pve-firewall
Dietmar Maurer [Fri, 28 Nov 2014 10:39:47 +0000 (11:39 +0100)]
add debian/dirs file to install /var/lib/pve-firewall

4 years agobump version to 1.0-12
Dietmar Maurer [Fri, 28 Nov 2014 08:00:13 +0000 (09:00 +0100)]
bump version to 1.0-12

4 years agoadd preinst script
Dietmar Maurer [Fri, 28 Nov 2014 07:56:21 +0000 (08:56 +0100)]
add preinst script

We need to clear ipset from older installation, because sets cannot be
swapped if there type does not match.

4 years agobump version to 1.0-11
Dietmar Maurer [Fri, 28 Nov 2014 07:04:26 +0000 (08:04 +0100)]
bump version to 1.0-11

4 years agoverify_rule: correctly set ipversion for aliases
Dietmar Maurer [Fri, 28 Nov 2014 07:01:52 +0000 (08:01 +0100)]
verify_rule: correctly set ipversion for aliases

4 years agosave restore commands into files (debug help)
Dietmar Maurer [Fri, 28 Nov 2014 06:09:37 +0000 (07:09 +0100)]
save restore commands into files (debug help)

To make it easier to debug restore errors.

4 years agobump version to 1.0-10
Dietmar Maurer [Wed, 26 Nov 2014 06:04:21 +0000 (07:04 +0100)]
bump version to 1.0-10

4 years agopve-firewall compile: improve output format
Dietmar Maurer [Wed, 26 Nov 2014 06:03:14 +0000 (07:03 +0100)]
pve-firewall compile: improve output format

5 years agoAPI2::Firewall::IPSet: fix alias check for ipv6 addresses
Dietmar Maurer [Mon, 17 Nov 2014 11:41:03 +0000 (12:41 +0100)]
API2::Firewall::IPSet: fix alias check for ipv6 addresses

5 years agoget_ipset_cmdlist: avoid restore problems due to wrong order
Dietmar Maurer [Mon, 10 Nov 2014 11:50:29 +0000 (12:50 +0100)]
get_ipset_cmdlist: avoid restore problems due to wrong order

5 years agoimprove error messages
Dietmar Maurer [Mon, 10 Nov 2014 11:49:00 +0000 (12:49 +0100)]
improve error messages

5 years agodo not emit smurfs chain for ipv6
Dietmar Maurer [Mon, 10 Nov 2014 11:47:31 +0000 (12:47 +0100)]
do not emit smurfs chain for ipv6

5 years agoipv6 addrtype does not work with kernel 2.6.32, use -d ff00::/8 instead
Dietmar Maurer [Mon, 10 Nov 2014 11:45:02 +0000 (12:45 +0100)]
ipv6 addrtype does not work with kernel 2.6.32, use -d ff00::/8 instead

5 years agoadd ipv6 examples
Alexandre Derumier [Tue, 15 Jul 2014 23:14:32 +0000 (01:14 +0200)]
add ipv6 examples

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoip6tables : remove_pvefw_chains
Alexandre Derumier [Tue, 15 Jul 2014 23:14:31 +0000 (01:14 +0200)]
ip6tables : remove_pvefw_chains

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoapply ipv6 ruleset
Alexandre Derumier [Tue, 15 Jul 2014 23:14:30 +0000 (01:14 +0200)]
apply ipv6 ruleset

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agocompile ipv6 ruleset
Alexandre Derumier [Tue, 15 Jul 2014 23:14:29 +0000 (01:14 +0200)]
compile ipv6 ruleset

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoadd ip6tables standard chains
Alexandre Derumier [Tue, 15 Jul 2014 23:14:28 +0000 (01:14 +0200)]
add ip6tables standard chains

- icmp types in reject are different than ipv4
- broadcast not exist in ipv6
- I don't think that smurf attack exist (no broadcast)

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoadd icmpv6 support
Dietmar Maurer [Tue, 4 Nov 2014 09:53:01 +0000 (10:53 +0100)]
add icmpv6 support

skip icmpv6 rule for iptables rules
skip icmp rule for ip6tables rules

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
5 years agoadd ipv6 ipset support
Dietmar Maurer [Tue, 4 Nov 2014 07:43:38 +0000 (08:43 +0100)]
add ipv6 ipset support

big change here,
we create now a ipset which include 2 others ipsets for ipv4 and ipv6

PVEFW-0-blacklist list:set
    PVEFW-0-blacklist-v4 hash:net family inet4
    PVEFW-0-blacklist-v6 hash:net family inet6

v4 and v6, are only created if ip address are defined in the set
in iptables rules, we use the main set.

Benchmark show no performance impact

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
5 years agoipset_match: implement simulation of list type ipsets
Dietmar Maurer [Tue, 4 Nov 2014 06:44:37 +0000 (07:44 +0100)]
ipset_match: implement simulation of list type ipsets

5 years agoresolve_alias: use better regex to detect alias
Dietmar Maurer [Mon, 3 Nov 2014 05:23:26 +0000 (06:23 +0100)]
resolve_alias: use better regex to detect alias

5 years agocode cleanup
Dietmar Maurer [Fri, 31 Oct 2014 12:06:52 +0000 (13:06 +0100)]
code cleanup

5 years agocheck ipversion of aliases
Alexandre Derumier [Tue, 15 Jul 2014 23:14:24 +0000 (01:14 +0200)]
check ipversion of aliases

also add support for ipv6

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoskip group rules generation if rule ipversion don't match iptables version
Alexandre Derumier [Tue, 15 Jul 2014 23:14:22 +0000 (01:14 +0200)]
skip group rules generation if rule ipversion don't match iptables version

we skip ipv6 rules for iptables
we skip ipv4 rules for ip6tables

if rule ipversion is undef, we apply to both iptables and ip6tables

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agouse integer compare for $ipversion
Dietmar Maurer [Fri, 31 Oct 2014 11:08:10 +0000 (12:08 +0100)]
use integer compare for $ipversion

5 years agoenable hostfw for ipv4 only
Alexandre Derumier [Tue, 15 Jul 2014 23:14:21 +0000 (01:14 +0200)]
enable hostfw for ipv4 only

currently pveproxy don't works with ipv6,
so let's generate host fw ipv4 only for the moment

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agofix venet rule generation: venet can have ipv4 and ipv6 address
Dietmar Maurer [Fri, 31 Oct 2014 11:03:17 +0000 (12:03 +0100)]
fix venet rule generation: venet can have ipv4 and ipv6 address

5 years ago$ipversion is interger, so use '!=' instead of string 'ne'
Dietmar Maurer [Thu, 30 Oct 2014 12:35:55 +0000 (13:35 +0100)]
$ipversion is interger, so use '!=' instead of string 'ne'

5 years agoskip vms rules generation if rule ipversion don't match iptables version
Alexandre Derumier [Tue, 15 Jul 2014 23:14:20 +0000 (01:14 +0200)]
skip vms rules generation if rule ipversion don't match iptables version

we skip ipv6 rules for iptables
we skip ipv4 rules for ip6tables

if rule ipversion is undef, we apply to both iptables and ip6tables

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoverify_rule: detected mixed ipv4/ipv6 addresses
Dietmar Maurer [Thu, 30 Oct 2014 12:27:01 +0000 (13:27 +0100)]
verify_rule: detected mixed ipv4/ipv6 addresses

5 years agoparse_address_list: improve type detection
Dietmar Maurer [Thu, 30 Oct 2014 12:12:58 +0000 (13:12 +0100)]
parse_address_list: improve type detection

5 years agoparse_address_list: make sure we only have one type of addresses (ipv4 or ipv6)
Dietmar Maurer [Thu, 30 Oct 2014 11:58:09 +0000 (12:58 +0100)]
parse_address_list: make sure we only have one type of addresses (ipv4 or ipv6)

5 years agofix error message
Dietmar Maurer [Thu, 30 Oct 2014 11:52:29 +0000 (12:52 +0100)]
fix error message

5 years agorename pve-fw-v4addr-spec to pve-fw-addr-spec
Dietmar Maurer [Thu, 30 Oct 2014 11:43:52 +0000 (12:43 +0100)]
rename pve-fw-v4addr-spec to pve-fw-addr-spec

Because we allow ipv4 and ipv6 addresses now.

5 years agoparse_rules src && dst ipversion
Alexandre Derumier [Tue, 15 Jul 2014 23:14:19 +0000 (01:14 +0200)]
parse_rules src && dst ipversion

check the ipversion of src and dst in rules

(fixme : parse ip in range)

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agocleanup generate_std_chains: don't overwrite global variable $pve_std_chains
Dietmar Maurer [Thu, 30 Oct 2014 11:21:00 +0000 (12:21 +0100)]
cleanup generate_std_chains: don't overwrite global variable $pve_std_chains

Instead, pass $ipversion and use local var $std_chains.

5 years agomove $pve_std_chains to $pve_std_chains->{$ipversion}
Alexandre Derumier [Tue, 15 Jul 2014 23:14:18 +0000 (01:14 +0200)]
move $pve_std_chains to $pve_std_chains->{$ipversion}

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agosplit compile to compile_iptables_filter
Alexandre Derumier [Tue, 15 Jul 2014 23:14:17 +0000 (01:14 +0200)]
split compile to compile_iptables_filter

compile just read configs file and will call compile_iptables_filter for iptables and ip6tables

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agobump version to 1.0-9
Dietmar Maurer [Tue, 14 Oct 2014 14:30:01 +0000 (16:30 +0200)]
bump version to 1.0-9

5 years agofix max ipset name lenght
Dietmar Maurer [Tue, 14 Oct 2014 14:28:44 +0000 (16:28 +0200)]
fix max ipset name lenght

5 years agomake dependency to cman/clvm optional
Dietmar Maurer [Mon, 8 Sep 2014 11:06:39 +0000 (13:06 +0200)]
make dependency to cman/clvm optional

5 years agodo not start daemons during installation
Dietmar Maurer [Mon, 8 Sep 2014 10:25:13 +0000 (12:25 +0200)]
do not start daemons during installation

5 years agobump version to 1.0-8
Dietmar Maurer [Mon, 8 Sep 2014 10:17:02 +0000 (12:17 +0200)]
bump version to 1.0-8

5 years agoFirewall/IPSet: implement permission
Dietmar Maurer [Mon, 21 Jul 2014 08:48:00 +0000 (10:48 +0200)]
Firewall/IPSet: implement permission

Facor out common code into PVE/Firewall.

5 years agoFirewall/Rules: add permissions
Dietmar Maurer [Mon, 21 Jul 2014 08:24:09 +0000 (10:24 +0200)]
Firewall/Rules: add permissions

5 years agoFirewall/Groups: add permissions
Dietmar Maurer [Mon, 21 Jul 2014 07:54:42 +0000 (09:54 +0200)]
Firewall/Groups: add permissions

5 years agoFirewall/VM: add permissions
Dietmar Maurer [Mon, 21 Jul 2014 07:52:01 +0000 (09:52 +0200)]
Firewall/VM: add permissions

5 years agoFirewall/Host: add permissions
Dietmar Maurer [Mon, 21 Jul 2014 07:40:34 +0000 (09:40 +0200)]
Firewall/Host: add permissions

5 years agoFirewall/Cluster: add permissions
Dietmar Maurer [Mon, 21 Jul 2014 07:33:18 +0000 (09:33 +0200)]
Firewall/Cluster: add permissions

5 years agogenerate MAC and IP filter rules if firewall is enabled on NIC
Dietmar Maurer [Thu, 26 Jun 2014 07:07:27 +0000 (09:07 +0200)]
generate MAC and IP filter rules if firewall is enabled on NIC

Only omit rules if firewall is disabled. Also remove ipfilter for
venet, because that is not required (kernel does that job for us).

5 years agobump version to 1.0-7
Dietmar Maurer [Thu, 26 Jun 2014 05:13:16 +0000 (07:13 +0200)]
bump version to 1.0-7

5 years agoproxy host rule API calls to correct node
Dietmar Maurer [Thu, 26 Jun 2014 05:12:06 +0000 (07:12 +0200)]
proxy host rule API calls to correct node

5 years agobump version to 1.0-6
Dietmar Maurer [Thu, 12 Jun 2014 06:37:43 +0000 (08:37 +0200)]
bump version to 1.0-6

5 years agoadd example for ipfilter ipset
Dietmar Maurer [Thu, 12 Jun 2014 06:36:05 +0000 (08:36 +0200)]
add example for ipfilter ipset

5 years agoadd regression tests for ipfilter
Dietmar Maurer [Thu, 12 Jun 2014 06:32:11 +0000 (08:32 +0200)]
add regression tests for ipfilter

5 years agofwtester: add more network (net1, net2) to vm100 to test ipfilter
Dietmar Maurer [Thu, 12 Jun 2014 06:30:33 +0000 (08:30 +0200)]
fwtester: add more network (net1, net2) to vm100 to test ipfilter

5 years agoimplement negative ipset match
Dietmar Maurer [Thu, 12 Jun 2014 06:29:32 +0000 (08:29 +0200)]
implement negative ipset match

To simulate ipfilter.

5 years agouse separate ipfilter ipset on each interface
Dietmar Maurer [Thu, 12 Jun 2014 04:39:31 +0000 (06:39 +0200)]
use separate ipfilter ipset on each interface

5 years agoadd support for ipfilter ipset
Dietmar Maurer [Wed, 11 Jun 2014 07:59:21 +0000 (09:59 +0200)]
add support for ipfilter ipset

5 years agogenerate /etc/pve/firewall directory automatically
Dietmar Maurer [Wed, 4 Jun 2014 07:13:43 +0000 (09:13 +0200)]
generate /etc/pve/firewall directory automatically

5 years agoavoid errors about undefined values
Dietmar Maurer [Wed, 4 Jun 2014 07:03:53 +0000 (09:03 +0200)]
avoid errors about undefined values

5 years agobump version to 1.0-5
Dietmar Maurer [Wed, 4 Jun 2014 06:50:57 +0000 (08:50 +0200)]
bump version to 1.0-5

5 years agoremove ipsets when firewall disabled
Dietmar Maurer [Wed, 4 Jun 2014 06:40:15 +0000 (08:40 +0200)]
remove ipsets when firewall disabled

And improve status output

5 years agoreturn empty ruleset if firewall disabled in cluster.fw
Dietmar Maurer [Wed, 4 Jun 2014 05:24:34 +0000 (07:24 +0200)]
return empty ruleset if firewall disabled in cluster.fw

5 years agobump version to 1.0-4
Dietmar Maurer [Wed, 4 Jun 2014 04:49:30 +0000 (06:49 +0200)]
bump version to 1.0-4

5 years agodepend on iptables and ipset
Dietmar Maurer [Wed, 4 Jun 2014 04:44:57 +0000 (06:44 +0200)]
depend on iptables and ipset

5 years agochange dh_installinit order
Dietmar Maurer [Wed, 4 Jun 2014 04:36:55 +0000 (06:36 +0200)]
change dh_installinit order

5 years agoimprove error message
Dietmar Maurer [Mon, 2 Jun 2014 11:17:53 +0000 (13:17 +0200)]
improve error message

5 years agogenerate warnings when we read the configuration file
Dietmar Maurer [Mon, 2 Jun 2014 11:14:42 +0000 (13:14 +0200)]
generate warnings when we read the configuration file

5 years agopass ipset errors to GUI
Dietmar Maurer [Fri, 30 May 2014 11:06:55 +0000 (13:06 +0200)]
pass ipset errors to GUI

5 years agoskip non-existent aliases inside ipset configuration
Dietmar Maurer [Fri, 30 May 2014 10:40:25 +0000 (12:40 +0200)]
skip non-existent aliases inside ipset configuration