pve-firewall.git
5 years agoadd README and example to debian package
Dietmar Maurer [Fri, 18 Apr 2014 08:50:15 +0000 (10:50 +0200)]
add README and example to debian package

5 years agofix README
Dietmar Maurer [Fri, 18 Apr 2014 08:43:30 +0000 (10:43 +0200)]
fix README

5 years agoonly allow tcpflafgs and nosmurfs in host.fw
Dietmar Maurer [Fri, 18 Apr 2014 08:28:13 +0000 (10:28 +0200)]
only allow tcpflafgs and nosmurfs in host.fw

5 years agoenable cluster wide rules
Dietmar Maurer [Fri, 18 Apr 2014 06:11:49 +0000 (08:11 +0200)]
enable cluster wide rules

5 years agoadd remaining options to VM API
Dietmar Maurer [Fri, 18 Apr 2014 05:44:32 +0000 (07:44 +0200)]
add remaining options to VM API

5 years agoadd options and log API for VMs
Dietmar Maurer [Fri, 18 Apr 2014 05:23:20 +0000 (07:23 +0200)]
add options and log API for VMs

5 years agobugfix : ruleset_generate_cmdstr : use -d for destination
Alexandre Derumier [Thu, 17 Apr 2014 04:42:50 +0000 (06:42 +0200)]
bugfix : ruleset_generate_cmdstr : use -d for destination

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agocomplete options API for host.fw
Dietmar Maurer [Tue, 15 Apr 2014 10:28:05 +0000 (12:28 +0200)]
complete options API for host.fw

5 years agoadd API for firewall log
Dietmar Maurer [Tue, 15 Apr 2014 09:03:17 +0000 (11:03 +0200)]
add API for firewall log

5 years agocorrectly initialize std chains
Dietmar Maurer [Tue, 15 Apr 2014 08:38:40 +0000 (10:38 +0200)]
correctly initialize std chains

Else those chains grow if called from a daemon.

5 years agodo not set persistent state if firewall is disabled
Dietmar Maurer [Tue, 15 Apr 2014 07:04:42 +0000 (09:04 +0200)]
do not set persistent state if firewall is disabled

Else we have to manually restart the service after enable is set.

5 years agodisable firewall by default
Dietmar Maurer [Tue, 15 Apr 2014 06:15:53 +0000 (08:15 +0200)]
disable firewall by default

5 years agoadd init script to start firewall
Dietmar Maurer [Tue, 15 Apr 2014 06:12:27 +0000 (08:12 +0200)]
add init script to start firewall

5 years agoips : allow --queue-bypass only for kernel 3.10
Alexandre Derumier [Tue, 15 Apr 2014 05:25:21 +0000 (07:25 +0200)]
ips : allow --queue-bypass only for kernel 3.10

This don't exist in 2.6.32 kernel

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agostop firewall inside update if firewall is disabled in cluster.fw
Dietmar Maurer [Tue, 15 Apr 2014 05:29:50 +0000 (07:29 +0200)]
stop firewall inside update if firewall is disabled in cluster.fw

And some code cleanups.

5 years agoimplement API for cluster.fw policy_in and policy_out options
Dietmar Maurer [Mon, 14 Apr 2014 10:51:16 +0000 (12:51 +0200)]
implement API for cluster.fw policy_in and policy_out options

5 years agomove host policy setting to cluster.fw
Dietmar Maurer [Mon, 14 Apr 2014 10:21:38 +0000 (12:21 +0200)]
move host policy setting to cluster.fw

Because we also have cluster wide rules

5 years agoremove option dhcp for host.fw
Dietmar Maurer [Mon, 14 Apr 2014 10:06:45 +0000 (12:06 +0200)]
remove option dhcp for host.fw

5 years agoadd tunnable nf_conntrack_tcp_timeout_established value
Alexandre Derumier [Mon, 14 Apr 2014 07:59:47 +0000 (09:59 +0200)]
add tunnable nf_conntrack_tcp_timeout_established value

default nf_conntrack_tcp_timeout_established value is 5 days.

This is really huge, in case of a ddos attack for example

from:
https://dev.openwrt.org/ticket/12976

minimum value should be

"7875 seconds (= tcp_keepalive_time + tcp_keepalive_probes * tcp_keepalive_intvl = 7200 + 9 * 75 by default) to give the endpoints sufficient time to send keep-alive probes"

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agocopy_xxx_with_digest: do not copy undefined values
Dietmar Maurer [Fri, 11 Apr 2014 10:52:48 +0000 (12:52 +0200)]
copy_xxx_with_digest: do not copy undefined values

5 years agoimprove concurrent update handling
Dietmar Maurer [Fri, 11 Apr 2014 09:32:32 +0000 (11:32 +0200)]
improve concurrent update handling

compute digest per section.

5 years agocorrectly encode section comments as utf8
Dietmar Maurer [Thu, 10 Apr 2014 10:28:50 +0000 (12:28 +0200)]
correctly encode section comments as utf8

5 years agosupport comments on ipset sections
Dietmar Maurer [Thu, 10 Apr 2014 10:08:48 +0000 (12:08 +0200)]
support comments on ipset sections

Also implement concurrenty change prevention for ipset API.

5 years agorules API: protect against concurrent updates
Dietmar Maurer [Thu, 10 Apr 2014 08:44:56 +0000 (10:44 +0200)]
rules API: protect against concurrent updates

5 years agosecurity group API: protect against concurrent updates
Dietmar Maurer [Thu, 10 Apr 2014 08:38:48 +0000 (10:38 +0200)]
security group API: protect against concurrent updates

5 years agodefine standard option pve-config-digest
Dietmar Maurer [Thu, 10 Apr 2014 07:01:28 +0000 (09:01 +0200)]
define standard option pve-config-digest

5 years agosupport comments on group sections
Dietmar Maurer [Wed, 9 Apr 2014 10:53:12 +0000 (12:53 +0200)]
support comments on group sections

5 years agocorrectly save security group rules
Dietmar Maurer [Wed, 9 Apr 2014 07:48:42 +0000 (09:48 +0200)]
correctly save security group rules

5 years agocomplete security group API
Dietmar Maurer [Wed, 9 Apr 2014 06:53:58 +0000 (08:53 +0200)]
complete security group API

5 years agodefine standard option for security group names
Dietmar Maurer [Wed, 9 Apr 2014 06:05:51 +0000 (08:05 +0200)]
define standard option for security group names

5 years agocorrectly verify ipset name
Dietmar Maurer [Wed, 9 Apr 2014 05:34:06 +0000 (07:34 +0200)]
correctly verify ipset name

5 years agoIPSet: implement rename API
Dietmar Maurer [Wed, 9 Apr 2014 05:15:14 +0000 (07:15 +0200)]
IPSet: implement rename API

5 years agoadd newline to error message
Dietmar Maurer [Wed, 9 Apr 2014 05:02:01 +0000 (07:02 +0200)]
add newline to error message

5 years agoipset: implement create/delete API
Dietmar Maurer [Tue, 8 Apr 2014 10:50:47 +0000 (12:50 +0200)]
ipset: implement create/delete API

5 years agoipset API: add get/update methods
Dietmar Maurer [Tue, 8 Apr 2014 09:18:03 +0000 (11:18 +0200)]
ipset API: add get/update methods

5 years agofix ipset ref test in parse_address_list
Dietmar Maurer [Tue, 8 Apr 2014 05:21:58 +0000 (07:21 +0200)]
fix ipset ref test in parse_address_list

5 years agoimprove ipset updates
Dietmar Maurer [Mon, 7 Apr 2014 11:27:42 +0000 (13:27 +0200)]
improve ipset updates

Remove duplicates, remove stale _swap chains, better cidr parser

5 years agoipset: implement delete API, improve parameter verification
Dietmar Maurer [Mon, 7 Apr 2014 10:44:22 +0000 (12:44 +0200)]
ipset: implement delete API, improve parameter verification

5 years agostart API for IPSet
Dietmar Maurer [Mon, 7 Apr 2014 10:31:45 +0000 (12:31 +0200)]
start API for IPSet

5 years agoipset: only save ip/network once
Dietmar Maurer [Mon, 7 Apr 2014 09:02:14 +0000 (11:02 +0200)]
ipset: only save ip/network once

We do not allow duplicate entries.

5 years agocorrectly save ipset data
Dietmar Maurer [Mon, 7 Apr 2014 08:41:35 +0000 (10:41 +0200)]
correctly save ipset data

5 years agoallow icmp port names
Dietmar Maurer [Mon, 7 Apr 2014 06:32:29 +0000 (08:32 +0200)]
allow icmp port names

5 years agoverify macro parameters when updating a rule using API
Dietmar Maurer [Mon, 7 Apr 2014 05:12:57 +0000 (07:12 +0200)]
verify macro parameters when updating a rule using API

5 years agofix port parser
Dietmar Maurer [Fri, 4 Apr 2014 11:22:12 +0000 (13:22 +0200)]
fix port parser

And correctly verify rules on updates on API.

5 years agoadd macro descriptions (and API to read them)
Dietmar Maurer [Fri, 4 Apr 2014 07:33:26 +0000 (09:33 +0200)]
add macro descriptions (and API to read them)

5 years agoimplement delete parameter for rule update API
Dietmar Maurer [Thu, 3 Apr 2014 11:28:50 +0000 (13:28 +0200)]
implement delete parameter for rule update API

5 years agorule type and action are required parameters
Dietmar Maurer [Thu, 3 Apr 2014 09:48:48 +0000 (11:48 +0200)]
rule type and action are required parameters

5 years agosimplify check for iprange
Dietmar Maurer [Thu, 3 Apr 2014 07:33:20 +0000 (09:33 +0200)]
simplify check for iprange

We already parsed the address, so we can do a simpler check.

5 years agoparse_address_list: add check for ipset references.
Dietmar Maurer [Thu, 3 Apr 2014 07:29:56 +0000 (09:29 +0200)]
parse_address_list: add check for ipset references.

5 years agoparse_address_list: only allow one ip range
Dietmar Maurer [Thu, 3 Apr 2014 07:25:28 +0000 (09:25 +0200)]
parse_address_list: only allow one ip range

The previous check did not work if the range is the first entry in the list,
for example:

IN  ACCEPT net0 10.0.0.1-10.0.0.10,10.0.0.12

5 years agoipset: check kernel version
Dietmar Maurer [Thu, 3 Apr 2014 07:11:33 +0000 (09:11 +0200)]
ipset: check kernel version

And white space cleanups.

5 years agorename netgroup to ipset
Alexandre Derumier [Tue, 1 Apr 2014 14:06:14 +0000 (16:06 +0200)]
rename netgroup to ipset

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoprefix ipset chains with PVEFW-
Alexandre Derumier [Tue, 1 Apr 2014 14:06:13 +0000 (16:06 +0200)]
prefix ipset chains with PVEFW-

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoimplemented ipset rules in iptables
Alexandre Derumier [Tue, 1 Apr 2014 14:06:12 +0000 (16:06 +0200)]
implemented ipset rules in iptables

I'm reusing shorewall syntax,  +mynetgroup

also fixing iprange and iplist

vmid.fw
-------
IN SSH(ACCEPT) net0 192.168.2.192  # only allow SSH from  192.168.2.192
IN SSH(ACCEPT) net0 10.0.0.1-10.0.0.10 #accept SSH for ip in range 10.0.0.1 to 10.0.0.10
IN SSH(ACCEPT) net0 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for 10.0.0.1 or 10.0.0.2 or 10.0.0.3
IN SSH(ACCEPT) net0 +mynetgroup   #accept ssh for netgroup mynetgroup

cluster.fw
----------
IN  ACCEPT 10.0.0.1
IN  ACCEPT 10.0.0.1-10.0.0.10
IN  ACCEPT 10.0.0.1,10.0.0.2,10.0.0.3
IN  ACCEPT +mynetgroup

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoreally save options
Dietmar Maurer [Wed, 2 Apr 2014 10:51:30 +0000 (12:51 +0200)]
really save options

5 years agoimplement rules API for <vmid>.fw
Dietmar Maurer [Wed, 2 Apr 2014 08:24:05 +0000 (10:24 +0200)]
implement rules API for <vmid>.fw

5 years agoimplement rules API for host.fw
Dietmar Maurer [Wed, 2 Apr 2014 08:11:33 +0000 (10:11 +0200)]
implement rules API for host.fw

5 years agoimplement generic rule API class
Dietmar Maurer [Wed, 2 Apr 2014 05:56:11 +0000 (07:56 +0200)]
implement generic rule API class

So that we can reuse the code.

5 years agoimplement option API for cluster.fw
Dietmar Maurer [Tue, 1 Apr 2014 09:20:47 +0000 (11:20 +0200)]
implement option API for cluster.fw

5 years agostart cluster wide firewall API
Dietmar Maurer [Tue, 1 Apr 2014 08:25:25 +0000 (10:25 +0200)]
start cluster wide firewall API

5 years agodelete trailing white space from 'ipset save' output.
Dietmar Maurer [Tue, 1 Apr 2014 06:28:46 +0000 (08:28 +0200)]
delete trailing white space from 'ipset save' output.

Also improve verbose output.

5 years agoavoid multiple calls to ipset_get_chains()
Dietmar Maurer [Tue, 1 Apr 2014 05:39:13 +0000 (07:39 +0200)]
avoid multiple calls to ipset_get_chains()

and some white space cleanups.

5 years agoipset : use only netgroup
Alexandre Derumier [Mon, 31 Mar 2014 13:56:39 +0000 (15:56 +0200)]
ipset : use only netgroup

only use hash:net for both ips and network.

allow comments and nomatch

delete ipset chains after iptables restore

also optimize hashsize

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoremove unneccessary iptables code
Dietmar Maurer [Mon, 31 Mar 2014 10:43:19 +0000 (12:43 +0200)]
remove unneccessary iptables code

5 years agoavoid calls to iptables_rule_exist()
Dietmar Maurer [Mon, 31 Mar 2014 10:39:29 +0000 (12:39 +0200)]
avoid calls to iptables_rule_exist()

5 years agonew method iptables_chain_digest() to compute digest
Dietmar Maurer [Mon, 31 Mar 2014 09:52:57 +0000 (11:52 +0200)]
new method iptables_chain_digest() to compute digest

Note: My previous commit introcuded a bug, using ipset_chain_digest()
for the iptables ruleset - this is a fix for that.

5 years agos/rulset/ruleset/
Dietmar Maurer [Mon, 31 Mar 2014 09:39:41 +0000 (11:39 +0200)]
s/rulset/ruleset/

5 years agoavoid calls to iptables_rule_exist
Dietmar Maurer [Mon, 31 Mar 2014 09:35:12 +0000 (11:35 +0200)]
avoid calls to iptables_rule_exist

We can return that info with iptables_get_chains().

5 years agoallow options and rules section in cluster.fw
Dietmar Maurer [Mon, 31 Mar 2014 08:41:52 +0000 (10:41 +0200)]
allow options and rules section in cluster.fw

5 years agorename groups.fw to cluster.fw
Dietmar Maurer [Mon, 31 Mar 2014 07:59:03 +0000 (09:59 +0200)]
rename groups.fw to cluster.fw

Because we also want to have cluster wide rules/options.

5 years agocleanup ipset code
Dietmar Maurer [Fri, 28 Mar 2014 11:09:02 +0000 (12:09 +0100)]
cleanup ipset code

5 years agoimplement ipset ip/net groups
Alexandre Derumier [Thu, 27 Mar 2014 10:22:06 +0000 (11:22 +0100)]
implement ipset ip/net groups

This implement ipset groups of ips or network in groups.fw.

groups.fw
---------
[ipgroup ipgroup1]

192.168.0.1
192.168.0.2
192.168.0.3

[ipgroup ipgroup2]

192.168.0.3
192.168.0.4

[netgroup netgroup1]

192.168.0.0/24
10.0.0.0/8

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agocleanup ips detection
Alexandre Derumier [Wed, 26 Mar 2014 12:26:54 +0000 (13:26 +0100)]
cleanup ips detection

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoignor eadditional arguments when moveto is set
Dietmar Maurer [Tue, 25 Mar 2014 12:05:22 +0000 (13:05 +0100)]
ignor eadditional arguments when moveto is set

5 years agoimprove parameter verification
Dietmar Maurer [Tue, 25 Mar 2014 10:02:18 +0000 (11:02 +0100)]
improve parameter verification

5 years agocleanup_fw_rule: only copy defined rule properties
Dietmar Maurer [Tue, 25 Mar 2014 08:20:52 +0000 (09:20 +0100)]
cleanup_fw_rule: only copy defined rule properties

5 years agodo not expand macros on load
Dietmar Maurer [Tue, 25 Mar 2014 07:55:26 +0000 (08:55 +0100)]
do not expand macros on load

Else we save expanded macros!

5 years agoimprove API
Dietmar Maurer [Tue, 25 Mar 2014 06:20:44 +0000 (07:20 +0100)]
improve API

5 years agoadd ips optimizations
Alexandre Derumier [Tue, 25 Mar 2014 04:15:28 +0000 (05:15 +0100)]
add ips optimizations

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoadd optimize flag
Alexandre Derumier [Tue, 25 Mar 2014 04:15:27 +0000 (05:15 +0100)]
add optimize flag

this flag enble optimizations on rules processing

host.fw
-------
optimize:1

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agoadd ips feature v7
Alexandre Derumier [Tue, 25 Mar 2014 04:15:26 +0000 (05:15 +0100)]
add ips feature v7

This add ips (like suricata) support through nfqueues.

The main idea is to replace -j ACCEPT with -J NFQUEUE , to pass packets to ips

it's using --queue-bypass (only available in 3.10 kernel), so it's suricata daemon is down,
packets are not dropped.

tap-out chain,
-------------
we goto PVEFW-SET-ACCEPT-MARK is always use when connection is already established
 -m conntrack --ctstate RELATED,ESTABLISHED -g PVEFW-SET-ACCEPT-MARK

tap-in chain
---------------
I replace -j ACCEPT by -j NFQUEUE when ips is enabled
and
-m conntrack --ctstate RELATED,ESTABLISHED -j NFQUEUE

group-in rules now use also mark
---------------------------------
-A tap110i0-IN -j GROUP-group1-IN
   -A GROUP-group1-IN -j MARK --set-xmark 0x0/0xffffffff
   -A GROUP-group1-IN -p icmp -g PVEFW-SET-ACCEPT-MARK
-A tap110i0-IN -m mark --mark 0x1 -j ACCEPT|NFQUEUE

vmid.fw
-------
ips: 1

ips_queues: 0:3

1 or more queues can be defined (if we want cpu loadbalancing, or dedicated queue for a specific vm).
If not defined, default queue 0 is used.

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agocode cleanup: use ruleset_generate_rule to generate dhcp rules
Dietmar Maurer [Fri, 21 Mar 2014 06:34:38 +0000 (07:34 +0100)]
code cleanup: use ruleset_generate_rule to generate dhcp rules

5 years agoassume rule is enabled if {enable} is not defined
Dietmar Maurer [Fri, 21 Mar 2014 06:32:09 +0000 (07:32 +0100)]
assume rule is enabled if {enable} is not defined

5 years agodhcp out rule : use goto instead jump
Alexandre Derumier [Fri, 21 Mar 2014 05:03:00 +0000 (06:03 +0100)]
dhcp out rule : use goto instead jump

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agouse enable instead of disable
Dietmar Maurer [Thu, 20 Mar 2014 10:49:30 +0000 (11:49 +0100)]
use enable instead of disable

This make it easier to write the GUI.

5 years agoimplement nosmurfs option for hiost firewall
Dietmar Maurer [Thu, 20 Mar 2014 06:53:59 +0000 (07:53 +0100)]
implement nosmurfs option for hiost firewall

5 years agoadd tcpflags to host.fw example
Dietmar Maurer [Thu, 20 Mar 2014 06:48:58 +0000 (07:48 +0100)]
add tcpflags to host.fw example

5 years agoimplement option tcpflags for host firewall
Dietmar Maurer [Thu, 20 Mar 2014 06:42:56 +0000 (07:42 +0100)]
implement option tcpflags for host firewall

But we only add the check for incoming packets, assuming that the
host itself never generates invalid tcp flags.

5 years agogenerate_group_rules : fix check of security group
Alexandre Derumier [Wed, 19 Mar 2014 15:31:55 +0000 (16:31 +0100)]
generate_group_rules : fix check of security group

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
5 years agofix dhcp rule
Dietmar Maurer [Wed, 19 Mar 2014 11:30:28 +0000 (12:30 +0100)]
fix dhcp rule

As suggested by Alexandre.

5 years agoallow to use utf8 encoded comments
Dietmar Maurer [Wed, 19 Mar 2014 11:16:16 +0000 (12:16 +0100)]
allow to use utf8 encoded comments

5 years agoswitch back to gnu99 std
Dietmar Maurer [Wed, 19 Mar 2014 08:15:24 +0000 (09:15 +0100)]
switch back to gnu99 std

So that we can compile with gcc 4.4

5 years agoremove optimization which accepts unrelated traffic
Dietmar Maurer [Wed, 19 Mar 2014 08:11:17 +0000 (09:11 +0100)]
remove optimization which accepts unrelated traffic

Removing this alsmo make ips filter easier.

5 years agostart VM firewall API
Dietmar Maurer [Tue, 18 Mar 2014 11:06:53 +0000 (12:06 +0100)]
start VM firewall API

5 years agostart host API
Dietmar Maurer [Tue, 18 Mar 2014 10:30:53 +0000 (11:30 +0100)]
start host API

5 years agoimprove security group API
Dietmar Maurer [Tue, 18 Mar 2014 09:36:46 +0000 (10:36 +0100)]
improve security group API

5 years agostart API
Dietmar Maurer [Tue, 18 Mar 2014 07:03:26 +0000 (08:03 +0100)]
start API

5 years agonew method load_security_groups()
Dietmar Maurer [Tue, 18 Mar 2014 06:05:06 +0000 (07:05 +0100)]
new method load_security_groups()

5 years agoremove obsolete comment
Dietmar Maurer [Mon, 17 Mar 2014 09:56:17 +0000 (10:56 +0100)]
remove obsolete comment

5 years agoavoid dependency problems
Dietmar Maurer [Mon, 17 Mar 2014 09:55:22 +0000 (10:55 +0100)]
avoid dependency problems