pve-firewall.git
2 years agoparse_protocol_file: support lines without end comments
Wolfgang Bumiller [Wed, 28 Mar 2018 08:53:25 +0000 (10:53 +0200)]
parse_protocol_file: support lines without end comments

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agosplit parser out of get_etc_protocols
Wolfgang Bumiller [Wed, 28 Mar 2018 08:53:24 +0000 (10:53 +0200)]
split parser out of get_etc_protocols

Into a reusable parse_protocol_file.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agobump version to 3.0-7
Wolfgang Bumiller [Mon, 12 Mar 2018 13:58:19 +0000 (14:58 +0100)]
bump version to 3.0-7

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2 years agomultiport: add explaining comment
Fabian Grünbichler [Mon, 12 Mar 2018 11:38:51 +0000 (12:38 +0100)]
multiport: add explaining comment

about ordering single port matches before multiport matches,
and improve readability by adding some blank lines after returns.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agofix and improve multiport handling
Wolfgang Bumiller [Mon, 12 Mar 2018 10:55:18 +0000 (11:55 +0100)]
fix and improve multiport handling

The multiport `--ports` parameter is an `OR` match on source
and destination ports, so we should not use it.

We also don't actually use the port count, so let the port
range parser simply return a boolean and use the counter
only for the internal check. This also fixes a regression
caused by the previous multiport check which caused a single
port range to be recognized as a multiport option while it
did not have to be one, causing entries such as the SMB
macro to be added with `--match multiport` mistakenly, which
refused to accept the source port option.

Additionally, we now allow the case with 1 multiport and 1
single port entry: In order for the iptables command to
accept this the single port entry must come first, otherwise
it'll be passed to the multiport matcher (because why
shouldn't it interpret a singular `--Xport` as an alias to
the plural version `--Xports`... *sigh*).

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Fixes: 6a241ca745f7 ("check multiport limit in port ranges")

2 years agobump version to 3.0-6
Dietmar Maurer [Thu, 8 Mar 2018 12:53:54 +0000 (13:53 +0100)]
bump version to 3.0-6

2 years agobuild: use git rev-parse for GITVERSION
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:56 +0000 (13:33 +0100)]
build: use git rev-parse for GITVERSION

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agodebian: remove duplicate dh_systemd_enable code
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:55 +0000 (13:33 +0100)]
debian: remove duplicate dh_systemd_enable code

dh_systemd_enable already includes this snippet via the #DEBHELPER#
stanza, no need to duplicate it manually.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agodebian: drop preinst
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:54 +0000 (13:33 +0100)]
debian: drop preinst

the only actual code was for upgrading from PVE 3 to PVE 4..

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agodebian: switch to compat 9
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:53 +0000 (13:33 +0100)]
debian: switch to compat 9

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agodebian: drop init scripts
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:52 +0000 (13:33 +0100)]
debian: drop init scripts

and switch to plain dh_systemd_*

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agofix #1319: don't fail postinst with masked service
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:51 +0000 (13:33 +0100)]
fix #1319: don't fail postinst with masked service

by using "try-reload-or-restart" instead of "reload-or-restart"

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agocheck multiport limit in port ranges
Wolfgang Bumiller [Thu, 8 Mar 2018 11:06:21 +0000 (12:06 +0100)]
check multiport limit in port ranges

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2 years agobump version to 3.0-5
Wolfgang Bumiller [Thu, 7 Dec 2017 07:31:53 +0000 (08:31 +0100)]
bump version to 3.0-5

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2 years agohonor disabled flag on group rules again
Wolfgang Bumiller [Thu, 7 Dec 2017 07:30:01 +0000 (08:30 +0100)]
honor disabled flag on group rules again

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2 years agobump version to 3.0-4
Wolfgang Bumiller [Thu, 16 Nov 2017 10:42:37 +0000 (11:42 +0100)]
bump version to 3.0-4

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2 years agosort ipsets so that the digest is consistent
Dominik Csapak [Wed, 15 Nov 2017 10:41:34 +0000 (11:41 +0100)]
sort ipsets so that the digest is consistent

otherwise, editing an ipset randomly works (or not) due to
a wrong digest

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
2 years agoremove ruleset_generate_match, ruleset_generate_action
Tom Weber [Wed, 18 Oct 2017 20:24:10 +0000 (22:24 +0200)]
remove ruleset_generate_match, ruleset_generate_action

ruleset_generate_match and ruleset_generate_action not used anymore

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agoremove unused ruleset_generate_rule_insert
Tom Weber [Wed, 18 Oct 2017 20:24:09 +0000 (22:24 +0200)]
remove unused ruleset_generate_rule_insert

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agocleanup parameters to ruleset_generate_rule
Tom Weber [Wed, 18 Oct 2017 20:24:08 +0000 (22:24 +0200)]
cleanup parameters to ruleset_generate_rule

remove $actions and $goto - not used anymore

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agorule_substitude_action, remove ruleset_generate_rule_old
Tom Weber [Wed, 18 Oct 2017 20:24:07 +0000 (22:24 +0200)]
rule_substitude_action, remove ruleset_generate_rule_old

implement rule_substitude_action
eliminate use of ruleset_genereate_rule_old and remove it

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agoremove unused ruleset_generate_cmdstr
Tom Weber [Wed, 18 Oct 2017 20:24:06 +0000 (22:24 +0200)]
remove unused ruleset_generate_cmdstr

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agoimplement ipt_rule_to_cmds, ruleset_add_ipt_cmd
Tom Weber [Wed, 18 Oct 2017 20:24:05 +0000 (22:24 +0200)]
implement ipt_rule_to_cmds, ruleset_add_ipt_cmd

ipt_rule_to_cmds converts a %rule to an array of iptables commands
ruleset_add_ipt_cmd adds such an iptables command to a chain
ruleset_generate_rule uses these now
ruleset_generate_rule_old is an interim workaround

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agoiptables address matching in own subroutine
Tom Weber [Wed, 18 Oct 2017 20:24:04 +0000 (22:24 +0200)]
iptables address matching in own subroutine

put generation of iptables source/destination address matching
in own subroutine and use this in ruleset_generate_match

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agoeliminate unused nbdport in pve_std_chains_conf
Tom Weber [Wed, 18 Oct 2017 20:24:03 +0000 (22:24 +0200)]
eliminate unused nbdport in pve_std_chains_conf

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agomake $pve_std_chains a copy of $pve_std_chains_conf
Tom Weber [Wed, 18 Oct 2017 20:24:02 +0000 (22:24 +0200)]
make $pve_std_chains a copy of $pve_std_chains_conf

create a new $pve_std_chains with $pve_std_chains_conf as template on
every compilation of the rules. This avoids persitant changes to the
$pve_std_chains and makes it easier to read the std_chains configuration
from external config files (later to implement).

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agoconvert string based rule definitions to hashes
Tom Weber [Wed, 18 Oct 2017 20:24:01 +0000 (22:24 +0200)]
convert string based rule definitions to hashes

also extending %rule with log,logmsg,match,target

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agointegrate logging into ruleset_addrule
Tom Weber [Wed, 18 Oct 2017 20:24:00 +0000 (22:24 +0200)]
integrate logging into ruleset_addrule

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agoprepare code for more generic firewall logging
Tom Weber [Wed, 18 Oct 2017 20:23:59 +0000 (22:23 +0200)]
prepare code for more generic firewall logging

making ruleset generation aware of a match and action
part in iptable rules.
code will generate the same iptables as before! (except for
a few additional spaces between match and action).

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agoremove unused $rule_format
Tom Weber [Wed, 18 Oct 2017 20:23:58 +0000 (22:23 +0200)]
remove unused $rule_format

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
2 years agoUse run_cli_handler instead of deprecated run_cli
Philip Abernethy [Mon, 16 Oct 2017 08:59:23 +0000 (10:59 +0200)]
Use run_cli_handler instead of deprecated run_cli

2 years agopvefw-logger: fix typo
Fabian Grünbichler [Tue, 17 Oct 2017 12:24:01 +0000 (14:24 +0200)]
pvefw-logger: fix typo

2 years agobuild: reformat debian/control
Fabian Grünbichler [Wed, 4 Oct 2017 09:05:33 +0000 (11:05 +0200)]
build: reformat debian/control

using wrap-and-sort -abt

3 years agobump version to 3.0-3
Wolfgang Bumiller [Tue, 12 Sep 2017 12:43:13 +0000 (14:43 +0200)]
bump version to 3.0-3

3 years agobuildsys: clean: remove .buildinfo files
Wolfgang Bumiller [Wed, 6 Sep 2017 07:35:04 +0000 (09:35 +0200)]
buildsys: clean: remove .buildinfo files

3 years agoFix #1492: logger: print timestamps only if we have one
Wolfgang Bumiller [Mon, 4 Sep 2017 08:56:59 +0000 (10:56 +0200)]
Fix #1492: logger: print timestamps only if we have one

There's no guarantee that there's a timestamp in an skb, so
nflog_get_timestamp can fail.

3 years agobump version to 3.0-2
Wolfgang Bumiller [Mon, 17 Jul 2017 13:27:44 +0000 (15:27 +0200)]
bump version to 3.0-2

3 years agoFix #1446: allow pve-firewall package install twice in a row
Emmanuel Kasper [Mon, 17 Jul 2017 12:50:26 +0000 (14:50 +0200)]
Fix #1446: allow pve-firewall package install twice in a row

On packages removal (!= purge) systemd units are masked.
The postinst script has then to reenable this units at the
beginning of the 'configure' step.

Our other packages are doing this manually, or automatically
when the dh_systemd_enable helpers generated a postinst,
but this was missing here.

3 years agolog errors encountered by the daemon to syslog
Wolfgang Bumiller [Wed, 22 Mar 2017 11:53:34 +0000 (12:53 +0100)]
log errors encountered by the daemon to syslog

3 years agoforbid trailing commas in lists
Wolfgang Bumiller [Wed, 22 Mar 2017 11:53:33 +0000 (12:53 +0100)]
forbid trailing commas in lists

iptables-restore doesn't allow them

3 years agobump version to 3.0-1
Fabian Grünbichler [Thu, 9 Mar 2017 13:04:44 +0000 (14:04 +0100)]
bump version to 3.0-1

3 years agobuildsys: update upload target
Fabian Grünbichler [Thu, 9 Mar 2017 13:04:06 +0000 (14:04 +0100)]
buildsys: update upload target

3 years agobuildsys: fix deb target dependencies
Fabian Grünbichler [Thu, 9 Mar 2017 13:49:20 +0000 (14:49 +0100)]
buildsys: fix deb target dependencies

3 years agobuildsys: remove fakeroot from dpkg-buildpackage
Fabian Grünbichler [Thu, 9 Mar 2017 13:03:45 +0000 (14:03 +0100)]
buildsys: remove fakeroot from dpkg-buildpackage

3 years agobuildsys: use dpkg-architecture
Wolfgang Bumiller [Fri, 10 Feb 2017 12:57:59 +0000 (13:57 +0100)]
buildsys: use dpkg-architecture

3 years agologger: drop gthread dependency
Wolfgang Bumiller [Mon, 6 Feb 2017 11:07:23 +0000 (12:07 +0100)]
logger: drop gthread dependency

g_thread_new is part of glib directly, libgthread only
contains the deprecated g_thread_init() & friends which we
do not use.
This silences a build warning.

3 years agobuildsys: depend on lsb-base
Wolfgang Bumiller [Mon, 6 Feb 2017 11:05:01 +0000 (12:05 +0100)]
buildsys: depend on lsb-base

3 years agosimulator: make lxc/qemu optional
Wolfgang Bumiller [Tue, 31 Jan 2017 10:15:22 +0000 (11:15 +0100)]
simulator: make lxc/qemu optional

3 years agobuildsys: make job safety
Wolfgang Bumiller [Mon, 6 Feb 2017 10:52:54 +0000 (11:52 +0100)]
buildsys: make job safety

3 years agofix ambiguous if statements
Thomas Lamprecht [Tue, 13 Dec 2016 12:13:39 +0000 (13:13 +0100)]
fix ambiguous if statements

the funciton nflog_bind_pf(...) returns an integer smaller 0 on a
failure, we negated that which results in 1 if no failure and 0 if
there was a failure.
This is ambiguous and as no parenthesis are set the GCC 6 warning
"logical-not-parentheses" gets triggered.

Use a simple
    nflog_bind_pf(...) < 0
check instead.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
3 years agobump version to 2.0-33
Dietmar Maurer [Tue, 29 Nov 2016 11:18:41 +0000 (12:18 +0100)]
bump version to 2.0-33

3 years agoipset: don't allow the creation of zero-prefix entries
Wolfgang Bumiller [Tue, 29 Nov 2016 11:06:23 +0000 (12:06 +0100)]
ipset: don't allow the creation of zero-prefix entries

3 years agoipsets: catch zero-prefix entries
Wolfgang Bumiller [Tue, 29 Nov 2016 11:06:22 +0000 (12:06 +0100)]
ipsets: catch zero-prefix entries

This way the error is visible with pve-firewall compile
without breaking the rest.

3 years agobump version to 2.0-32
Dietmar Maurer [Tue, 29 Nov 2016 05:42:32 +0000 (06:42 +0100)]
bump version to 2.0-32

3 years agoimprove search for local-network
Wolfgang Bumiller [Wed, 23 Nov 2016 09:23:36 +0000 (10:23 +0100)]
improve search for local-network

Skip zero-prefix routes as they make no sense to be
considered (and ipset doesn't allow ::/0 to be added
anyway).

Support /128 local addresses by also checking for identical
addresses beside b-in-a overlapping.

3 years agobump version to 2.0-31
Dietmar Maurer [Thu, 6 Oct 2016 06:34:17 +0000 (08:34 +0200)]
bump version to 2.0-31

3 years agouse new repoman for upload target
Dietmar Maurer [Thu, 6 Oct 2016 06:33:42 +0000 (08:33 +0200)]
use new repoman for upload target

3 years agodon't try to apply ports to rules which don't support them
Wolfgang Bumiller [Wed, 5 Oct 2016 13:36:55 +0000 (15:36 +0200)]
don't try to apply ports to rules which don't support them

3 years agoremove redundant checks
Wolfgang Bumiller [Wed, 5 Oct 2016 13:36:54 +0000 (15:36 +0200)]
remove redundant checks

4 years agobump version to 2.0-30
Dietmar Maurer [Fri, 16 Sep 2016 06:53:27 +0000 (08:53 +0200)]
bump version to 2.0-30

4 years agoadd multicast DNS to the list of Macros
Emmanuel Kasper [Mon, 5 Sep 2016 14:03:26 +0000 (16:03 +0200)]
add multicast DNS to the list of Macros

multicast DNS allows to quickly access hosts without the need to
configure a DNS server

4 years agoadd missing parameter descriptions
Dietmar Maurer [Mon, 5 Sep 2016 08:22:51 +0000 (10:22 +0200)]
add missing parameter descriptions

4 years agobuild-depends: add dh-systemd
Wolfgang Bumiller [Tue, 28 Jun 2016 13:02:01 +0000 (15:02 +0200)]
build-depends: add dh-systemd

4 years agobump version to 2.0-29
Dietmar Maurer [Fri, 3 Jun 2016 14:46:55 +0000 (16:46 +0200)]
bump version to 2.0-29

4 years agoprevent overwriting ipsets/sec. groups by renaming
Dominik Csapak [Fri, 3 Jun 2016 14:11:27 +0000 (16:11 +0200)]
prevent overwriting ipsets/sec. groups by renaming

we did not check if the target name of the group/ipset
already existed, so we overwrote them

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
4 years agofix allowed group name length
Dominik Csapak [Fri, 3 Jun 2016 13:14:24 +0000 (15:14 +0200)]
fix allowed group name length

the allowed length for an iptable chain is 28 chars

we had a max set of 20 but a format of
GROUP-<name>-IN and
GROUP-<name>-OUT

where <name> is the group name

but GROUP--OUT are 10 chars so we just allow 18 chars max

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
4 years agomake group digest stable
Dominik Csapak [Fri, 3 Jun 2016 13:14:23 +0000 (15:14 +0200)]
make group digest stable

if we had mulitple security groups and wanted to
edit one, we did not have a stable digest,
because perl hashes are not sorted

this patch sorts the keys before hashing

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
4 years agobump version to 2.0-28
Dietmar Maurer [Fri, 3 Jun 2016 09:02:06 +0000 (11:02 +0200)]
bump version to 2.0-28

4 years agouse pve-common's ipv4_mask_hash_localnet
Wolfgang Bumiller [Fri, 3 Jun 2016 08:40:13 +0000 (10:40 +0200)]
use pve-common's ipv4_mask_hash_localnet

4 years agobump version to 2.0-27
Dietmar Maurer [Tue, 17 May 2016 06:00:12 +0000 (08:00 +0200)]
bump version to 2.0-27

4 years agofix #972: make PVEFW-FWBR-* rule order stable
Fabian Grünbichler [Fri, 13 May 2016 08:23:10 +0000 (10:23 +0200)]
fix #972: make PVEFW-FWBR-* rule order stable

by sorting the VM/CT IDs and the VM/CT config keys before
iterating over them.

4 years agobump version to 2.0-26
Dietmar Maurer [Mon, 9 May 2016 08:02:07 +0000 (10:02 +0200)]
bump version to 2.0-26

4 years agoinstall sysctl file set set rp_filter=2
Dietmar Maurer [Mon, 9 May 2016 07:58:15 +0000 (09:58 +0200)]
install sysctl file set set rp_filter=2

To avoid that packet gets accepted to early in fwbr. We had the
same setting in package vzctl (Proxmox VE 3.X).

4 years agobump version to 2.0-25
Dietmar Maurer [Thu, 21 Apr 2016 07:59:01 +0000 (09:59 +0200)]
bump version to 2.0-25

4 years agofix #945: add uninitialized check in lxc ipset compilation
Fabian Grünbichler [Wed, 20 Apr 2016 07:54:39 +0000 (09:54 +0200)]
fix #945: add uninitialized check in lxc ipset compilation

4 years agouse pve-doc-generator, bump version to 2.0-24
Dietmar Maurer [Wed, 6 Apr 2016 08:55:08 +0000 (10:55 +0200)]
use pve-doc-generator, bump version to 2.0-24

4 years agomove option definition to PVE::Firewall
Dietmar Maurer [Fri, 1 Apr 2016 10:30:59 +0000 (12:30 +0200)]
move option definition to PVE::Firewall

So that we can auto-generate docs.

4 years agobump version to 2.0-23
Dietmar Maurer [Fri, 1 Apr 2016 05:36:19 +0000 (07:36 +0200)]
bump version to 2.0-23

4 years agouse only the top bit for our accept marks
Wolfgang Bumiller [Thu, 31 Mar 2016 11:59:46 +0000 (13:59 +0200)]
use only the top bit for our accept marks

This way we can let the remaining 31 bits be used by the
user.
Note that the routing decision has already been made when
these tables are being traversed, so the fwmark will not be
usable for routing rules (ip-rule(8)), but the mark can
still be used for other tasks such as traffic control (tc)
which happens on the outgoing interface.

4 years agoadd description to DHCPv6 macro
Dietmar Maurer [Fri, 1 Apr 2016 05:29:29 +0000 (07:29 +0200)]
add description to DHCPv6 macro

4 years agocleanup descriptions (use single quote instead of backticks)
Dietmar Maurer [Thu, 31 Mar 2016 08:06:48 +0000 (10:06 +0200)]
cleanup descriptions (use single quote instead of backticks)

4 years agocleanup descriptions (correctly quote backslash)
Dietmar Maurer [Thu, 31 Mar 2016 07:59:39 +0000 (09:59 +0200)]
cleanup descriptions (correctly quote backslash)

4 years agoadd property descriptions to improve docs
Dietmar Maurer [Thu, 31 Mar 2016 06:06:02 +0000 (08:06 +0200)]
add property descriptions to improve docs

4 years agobump version to 2.0-22
Dietmar Maurer [Tue, 8 Mar 2016 10:47:55 +0000 (11:47 +0100)]
bump version to 2.0-22

4 years agoUse cfs_config_path from PVE::QemuConfig
Fabian Grünbichler [Mon, 7 Mar 2016 11:42:02 +0000 (12:42 +0100)]
Use cfs_config_path from PVE::QemuConfig

update after refactoring

4 years agoLXC refactoring
Fabian Grünbichler [Thu, 3 Mar 2016 09:43:36 +0000 (10:43 +0100)]
LXC refactoring

call cfs_config_path and parse_lxc_network in
PVE::LXC::Config instead of PVE::LXC

4 years agobump version to 2.0-21
Dietmar Maurer [Thu, 3 Mar 2016 08:43:56 +0000 (09:43 +0100)]
bump version to 2.0-21

4 years agowhitespace cleanup
Wolfgang Bumiller [Wed, 2 Mar 2016 11:59:17 +0000 (12:59 +0100)]
whitespace cleanup

4 years agotest: add test for implicitly allowed container IP
Wolfgang Bumiller [Wed, 2 Mar 2016 11:59:16 +0000 (12:59 +0100)]
test: add test for implicitly allowed container IP

4 years agoipfilter: include configured container IPs by default
Wolfgang Bumiller [Wed, 2 Mar 2016 11:59:15 +0000 (12:59 +0100)]
ipfilter: include configured container IPs by default

4 years agoadded the 'ipfilter' option
Wolfgang Bumiller [Wed, 2 Mar 2016 11:59:14 +0000 (12:59 +0100)]
added the 'ipfilter' option

This effectively acts like adding an emtpy 'ipfilter-netX'
ipset for every firewall-enabled interface.

4 years agoipv6: fix ip_compress_address_call
Wolfgang Bumiller [Tue, 1 Mar 2016 11:20:16 +0000 (12:20 +0100)]
ipv6: fix ip_compress_address_call

This only takes an address and not a CIDR notation. It does
preserve the suffix but ended up compressing
fc00:0000::0000/64 to fc00::0000/64 instead of fc00::/64 and
thus caused the firewall to always show there are pending
changes when ipv6 addresses were available.

4 years agouse systemctl reload-or-restart on update
Wolfgang Bumiller [Tue, 1 Mar 2016 11:20:21 +0000 (12:20 +0100)]
use systemctl reload-or-restart on update

dh_installinit's -R option uses 'restart' causing a
stop-start cycle with systemd. We really don't want that.

4 years agoipfilter: imiplicitly add the default link local address
Wolfgang Bumiller [Tue, 1 Mar 2016 11:20:20 +0000 (12:20 +0100)]
ipfilter: imiplicitly add the default link local address

When adding an ipset for a device via the 'ipfilter-net$NUM'
name we now implicitly add the default link local address
based on the device's MAC address and a 'nomatch' entry for
the rest of fe80::/10. This is comparable to an ARP/MAC
filter in IPv4 with the main difference that it explicitly
works at IP level.

4 years agosplit compile_ipsets() out of compile_iptables_filter()
Wolfgang Bumiller [Tue, 1 Mar 2016 11:20:19 +0000 (12:20 +0100)]
split compile_ipsets() out of compile_iptables_filter()

compile_iptables_filter() is called twice, once to get the
ipv4 ruleset + ipsets and ones to get the ipv6 ruleset. The
second call still generates ipsets which are discarded so it
makes sense to do this in a separate step.

4 years agocleanup after old change
Wolfgang Bumiller [Tue, 1 Mar 2016 11:20:18 +0000 (12:20 +0100)]
cleanup after old change

get_ipset_cmdlist() had a delete parameter in one commit,
removed in the one after that (dd7a13fddc) and this call
was not updated accordingly with the second patch.

4 years agondp: use PVEFW-SET-ACCEPT-MARK and move rules further down
Wolfgang Bumiller [Tue, 1 Mar 2016 11:20:17 +0000 (12:20 +0100)]
ndp: use PVEFW-SET-ACCEPT-MARK and move rules further down

On host level: moved NDP to after connection tracking and
switched to RETURN instead of ACCEPT.

On VM level:
The output direction now uses the accept-mark like the dhcp
option does, too.
Also moved NDP rules below the macfilter & ipset rules.

4 years agoonly allow icmp names in the destination port field
Wolfgang Bumiller [Tue, 1 Mar 2016 11:20:15 +0000 (12:20 +0100)]
only allow icmp names in the destination port field

We generate ICMP rules from the destination port field,
so allowing them in the source port field only confuses
people.

4 years agobump version to 2.0-20
Dietmar Maurer [Mon, 29 Feb 2016 11:40:36 +0000 (12:40 +0100)]
bump version to 2.0-20

4 years agofix 901: encode unicode characters in sha digest
Dominik Csapak [Mon, 29 Feb 2016 11:36:19 +0000 (12:36 +0100)]
fix 901: encode unicode characters in sha digest

if we do not do this, Digest::SHA->add croaks when it detects
wide symbols

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>