pve-firewall.git
6 months agobump version to 3.0-18
Thomas Lamprecht [Mon, 4 Mar 2019 09:27:42 +0000 (10:27 +0100)]
bump version to 3.0-18

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
6 months agod/control: bump version dependency to pve-doc-generator
Thomas Lamprecht [Fri, 22 Feb 2019 12:31:32 +0000 (13:31 +0100)]
d/control: bump version dependency to pve-doc-generator

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
6 months ago1891 Add zsh command completion for pve-firewall
Christian Ebner [Thu, 21 Feb 2019 13:24:59 +0000 (14:24 +0100)]
1891 Add zsh command completion for pve-firewall

Adds the zsh command completion scripts for pve-firewall.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
6 months agodaemon: cleanup '+' character at begin of line
Alexandre Derumier [Wed, 20 Feb 2019 00:16:58 +0000 (01:16 +0100)]
daemon: cleanup '+' character at begin of line

this stray '+' was introduced by
commit 151c209e05a9e15d5d7a9402391ca936e562a173 while it had no
effect let's remove it nonetheless.

6 months agoFix unitialized value $mark in bitwise operation
Alwin Antreich [Wed, 13 Feb 2019 11:27:58 +0000 (12:27 +0100)]
Fix unitialized value $mark in bitwise operation

Signed-off-by: Alwin Antreich <a.antreich@proxmox.com>
7 months agolog reject : add space after policy REJECT like drop
Alexandre Derumier [Tue, 5 Feb 2019 10:22:45 +0000 (11:22 +0100)]
log reject : add space after policy REJECT like drop

For log consistency and parsing, we already have a space after "policy DROP: "
but not REJECT

ex:

DROP
135 6 tap135i1-IN 05/Feb/2019:10:59:55 +0100 policy DROP: IN=.....

REJECT
232 6 tap232i1-IN 05/Feb/2019:10:59:28 +0100 policy REJECT:IN=....

7 months agofollowup: avoid long hash access, use own variable
Thomas Lamprecht [Mon, 4 Feb 2019 13:22:41 +0000 (14:22 +0100)]
followup: avoid long hash access, use own variable

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
7 months agoFix #1606 Add nf_conntrack_allow_invalid option
Christian Ebner [Fri, 1 Feb 2019 09:46:11 +0000 (10:46 +0100)]
Fix #1606 Add nf_conntrack_allow_invalid option

This adds the nf_conntrack_allow_invalid host firewall option to allow to disable
the dropping of invalid packets from the connection tracker point of view.
This is needed for some rare setups with asymmetrical multi-path routing.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
7 months agobuildsys: build a dbgsym package
Wolfgang Bumiller [Fri, 25 Jan 2019 09:56:16 +0000 (10:56 +0100)]
buildsys: build a dbgsym package

don't forcefully strip debug components out of the firewall
logger...

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
8 months agobump version to 3.0-17
Thomas Lamprecht [Wed, 9 Jan 2019 15:54:29 +0000 (16:54 +0100)]
bump version to 3.0-17

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
8 months agolog and ignore ENOBUFS in nfct_catch
David Limbeck [Wed, 9 Jan 2019 14:32:10 +0000 (15:32 +0100)]
log and ignore ENOBUFS in nfct_catch

nfct_catch sets ENOBUFS if not enough buffer space is available. log
and continue operation instead of stopping. in addition log possible
other errors set by nfct_catch

Signed-off-by: David Limbeck <d.limbeck@proxmox.com>
8 months agofixup va_arg usage
Wolfgang Bumiller [Wed, 9 Jan 2019 13:26:00 +0000 (14:26 +0100)]
fixup va_arg usage

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
9 months agoadd log_nf_conntrack host firewall option
David Limbeck [Thu, 13 Dec 2018 12:08:52 +0000 (13:08 +0100)]
add log_nf_conntrack host firewall option

add log_nf_conntrack host firewall option to enable or disable logging
of connections. restarts pvefw-logger if the option changes in the
config. the pvefw-logger is always restarted in the beginning to make
sure the current config is applied.

Signed-off-by: David Limbeck <d.limbeck@proxmox.com>
9 months agoadd conntrack logging via libnetfilter_conntrack
David Limbeck [Thu, 13 Dec 2018 12:08:51 +0000 (13:08 +0100)]
add conntrack logging via libnetfilter_conntrack

add conntrack logging to pvefw-logger including timestamps (requires
/proc/sys/net/netfilter/nf_conntrack_timestamp to be 1).
this allows the tracking of sessions (start, end timestamps with
nf_conntrack_timestamp on [DESTROY] messages). commit includes
Build-Depends inclusion of libnetfilter-conntrack-dev and
libnetfilter_conntrack library in the Makefile.

Signed-off-by: David Limbeck <d.limbeck@proxmox.com>
9 months agofix #2004: do not allow backwards ranges
Dominik Csapak [Fri, 30 Nov 2018 15:31:41 +0000 (16:31 +0100)]
fix #2004: do not allow backwards ranges

ranges like 10:5 are allowed by us, but iptables throws an error
that is only visible in the syslog and the firewall rules do not
get updated

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
9 months agofix #2005: only allow ascii port digits
Dominik Csapak [Fri, 30 Nov 2018 08:53:49 +0000 (09:53 +0100)]
fix #2005: only allow ascii port digits

perl accepts non-ascii digits for \d like U+09EA
which do not work with iptables

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
9 months agobump version to 3.0-16
Thomas Lamprecht [Fri, 30 Nov 2018 15:03:11 +0000 (16:03 +0100)]
bump version to 3.0-16

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
9 months agomacro: fix return verification failure
Dominik Csapak [Thu, 29 Nov 2018 13:29:03 +0000 (14:29 +0100)]
macro: fix return verification failure

macros are strings not integers

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
9 months agobump version to 3.0-15
Thomas Lamprecht [Fri, 23 Nov 2018 13:05:23 +0000 (14:05 +0100)]
bump version to 3.0-15

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
10 months agod/control: add missing Build-Depends
Rhonda D'Vine [Mon, 12 Nov 2018 14:14:46 +0000 (15:14 +0100)]
d/control: add missing Build-Depends

Found while building in a clean chroot.

Signed-off-by: Rhonda D'Vine <rhonda@proxmox.com>
10 months agoFix #1971: display firewall rule properties
Rhonda D'Vine [Mon, 12 Nov 2018 14:14:45 +0000 (15:14 +0100)]
Fix #1971: display firewall rule properties

This is the list of the properties that should get returned in the
pretty print format, too, not just in yaml/json output.

Signed-off-by: Rhonda D'Vine <rhonda@proxmox.com>
12 months agod/rules: fix pvefw-logger service unit-name
Thomas Lamprecht [Tue, 4 Sep 2018 07:50:37 +0000 (09:50 +0200)]
d/rules: fix pvefw-logger service unit-name

debhelpers on stretch do not care about the wrong uinit name, and the
name used is always the one from --name.
But buster cares, so fix it to the right one.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
12 months agobump version to 3.0-14
Wolfgang Bumiller [Fri, 24 Aug 2018 08:51:19 +0000 (10:51 +0200)]
bump version to 3.0-14

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
12 months agoFix #1841: ebtables: sort interfaces per guest
Stoiko Ivanov [Thu, 23 Aug 2018 14:04:50 +0000 (16:04 +0200)]
Fix #1841: ebtables: sort interfaces per guest

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
14 months agobump version to 3.0-13
Wolfgang Bumiller [Thu, 28 Jun 2018 12:47:25 +0000 (14:47 +0200)]
bump version to 3.0-13

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
14 months agoebtables: sort guest chains during rulecreation
Stoiko Ivanov [Thu, 28 Jun 2018 12:41:56 +0000 (14:41 +0200)]
ebtables: sort guest chains during rulecreation

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
14 months agoapi: host, vm: explicit import raise_param_exc
Thomas Lamprecht [Thu, 14 Jun 2018 10:08:52 +0000 (12:08 +0200)]
api: host, vm: explicit import raise_param_exc

we inherited the import from PVE::RESTHandler but may want to get rid
of it there. So explicitly import it here.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
14 months agowhitespace fixup
Wolfgang Bumiller [Wed, 13 Jun 2018 11:26:28 +0000 (13:26 +0200)]
whitespace fixup

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
15 months agobump version to 3.0-12
Wolfgang Bumiller [Tue, 12 Jun 2018 10:02:32 +0000 (12:02 +0200)]
bump version to 3.0-12

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
15 months agofixup active_chains distinction when deleting chains
Wolfgang Bumiller [Tue, 12 Jun 2018 10:00:10 +0000 (12:00 +0200)]
fixup active_chains distinction when deleting chains

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
15 months agofixup changelog UNRELEASED
Thomas Lamprecht [Wed, 6 Jun 2018 14:18:48 +0000 (16:18 +0200)]
fixup changelog UNRELEASED

15 months agobump version to 3.0-11
Thomas Lamprecht [Wed, 6 Jun 2018 14:15:01 +0000 (16:15 +0200)]
bump version to 3.0-11

15 months agorename ebtables_enable to ebtables
Stoiko Ivanov [Wed, 6 Jun 2018 09:56:05 +0000 (11:56 +0200)]
rename ebtables_enable to ebtables

and register ebtables option with the API

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
15 months agobump version to 3.0-10
Wolfgang Bumiller [Tue, 29 May 2018 13:14:43 +0000 (15:14 +0200)]
bump version to 3.0-10

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
15 months agotypo fixup
Wolfgang Bumiller [Tue, 29 May 2018 13:08:25 +0000 (15:08 +0200)]
typo fixup

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
15 months agoDon't change external ebtables rules
Stoiko Ivanov [Sat, 26 May 2018 20:50:30 +0000 (22:50 +0200)]
Don't change external ebtables rules

  * Fixes #1764
  * Introduces ebtables_enable option to cluster config
  * All ebtables chains not created by PVE are left in place
  * get_ruleset_status optionally takes an additional argument
    (a regex indicating which chains should be left intact)

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
16 months agobump version to 3.0-9
Wolfgang Bumiller [Thu, 17 May 2018 12:41:40 +0000 (14:41 +0200)]
bump version to 3.0-9

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
16 months agofix PVEFW-FORWARD chain not being used
Wolfgang Bumiller [Thu, 17 May 2018 11:09:23 +0000 (13:09 +0200)]
fix PVEFW-FORWARD chain not being used

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
17 months agobump version to 3.0-8
Wolfgang Bumiller [Wed, 11 Apr 2018 12:26:15 +0000 (14:26 +0200)]
bump version to 3.0-8

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
17 months agoebtables_get_chains: deal with empty chains
Wolfgang Bumiller [Thu, 29 Mar 2018 07:48:28 +0000 (09:48 +0200)]
ebtables_get_chains: deal with empty chains

Since we don't have signatures in ebtables we need to also
see empty chains to not think we have to create them.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
17 months agoadd ebtables dependency
Wolfgang Bumiller [Wed, 28 Mar 2018 08:53:31 +0000 (10:53 +0200)]
add ebtables dependency

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
17 months agoavoid double spaces in ruleset_addrule
Wolfgang Bumiller [Wed, 28 Mar 2018 08:53:30 +0000 (10:53 +0200)]
avoid double spaces in ruleset_addrule

ebtables doesn't have comment rules we could store the
digest in, so we need to match the ebtables-save output
instead.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
17 months agoapply ebtables_ruleset
Alexandre Derumier [Wed, 28 Mar 2018 08:53:29 +0000 (10:53 +0200)]
apply ebtables_ruleset

need ebtables-save && ebtables-restore,  ebtables debian package don't include them.

ebtables-restore need to restore the full ruleset (atomicaly),
so we can't update only 1 chain

Signed-off-by: Alexandre Derumier <aderumier at odiso.com>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
17 months agocompile ebtables rules
Alexandre Derumier [Wed, 28 Mar 2018 08:53:28 +0000 (10:53 +0200)]
compile ebtables rules

-A FORWARD -j PVEFW-FORWARD
   -A PVEFW-FORWARD -p IPv4 -j ACCEPT  #filter mac in iptables for ipv4, so we can speedup rules with conntrack established
   -A PVEFW-FORWARD -p IPv6 -j ACCEPT
   -A PVEFW-FORWARD -o fwln+ -j PVEFW-FWBR-OUT
-A PVEFW-FWBR-OUT -i tap110i0 -j tap110i0-OUT
-A tap110i0-OUT -s ! 36:97:15:91:19:3c -j DROP
-A tap110i0-OUT -p ARP -j ACCEPT
-A tap110i0-OUT -j DROP
-A tap110i0-OUT -j ACCEPT
-A PVEFW-FWBR-OUT -i veth130.1 -j veth130.1-OUT
-A veth130.1-OUT -s ! 36:95:a9:ae:f5:ec -j DROP
-A veth130.1-OUT -j ACCEPT

Signed-off-by: Alexandre Derumier <aderumier at odiso.com>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
17 months ago/etc/services can also define 'sctp' services
Wolfgang Bumiller [Wed, 28 Mar 2018 08:53:27 +0000 (10:53 +0200)]
/etc/services can also define 'sctp' services

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
17 months agoadd get_etc_ethertypes
Wolfgang Bumiller [Wed, 28 Mar 2018 08:53:26 +0000 (10:53 +0200)]
add get_etc_ethertypes

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
17 months agoparse_protocol_file: support lines without end comments
Wolfgang Bumiller [Wed, 28 Mar 2018 08:53:25 +0000 (10:53 +0200)]
parse_protocol_file: support lines without end comments

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
17 months agosplit parser out of get_etc_protocols
Wolfgang Bumiller [Wed, 28 Mar 2018 08:53:24 +0000 (10:53 +0200)]
split parser out of get_etc_protocols

Into a reusable parse_protocol_file.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
18 months agobump version to 3.0-7
Wolfgang Bumiller [Mon, 12 Mar 2018 13:58:19 +0000 (14:58 +0100)]
bump version to 3.0-7

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
18 months agomultiport: add explaining comment
Fabian Grünbichler [Mon, 12 Mar 2018 11:38:51 +0000 (12:38 +0100)]
multiport: add explaining comment

about ordering single port matches before multiport matches,
and improve readability by adding some blank lines after returns.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
18 months agofix and improve multiport handling
Wolfgang Bumiller [Mon, 12 Mar 2018 10:55:18 +0000 (11:55 +0100)]
fix and improve multiport handling

The multiport `--ports` parameter is an `OR` match on source
and destination ports, so we should not use it.

We also don't actually use the port count, so let the port
range parser simply return a boolean and use the counter
only for the internal check. This also fixes a regression
caused by the previous multiport check which caused a single
port range to be recognized as a multiport option while it
did not have to be one, causing entries such as the SMB
macro to be added with `--match multiport` mistakenly, which
refused to accept the source port option.

Additionally, we now allow the case with 1 multiport and 1
single port entry: In order for the iptables command to
accept this the single port entry must come first, otherwise
it'll be passed to the multiport matcher (because why
shouldn't it interpret a singular `--Xport` as an alias to
the plural version `--Xports`... *sigh*).

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Fixes: 6a241ca745f7 ("check multiport limit in port ranges")

18 months agobump version to 3.0-6
Dietmar Maurer [Thu, 8 Mar 2018 12:53:54 +0000 (13:53 +0100)]
bump version to 3.0-6

18 months agobuild: use git rev-parse for GITVERSION
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:56 +0000 (13:33 +0100)]
build: use git rev-parse for GITVERSION

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
18 months agodebian: remove duplicate dh_systemd_enable code
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:55 +0000 (13:33 +0100)]
debian: remove duplicate dh_systemd_enable code

dh_systemd_enable already includes this snippet via the #DEBHELPER#
stanza, no need to duplicate it manually.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
18 months agodebian: drop preinst
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:54 +0000 (13:33 +0100)]
debian: drop preinst

the only actual code was for upgrading from PVE 3 to PVE 4..

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
18 months agodebian: switch to compat 9
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:53 +0000 (13:33 +0100)]
debian: switch to compat 9

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
18 months agodebian: drop init scripts
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:52 +0000 (13:33 +0100)]
debian: drop init scripts

and switch to plain dh_systemd_*

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
18 months agofix #1319: don't fail postinst with masked service
Fabian Grünbichler [Thu, 8 Mar 2018 12:33:51 +0000 (13:33 +0100)]
fix #1319: don't fail postinst with masked service

by using "try-reload-or-restart" instead of "reload-or-restart"

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
18 months agocheck multiport limit in port ranges
Wolfgang Bumiller [Thu, 8 Mar 2018 11:06:21 +0000 (12:06 +0100)]
check multiport limit in port ranges

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
21 months agobump version to 3.0-5
Wolfgang Bumiller [Thu, 7 Dec 2017 07:31:53 +0000 (08:31 +0100)]
bump version to 3.0-5

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
21 months agohonor disabled flag on group rules again
Wolfgang Bumiller [Thu, 7 Dec 2017 07:30:01 +0000 (08:30 +0100)]
honor disabled flag on group rules again

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
22 months agobump version to 3.0-4
Wolfgang Bumiller [Thu, 16 Nov 2017 10:42:37 +0000 (11:42 +0100)]
bump version to 3.0-4

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
22 months agosort ipsets so that the digest is consistent
Dominik Csapak [Wed, 15 Nov 2017 10:41:34 +0000 (11:41 +0100)]
sort ipsets so that the digest is consistent

otherwise, editing an ipset randomly works (or not) due to
a wrong digest

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
22 months agoremove ruleset_generate_match, ruleset_generate_action
Tom Weber [Wed, 18 Oct 2017 20:24:10 +0000 (22:24 +0200)]
remove ruleset_generate_match, ruleset_generate_action

ruleset_generate_match and ruleset_generate_action not used anymore

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agoremove unused ruleset_generate_rule_insert
Tom Weber [Wed, 18 Oct 2017 20:24:09 +0000 (22:24 +0200)]
remove unused ruleset_generate_rule_insert

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agocleanup parameters to ruleset_generate_rule
Tom Weber [Wed, 18 Oct 2017 20:24:08 +0000 (22:24 +0200)]
cleanup parameters to ruleset_generate_rule

remove $actions and $goto - not used anymore

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agorule_substitude_action, remove ruleset_generate_rule_old
Tom Weber [Wed, 18 Oct 2017 20:24:07 +0000 (22:24 +0200)]
rule_substitude_action, remove ruleset_generate_rule_old

implement rule_substitude_action
eliminate use of ruleset_genereate_rule_old and remove it

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agoremove unused ruleset_generate_cmdstr
Tom Weber [Wed, 18 Oct 2017 20:24:06 +0000 (22:24 +0200)]
remove unused ruleset_generate_cmdstr

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agoimplement ipt_rule_to_cmds, ruleset_add_ipt_cmd
Tom Weber [Wed, 18 Oct 2017 20:24:05 +0000 (22:24 +0200)]
implement ipt_rule_to_cmds, ruleset_add_ipt_cmd

ipt_rule_to_cmds converts a %rule to an array of iptables commands
ruleset_add_ipt_cmd adds such an iptables command to a chain
ruleset_generate_rule uses these now
ruleset_generate_rule_old is an interim workaround

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agoiptables address matching in own subroutine
Tom Weber [Wed, 18 Oct 2017 20:24:04 +0000 (22:24 +0200)]
iptables address matching in own subroutine

put generation of iptables source/destination address matching
in own subroutine and use this in ruleset_generate_match

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agoeliminate unused nbdport in pve_std_chains_conf
Tom Weber [Wed, 18 Oct 2017 20:24:03 +0000 (22:24 +0200)]
eliminate unused nbdport in pve_std_chains_conf

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agomake $pve_std_chains a copy of $pve_std_chains_conf
Tom Weber [Wed, 18 Oct 2017 20:24:02 +0000 (22:24 +0200)]
make $pve_std_chains a copy of $pve_std_chains_conf

create a new $pve_std_chains with $pve_std_chains_conf as template on
every compilation of the rules. This avoids persitant changes to the
$pve_std_chains and makes it easier to read the std_chains configuration
from external config files (later to implement).

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agoconvert string based rule definitions to hashes
Tom Weber [Wed, 18 Oct 2017 20:24:01 +0000 (22:24 +0200)]
convert string based rule definitions to hashes

also extending %rule with log,logmsg,match,target

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agointegrate logging into ruleset_addrule
Tom Weber [Wed, 18 Oct 2017 20:24:00 +0000 (22:24 +0200)]
integrate logging into ruleset_addrule

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agoprepare code for more generic firewall logging
Tom Weber [Wed, 18 Oct 2017 20:23:59 +0000 (22:23 +0200)]
prepare code for more generic firewall logging

making ruleset generation aware of a match and action
part in iptable rules.
code will generate the same iptables as before! (except for
a few additional spaces between match and action).

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agoremove unused $rule_format
Tom Weber [Wed, 18 Oct 2017 20:23:58 +0000 (22:23 +0200)]
remove unused $rule_format

Signed-off-by: Tom Weber <pve@junkyard.4t2.com>
22 months agoUse run_cli_handler instead of deprecated run_cli
Philip Abernethy [Mon, 16 Oct 2017 08:59:23 +0000 (10:59 +0200)]
Use run_cli_handler instead of deprecated run_cli

23 months agopvefw-logger: fix typo
Fabian Grünbichler [Tue, 17 Oct 2017 12:24:01 +0000 (14:24 +0200)]
pvefw-logger: fix typo

23 months agobuild: reformat debian/control
Fabian Grünbichler [Wed, 4 Oct 2017 09:05:33 +0000 (11:05 +0200)]
build: reformat debian/control

using wrap-and-sort -abt

2 years agobump version to 3.0-3
Wolfgang Bumiller [Tue, 12 Sep 2017 12:43:13 +0000 (14:43 +0200)]
bump version to 3.0-3

2 years agobuildsys: clean: remove .buildinfo files
Wolfgang Bumiller [Wed, 6 Sep 2017 07:35:04 +0000 (09:35 +0200)]
buildsys: clean: remove .buildinfo files

2 years agoFix #1492: logger: print timestamps only if we have one
Wolfgang Bumiller [Mon, 4 Sep 2017 08:56:59 +0000 (10:56 +0200)]
Fix #1492: logger: print timestamps only if we have one

There's no guarantee that there's a timestamp in an skb, so
nflog_get_timestamp can fail.

2 years agobump version to 3.0-2
Wolfgang Bumiller [Mon, 17 Jul 2017 13:27:44 +0000 (15:27 +0200)]
bump version to 3.0-2

2 years agoFix #1446: allow pve-firewall package install twice in a row
Emmanuel Kasper [Mon, 17 Jul 2017 12:50:26 +0000 (14:50 +0200)]
Fix #1446: allow pve-firewall package install twice in a row

On packages removal (!= purge) systemd units are masked.
The postinst script has then to reenable this units at the
beginning of the 'configure' step.

Our other packages are doing this manually, or automatically
when the dh_systemd_enable helpers generated a postinst,
but this was missing here.

2 years agolog errors encountered by the daemon to syslog
Wolfgang Bumiller [Wed, 22 Mar 2017 11:53:34 +0000 (12:53 +0100)]
log errors encountered by the daemon to syslog

2 years agoforbid trailing commas in lists
Wolfgang Bumiller [Wed, 22 Mar 2017 11:53:33 +0000 (12:53 +0100)]
forbid trailing commas in lists

iptables-restore doesn't allow them

2 years agobump version to 3.0-1
Fabian Grünbichler [Thu, 9 Mar 2017 13:04:44 +0000 (14:04 +0100)]
bump version to 3.0-1

2 years agobuildsys: update upload target
Fabian Grünbichler [Thu, 9 Mar 2017 13:04:06 +0000 (14:04 +0100)]
buildsys: update upload target

2 years agobuildsys: fix deb target dependencies
Fabian Grünbichler [Thu, 9 Mar 2017 13:49:20 +0000 (14:49 +0100)]
buildsys: fix deb target dependencies

2 years agobuildsys: remove fakeroot from dpkg-buildpackage
Fabian Grünbichler [Thu, 9 Mar 2017 13:03:45 +0000 (14:03 +0100)]
buildsys: remove fakeroot from dpkg-buildpackage

2 years agobuildsys: use dpkg-architecture
Wolfgang Bumiller [Fri, 10 Feb 2017 12:57:59 +0000 (13:57 +0100)]
buildsys: use dpkg-architecture

2 years agologger: drop gthread dependency
Wolfgang Bumiller [Mon, 6 Feb 2017 11:07:23 +0000 (12:07 +0100)]
logger: drop gthread dependency

g_thread_new is part of glib directly, libgthread only
contains the deprecated g_thread_init() & friends which we
do not use.
This silences a build warning.

2 years agobuildsys: depend on lsb-base
Wolfgang Bumiller [Mon, 6 Feb 2017 11:05:01 +0000 (12:05 +0100)]
buildsys: depend on lsb-base

2 years agosimulator: make lxc/qemu optional
Wolfgang Bumiller [Tue, 31 Jan 2017 10:15:22 +0000 (11:15 +0100)]
simulator: make lxc/qemu optional

2 years agobuildsys: make job safety
Wolfgang Bumiller [Mon, 6 Feb 2017 10:52:54 +0000 (11:52 +0100)]
buildsys: make job safety

2 years agofix ambiguous if statements
Thomas Lamprecht [Tue, 13 Dec 2016 12:13:39 +0000 (13:13 +0100)]
fix ambiguous if statements

the funciton nflog_bind_pf(...) returns an integer smaller 0 on a
failure, we negated that which results in 1 if no failure and 0 if
there was a failure.
This is ambiguous and as no parenthesis are set the GCC 6 warning
"logical-not-parentheses" gets triggered.

Use a simple
    nflog_bind_pf(...) < 0
check instead.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agobump version to 2.0-33
Dietmar Maurer [Tue, 29 Nov 2016 11:18:41 +0000 (12:18 +0100)]
bump version to 2.0-33

2 years agoipset: don't allow the creation of zero-prefix entries
Wolfgang Bumiller [Tue, 29 Nov 2016 11:06:23 +0000 (12:06 +0100)]
ipset: don't allow the creation of zero-prefix entries

2 years agoipsets: catch zero-prefix entries
Wolfgang Bumiller [Tue, 29 Nov 2016 11:06:22 +0000 (12:06 +0100)]
ipsets: catch zero-prefix entries

This way the error is visible with pve-firewall compile
without breaking the rest.

2 years agobump version to 2.0-32
Dietmar Maurer [Tue, 29 Nov 2016 05:42:32 +0000 (06:42 +0100)]
bump version to 2.0-32